A network security alarm efficient disposal method based on a dynamic graph neural network

Abstract

The application relates to a network security alarm efficient disposal method based on a dynamic graph neural network and belongs to the technical field of artificial intelligence and network security. The application comprises the following steps: collecting network security alarm, agent and disposal tool information, and performing data preprocessing; creating an initial dynamic graph; monitoring network environment changes in real time and updating the dynamic graph; training a dynamic graph neural network model using historical network security alarm disposal data, inputting the dynamic graph, and outputting recommended results of the agent and the disposal tool; continuously updating and optimizing the model according to disposal result feedback; determining the most suitable agent and disposal tool to dispose of the current network security alarm; converting the determined disposal scheme into specific instructions, sending the specific instructions to the corresponding agent and disposal tool for execution, monitoring the disposal effect in real time during the disposal execution process, feeding back the result to the alarm system, and optimizing the dynamic graph and the model. The application has intelligent analysis and efficient disposal capabilities and is highly expandable.

Description

Technical Field

[0001] This invention relates to an efficient method for handling network security alarms based on dynamic graph neural networks, belonging to the fields of artificial intelligence and network security technology. Background Technology

[0002] In today's digital age, the internet has become fundamental to people's lives and work. However, cybersecurity issues are becoming increasingly prominent, and cyberattack methods and approaches are becoming more complex, leading to an explosive growth in the number of cybersecurity alerts. Timely and effective handling of cybersecurity alerts is crucial for protecting network assets, preventing data breaches, and maintaining business continuity.

[0003] Traditional methods for handling network security alerts primarily rely on pre-set rules and human experience. These rules are based on security personnel's summaries and generalizations of common alert types and handling methods. When an alert occurs, the system matches the corresponding processing flow according to the pre-set rules, or security analysts intervene manually based on experience. However, traditional methods have many limitations and are ill-suited to the current complex and ever-changing network security environment:

[0004] On the one hand, network security alerts are numerous and complex, with significant differences in their causes, impact, and handling methods. Pre-defined rules are insufficient to cover all possible alert scenarios, and often fail to provide effective solutions when faced with new types of network attacks or complex alert scenarios. This leads to untimely and inaccurate alert handling, prolonging the resolution time of network security issues and increasing the risk of exploitation by attackers.

[0005] On the other hand, the network environment is constantly changing, with factors such as network topology, device status, service traffic, and security threats constantly evolving. Traditional systems have a weak ability to perceive and adapt to these dynamic network changes, making it difficult to adjust alarm handling strategies based on real-time network conditions. For example, when new attack patterns or vulnerability exploitation methods emerge in the network, the system cannot update its rules in a timely manner to address these changes, thus significantly reducing the effectiveness of alarm handling.

[0006] Furthermore, traditional methods struggle to effectively correlate and analyze the relationships between multiple alerts. In complex cyberattacks, a single attack step may trigger multiple related alerts, and these alerts often exhibit correlations. Failure to accurately identify and analyze these related alerts can lead to duplicate processing or the omission of crucial information, failing to fundamentally resolve cybersecurity issues.

[0007] Dynamic graph neural network (GNN) technology has made significant progress in processing graph-structured data in recent years. It can effectively capture the dynamic changes of nodes and edges, and through the learning mechanism of GNNs, uncover complex relationships and semantic information between nodes and edges. This technological characteristic gives it enormous application potential in the field of network security alert handling, overcoming the limitations of traditional methods and enabling efficient and accurate handling of network security alerts. Summary of the Invention

[0008] This invention provides an efficient method for handling network security alarms based on dynamic graph neural networks, which addresses the limitations of traditional network security alarm handling methods in the face of complex and ever-changing network environments. By intelligently analyzing network security alarm information, dynamically adapting to changes in the network environment, and correlating the relationships between multiple alarms, it achieves efficient and accurate handling of network security alarms, improves network security, and reduces the adverse impact of network security issues on business operations.

[0009] The technical solution of this invention is: an efficient method for handling network security alarms based on dynamic graph neural networks, comprising:

[0010] S1. Collect network security alarm information, intelligent agent information and handling tool information in the network environment, and perform data preprocessing, including data cleaning, transformation and feature extraction;

[0011] S2. Use the preprocessed data to create an initial dynamic graph, representing network security alarms, agents, and handling tools as nodes, the relationships between nodes as edges, and assigning corresponding attributes to nodes and edges;

[0012] S3. Monitor network environment changes in real time and update dynamic graphs promptly;

[0013] S4. Train the dynamic graph neural network model using historical network security alarm handling data, input the dynamic graph, and output the recommendation results for the agent and handling tools; at the same time, continuously update and optimize the model based on the handling results feedback;

[0014] S5. Based on the model output, take into account multiple decision-making strategies to determine the most suitable agent and processing tool to handle the current network security alarm;

[0015] S6. Transform the determined handling plan into specific instructions, send them to the corresponding intelligent agents and handling tools for execution, monitor the handling effect in real time during the handling process, and feed the results back to the alarm system to further optimize the dynamic graph and model.

[0016] Further, S2 includes:

[0017] S2.1 Determine the type and attributes of the nodes; among them, network security alarms, intelligent agents, and handling tools are respectively regarded as three types of nodes in the dynamic graph;

[0018] S2.2 Determine the edge type and attributes; edges are used to represent the relationships between nodes;

[0019] S2.3 Construct an initial dynamic graph, which consists of a set of nodes and a set of edges;

[0020] S2.4 Initializing the embedding representation of nodes and edges refers to the initialization of node embeddings and the initialization of edge embeddings;

[0021] Node embedding initialization: Initialize node embeddings with random vectors;

[0022] Edge embedding initialization: The edge embedding is initialized as a one-hot encoded vector of the corresponding relation type.

[0023] Furthermore, in S3, the real-time monitoring of network environment changes refers to:

[0024] First, continuously monitor real-time alarm information generated by network security devices. Once a new alarm is detected, immediately obtain detailed information about the new alarm, including key elements such as alarm type, alarm level, and time of occurrence.

[0025] Second, monitor the registration or installation status of intelligent agents and processing tools in the monitoring system, and promptly obtain the functional descriptions and applicable scope information of new intelligent agents or processing tools when they are launched.

[0026] Third, track the processing progress and status changes of existing alarms, including alarm level adjustments and processing status updates.

[0027] Furthermore, in S3, the operation of updating the dynamic graph includes: adding newly emerging alarms, agents, or handling tools as new nodes to the dynamic graph;

[0028] The update of the embedding representations of nodes and edges when adding new nodes to the dynamic graph includes:

[0029] When node attributes change or new nodes are added, the node embeddings are updated using a graph neural network model.

[0030] For newly added nodes, their initial embedding vectors are obtained by random initialization or encoding based on their attributes, and then gradually optimized through model training;

[0031] For existing nodes, update the embedding vector based on changes in the node's attributes and interactions with neighboring nodes;

[0032] When the attributes or relationships of an edge change, the edge embedding representation is updated accordingly. The edge embedding is recalculated using a graph neural network model, or the edge embedding is adjusted based on the changes in the edge attributes and the embedding vectors of the associated nodes, in order to ensure that the edge embedding accurately reflects the relationships and interactions between the nodes.

