A network security threat monitoring method, system, device, medium and product

Abstract

This application provides a network security threat monitoring method, system, device, medium, and product. The method integrates multimodal raw data, performs parsing and refinement, standardizes ontology architecture definition, and aligns sparse anchor points with topology guidance to achieve cross-platform and cross-protocol semantic fusion. Then, it constructs a dynamic spatiotemporal heterogeneous graph based on the fused entity relationship data and performs streaming incremental updates to form a unified security graph. It uses graph neural networks and spatiotemporal association models to detect collaborative attack behaviors. Through adversarial elastic embedding and reinforcement learning mechanisms, it achieves robust source tracing and family merging of attacks with structural disturbances or temporal variations. Finally, it generates structured disposal suggestions based on the metagraph mechanism and displays them visually. This solves the problems of traditional security monitoring systems, such as difficulty in identifying collaborative attacks due to reliance on a single data source, difficulty in modeling complex spatiotemporal dependencies with static models, low detection rate and high false alarm rate for malicious behaviors and evasion methods, lack of elasticity in source tracing and merging, and unstructured disposal suggestions.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a network security threat monitoring method, system, device, medium and product. Background Technology

[0002] With the rapid development of mobile internet and cloud-network convergence architecture, cyberattacks are increasingly characterized by cross-platform, multi-stage, highly covert, and highly collaborative features. Traditional security monitoring systems typically rely on isolated single data sources (such as terminal logs, network traffic, or application behavior), lacking the ability to deeply integrate multimodal data from the mobile application side, terminal host side, and network side. This makes it difficult to identify collaborative attack behaviors distributed across different platforms but logically related. Furthermore, existing threat detection methods generally employ static rules or shallow machine learning models, failing to effectively model complex spatiotemporal dependencies between entities. This results in low detection rates and high false positive rates for new variant attacks or malicious behaviors evaded through obfuscation, encryption, tunneling, and other evasion techniques. In addition, current systems lack flexible semantic understanding capabilities in risk tracing and family merging, making it difficult to cope with attack code structure disturbances or temporal variations; and handling suggestions are mostly unstructured text, unable to automatically link with operational systems.

[0003] Therefore, there is an urgent need for a security risk monitoring method that can integrate multi-source heterogeneous data, achieve cross-platform semantic alignment, construct a dynamic unified security graph, and support collaborative behavior detection, elastic source tracing and merging, and structured response generation, so as to improve the ability to perceive, assess and respond to advanced persistent threats. Summary of the Invention

[0004] This application provides a network security threat monitoring method, system, device, medium, and product to solve the problems existing in the prior art.

[0005] Firstly, this application provides a method for monitoring cybersecurity threats, including:

[0006] Acquire multimodal raw data collected and uploaded by the mobile application side, terminal host side, and network side;

[0007] The multimodal raw data is parsed, features are extracted and refined to obtain structured and semantic information elements;

[0008] Based on a pre-defined network security threat analysis ontology architecture, the information elements are standardized and generalized abstracted to obtain standardized entity relationship data.

[0009] Based on the standardized entity relationship data, cross-platform and cross-protocol data semantic alignment is achieved through a topology-guided sparse anchor alignment mechanism to obtain semantically aligned fused entity relationship data.

[0010] A dynamic spatiotemporal heterogeneous graph is constructed based on the fused entity relationship data, and the dynamic spatiotemporal heterogeneous graph is updated incrementally in a streaming manner to form a unified security graph.

[0011] Using the unified security graph as input, threat detection is performed through a graph neural network and a spatiotemporal association model to obtain the threat detection results;

[0012] Based on the threat detection results, threat attribution and family merging are performed through adversarial elastic embedding and reinforcement learning mechanisms to obtain threat family merging results and attribution information;

[0013] Based on the detection results, the threat family merging results, and the source tracing information, structured disposal suggestions are generated through a metagraph-based mechanism;

[0014] The proposed actions and the threat detection results are displayed.

[0015] In one possible design, the parsing, feature extraction, and refinement of the multimodal raw data includes:

[0016] The original data from the mobile application side is reverse engineered and analyzed, and runtime behavior is monitored to extract static and dynamic features. The backend communication address is extracted by penetrating code obfuscation and string encryption.

[0017] The raw data on the terminal host side is subjected to fine-grained parsing of processes, files, and network connections to extract host behavior features and entity association information;

[0018] The system performs full traffic capture and layer-by-layer protocol parsing on the raw data from the network side, completes session reassembly, and extracts network connection metadata, protocol features, and payload association information.

[0019] In one possible design, the reverse engineering and runtime behavior monitoring of the raw data on the mobile application side, extracting static and dynamic features, and extracting the backend communication address by penetrating code obfuscation and string encryption techniques, includes:

[0020] The mobile application installation package is subjected to structural parsing and reverse analysis to extract the static features; wherein, the static features include application components, permission list and control flow graph;

[0021] Run the mobile application in a controlled environment, monitor and record the dynamic behavior characteristics of the mobile application during runtime;

[0022] Based on the analysis results of threat application family characteristics and code homology, a special removal rule base is constructed. The network request initiation point and configuration decryption interface of the mobile application are located according to the special removal rule base, and the background communication address containing domain name, Internet Protocol address and network address path is extracted.

[0023] In one possible design, the process of capturing all traffic and parsing the raw data from the network side layer by layer to complete session reassembly and extract network connection metadata, protocol characteristics, and payload association information includes:

[0024] The probe captures the full amount of raw traffic on the network side, and zero-copy packet processing and session reassembly in user space are achieved based on the data plane development kit.

[0025] The captured traffic data is parsed layer by layer from the link layer to the transport layer to extract the five-tuple connection metadata, including source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type.

[0026] It employs a recognition technology that integrates port number, protocol fingerprint, and traffic behavior characteristics to parse application layer protocols and extract protocol metadata, restore the file entities transmitted at the application layer, and store them securely.

[0027] In one possible design, based on the standardized entity relationship data, cross-platform and cross-protocol data semantic alignment is achieved through a topology-guided sparse anchor alignment mechanism to obtain semantically aligned fused entity relationship data, including:

[0028] Based on the standardized entity relationship data, a mobile application behavior graph and a network traffic graph are constructed respectively.

[0029] The mobile application behavior graph and the network traffic graph are divided into structured communities using an unsupervised community detection algorithm, resulting in multiple cohesive community modules.

[0030] Within each of the aforementioned community modules, anchor entities with key topological locations are mined using a centrality metric method;

[0031] For each anchor entity, a context packet is constructed that includes an attribute summary, a neighborhood structure summary, and a behavior sequence summary;

[0032] The large language model is invoked to perform semantic reasoning and alignment determination on the cross-platform anchor entity context package, and the alignment result is output.