[0033] Further, step S4 includes the following steps:

[0034] S41. Model Determination and Initialization: Select an appropriate dynamic graph neural network model and initialize the parameters of the dynamic graph neural network model, including the node embedding matrix and the edge embedding matrix; use random initialization or initialization based on prior knowledge;

[0035] S42. Forward Propagation of the Model: Input the dynamic graph into the model and perform forward propagation calculation; through the multi-layer structure of the graph neural network, aggregate and update the features of nodes and edges to obtain the output representation of each node;

[0036] S43. Loss Calculation: Calculate the loss function based on the model's recommended results and the actual actions taken; use the cross-entropy loss function; assume that for an alarm node... The real intelligent agent chooses to be The chosen treatment tool is The model predicts the agent's choice probability distribution as follows: The probability distribution of the choice of treatment tool is as follows The loss function is then expressed as:

[0037]

[0038] S44. Backpropagation: The gradient of the loss function with respect to the model parameters is calculated using the backpropagation algorithm, and the model parameters are updated using an optimization algorithm to minimize the loss function;

[0039] S45. Collect new data: During the model application process, collect new network security alarm handling data in real time, including the structure data after the dynamic graph is updated and the new handling result data; integrate the newly collected data with historical data to form a new training dataset;

[0040] S46. Periodic fine-tuning: Periodically fine-tune the model using a new training dataset; use the same methods as during model training to perform forward propagation, loss calculation, and backpropagation to update the model parameters;

[0041] S47. Performance evaluation and verification refers to the performance evaluation and verification of the model after the model is updated.

[0042] Further, step S5 includes the following steps:

[0043] S51. Obtaining Model Output Results: Obtain the recommended results of agents and handling tools corresponding to the current network security alarm from the trained dynamic graph neural network model, including the probability distribution of agent selection and the probability distribution of handling tool selection;

[0044] S52. Probability-based decision making: Select agents and action tools based on the probability distribution output by the model; select the agent with the highest probability as the recommending agent;

[0045] Similarly, the treatment tool with the highest probability is selected as the recommended treatment tool;

[0046] S53. Threshold-based decision making: Set a threshold. If the maximum probability is less than the threshold, the current model output is considered unreliable and requires further analysis or manual intervention.

[0047] S54. Taking into account multiple decision-making strategies and business rules: Adjust the model recommendation results according to actual network security handling needs and business rules;

[0048] S55. Multi-objective Optimization Decision: Considering multiple decision objectives, construct a multi-objective optimization model; through weight allocation or ordinal optimization, comprehensively consider each objective to obtain the final decision result; define the objective function:

[0049]

[0050] in, This represents the weight of each objective. Describes the final objective function. Indicates the effect of the treatment. Indicates resource consumption. Indicates the processing time. Adjustments should be made according to actual needs to achieve the best possible outcome.

[0051] Further, step S6 includes the following steps:

[0052] S61. Transforming the handling plan into specific instructions: The intelligent decision-making module combines the agent and handling tools determined by the intelligent decision-making module into specific instructions; for the selected agent... and disposal tools Based on its functions and operational requirements, the agent generates corresponding execution instructions; if the intelligent agent... It is an intelligent agent used to analyze network traffic; its commands include starting traffic monitoring and setting monitoring parameters; if the handling tool It is a tool for defending against DDoS attacks, and the commands include enabling defense mode and configuring defense policies;

[0053] S62. Instruction Generation and Execution: The generated specific instructions are sent to the corresponding intelligent agents and processing tools, which then perform the specific processing operations; during the execution process, the accurate transmission and execution of the instructions are ensured, and the execution time and status information are recorded;

[0054] S63. Real-time monitoring of handling effects: During the handling process, feedback data is collected in real time to monitor the handling effects; feedback data includes changes in alarm status, changes in network performance indicators, and the operating status of intelligent agents and handling tools;

[0055] S64. Feedback Result Integration and Analysis: The monitored handling results are fed back to the system for further optimization of the dynamic graph and model. Specific steps are as follows: Collect feedback data on post-handling alarm status, network performance indicators, and operational logs of agents and handling tools; preprocess the feedback data, including data cleaning and transformation, to ensure consistency with the structure of the dynamic graph and the input requirements of the model; update the dynamic graph based on the feedback data; use the feedback data as new training samples and update the model in conjunction with historical data; retrain or fine-tune the model; use incremental learning to gradually update the model parameters so that the model can continuously adapt to new network security situations.

[0056] S65. System performance optimization: Continuous optimization of the system is achieved through the analysis of feedback data and the updating of the model; the system parameters and strategies are adjusted according to the evaluation indicators of the treatment effect to achieve the best performance.

[0057] This invention also provides a high-efficiency network security alarm handling system based on dynamic graph neural networks, comprising:

[0058] The data acquisition and preprocessing module is used to collect network security alarm information, intelligent agent information, and disposal tool information in the network environment, and to perform data preprocessing, including data cleaning, transformation, and feature extraction.

[0059] The initial dynamic graph construction module is used to create an initial dynamic graph using preprocessed data. It represents network security alarms, agents, and handling tools as nodes, the relationships between nodes as edges, and assigns corresponding attributes to nodes and edges.

[0060] The dynamic graph update module is used to monitor changes in the network environment in real time and update the dynamic graph accordingly.

[0061] The model training and update module is used to train the dynamic graph neural network model using historical network security alarm handling data. The input is a dynamic graph, and the output is recommendation results for agents and handling tools. At the same time, the model is continuously updated and optimized based on the handling results feedback.

[0062] The intelligent decision-making module is used to determine the most suitable intelligent agent and processing tool to handle the current network security alarm by comprehensively considering multiple decision-making strategies based on the model output results.

[0063] The disposal execution and feedback module is used to transform the determined disposal plan into specific instructions, send them to the corresponding intelligent agents and disposal tools for execution, monitor the disposal effect in real time during the disposal execution process, and feed the results back to the alarm system to further optimize the dynamic graph and model.

[0064] Furthermore, the dynamic graph neural network model used in the model training and update module includes an input layer, a hidden layer, and an output layer. The hidden layer employs graph convolutional layers and graph attention layers to aggregate and update the features of nodes and edges.

[0065] Furthermore, when executing the disposal plan, the disposal execution and feedback module adjusts the disposal strategy based on the real-time monitoring of the disposal effect and integrates the feedback data into the system for further optimization of the dynamic graph and model.

[0066] The beneficial effects of this invention are:

[0067] 1. This invention uses a dynamic graph neural network to perform deep learning and analysis on network security alarm data, which can automatically uncover hidden patterns and complex relationships in the security alarm data, realize intelligent alarm handling decisions, and improve the accuracy and efficiency of alarm handling.

[0068] 2. This invention can update the dynamic graph in real time according to changes in the network environment and adjust the alarm handling strategy accordingly. It can quickly adapt to new network security threats and attack patterns and has strong dynamic adaptability.

[0069] 3. This invention fully considers the correlation between multiple alarms, and can comprehensively analyze and process related alarms, avoiding the problems of repeated processing and information omission caused by ignoring related alarms in traditional methods, which helps to fundamentally solve network security problems;

[0070] 4. This invention accurately recommends the most suitable intelligent agent and handling tool based on the specific circumstances of the alarm, avoiding unnecessary resource allocation, optimizing the allocation of network security resources, and improving the overall performance of the system;

[0071] 5. To intelligently analyze and process various security alarms generated during network operation, aiming to improve the response speed and resolution efficiency of network faults and security threats, reduce the adverse impact of network security issues on business, and ensure the stable and reliable operation of the network. Attached Figure Description

[0072] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0073] Figure 1 This is a flowchart of the steps of an efficient network security alarm handling method based on dynamic graph neural network provided by the present invention;

[0074] Figure 2 This is a module connection diagram of an efficient network security alarm handling method based on dynamic graph neural network provided by the present invention;

[0075] Figure 3 This is a flowchart of a method for efficiently handling network security alarms based on dynamic graph neural networks, provided by the present invention. Detailed Implementation

[0076] Example 1: As Figures 1-3 As shown, an efficient method for handling network security alarms based on dynamic graph neural networks includes:

[0077] S1. Collect network security alarm information, intelligent agent information and handling tool information in the network environment, and perform data preprocessing, including data cleaning, transformation and feature extraction;

[0078] The data preprocessing removes invalid or erroneous data, laying the foundation for subsequent analysis;

[0079] Furthermore, the specific steps of S1 include:

[0080] S11. Network Security Alarm Information Collection: Collect various raw information in the network environment, including network security alarm information, agent information, and handling tool information; among which, network security alarm information covers key elements such as alarm type, alarm level, occurrence time, source IP, destination IP, and port number;

[0081] S12. Agent Information Collection: Collect relevant information about different security alarm handling agents, including the agent's unique identifier, name, functional description (such as whether it has the ability to monitor specific network traffic), operating status (such as running, stopped, paused, etc.), and applicable scope (such as which network environment or specific network device type it is applicable to).

[0082] S13. Information Collection on Disposal Tools: Collect detailed information on various disposal tools, including the tool's unique identifier, name, functional scope (e.g., ability to defend against specific types of network attacks or repair specific types of network faults), operating parameters (e.g., specific parameter configurations required when performing repair operations), and applicable scenarios (e.g., applicable to which network security incidents or network environments).

[0083] S14. Data Preprocessing: Remove invalid or erroneous data and transform the data into a format suitable for constructing dynamic graphs, laying a good foundation for subsequent analysis and processing. Extract useful features for constructing dynamic graphs. For alarm information, extract features such as alarm type, level, and occurrence time; for agent and handling tool information, extract features such as function description and scope of application.

[0084] S2. Use the preprocessed data to create an initial dynamic graph, representing network security alarms, agents, and handling tools as nodes, the relationships between nodes as edges, and assigning corresponding attributes to nodes and edges;

[0085] Furthermore, step S2 includes the following specific steps:

[0086] S2.1 Determine the type and attributes of the nodes; among them, network security alarms, intelligent agents, and handling tools are respectively regarded as three types of nodes in the dynamic graph;

[0087] Alarm Node (A): Each alarm node represents a specific network security alarm event; its attributes include alarm type ( (e.g., DDoS attacks, SQL injection, etc.) Alarm level ( (e.g., high, medium, low), time of occurrence () (timestamps accurate to the second, etc.); represented by a set. ,in Indicates the first One alarm node.

[0088] Agent Node (I): Each agent node represents an agent used to monitor or analyze network security status. Its attributes include a functional description (I). Such as monitoring abnormal network traffic, detecting intrusion behavior, etc.), and operational status ( (e.g., running, stopped, paused, etc.) Scope of application ( (e.g., applicable to specific types of network environments or devices). Represented as... ,in (j=1,2,…) represents the number of... Each intelligent agent node.

[0089] Disposal Tool Node (T): Each disposal tool node represents a tool used to address cybersecurity issues. Its attributes include functional scope (T). Such as the ability to defend against specific types of attacks, repair specific types of faults, etc.), operating parameters ( Such as the specific parameter configuration required when performing the repair operation, and the applicable scenarios ( (e.g., which network security incident or network environment it applies to). Use It means that, among them (k=1,2,…) represents the kth... Each processing tool node.

[0090] S2.2 Determine the edge type and attributes; edges are used to represent the relationships between nodes;

[0091] Alarm-Agent Edge (AI): Represents the relationship between an alarm and an agent, such as an "analysis" relationship. Its attributes include relationship type (…). (e.g., analysis, triggering, etc.) weight () This indicates the strength or importance of the relationship. (Represented as...) ,in and They represent the first The alarm node and the first Each intelligent agent node Indicates the first The alarm node and the first The relational type attribute of each agent node. Indicates the first The alarm node and the first The weight attributes of each agent node.

[0092] Agent-Disposal Tool Edge (IT): Represents the relationship between an agent and a disposal tool, such as a "recommendation" relationship. Its attributes include the relationship type (...). (e.g., recommended use, invocation, etc.) weight () The value range is [0,1]). The form is... ,in and They represent the first The first intelligent agent node and the first Each processing tool node, , They represent the first The first intelligent agent node and the first The relationship type attribute and weight attribute of each disposal tool node.

[0093] S2.3 Construct an initial dynamic graph, consisting of a set of nodes and a set of edges; specifically, the dynamic graph is composed of a set of nodes. Sum of edges Composition of dynamic graph Each node There is a set of attributes Each edge Corresponding attribute set This step integrates all relevant nodes and edges to form a complete graph structure, providing a foundation for subsequent analysis and processing;

[0094] S2.4 Initializing the embedding representation of nodes and edges refers to the initialization of node embeddings and the initialization of edge embeddings;

[0095] Node embedding initialization: Initialize node embeddings with random vectors;

[0096] Edge embedding initialization: The edge embedding is initialized as a one-hot encoded vector of the corresponding relation type.

[0097] Specifically, this includes:

[0098] Node embedding initialization: Initialize node embeddings using random vectors. For alarm nodes, generate a random vector matrix. ,in Indicates the number of alarm nodes. For the embedding dimension. Similarly, the agent node embedding matrix. Processing tool node embedding matrix These random vectors provide an initial low-dimensional representation for each node, facilitating learning and analysis by the subsequent graph neural network model.

[0099] Edge embedding initialization: Edge embeddings can be initialized as one-hot encoded vectors of the corresponding relation type. For example, for an alarm-agent edge, if... For different types of relations, the embedding vector of each edge is a... A one-hot encoded vector of dimension , where the dimension corresponding to the relation type is 1, and the rest are 0. This provides a simple initial representation of edges, making it easier for the model to learn the characteristics of edges during training.

[0100] S3. Monitor network environment changes in real time and update dynamic graphs promptly;

[0101] This includes monitoring changes in the network environment, such as the emergence of new alarms, the launch of intelligent agents or handling tools, and alarm status updates; updating dynamic graphs to ensure they reflect the latest network security situation and provide accurate basis for model inference.

[0102] Furthermore, in S3, the real-time monitoring of network environment changes refers to:

[0103] First, continuously monitor real-time alarm information generated by network security devices (such as intrusion detection systems, firewalls, etc.). Once a new alarm is detected, immediately obtain detailed information about the new alarm, including key elements such as alarm type, alarm level, and time of occurrence.