[0033] The alignment results are propagated within the corresponding community modules using a confidence propagation algorithm, and entities and events across platforms and protocols are fused to obtain semantically aligned fused entity relationship data.

[0034] In one possible design, the step of mining anchor entities with key topological locations within each of the community modules using a centrality metric includes:

[0035] The degree centrality method and the betweenness centrality method are used to measure the nodes within the community module; wherein, the degree centrality method is used to evaluate the connectivity breadth of a node, and the betweenness centrality method is used to identify the network bridging role of a node.

[0036] Target nodes whose measurement results meet the preset threshold are used as anchor entities for key topological locations.

[0037] In one possible design, the construction of a dynamic spatiotemporal heterogeneous graph based on the fused entity relationship data, and the streaming incremental updates of the dynamic spatiotemporal heterogeneous graph to form a unified security graph, includes:

[0038] Based on the fused entity relationship data, heterogeneous nodes of terminal hosts, network services, digital certificates, and network infrastructure are defined, along with multiple edge relationships of communication, dependency, affiliation, and co-occurrence, to obtain the basic graph structure.

[0039] Entities and relationships are extracted from the network observation data, and the extraction results are instantiated into timestamped nodes and edges in the graph infrastructure.

[0040] The spatiotemporal companion relationship strength is obtained by quantifying time synchronization and resource similarity. Spatiotemporal companion edges are established between nodes that meet the preset strength threshold to construct the dynamic spatiotemporal heterogeneous graph.

[0041] Maintain a corresponding last active timestamp for each entity and each relationship in the dynamic spatiotemporal heterogeneous graph;

[0042] Entities and associated edges that have not updated the last active timestamp beyond the preset window are aged out and removed, while the attributes of continuously active entities are updated in a rolling manner to complete the streaming incremental update and form the unified security graph.

[0043] In one possible design, the step of using the unified security graph as input and performing threat detection through a graph neural network and a spatiotemporal association model to obtain threat detection results includes:

[0044] The unified security graph is used as input, and a heterogeneous graph attention network is used to encode the structure of the unified security graph to learn the low-dimensional vector representation of each node.

[0045] The explicit logical relationships and spatiotemporal associated relationships in the unified security graph are deeply mined through a dual-path analysis layer. The dual-path analysis layer includes explicit logical relationship paths and spatiotemporal associated relationship paths. The explicit logical relationship paths handle communication, dependency, and attribution relationships, while the spatiotemporal associated relationship paths analyze time synchronization and network topology proximity.

[0046] The dual-path analysis results are adaptively integrated using a context-based gating fusion module to generate node fusion features;

[0047] Based on the node fusion features, a multi-task learning head is used to complete node-level and graph-level threat detection, and output threat detection results including node threat scores and graph-level collaborative threat identifiers.

[0048] In one possible design, the threat attribution and family merging based on the threat detection results, using adversarial resilient embedding and reinforcement learning mechanisms, yields threat family merging results and attribution information, including:

[0049] Based on the threat detection results, a suspicious threat sub-graph is extracted from the unified security graph;

[0050] Structural and temporal noise is applied to the suspected threat subgraph to generate adversarial examples;

[0051] An order-preserving contrastive learning strategy is used to construct an embedding space with a dynamic tolerance radius. The suspected threat subgraph and the adversarial sample are mapped to the embedding space, and homologous features are extracted.

[0052] By using a two-stage retrieval process of rapid range recall and dynamic radius, family merging analysis is performed on the homologous features to obtain threat family merging results.

[0053] By combining reinforcement learning agents to dynamically adjust the retrieval parameters of the two-stage retrieval based on detection feedback, subgraph source tracing analysis is performed on the merged threat families to obtain source tracing information including attack paths, core entities, and threat patterns.

[0054] In one possible design, the generation of structured handling recommendations based on the detection results, the threat family merging results, and the source tracing information, through a metagraph-based mechanism, includes:

[0055] Based on the detection results, the threat family merging results, and the source tracing information, key sub-graphs, event sequences, and hit indicators of the threat context are extracted to construct a standardized threat context.

[0056] A metagraph structure is defined at the graph pattern layer, and defense knowledge is abstracted into disposal suggestion nodes. Based on the standardized threat context, the large language model is driven to generate an initial disposal suggestion draft.

[0057] Define the combination, dependency, mutual exclusion, and escalation relationships between the proposed disposal nodes, and dynamically arrange the initial disposal proposal draft into an initial disposal scheme chain;

[0058] By learning from historical attack chain patterns and cross-domain spatiotemporal accompanying patterns, and combining the family characteristics and source information of current threats, we can predict the development path and key attack links of current threats.

[0059] Based on the initial handling scheme link, corresponding handling suggestion nodes are pre-attached to the key attack links of the predicted path to obtain the target handling scheme link; wherein, the pre-attached handling suggestion nodes are associated with preset triggering conditions and expected effective time windows;

[0060] The target disposal plan link is associated and bound with the corresponding evidence package and approval strategy to form a structured disposal suggestion that includes execution priority, scope of application, potential impact and rollback mechanism.

[0061] In one possible design, displaying the proposed actions and the threat detection results includes:

[0062] The threat detection results are aggregated, deduplicated, and correlated to generate interpretable alert events with accompanying contextual information, attack chain stage annotations, and confidence scores.

[0063] The unified security graph is displayed through a multi-view visualization dashboard, showing the global threat situation, threat distribution, and attack chain map. The interactive browser enables dynamic exploration and drill-down of the unified security graph.

[0064] The proposed handling measures are displayed in association with the explainable alarm events, showing the scope of application, execution priority, and potential impact of the proposed measures.

[0065] One possible design also includes:

[0066] The prediction confidence changes of the graph neural network and the spatiotemporally associated model are monitored in real time, and the concept drift of the network traffic characteristic distribution is perceived by calculating the moving average and standard deviation of the prediction entropy.

[0067] When a conceptual shift in the distribution of network traffic features is detected, a meta-learner is used to perform rapid gradient updates on the graph neural network and the spatiotemporal associated model to generate temporary adaptation parameters.

[0068] The temporary adaptation parameters are jointly trained with the example data of historical threat patterns, and the incremental update of the graph neural network and spatiotemporal association model is completed by combining knowledge distillation technology.

[0069] Secondly, this application provides a network security threat monitoring system, comprising:

[0070] The data collection module is used to acquire multimodal raw data collected and uploaded by the mobile application side, the terminal host side, and the network side;

[0071] The data processing module is used to parse, extract features, and refine the multimodal raw data to obtain structured and semantic information elements;

[0072] The entity relationship standardization module is used to standardize and generalize the information elements based on a preset network security threat analysis ontology architecture to obtain standardized entity relationship data.