[0104] Second, monitor the registration or installation status of intelligent agents and processing tools in the monitoring system. When a new intelligent agent or processing tool is launched, promptly obtain information such as the functional description and applicable scope of the new intelligent agent or processing tool.

[0105] Third, track the processing progress and status changes of existing alarms, including alarm level adjustments and processing status updates.

[0106] Furthermore, in S3, the operation of updating the dynamic graph includes: adding newly emerging alarms, agents, or handling tools as new nodes to the dynamic graph;

[0107] For example, if a new alarm is detected Then add it to the alarm node set. In the diagram, the updated set of alarm nodes is represented as follows: At the same time, assign initial attribute values ​​to the new node, such as (Alarm type) (Alarm Level) (Time of occurrence), etc. When a new node has a relationship with an existing node, add the corresponding edge. New alerts are generated. For example, if a certain intelligent agent If the alarm can be analyzed, then add an edge. ,in Indicates the type of relation (such as analysis). This represents the relation weight, with a value range of [0,1]. For existing nodes and edges, their attributes are updated in real time according to changes in the network environment. For example, if an alarm... If the level is adjusted from low to high, then its attributes will be changed. Update from low to high; if the agent With disposal tools Relationship weights If a change occurs, the weight value of that edge is updated accordingly.

[0108] S33. Animated Graph In time The set of nodes at time is The edge set is When the network environment changes, in time... At that time, the animated image is updated to For newly added nodes, assume a new alarm node. In time If a node is added at a certain time, the updated set of nodes will be:

[0109]

[0110] For newly added edges, a new alert will be issued. and intelligent agents Added edges between The updated edge set is:

[0111]

[0112] When updating the properties of a node or edge, for example, when issuing an alert. The level is updated from low to high using... To indicate the updated alert level, then:

[0113]

[0114] Similarly, if the intelligent agent With disposal tools The relationship weights are updated to ,but:

[0115]

[0116] The above formulas can clearly describe the changes in nodes and edges during the dynamic graph update process, ensuring that the dynamic graph can reflect the latest changes in the network security situation in a timely manner, and providing an accurate data foundation for subsequent model inference.

[0117] When a new node is added to the dynamic graph, the updates to the embedding representations of nodes and edges include:

[0118] When node attributes change or new nodes are added, the node embeddings are updated using a graph neural network model.

[0119] For newly added nodes, their initial embedding vectors are obtained by random initialization or encoding based on their attributes, and then gradually optimized through model training;

[0120] For existing nodes, the embedding vector is updated based on changes in the node's attributes and interactions with neighboring nodes, so that it can better reflect the current network security situation.

[0121] When the attributes or relationships of an edge change, the edge embedding representation is updated accordingly. The edge embedding is recalculated using a graph neural network model, or the edge embedding is adjusted based on the changes in the edge attributes and the embedding vectors of the associated nodes, in order to ensure that the edge embedding accurately reflects the relationships and interactions between the nodes.

[0122] S4. Train the dynamic graph neural network model using historical network security alarm handling data, input the dynamic graph, and output the recommendation results for the agent and handling tools; at the same time, continuously update and optimize the model based on the handling results feedback;

[0123] Further, step S4 includes the following steps:

[0124] S41. Model Determination and Initialization: Select an appropriate dynamic graph neural network model and initialize the parameters of the dynamic graph neural network model, including the node embedding matrix. , , The edge embedding matrix is ​​initialized either randomly or based on prior knowledge.

[0125] S42. Model Forward Propagation: Transform the dynamic graph... The input is fed into the model for forward propagation computation; through the multi-layer structure of the graph neural network, the features of nodes and edges are aggregated and updated to obtain the output representation of each node;

[0126] For example, for alarm nodes Its output is represented as Intelligent agent node The output is represented as , processing tool node The output is represented as .

[0127] GIF The input model aggregates and updates the features of nodes and edges through a multi-layer graph neural network structure (such as graph convolutional layers and graph attention layers) to obtain the output representation of each node:

[0128]

[0129]

[0130]

[0131] in, , , These represent alarm nodes. Intelligent agent nodes , processing tool nodes The output representation, , , These represent graph neural network functions for different types of nodes.

[0132] S43. Loss Calculation: Calculate the loss function based on the model's recommended results and the actual actions taken; use the cross-entropy loss function; assume that for an alarm node... The real intelligent agent is chosen as The chosen treatment tool is The model predicts the agent's choice probability distribution as follows: The probability distribution of the choice of treatment tool is as follows The loss function is then expressed as:

[0133]

[0134] S44. Backpropagation: Calculate the loss function using the backpropagation algorithm. gradient with respect to model parameters And update the model parameters using optimization algorithms (such as Adam). To minimize the loss function:

[0135] in, It's the learning rate. The updated model parameters will make the model's judgments closer to the actual actions taken.

[0136] S45. Collect New Data: During model application, collect new network security alarm handling data in real time, including the updated structure data of the dynamic graph and new handling result data; and process the newly collected data. Compared with historical data Integrate them to form a new training dataset :

[0137]

[0138] New data can be gradually incorporated into the model training through online learning, or the model can be updated in batches periodically.

[0139] S46. Regular Fine-Tuning: Regularly fine-tune the model using a new training dataset; employ the same methods as during model training, performing forward propagation, loss calculation, and backpropagation to update model parameters; during fine-tuning, hyperparameters such as the learning rate can be adjusted appropriately to balance the impact of new and old data. Use a new training dataset. Fine-tune the model by repeating the forward propagation, loss calculation, and backpropagation steps, and update the model parameters. :

[0140]

[0141] in, The loss is calculated based on the new data. It is the gradient obtained from the new data;

[0142] S47. Performance evaluation and validation refers to evaluating and validating the model's performance after an update. Using a subset of new data as a validation set, calculate the model's metrics (such as accuracy, recall, F1 score, etc.) on the validation set to ensure that the model's performance has improved or remained stable after the update. If model performance deteriorates, the update strategy can be adjusted or the cause can be further analyzed.

[0143] Through the above steps, the model is trained and updated, enabling it to continuously adapt to changes in the cybersecurity landscape and improve the accuracy and reliability of recommendations for agents and response tools.

[0144] S5. Based on the model output, take into account multiple decision-making strategies to determine the most suitable agent and processing tool to handle the current network security alarm;

[0145] Further, step S5 includes the following steps:

[0146] S51. Obtaining Model Output Results: Obtain the recommended agents and handling tools corresponding to the current network security alert from the trained dynamic graph neural network model, including the probability distribution of agent selection. Probability distribution of treatment tool selection ;

[0147] S52. Probability-based decision making: Select agents and action tools based on the probability distribution output by the model; select the agent with the highest probability as the recommending agent. ,Right now:

[0148]

[0149] in, This represents the final recommended agent. It is a function that maximizes the probability; It is the first One candidate agent, ; It is a collection of intelligent agents, containing all available intelligent agents; These are currently pending cybersecurity alerts. The model is for alarms The output agent probability distribution vector has a dimension equal to ; That is, vector Corresponding intelligent agents The probability value;

[0150] Similarly, the treatment tool with the highest probability should be selected as the recommended treatment tool. :

[0151]

[0152] in, This indicates the final recommended treatment tool; It is the first One candidate disposal tool, ; It is a collection of tools for handling the situation, including all available tools; The model is for alarms The output tool probability distribution vector has a dimension equal to . That is, vector Corresponding tools The probability value;

[0153] S53. Threshold-based decision-making: Set a threshold; if the maximum probability is less than the threshold, the current model output is considered unreliable and requires further analysis or manual intervention; for example, when When this occurs, it indicates that the agent lacks sufficient confidence in its choice and may need to re-evaluate or combine it with other decision-making strategies.