[0073] The cross-domain semantic alignment module is used to achieve cross-platform and cross-protocol data semantic alignment based on the standardized entity relationship data through a topology-guided sparse anchor alignment mechanism, so as to obtain semantically aligned fused entity relationship data.

[0074] The security graph construction module is used to construct a dynamic spatiotemporal heterogeneous graph based on the fused entity relationship data, and to perform streaming incremental updates on the dynamic spatiotemporal heterogeneous graph to form a unified security graph.

[0075] The threat collaborative detection module is used to take the unified security graph as input and perform threat detection through a graph neural network and a spatiotemporal association model to obtain threat detection results.

[0076] The threat tracing and merging module is used to perform threat tracing and family merging based on the threat detection results through adversarial elastic embedding and reinforcement learning mechanisms, so as to obtain threat family merging results and tracing information;

[0077] The disposal suggestion generation module is used to generate structured disposal suggestions based on the detection results, the threat family merging results, and the source tracing information, through a metagraph-based mechanism.

[0078] The monitoring results display module is used to display the proposed actions and the threat detection results.

[0079] Thirdly, this application provides an electronic device, including: a processor, and a memory communicatively connected to the processor;

[0080] The memory stores computer-executed instructions;

[0081] The processor executes computer execution instructions stored in the memory to implement the method as described in any of the first aspects.

[0082] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any of the first aspects.

[0083] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the method described in any of the first aspects.

[0084] This application provides a network security threat monitoring method, system, device, medium, and product. The method integrates multimodal raw data from mobile applications, terminal hosts, and the network. Through parsing and refining, standardizing the ontology architecture, and aligning topology-guided sparse anchor points, it achieves cross-platform and cross-protocol semantic fusion. Based on the fused entity relationship data, it constructs a dynamic spatiotemporal heterogeneous graph and performs streaming incremental updates to form a unified security graph. It accurately detects collaborative attack behaviors using graph neural networks and spatiotemporal association models. Through adversarial elastic embedding and reinforcement learning mechanisms, it achieves robust source tracing and identification of structural perturbation or temporal mutation attacks. The system merges and ultimately generates structured handling suggestions that can be automatically linked with the operation system based on the metagraph mechanism, and displays them visually. This effectively solves the technical problems of traditional security monitoring systems, such as the difficulty in identifying collaborative attacks due to reliance on a single data source, the difficulty in modeling complex spatiotemporal dependencies in static models and the low detection rate and high false alarm rate of malicious behavior and evasion methods, the lack of flexibility in tracing and merging, and the unstructured handling suggestions. It significantly improves the perception coverage, judgment accuracy and response timeliness of advanced persistent threats that are cross-platform, multi-stage, highly concealed and highly collaborative, and provides full-link, intelligent and implementable technical support for network security operations. Attached Figure Description

[0085] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0086] Figure 1 An application scenario diagram corresponding to a network security threat monitoring method provided in an embodiment of this application;

[0087] Figure 2 A flowchart illustrating a network security threat monitoring method provided in an embodiment of this application;

[0088] Figure 3 A flowchart illustrating a network security threat monitoring method provided in another embodiment of this application;

[0089] Figure 4 A flowchart illustrating a network security threat monitoring method provided in another embodiment of this application;

[0090] Figure 5 A schematic diagram of the structure of a network security threat monitoring system provided in an embodiment of this application;

[0091] Figure 6 This is a structural example diagram of an electronic device provided in an embodiment of this application.

[0092] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0093] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0094] To clearly understand the technical solution of this application, the solutions of the prior art will be described in detail first.

[0095] With the rapid development of mobile internet and cloud-network convergence architecture, cyberattacks are increasingly characterized by cross-platform, multi-stage, highly covert, and highly collaborative features. Traditional security monitoring systems typically rely on isolated single data sources (such as terminal logs, network traffic, or application behavior), lacking the ability to deeply integrate multimodal data from the mobile application side, terminal host side, and network side. This makes it difficult to identify collaborative attack behaviors distributed across different platforms but logically related. Furthermore, existing threat detection methods generally employ static rules or shallow machine learning models, failing to effectively model complex spatiotemporal dependencies between entities. This results in low detection rates and high false positive rates for new variant attacks or malicious behaviors evaded through obfuscation, encryption, tunneling, and other evasion techniques. In addition, current systems lack flexible semantic understanding capabilities in risk tracing and family merging, making it difficult to cope with attack code structure disturbances or temporal variations; and handling suggestions are mostly unstructured text, unable to automatically link with operational systems.

[0096] Therefore, there is an urgent need for a security risk monitoring method that can integrate multi-source heterogeneous data, achieve cross-platform semantic alignment, construct a dynamic unified security graph, and support collaborative behavior detection, elastic source tracing and merging, and structured response generation, so as to improve the ability to perceive, assess and respond to advanced persistent threats.

[0097] Figure 1An application scenario diagram corresponding to a network security threat monitoring method provided in an embodiment of this application is shown, such as... Figure 1 As shown, the application scenario provided in this embodiment includes: a multi-source data acquisition terminal 10, a monitoring platform 11, and a display terminal 12. The multi-source data acquisition terminal 10 and the monitoring platform 11 achieve real-time data transmission through a dedicated network / cloud network converged link, and the monitoring platform 11 and the display terminal 12 interact through an intranet.

[0098] The multi-source data acquisition terminal 10 includes acquisition nodes on the mobile application side, terminal host side, and network side, which respectively collect multimodal raw data such as application behavior, terminal logs, and network traffic. The display terminal 12 can be a security management screen or an operation and maintenance terminal.

[0099] This solution is applicable to network security protection scenarios such as enterprise distributed office networks and mobile office scenarios. In these scenarios, network attacks exhibit cross-platform, multi-stage, and highly covert collaborative characteristics. Traditional security monitoring systems rely on a single data source and use static rule detection, making it difficult to identify related attack behaviors. They also have a low detection rate for variant attacks, weak source tracing and merging capabilities, and their handling suggestions cannot be linked to the operation system, making it difficult to cope with advanced persistent threats.

[0100] Specifically, the threat monitoring process is as follows: First, the multi-source data acquisition terminal 10 simultaneously collects multimodal raw data from the mobile application side, terminal host side, and network side, and sends it to the monitoring platform 11 in real time; the monitoring platform 11 first parses the multimodal raw data, extracts features, and refines them into structured semantic information elements, and then, based on the preset network security threat analysis ontology architecture, standardizes and generalizes the structured semantic information elements to obtain standardized entity relationship data; subsequently, through the topology-guided sparse anchor point alignment mechanism, cross-platform and cross-protocol data semantic alignment is achieved to generate fused entity relationship data; A dynamic spatiotemporal heterogeneous graph is constructed based on fused entity relationship data and updated incrementally in a streaming manner to form a unified security graph. The unified security graph is then input into a graph neural network and a spatiotemporal association model to complete threat detection and obtain threat detection results. Threat attribution and family merging are then carried out through adversarial elastic embedding and reinforcement learning mechanisms to obtain attribution information and family merging results. Based on the metagraph mechanism, the attribution information and family merging results are transformed into structured handling suggestions. Finally, the monitoring platform 11 synchronously sends the threat detection results and structured handling suggestions to the security operation display terminal 12 for operation and maintenance personnel to carry out defense and handling.

[0101] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0102] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are merely illustrative; for instance, the division of modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or modules, and may be electrical, mechanical, or other forms.

[0103] Figure 2 This is a flowchart illustrating a network security threat monitoring method according to an embodiment of this application, as shown below. Figure 2 As shown, the execution subject of this embodiment is a network security threat monitoring device. This device can be implemented through a computer program, or through a medium storing the relevant computer program, such as a USB flash drive and / or optical disc; alternatively, it can be implemented through a physical device that integrates or installs the relevant computer program, such as a chip or electronic device. The electronic device may be a computer or a server, etc. The network security threat monitoring method provided in this embodiment includes the following steps:

[0104] S201. Obtain multimodal raw data collected and uploaded by the mobile application side, terminal host side, and network side.

[0105] Multimodal raw data refers to network security raw monitoring data collected from three different dimensions: mobile application side, terminal host side, and network side. It is heterogeneous in type and diverse in format. The characteristics of multimodal raw data are wide range of sources, multiple forms of expression, and rich information dimensions, covering raw traffic, operation logs, asset information, etc.

[0106] Among them, the cloud network probe is a high-performance data acquisition device deployed at network backbone nodes and egress points. It supports full traffic capture, layer-by-layer protocol parsing, and file restoration, and is the core hardware carrier for network-side data acquisition.

[0107] Among them, the lightweight security probe is a small data acquisition module deployed on the terminal host. It has low resource consumption and can capture behavioral data such as processes, files, and network connections within the host in real time.

[0108] Optionally, the multimodal raw data is collected in real time by the acquisition devices on each side and then uploaded to the network security threat monitoring device through communication methods such as local area network and distributed computing network. The network security threat monitoring device receives, caches, and classifies the data for unified storage.

[0109] Optionally, the raw data on the mobile application side is collected by the mobile terminal and application security detection device, including but not limited to APP installation packages, application running logs, system call records, network request logs, application permission request records, dynamic loading behavior logs, etc. on Android / iOS; the collection methods include crawling application market samples, embedding terminal application behavior, offline analysis by security detection devices, etc.

[0110] Optionally, the raw data on the terminal host side is collected by a lightweight security probe deployed on the host (including PC, server, IoT terminal, etc.), including but not limited to process creation / exit logs, file read / write / execution / deletion operation records, network connection establishment / destruction logs, system asset information (such as operating system version, hardware configuration), user login session data, system call sequence, registry modification records, etc.

[0111] Optionally, raw network data is collected by cloud network probes deployed at network backbone nodes and egress points, including but not limited to raw network traffic packets, NetFlow data, DNS (Domain Name System) query logs, TLS / SSL certificate logs, HTTP / HTTPS session logs, QUIC protocol traffic logs, and network asset liveness status data. The collection method is to access the network through optical splitting or mirroring links to achieve full and lossless capture.

[0112] S202. Analyze, extract features and refine the multimodal raw data to obtain structured and semantic information elements.

[0113] The purpose of this step is to transform heterogeneous, unstructured multimodal raw data into structured, semantic information elements that can be used for subsequent map construction, thereby eliminating data redundancy and format differences.

[0114] Specifically, an information element refers to a basic data unit that has extracted core features, has a clear semantic orientation, and is formatted in a standardized manner, including the core attributes and key behavioral features of an entity.

[0115] Specifically, fine-grained analysis refers to breaking down and analyzing the original data into its smallest units to ensure that no key behavioral details are missed, such as the parent-child relationship of processes, the type of file operation, and the timing characteristics of network connections.

[0116] Specifically, payload-related information refers to file entity-related information transmitted at the application layer in network traffic, including file hash, file size, transmission path, file format, file signature, etc.

[0117] Specifically, differentiated processing strategies are adopted for multimodal raw data from the mobile application side, the terminal host side, and the network side to complete parsing, feature extraction, and information extraction respectively.

[0118] Optionally, reverse engineering and runtime behavior monitoring are performed on the raw data from the mobile application side to extract static and dynamic features, and the backend communication address is extracted by penetrating code obfuscation and string encryption concealment methods.

[0119] Optionally, the raw data on the terminal host side can be parsed in a fine-grained manner, including processes, files, and network connections, to extract host behavior characteristics and entity association information.

[0120] Optionally, process parsing can extract features such as the process ID (PID), parent process ID (PPID), user ID (UID), command-line arguments, CPU / memory usage, process lifecycle (creation / running / exit time), and process derivation relationships. File parsing can extract features such as file path, name, type, hash value (MD5 / SHA256), access permissions, operation type (read / write / execute / delete), operation timestamp, and associated processes. Network connection parsing can extract features such as the five-tuple information of network connections (source IP, source port, destination IP, destination port, protocol type), connection establishment / disconnection time, data transfer volume, and connection status. Entity association information extraction can construct associations such as "process-file," "process-network connection," and "file-network connection," such as "process A executes file B and then initiates a network connection to IP C," or "process D modifies the access permissions of file E, and then process F reads file E," providing a foundation for entity relationships in subsequent graph construction.

[0121] Optionally, full traffic capture and layer-by-layer protocol parsing are performed on the raw data from the network side to complete session reassembly and extract network connection metadata, protocol characteristics, and payload association information.

[0122] Specifically, after the above processing, the multimodal raw data from the mobile application side, the terminal host side, and the network side are all transformed into structured and semantic information elements, and the information elements from each side are integrated to form a multi-source information element dataset.

[0123] S203. Based on the preset network security threat analysis ontology architecture, information elements are defined in a standardized manner and abstracted in a generalized way to obtain standardized entity relationship data.

[0124] The purpose of this step is to eliminate semantic differences between information elements from different sides through a unified ontology architecture, thereby achieving standardized mapping of multi-source data.

[0125] Among them, the cybersecurity threat analysis ontology architecture refers to a pre-designed, standardized conceptual framework for the cybersecurity threat analysis field. It standardizes and generalizes the definitions of core entities, entity attributes, and relationships between entities in the cybersecurity field, and serves as a "benchmark framework" for the semantic unification of multi-source data.