[0154] S54. Comprehensively consider multiple decision-making strategies combined with business rules: Adjust the model recommendation results according to actual network security handling needs and business rules; for example, certain types of alarms may require priority to use specific intelligent agents or handling tools, even if the model recommendation probability is not the highest; in this case, define priority rules and make decisions according to the rules.

[0155] S55. Multi-objective Optimization Decision: Considering multiple decision objectives, construct a multi-objective optimization model; through weight allocation or ordinal optimization, comprehensively consider each objective to obtain the final decision result; define the objective function:

[0156]

[0157] in, This represents the weight of each objective. Describes the final objective function. Indicates the effect of the treatment. Indicates resource consumption. Indicates the processing time. Adjustments should be made according to actual needs to achieve the best possible outcome.

[0158] By taking into account the model output and various decision-making strategies, the most suitable agent and processing tools are determined to handle the current network security alerts, ensuring the scientific and rational nature of the decision-making.

[0159] S6. Transform the determined handling plan into specific instructions, send them to the corresponding intelligent agents and handling tools for execution, monitor the handling effect in real time during the handling process, and feed the results back to the alarm system to further optimize the dynamic graph and model.

[0160] Further, step S6 includes the following steps:

[0161] S61. Transforming the handling plan into specific instructions: The intelligent decision-making module combines the agent and handling tools determined by the intelligent decision-making module into specific instructions; for the selected agent... and disposal tools Based on its functions and operational requirements, the agent generates corresponding execution instructions; if the intelligent agent... It is an intelligent agent used to analyze network traffic; its commands include starting traffic monitoring and setting monitoring parameters; if the handling tool It is a tool for defending against DDoS attacks, and the commands include enabling defense mode and configuring defense policies;

[0162] S62. Instruction Generation and Execution: The generated specific instructions are sent to the corresponding intelligent agents and processing tools, which then perform the specific processing operations; during the execution process, the accurate transmission and execution of the instructions are ensured, and the execution time and status information are recorded;

[0163] S63. Real-time monitoring of handling effects: During the handling process, feedback data is collected in real time to monitor the handling effect; feedback data includes changes in alarm status (such as whether it is cleared, whether the level is reduced, etc.), changes in network performance indicators (such as whether traffic has returned to normal, whether latency has decreased, etc.), and the operating status of intelligent agents and handling tools;

[0164] S64. Feedback Result Integration and Analysis: The monitored handling results are fed back to the system for further optimization of the dynamic graph and model. Specific steps are as follows: Collect feedback data on alarm status, network performance indicators, and operational logs of agents and handling tools after handling; preprocess the feedback data, including data cleaning and transformation operations, to ensure consistency with the structure of the dynamic graph and the input requirements of the model; update the dynamic graph based on the feedback data; for example, if an alarm... If the issue has been successfully resolved, then update its state attributes; if the agent... Excellent performance during the handling process can increase its relevant weight in the dynamic graph; use feedback data as new training samples and update the model in combination with historical data; retrain or fine-tune the model; use incremental learning methods to gradually update the model parameters so that the model can continuously adapt to new cybersecurity situations;

[0165] S65. System Performance Optimization: Through the analysis of feedback data and the updating of models, the system is continuously optimized; the efficiency and accuracy of the system in handling network security alarms are continuously improved, the false alarm rate and the missed alarm rate are reduced, and the security and stability of the network are improved; the system parameters and strategies are adjusted according to the evaluation indicators of the handling effect (such as the handling success rate, handling time, etc.) to achieve the best performance.

[0166] By following the above steps, a closed-loop management system for handling, execution, and feedback can be achieved, continuously improving the system's performance and handling capabilities to better respond to cybersecurity alerts.

[0167] This invention also provides a high-efficiency network security alarm handling system based on dynamic graph neural networks, comprising:

[0168] The data acquisition and preprocessing module is used to collect network security alarm information, intelligent agent information, and disposal tool information in the network environment, and to perform data preprocessing, including data cleaning, transformation, and feature extraction.

[0169] The initial dynamic graph construction module is used to create an initial dynamic graph using preprocessed data. It represents network security alarms, agents, and handling tools as nodes, the relationships between nodes as edges, and assigns corresponding attributes to nodes and edges.

[0170] The dynamic graph update module is used to monitor changes in the network environment in real time and update the dynamic graph accordingly.

[0171] The model training and update module is used to train the dynamic graph neural network model using historical network security alarm handling data. The input is a dynamic graph, and the output is recommendation results for agents and handling tools. At the same time, the model is continuously updated and optimized based on the handling results feedback.

[0172] The intelligent decision-making module is used to determine the most suitable intelligent agent and processing tool to handle the current network security alarm by comprehensively considering multiple decision-making strategies based on the model output results.

[0173] The disposal execution and feedback module is used to transform the determined disposal plan into specific instructions, send them to the corresponding intelligent agents and disposal tools for execution, monitor the disposal effect in real time during the disposal execution process, and feed the results back to the alarm system to further optimize the dynamic graph and model.

[0174] Furthermore, the dynamic graph neural network model used in the model training and update module includes an input layer, a hidden layer, and an output layer. The hidden layer employs graph convolutional layers and graph attention layers to aggregate and update the features of nodes and edges.

[0175] Furthermore, when executing the disposal plan, the disposal execution and feedback module adjusts the disposal strategy based on the real-time monitoring of the disposal effect and integrates the feedback data into the system for further optimization of the dynamic graph and model.

[0176] Through the detailed embodiments described above, the present invention can achieve efficient handling of network security alarms in the network environment of financial enterprises, improve network security and stability, optimize the allocation and utilization of network security resources, and ensure the stable operation of financial business and the safety of customer funds.

[0177] Table 1 compares the advantages and disadvantages of the present invention with those of traditional manual alarm handling and traditional machine learning alarm handling.

[0178]

[0179] Example 2: As Figures 1-3 As shown, an efficient method for handling network security alarms based on dynamic graph neural networks is presented, taking the efficient handling of network security alarms in the network environment of a financial enterprise as an example.

[0180] This embodiment applies to the network environment of a financial enterprise. This network includes various critical devices such as core switches, firewalls, intrusion detection systems (IDS), and network behavior monitoring systems. Due to the extremely high network security requirements of the financial industry, various types of network security alerts exist, such as unauthorized login attempts, abnormal fund transactions, malware infections, and DDoS attacks. This embodiment aims to achieve efficient handling of these network security alerts through the method of this invention, ensuring the stable operation of financial services and the security of customer funds.