[0126] Standardized entity relationship data refers to structured data with a unified format and consistent semantics, containing "entity-attribute-relationship" triples, formed after information elements are mapped through the network security threat analysis ontology architecture. It can be directly used for subsequent cross-platform semantic alignment and graph construction.

[0127] Specifically, the cybersecurity threat analysis ontology architecture includes three core elements: entity type, entity attribute, and relationship type.

[0128] Among them, the entity types cover the key elements of the attack chain, including App components, system processes, network assets, file payloads, digital certificates, network infrastructure, event nodes, etc.; among them, App component entities correspond to the application component characteristics on the mobile application side, system process entities correspond to the process information on the terminal host side, and network asset entities correspond to information such as IP (Internet Protocol), domain name, and port on the network side.

[0129] Among them, the entity attributes are configured with exclusive key attributes for each entity type. For example, the attributes of an App component include package name, component type, permission list, and running status; the attributes of a system process include PID, PPID, command line parameters, and CPU / memory usage; the attributes of a network asset include IP address, domain name, geographical location, and ASN (Autonomous System Number); and the attributes of a file payload include MD5 / SHA256 hash, file path, and access permissions.

[0130] Among them, the relationship type describes the dynamic interaction behavior between various entities. The relationship types include process derivation, file operation, network connection, internal call, host relationship, communication dependency, ownership relationship, co-occurrence relationship, etc. Among them, the process derivation relationship is the relationship between system process entities, describing the execution flow transmission; the file operation relationship is the relationship between system process and file payload entities, revealing data residence behavior; the network connection relationship is the relationship between system process and network asset entities, connecting host behavior and traffic characteristics.

[0131] Optionally, information elements can be mapped to corresponding entity types in the network security threat analysis ontology architecture. For example, on the mobile application side, "Application Component Activity" can be mapped to the "App Component" entity, and on the network side, "IP Address 192.168.1.1" can be mapped to the "Network Asset" entity.

[0132] Optionally, features from information elements can be extracted and filled into the attribute fields of the corresponding entities, such as extracting features like PID and PPID from process logs and filling them into the attribute fields of the "system process" entity; non-standardized attribute values ​​can be normalized, such as converting IP addresses to IPv4 / IPv6 standard format and timestamps to UTC (Coordinated Universal Time) time format.

[0133] Optionally, the semantic relationships between information elements are analyzed and mapped to the corresponding relationship types in the network security threat analysis ontology architecture, clarifying the source entity and target entity of the relationship, such as mapping "process A creates file B" to the "file operation" relationship; where the source entity is process A and the target entity is file B.

[0134] Optionally, the mapped entities and relationships can be encapsulated in a unified format (such as JSON-LD format) to form standardized entity-relationship data, ensuring data scalability and interoperability.

[0135] S204. Based on standardized entity relationship data, cross-platform and cross-protocol data semantic alignment is achieved through a topology-guided sparse anchor alignment mechanism to obtain semantically aligned fused entity relationship data.

[0136] The purpose of this step is to overcome the problem of data semantic fragmentation across platforms and protocols, and to achieve semantic fusion of data on the mobile application side, the terminal host side, and the network side.

[0137] Among them, the topology-guided sparse anchor alignment mechanism refers to a mechanism that uses the community structure characteristics and node centrality characteristics of graph topology for guidance, and achieves cross-platform and cross-protocol data semantic alignment by sparsely filtering key anchor entities. Topology guidance refers to determining the filtering rules and cross-platform alignment priorities of anchor entities based on the cohesion characteristics of community modules and combined with the degree centrality and betweenness centrality characteristics of nodes. Sparse anchors refer to anchor entities whose number accounts for no more than 20% of the total number of nodes in the corresponding community module. Sparse filtering reduces computational overhead and ensures alignment coreness.

[0138] Anchor entities refer to entities that are located in key topological positions in the graph structure, carry core information flows, or exhibit abnormal behavior. They are key nodes for cross-platform semantic alignment, such as processes that frequently communicate with suspicious domain names or IP addresses associated with multiple malicious files.

[0139] Semantic alignment refers to determining whether different entities / events across platforms point to different aspects of the same security event. For example, whether "process A on the mobile application side initiates a network request" and "IPB on the network side establishes communication with domain name C" are the same behavior, thus realizing the semantic association of cross-platform data.

[0140] Among them, fused entity relationship data refers to the structured data of cross-platform entities and relationships after semantic alignment, which eliminates semantic fragmentation and forms a globally consistent entity relationship view.

[0141] S205. Construct a dynamic spatiotemporal heterogeneous graph based on the fused entity relationship data, and perform streaming incremental updates on the dynamic spatiotemporal heterogeneous graph to form a unified security graph.

[0142] The purpose of this step is to transform the fused entity relationship data into a graph structure that includes spatiotemporal dimensions, and to achieve the dynamic evolution of the graph structure through streaming updates, thereby constructing a globally unified knowledge graph.

[0143] Specifically, Dynamic Spatio-Temporal Heterogeneous Graph (DSTHG) refers to a graph structure that integrates heterogeneous nodes, multiple edge relationships, and explicitly encodes the time-series patterns and spatial topological proximity of entity interactions, supporting streaming incremental updates. Its characteristics include heterogeneity (diverse node / edge types), spatiotemporality (containing time / space information), and dynamism (can be updated in real time).

[0144] Specifically, a unified security graph refers to a global knowledge graph that deeply integrates cross-domain entity semantic alignment results with fine-grained network spatiotemporal features. It is the final form of a dynamic spatiotemporal heterogeneous graph after streaming incremental updates, and can truly reflect the complex interactions and dependencies between entities in cyberspace. It serves as the input for subsequent threat detection, source tracing, and merging.

[0145] Among them, spatiotemporal association refers to the implicit association formed when two entities that do not communicate directly access the same batch of malicious resources or exhibit synchronized behavior patterns within a similar time period. It is a key relationship for discovering mass threats (such as botnets and fraud gangs).

[0146] Among them, streaming incremental update refers to a mechanism that updates the graph structure in real time using a sliding time window, including adding entities / relationships, updating the attributes of existing entities / relationships, and aging out expired entities / relationships to ensure the timeliness of the graph structure.

[0147] S206. Using the unified security graph as input, threat detection is performed through a graph neural network and a spatiotemporal association model to obtain the threat detection results.

[0148] The purpose of this step is to use a threat detection model based on graph neural networks to perform in-depth analysis of the unified security graph, and to achieve threat detection at both the node and graph levels.

[0149] Among them, Graph Neural Network (GNN) refers to a deep learning model specifically designed for processing graph-structured data. It can learn the contextual features of nodes in a graph through a message passing mechanism, enabling feature extraction and inference of graph-structured data. It is suitable for entity association analysis and threat detection in the field of cybersecurity.

[0150] Among them, the spatiotemporal association model refers to a threat detection model that integrates graph neural networks and spatiotemporal feature analysis. Its core is to detect cross-platform collaborative attack behavior by mining explicit logical relationships and implicit spatiotemporal association relationships in the graph through a dual-path analysis layer. The input of the model is the heterogeneous node features, multi-edge relationship features and spatiotemporal association relationship strength features of the unified security graph.

[0151] The threat detection result refers to structured data that includes node threat scores, graph-level collaborative threat identifiers, and corresponding key evidence. Node threat scores are values ​​between 0 and 1 (the higher the score, the stronger the threat). Graph-level collaborative threat identifiers are used to indicate whether there is a group threat.

[0152] S207. Based on the threat detection results, threat attribution and family merging are performed through adversarial resilient embedding and reinforcement learning mechanisms to obtain threat family merging results and attribution information.

[0153] The purpose of this step is to achieve deep source tracing and family merging of threats through adversarial resilient embedding and reinforcement learning mechanisms, thereby solving the problem of attackers evading detection through structural / temporal noise.

[0154] Among them, adversarial elastic embedding refers to graph embedding methods that are resistant to structural noise. By generating adversarial examples and order-preserving contrastive learning, a dynamic tolerance radius is constructed in the embedding space, so that the embedding vectors of threat subgraphs that are from the same source but are disturbed are still within a controllable range, thereby improving the adversarial robustness of the model.

[0155] Among them, order-preserving contrastive learning refers to a contrastive learning strategy. Its core is to constrain the embedding distance between the original sample and the adversarial sample within a preset tolerance radius, while pushing the embedding distance of non-homologous samples outside the safety boundary, so as to ensure the robustness and discriminability of the embedding features.

[0156] Threat family merging refers to grouping threat entities (IPs, domains, apps, files, etc.) with similar characteristics (such as the same attack patterns, the same communication infrastructure, and the same code framework) into the same threat family, thereby enabling the systematic identification and crackdown on threat network resources.

[0157] Threat attribution refers to uncovering the attack paths (such as malicious code propagation paths and C2 communication paths), core entities (such as master control nodes and key malicious domains / IPs), and threat patterns (such as attack methods and communication characteristics) of threats, tracing the source and propagation chain of the attack.

[0158] The C2 (Command and Control) communication path is the channel through which attackers establish communication connections with controlled systems (such as attacked computers, network devices, devices in robot networks, or drones) to achieve malicious operations such as remote control, command issuance, and data theft.

[0159] S208. Based on the detection results, threat family merging results, and source tracing information, structured disposal suggestions are generated through a metagraph-based mechanism.

[0160] The purpose of this step is to transform threat analysis results into actionable, interpretable, and evolvable structured action recommendations through the metagraph mechanism, thereby achieving a closed loop from threat detection to action response.

[0161] Metagraph refers to an abstract graph structure that transforms defense knowledge into a graph. Defense elements such as disposal suggestions, evidence, and approval strategies are defined as nodes, and the relationships between elements (such as dependency, mutual exclusion, and escalation) are defined as edges. It is the basis for generating structured disposal suggestions.

[0162] Among them, the disposal suggestion node is the core entity in the metagraph, which is used to structurally carry "disposal suggestions / blocking suggestions / alarm suggestions". It is an atomic unit of defense knowledge, and its attributes include suggestion ID, suggestion type, target object, risk level, applicable time window, etc.

[0163] Among them, structured handling recommendations refer to actionable handling solutions that include execution priority, scope of application, potential impact, rollback mechanism, evidence package, and approval strategy, and can be directly connected to execution nodes such as firewalls, WAF (Web Application Firewall), and Endpoint Detection and Response (EDR).

[0164] S209. Display the handling recommendations and threat detection results.

[0165] The purpose of this step is to visualize and correlate threat detection results with structured handling recommendations, providing security operations personnel with intuitive and actionable decision-making support.

[0166] This application provides a network security threat monitoring method that integrates multimodal raw data from mobile applications, terminal hosts, and the network. Through parsing, extraction, standardized ontology architecture definition, and topology-guided sparse anchor alignment, it achieves cross-platform and cross-protocol semantic fusion. Based on the fused entity relationship data, it constructs a dynamic spatiotemporal heterogeneous graph and performs streaming incremental updates to form a unified security map. Graph neural networks and spatiotemporal association models are used to accurately detect collaborative attack behaviors. Adversarial elastic embedding and reinforcement learning mechanisms enable robust tracing and family merging of attacks involving structural disturbances or temporal variations. Finally, based on the metagraph mechanism, it generates structured handling suggestions that can be automatically linked with the operational system and visualized. This method effectively solves the technical problems of traditional security monitoring systems, such as difficulty in identifying collaborative attacks due to reliance on a single data source, difficulty in modeling complex spatiotemporal dependencies using static models, low detection rate and high false alarm rate for malicious behaviors and evasion methods, lack of elasticity in tracing and merging, and unstructured handling suggestions. It significantly improves the perception coverage, judgment accuracy, and response timeliness of advanced persistent threats that are cross-platform, multi-stage, highly concealed, and highly collaborative, providing end-to-end, intelligent, and implementable technical support for network security operations.

[0167] As an optional implementation, based on any of the above embodiments, the multimodal raw data is parsed, features are extracted and refined, including:

[0168] Specifically, the raw data from the mobile application side is reverse engineered and its runtime behavior is monitored to extract static and dynamic features, and the backend communication address is extracted by penetrating code obfuscation and string encryption.

[0169] Optionally, as an alternative implementation, the raw data from the mobile application side is reverse engineered and its runtime behavior monitored to extract static and dynamic features, and the backend communication address is extracted by penetrating code obfuscation and string encryption techniques, including the following:

[0170] The structure of the mobile application installation package is parsed and reverse analyzed to extract static features, including application components, permission lists, and control flow graphs.

[0171] Reverse engineering analysis refers to the technical means of disassembling and decompiling the installation package of a mobile application to restore its code logic and internal components, in order to extract the static characteristics of the application.

[0172] Among them, the control flow graph (CFG) is a graphical representation that describes the execution flow of an application. It includes the basic blocks in the program and the jump relationships between the basic blocks, and is used to analyze the execution logic of the application.

[0173] Optionally, when performing structural parsing and reverse engineering on mobile application installation packages (APK / IPA), the installation package is first disassembled using file parsing tools to extract components such as Dex bytecode (Android application), native libraries (SO files), resource configuration files (such as AndroidManifest.xml), and certificate files. Decompilation tools (such as Jadx and Ghidra) are then used to restore the Dex bytecode to Java source code and decompile the native libraries into assembly code to analyze the application's internal logic. Static features are extracted from the parsing and decompilation results, including application components (Activity, Service, Receiver, Provider), permission lists (such as permissions to access the network, read phone status, and write to external storage), control flow graphs (CFG), function call relationships, hard-coded strings (for initial screening), and resource file hash values.