[0181] Specific implementation steps of this embodiment:

[0182] Embodiment S1 of the present invention. Information collection and preprocessing: Collect network security alarm information, intelligent agent information and disposal tool information in the network environment, and perform data preprocessing, which includes data cleaning, transformation and feature extraction;

[0183] The main steps include:

[0184] S11. Collect alert information from the financial institution's network security equipment (such as firewalls, IDS, network behavior monitoring systems, etc.). This information includes alert type (such as unauthorized login attempts, abnormal fund transactions, etc.), alert level (high, medium, low), occurrence time (timestamp accurate to the second), source IP address, destination IP address, source port, destination port, protocol type, etc. For example, a firewall will generate alert information containing the above details when it detects multiple unauthorized login attempts.

[0185] S12. This financial enterprise's agent management system collects agent information. Agent information includes the agent's unique identifier, name, functional description (e.g., monitoring abnormal network traffic, detecting intrusion behavior, etc.), operating status (e.g., running, stopped, paused, etc.), and applicable scope (e.g., applicable to specific types of network environments or devices). For example, an agent used to monitor abnormal network traffic has a functional description of "real-time monitoring of network traffic and identification of abnormal traffic patterns," and its operating status is "running."

[0186] S13. Collect resolution tool information from the financial institution's resolution tool library. Resolution tool information includes the tool's unique identifier, name, functional scope (e.g., ability to defend against specific types of attacks, ability to repair specific types of faults), operating parameters (e.g., specific parameter configurations required to perform repair operations), and applicable scenarios (e.g., applicable to which network security incidents or network environments). For example, a resolution tool for defending against DDoS attacks has a functional scope of "defending against DDoS attacks," operating parameters including attack traffic thresholds and defense modes, and an applicable scenario of "activating when a DDoS attack is detected."

[0187] S14. Clean the collected data to remove duplicate and invalid alarm messages. For example, multiple identical alarm messages may be repeatedly sent due to equipment failure or network latency, and these duplicate data need to be removed; at the same time, check and correct erroneous data, such as incorrectly formatted IP addresses, invalid port numbers, etc.

[0188] S15. Convert data into a unified format, such as unifying the time format to a standard timestamp format (e.g., YYYY-MM-DD HH:MM:SS), and converting IP addresses into specific numerical representations (e.g., converting IPv4 addresses into decimal values).

[0189] S16. Extract features to construct a dynamic graph. For alarm information, extract features such as alarm type, level, and occurrence time; for agent information, extract features such as function description and applicable scope; for handling tool information, extract features such as functional scope and applicable scenarios. For example, extract features from alarm information such as alarm type "illegal login attempt", level "high", and occurrence time "2024-08-11 14:30:25".

[0190] Embodiment S2 of the present invention. Initial dynamic graph construction: An initial dynamic graph is created using the preprocessed data, in which network security alarms, intelligent agents, and handling tools are represented as nodes, the relationships between nodes are represented as edges, and the nodes and edges are assigned corresponding attributes;

[0191] The main steps include:

[0192] S21. Determine Node Type and Attributes: Each alarm node represents a specific network security alarm event. Its attributes include alarm type ( Alarm Level ), time of occurrence ( ), etc. Represented by sets. ,in Indicates the first One alarm node. For example, This may indicate an unauthorized login attempt. "Unauthorized login attempt" For "high", The date is "2024-08-11 14:30:25". Each agent node represents an agent used to monitor or analyze network security status. Its attributes include a functional description ( ), running status ( ), Scope of application ( ) etc. Represented as ,in Indicates the first Each intelligent agent node. For example... This could represent a network traffic monitoring agent, whose "Monitoring for abnormal network traffic" "Running" "Applicable to enterprise internal networks." Each disposal tool node represents a tool used to handle network security issues. Its attributes include functional scope (…). ), Operation parameters ( ), applicable scenarios ( ) etc. Writing ,in Indicates the first Each processing tool node. For example... This could refer to a DDoS attack defense tool. For "defense against DDoS attacks", Including parameters such as attack traffic threshold and defense mode, This is for scenarios where a DDoS attack is detected.

[0193] S22. Determine edge type and attributes: Alarm-Agent Edge (AI): Represents the relationship between an alarm and an agent, such as an "analysis" relationship. Its attributes include relationship type (…). ), weight ( This represents the strength or importance of the relationship, with values ​​ranging from [0,1]. ,in and They represent the first The alarm node and the first Each intelligent agent node. For example... and There may be an edge between them, representing the intelligent agent. It can analyze alarms ,That For "analysis", A value of 0.9 indicates a strong relationship. Agent-Disposal Tool Edge (IT): Represents the relationship between the agent and the disposal tool, such as a "recommendation" relationship. Its attributes include the relationship type (...). ), weight ( The value range is [0,1]). The form is... ,in and They represent the first The first intelligent agent node and the first Each processing tool node. For example, an intelligent agent. and disposal tools There may be an edge between them, representing the intelligent agent. Recommended treatment tools ,That "Recommended" It is 0.8.

[0194] S23. Constructing the initial dynamic graph: from a set of nodes Sum of edges Composition of dynamic graph Each node There is a set of attributes Each edge Corresponding attribute set This step integrates all relevant nodes and edges to form a complete graph structure, providing a foundation for subsequent analysis and processing. For example, the initial dynamic graph may contain multiple alarm nodes, agent nodes, and handling tool nodes, as well as various relational edges between them.

[0195] Embodiment S3 of the present invention. Dynamic graph update: Real-time monitoring of network environment changes and timely updating of the dynamic graph;

[0196] The main steps include:

[0197] S31. Real-time Network Change Monitoring: The network monitoring system listens for real-time alerts from network security devices (such as intrusion detection systems and firewalls). Upon detecting a new alert, its detailed information is immediately obtained, including key elements such as alert type, alert level, and time of occurrence. For example, when the IDS detects a new abnormal fund transaction alert, relevant information about the alert is obtained in real time. The system also monitors the registration and installation status of agents and processing tools. When a new agent or processing tool is launched, its functional description and scope of application are promptly obtained. For example, if a financial institution installs a new agent for detecting malware, its functional description and operational status need to be obtained promptly.

[0198] S32. Track the processing progress and status changes of existing alarms, such as alarm level adjustments and processing status updates. For example, an alarm that was originally marked as "medium" level may be adjusted to "high" level after further analysis.

[0199] S33. For newly emerging alarms, agents, or handling tools, add them as new nodes to the dynamic graph. For example, if a new alarm is detected... Then add it to the alarm node set. In the diagram, the updated set of alarm nodes is represented as follows: At the same time, assign initial attribute values ​​to the new node, such as (Alarm type) (Alarm Level) (Time of occurrence), etc. When a new node has a relationship with an existing node, add the corresponding edge. New alerts are generated. For example, if a certain intelligent agent If the alarm can be analyzed, then add an edge. ,in Indicates the type of relation (such as analysis). Represents relation weights. Updates node and edge attributes: For existing nodes and edges, their attributes are updated in real time based on changes in the network environment. For example, if an alarm... If the level is adjusted from low to high, then its attributes will be changed. Update from low to high; if the agent With disposal tools Relationship weights If a change occurs, the weight value of that edge is updated accordingly.