[0174] Run mobile applications in a controlled environment to monitor and record their runtime dynamic behavior.

[0175] Among them, the controlled environment refers to the isolated environment (such as sandbox, virtual machine, dedicated testing equipment) used to run mobile applications. It can monitor all the behavior of the application without affecting the real environment and is used to extract the dynamic behavioral characteristics of the application.

[0176] Optionally, when running a mobile application in a controlled environment and monitoring and recording its runtime dynamic behavior, the following steps are taken: First, an isolated controlled environment is set up, configured with the same operating system version, hardware parameters, and network environment as the real terminal to ensure the application can run normally. Next, the application's runtime behavior is monitored in real time using system hooks (such as the Xposed framework) and behavior monitoring tools. This includes system call sequences, critical API (Application Programming Interface) calls (such as network request APIs, file operation APIs, and reflection call APIs), file system operations (creating / reading / writing / deleting files), process lifecycle (starting / hibernating / exiting), initiated network connections (target address, port, protocol type), and interactions with other applications. Finally, the monitored dynamic behaviors are recorded in timestamp order to form a dynamic behavior log, from which key dynamic behavior features are extracted, such as high-frequency network request addresses, sensitive file operation paths, and abnormal system call sequences.

[0177] Based on the analysis results of threat application family characteristics and code homology, a special removal rule base is constructed. The network request initiation point and configuration decryption interface of the mobile application are located according to the special removal rule base, and the backend communication address containing domain name, Internet Protocol address and network address path is extracted.

[0178] Among them, threat application family characteristics refer to the common characteristics exhibited by applications of the same threat family (such as a certain type of malware) in terms of code framework, resource files, communication modules, and behavioral patterns.

[0179] Code homology analysis refers to the technical means of determining whether an application comes from the same development team or is developed based on the same code framework by comparing the similarity of application code, function call sequences, string characteristics, etc.

[0180] Among them, the special elimination rule base refers to the set of rules built based on the family characteristics of threat applications and the analysis results of code homology, which are used to locate the key logic of threat applications (such as network request initiation points and configuration decryption interfaces). The rule forms may include signature code matching rules, function call sequence rules, string decryption rules, etc.

[0181] The backend communication address refers to the network address used by the application to communicate with the backend server, including domain name, Internet Protocol address (IP), network address path (URL, Uniform Resource Locator), WebSocket endpoint, etc.

[0182] Optionally, a dedicated removal rule base is constructed based on the threat application family characteristics and code homology analysis results to extract the background communication address by penetrating concealment methods. First, a massive number of threat application samples are collected, and reverse engineering and code homology analysis are performed on the samples to summarize the common characteristics of the same threat family (such as network request function names, configuration decryption function characteristics, and communication address encryption methods). These common characteristics are transformed into dedicated removal rules to form a dedicated removal rule base. The rule base supports dynamic updates, and the corresponding rules are automatically updated when new threat family samples are added. Next, the mobile application code is matched with the dedicated removal rule base to locate the application's network request initiation point (such as specific function calls or specific component triggers), configuration decryption interface (such as string decryption functions or binary data decryption functions), and remote resource loading interface (such as interfaces for dynamically loading Dex files or downloading configuration files). To counter the application's covert techniques such as code obfuscation (e.g., control flow flattening, identifier obfuscation), string encryption (e.g., AES encryption), reflection calls, and dynamic loading, corresponding rules from a specialized attack rule base are used for cracking. For example, encrypted strings are restored using decryption rules, key obfuscated functions are located using function call sequence rules, and dynamically loaded communication addresses are captured through dynamic instrumentation. Finally, from the located key logic, the application's backend communication addresses are extracted, including domain names, IP addresses, URL paths, and WebSocket endpoints. These extracted communication addresses are then deduplicated and standardized in format to form a high-confidence list of backend communication addresses.

[0183] Optionally, samples of known threat apps are collected (covering various fraudulent categories such as fake online lending, fake investment and wealth management, and voice relay). Through code homology analysis (comparing function call sequences, resource file hashes, and configuration file structures) and behavioral coordination analysis (statistically analyzing network request patterns and data transmission timing), apps with similar code frameworks, communication modules, and operating models are grouped into the same threat family, accumulating at least 350 threat family feature libraries. Based on family characteristics, key technical features of each family are extracted: including function signatures of network request initiation points, parameter characteristics of configuration decryption interfaces, encryption algorithm types of communication addresses (such as AES), and dynamic loading trigger conditions (such as specific permission requests and system environment detection). These features are transformed into structured targeted removal rules, including feature code matching rules, function call sequence rules, string decryption rules, and JNI / So layer key function location rules, forming a specialized targeted removal rule library that supports dynamic updates.

[0184] Optionally, for apps that use string encryption, splitting, and concatenation, the storage location of the encrypted string (e.g., hard-coded in a Dex file or configuration file) and the corresponding decryption function are located using a dedicated kill rule library. The decryption process is captured in a controlled environment using dynamic instrumentation technology to restore the original communication address. For apps that use reflection calls and dynamic loading (Dex loading, hot updates), the class loading process is traced, the loadClass method of ClassLoader is intercepted, the dynamically loaded code snippets are obtained, and the network request interfaces and communication addresses are extracted. For apps that use JNI / So to hide the communication address, the So library is reverse-engineered to locate key functions (e.g., socket creation, connect calls to corresponding native methods), and the decrypted communication address is obtained through memory dump or register monitoring.

[0185] Specifically, the extracted communication addresses (domain name, IP address, URL path, WebSocket endpoint) are deduplicated and standardized in format. Combined with a threat family feature library, a confidence score is assigned to each address (based on the matching degree between the address and family features, and the completeness of evidence in the extraction process). High-confidence addresses are associated and labeled with their corresponding threat families and attack chain contexts, such as the threat category to which the address belongs (fraudulent online lending, voice relay), associated APP sample information (package name, version, channel), and historical blocking records, forming high-confidence intelligence elements that can be directly used for action.

[0186] Specifically, the raw data on the terminal host side is analyzed in a fine-grained manner, including processes, files, and network connections, to extract host behavior characteristics and entity association information.

[0187] Specifically, by deploying lightweight security probes on terminal hosts, based on kernel-level hooks (such as the Minifilter driver in the Windows kernel) or user-level monitoring tools, non-intrusive, fine-grained monitoring of the entire process lifecycle can be achieved, extracting multi-dimensional process behavioral characteristics. These multi-dimensional process behavioral characteristics include basic process attribute characteristics and dynamic process behavioral characteristics.