[0200] Embodiment S4 of the present invention. Model training and updating: The dynamic graph neural network model is trained using historical network security alarm handling data. The input is a dynamic graph, and the output is a recommendation result for the agent and handling tool. At the same time, the model is continuously updated and optimized based on the feedback of the handling results.

[0201] The main steps include:

[0202] S41. Use a two-layer GraphSAGE. After the first GraphSAGE layer, use a ReLU layer and a Dropout layer. After the second GraphSAGE layer, add a Log_softmax layer. Initialize the parameters of the dynamic graph neural network model, including the node embedding matrix. , , And edge embedding matrices, etc. Initialization can be done randomly or based on prior knowledge. For example, for the alarm node embedding matrix... Initially, a matrix that matches the number of nodes and the embedding dimension can be randomly generated.

[0203] S42. [Animated GIF] The input is fed into the model for forward propagation computation. Through the multi-layered structure of the graph neural network (such as graph convolutional layers and graph attention layers), the features of nodes and edges are aggregated and updated to obtain the output representation of each node. For example, for an alarm node... Its output is represented as Intelligent agent node The output is represented as , processing tool node The output is represented as .

[0204] S43. Calculate the loss function based on the model's recommended results and the actual actions taken. Use the cross-entropy loss function. Assume that for an alarm node... The real intelligent agent is chosen as The chosen treatment tool is The model predicts the agent's choice probability distribution as follows: The probability distribution of the choice of treatment tool is as follows Then the loss function can be expressed as:

[0205]

[0206] S44. Calculate the gradient of the loss function with respect to the model parameters using the backpropagation algorithm, and update the model parameters using an optimization algorithm (such as Adam) to minimize the loss function. The updated model parameters will make the model's predictions closer to the actual outcomes. For example, using the Adam optimization algorithm, with an appropriate learning rate, iteratively update the model parameters.

[0207] S45. During model application, regularly collect new network security alert handling data to fine-tune and update the model. For example, collect new data weekly and perform batch updates to the model;

[0208] Embodiment S5 of the present invention. Intelligent decision-making: Based on the model output results, a variety of decision-making strategies are comprehensively considered to determine the most suitable intelligent agent and handling tool to handle the current network security alarm;

[0209] The specific steps include:

[0210] S51. Obtain the recommended agents and handling tools corresponding to the current network security alert from the trained dynamic graph neural network model, including the probability distribution of agent selection. Probability distribution of treatment tool selection ,in This indicates the alarm node currently being processed. For example, an alarm for an unauthorized login attempt. The model outputs the agent selection probability distribution as follows: , indicating the selection of an intelligent agent The probability is 0.7, so the agent is selected. The probability of [the outcome] is 0.2, etc.; the probability distribution for the choice of treatment tool is [formula missing]. This indicates the choice of disposal tool. The probability is 0.6, etc.

[0211] S52. Select the agent and handling tool with the highest probability as the recommended handling solution; for example, issue an alert for the aforementioned unauthorized login attempt. In the case of, according to and Select intelligent agent and disposal tools This is the recommended course of action.

[0212] S53. Adjust the recommended handling solutions according to the cybersecurity handling strategies and business rules of financial institutions. For example, the business rules of financial institutions may stipulate that alarms involving fund transactions must be manually reviewed before handling operations can be performed; or for high-risk alarms, priority should be given to handling tools with high defense capabilities, etc.

[0213] Embodiment S6 of the present invention. Execution and feedback of the disposal: The determined disposal plan is converted into specific instructions and sent to the corresponding intelligent agents and disposal tools for execution. The disposal effect is monitored in real time during the disposal execution process, and the results are fed back to the alarm system to further optimize the dynamic graph and model.

[0214] The specific steps include:

[0215] S61. The determined handling plan is translated into specific instructions and sent to the corresponding intelligent agents and handling tools for execution. For example, for the selected handling tool... It generates specific instructions, such as enabling the unauthorized login defense mode or locking relevant user accounts, and sends these instructions to the handling tool. implement.

[0216] S62. During the execution of the action, monitor the effect of the action in real time and collect feedback data, such as whether the alarm has been cleared and whether the network performance indicators have returned to normal; for example, obtain network traffic, latency and other performance indicators in real time through the network monitoring system to determine whether the unauthorized login attempts have been effectively suppressed; at the same time, monitor changes in alarm status, such as whether the alarm has been cleared and whether the alarm level has been reduced.

[0217] S63. Integrate feedback data into the system for updating dynamic graphs and optimizing the model. Adjust system parameters and strategies based on the effectiveness evaluation metrics (such as success rate and time) to improve system performance. For example, if feedback data shows that a certain action successfully cleared the alarm, use the relevant dynamic graph data and model parameters as positive samples for further training and model optimization. If the action is ineffective, analyze the reasons and adjust model parameters or action strategies to improve system performance.

[0218] The specific embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A method for efficiently handling network security alarms based on dynamic graph neural networks, characterized in that, include: S1. Collect network security alarm information, intelligent agent information and handling tool information in the network environment, and perform data preprocessing, including data cleaning, transformation and feature extraction; S2. Use the preprocessed data to create an initial dynamic graph, representing network security alarms, agents, and handling tools as nodes, the relationships between nodes as edges, and assigning corresponding attributes to nodes and edges; S3. Monitor network environment changes in real time and update dynamic graphs promptly; S4. Train the dynamic graph neural network model using historical network security alarm handling data, input the dynamic graph, and output the recommendation results for the agent and handling tools; continuously update and optimize the model based on the handling results feedback; S5. Based on the model output, take into account multiple decision-making strategies to determine the most suitable agent and processing tool to handle the current network security alarm; S6. Transform the determined handling plan into specific instructions, send them to the corresponding intelligent agents and handling tools for execution, monitor the handling effect in real time during the handling process, and feed the results back to the alarm system to further optimize the dynamic graph and model.

2. The efficient network security alarm handling method based on dynamic graph neural network according to claim 1, characterized in that: S2 includes: S2.1 Determine the type and attributes of the nodes; among them, network security alarms, intelligent agents, and handling tools are respectively regarded as three types of nodes in the dynamic graph; S2.2 Determine the edge type and attributes; edges are used to represent the relationships between nodes; S2.3 Construct an initial dynamic graph, which consists of a set of nodes and a set of edges; S2.4 Initializing the embedding representation of nodes and edges refers to the initialization of node embeddings and the initialization of edge embeddings; Node embedding initialization: Initialize node embeddings with random vectors; Edge embedding initialization: The edge embedding is initialized as a one-hot encoded vector of the corresponding relation type.

3. The efficient network security alarm handling method based on dynamic graph neural network according to claim 1, characterized in that: In S3, the real-time monitoring of network environment changes refers to: First, continuously monitor real-time alarm information generated by network security devices. Once a new alarm is detected, immediately obtain detailed information about the new alarm, including key elements such as alarm type, alarm level, and time of occurrence. Second, monitor the registration or installation status of intelligent agents and processing tools in the monitoring system, and promptly obtain the functional descriptions and applicable scope information of new intelligent agents or processing tools when they are launched. Third, track the processing progress and status changes of existing alarms, including alarm level adjustments and processing status updates.

4. The efficient network security alarm handling method based on dynamic graph neural network according to claim 1, characterized in that: In S3, the operation of updating the dynamic graph includes: adding newly emerging alarms, agents, or handling tools as new nodes to the dynamic graph; The update of the embedding representations of nodes and edges when adding new nodes to the dynamic graph includes: When node attributes change or new nodes are added, the node embeddings are updated using a graph neural network model. For newly added nodes, their initial embedding vectors are obtained by random initialization or encoding based on their attributes, and then gradually optimized through model training; For existing nodes, update the embedding vector based on changes in the node's attributes and interactions with neighboring nodes; When the attributes or relationships of an edge change, the edge embedding representation is updated accordingly. The edge embedding is recalculated using a graph neural network model, or the edge embedding is adjusted based on the changes in the edge attributes and the embedding vectors of the associated nodes, in order to ensure that the edge embedding accurately reflects the relationships and interactions between the nodes.

5. The efficient network security alarm handling method based on dynamic graph neural network according to claim 1, characterized in that: S4 includes the following steps: S41. Model Determination and Initialization: Select an appropriate dynamic graph neural network model and initialize the parameters of the dynamic graph neural network model, including the node embedding matrix and the edge embedding matrix; use random initialization or initialization based on prior knowledge; S42. Forward Propagation of the Model: Input the dynamic graph into the model and perform forward propagation calculation; through the multi-layer structure of the graph neural network, aggregate and update the features of nodes and edges to obtain the output representation of each node; S43. Loss Calculation: Calculate the loss function based on the model's recommended results and the actual actions taken; use the cross-entropy loss function; assume that for an alarm node... The real intelligent agent chooses to be The chosen treatment tool is The model predicts the agent's choice probability distribution as follows: The probability distribution of the choice of treatment tool is as follows The loss function is then expressed as: ； S44. Backpropagation: The gradient of the loss function with respect to the model parameters is calculated using the backpropagation algorithm, and the model parameters are updated using an optimization algorithm to minimize the loss function; S45. Collect new data: During the model application process, collect new network security alarm handling data in real time, including the structure data after the dynamic graph is updated and the new handling result data; integrate the newly collected data with historical data to form a new training dataset; S46. Regular fine-tuning: Regularly fine-tune the model using a new training dataset; The same methods as those used for model training are employed for forward propagation, loss calculation, and backpropagation to update the model parameters. S47. Performance evaluation and verification refers to the performance evaluation and verification of the model after the model is updated.

6. The efficient network security alarm handling method based on dynamic graph neural network according to claim 1, characterized in that: S5 includes the following steps: S51. Obtaining Model Output Results: Obtain the recommended results of agents and handling tools corresponding to the current network security alarm from the trained dynamic graph neural network model, including the probability distribution of agent selection and the probability distribution of handling tool selection; S52. Probability-based decision making: Select agents and action tools based on the probability distribution output by the model; select the agent with the highest probability as the recommending agent; Similarly, the treatment tool with the highest probability is selected as the recommended treatment tool; S53. Threshold-based decision making: Set a threshold. If the maximum probability is less than the threshold, the current model output is considered unreliable and requires further analysis or manual intervention. S54. Taking into account multiple decision-making strategies and business rules: Adjust the model recommendation results according to actual network security handling needs and business rules; S55. Multi-objective Optimization Decision: Considering multiple decision objectives, construct a multi-objective optimization model; through weight allocation or ordinal optimization, comprehensively consider each objective to obtain the final decision result; define the objective function: ； in, This represents the weight of each objective. Describes the final objective function. Indicates the effect of the treatment. Indicates resource consumption. Indicates the processing time. Adjustments should be made according to actual needs to achieve the best possible outcome.

7. The efficient network security alarm handling method based on dynamic graph neural network according to claim 1, characterized in that: S6 includes the following steps: S61. Transforming the handling plan into specific instructions: The intelligent decision-making module combines the agent and handling tools determined by the intelligent decision-making module into specific instructions; for the selected agent... and disposal tools Based on its functions and operational requirements, the agent generates corresponding execution instructions; if the intelligent agent... It is an intelligent agent used to analyze network traffic; its commands include starting traffic monitoring and setting monitoring parameters; if the handling tool It is a tool for defending against DDoS attacks, and the commands include enabling defense mode and configuring defense policies; S62. Instruction Generation and Execution: The generated specific instructions are sent to the corresponding intelligent agents and processing tools, which then perform the specific processing operations; during the execution process, the accurate transmission and execution of the instructions are ensured, and the execution time and status information are recorded; S63. Real-time monitoring of handling effects: During the handling process, feedback data is collected in real time to monitor the handling effects; feedback data includes changes in alarm status, changes in network performance indicators, and the operating status of intelligent agents and handling tools; S64. Feedback Result Integration and Analysis: Feedback the monitored handling results to the system for further optimization of the dynamic graph and model; the specific steps are as follows: collect feedback data on alarm status, network performance indicators, and operation logs of agents and handling tools after handling; preprocess the feedback data, including data cleaning and transformation operations, to make it consistent with the structure of the dynamic graph and the input requirements of the model; Update the dynamic graph based on feedback data; Use feedback data as new training samples and combine it with historical data to update the model; retrain or fine-tune the model; use incremental learning methods to gradually update the model parameters so that the model can continuously adapt to new cybersecurity situations. S65. System performance optimization: Continuous optimization of the system is achieved through the analysis of feedback data and the updating of the model; the system parameters and strategies are adjusted according to the evaluation indicators of the treatment effect to achieve the best performance.

8. A high-efficiency network security alarm handling system based on dynamic graph neural networks, characterized in that, include: The data acquisition and preprocessing module is used to collect network security alarm information, intelligent agent information, and disposal tool information in the network environment, and to perform data preprocessing, including data cleaning, transformation, and feature extraction. The initial dynamic graph construction module is used to create an initial dynamic graph using preprocessed data. It represents network security alarms, agents, and handling tools as nodes, the relationships between nodes as edges, and assigns corresponding attributes to nodes and edges. The dynamic graph update module is used to monitor changes in the network environment in real time and update the dynamic graph accordingly. The model training and update module is used to train a dynamic graph neural network model using historical network security alarm handling data. The input is a dynamic graph, and the output is a recommendation result for the agent and handling tool. The model is continuously updated and optimized based on feedback from the handling results; The intelligent decision-making module is used to determine the most suitable intelligent agent and processing tool to handle the current network security alarm by comprehensively considering multiple decision-making strategies based on the model output results. The disposal execution and feedback module is used to transform the determined disposal plan into specific instructions, send them to the corresponding intelligent agents and disposal tools for execution, monitor the disposal effect in real time during the disposal execution process, and feed the results back to the alarm system to further optimize the dynamic graph and model.

9. The efficient network security alarm handling system based on dynamic graph neural network according to claim 8, characterized in that: The dynamic graph neural network model used in the model training and update module includes an input layer, a hidden layer, and an output layer. The hidden layer uses graph convolutional layers and graph attention layers to aggregate and update the features of nodes and edges.

10. The efficient network security alarm handling system based on dynamic graph neural network according to claim 8, characterized in that: When executing the disposal plan, the disposal execution and feedback module adjusts the disposal strategy based on the real-time monitoring of the disposal effect and integrates the feedback data into the system for further optimization of the dynamic graph and model.

Images