[0188] The basic process attributes include core identification features, execution context features, and permission and credential features. Optionally, the process's unique identifier, parent process identifier, user identifier, process group ID, and session ID are extracted to clarify the process's ownership and hierarchical relationship, thus obtaining the core identification features. Optionally, the process's command-line arguments (including full path, startup parameters, and environment variables), process image file path and hash value, process startup time, and runtime are recorded to obtain the execution context features. Optionally, the process's permission level (e.g., administrator privileges, ordinary user privileges), privileged operation requests (e.g., accessing sensitive registry keys, modifying system configurations), and credential reuse behavior (e.g., inter-process permission inheritance, token theft attempts) are captured to obtain permission and credential features.

[0189] The dynamic behavior characteristics of processes include process derivation characteristics, system call characteristics, and module loading characteristics. Optionally, process creation and exit events are tracked to construct parent-child process derivation chains, recording derivation timestamps, network environments at the time of derivation (such as current IP address and gateway), and user interaction states (such as whether it is a background process) to obtain process derivation characteristics. Optionally, key system call sequences of processes are captured (such as file operation classes open / write, network communication classes socket / connect, process control classes kill / waitpid, and memory operation classes mmap / mprotect), extracting the frequency, timing pattern, and return value distribution of system calls, and identifying abnormal call combinations (such as high-frequency creation of temporary files followed immediately by network transmission) to obtain system call characteristics. Optionally, the loading behavior of dynamic link libraries (DLLs / So libraries) of processes is monitored, recording the loaded library path, hash value, loading method (static loading / dynamic loading), and loading timing (when the process starts / during runtime), with a focus on detecting the loading behavior of suspicious libraries (such as unsigned libraries or libraries downloaded from overseas IP addresses) to obtain module loading characteristics.

[0190] Specifically, based on the file system filter driver or user-space file monitoring interface, all file operations within the terminal host are captured and parsed to extract file attribute features and file operation behavior features.

[0191] Optionally, record the file's absolute path, filename, file type (e.g., executable file, document file, configuration file), file size, creation / modification / access timestamps, file permissions, owner, and group. Calculate the file's MD5 / SHA256 hash value, file byte entropy value, file signature, and key content fragments (e.g., hard-coded strings in configuration files, import / export tables in executable files).

[0192] Optionally, capture process operations on files, including creation, reading, writing, modification, deletion, renaming, and permission changes, and record the timestamps of the operations; focus on monitoring file operations on sensitive system paths, such as system directories, user configuration directories, temporary directories, and startup project directories; track the file propagation path (such as downloading via network, copying via USB drive, and copying between processes), and record the file's source (such as download URL and copy device identifier) ​​and destination (such as upload target IP and copy target path).

[0193] Optionally, the network interface monitoring module of the terminal host captures all network connections initiated or received by the process, and extracts network connection characteristics using protocol parsing technology. Specifically, it extracts the five-tuple information of the network connection (source IP address, source port, destination IP address, destination port, protocol type), connection status, connection establishment / disconnection timestamp, and total data transmission volume; records the network interface used by the connection (such as Ethernet, Wi-Fi, virtual network card), local routing information (gateway IP, subnet mask), and DNS resolution records (mapping relationship between destination domain name and IP, resolution time). It analyzes the handshake parameters of the TCP connection (such as window size, number of timeout retransmissions), the timing pattern of data transmission (such as burst transmission, low-rate continuous transmission), and port reuse (whether the same port frequently establishes connections with different IPs); it performs shallow parsing of application layer protocols (such as HTTP / HTTPS), extracts key fields in the protocol header (such as HTTP User-Agent, Host, request method), identifies abnormal protocol behavior (such as HTTP communication on non-standard ports); and marks connections with malicious IPs / domains, connections with IPs from high-risk overseas regions, connections that frequently switch target IPs in a short period of time, and empty connections without normal protocol interaction.

[0194] Specifically, based on the parsing results of processes, files, and network connections, a ternary association relationship of "process-file", "process-network connection", and "file-network connection" is constructed to form an entity association graph.

[0195] Optionally, the operation mapping of "process PID → file path" is recorded to clarify the operation type, operation time, and operation result (success / failure) of a process on a specific file; the files that the process depends on during runtime (such as configuration files and dynamic libraries) are identified, the association relationship of "process → dependent files" is constructed, and the necessity of the dependency is marked (such as required dependency, optional dependency). Thus, the association between the process and the file is completed.

[0196] Optionally, a mapping of "process PID → network connection quintuple" can be established to identify all network connections initiated by a certain process, track the files transferred by the process through network connections (such as downloaded malicious samples or uploaded sensitive data), and construct the association chain of "process → network connection → file".

[0197] Optionally, the source and destination of files transferred via network connection are recorded to construct the association between "network connection → file", and the direction of file transfer (upload / download) and transfer status (complete / interrupted) are marked; the association between files downloaded via network connection and those executed / modified by local processes is also identified.

[0198] It should be noted that by extracting multi-dimensional features and constructing entity associations for processes, files, and network connections, a comprehensive and in-depth understanding of terminal host behavior is achieved. The extracted features and associated information not only provide data support for the subsequent construction of a unified security graph, but also accurately capture abnormal behavior trajectories on the terminal side, providing key clues for collaborative attack detection and threat tracing.

[0199] Optionally, full traffic capture and layer-by-layer protocol parsing are performed on the raw data from the network side to complete session reassembly and extract network connection metadata, protocol characteristics, and payload association information. Specifically, this includes the following steps:

[0200] First, the full traffic of the network side is captured by probes, and zero-copy packet processing and session reassembly in user space are achieved based on the data plane development kit.

[0201] The Data Plane Development Kit (DPDK) is a set of open-source software libraries and drivers for fast packet processing. It can bypass the operating system kernel and process network packets directly in user space, achieving zero-copy, low-latency packet processing, and is suitable for high-bandwidth, high-concurrency network traffic capture scenarios.

[0202] Zero-copy in user space refers to the direct transmission of data packets from the network interface card (NIC) to the user space memory of the application without the need for copying through the operating system kernel memory, thereby reducing data transmission latency and CPU overhead.

[0203] Session reassembly refers to the technical means of reassembling scattered network data packets according to sessions (such as TCP sessions) to restore the complete communication process, which is used to analyze application layer protocols and payload content.

[0204] Optionally, the raw network traffic can be captured in full without loss using a cloud network probe. The probe hardware supports gigabit / 10-gigabit optical interfaces and can be directly connected to split or mirror links. At the software level, a data processing channel is built based on a data plane development kit. A polling mode is used to replace the traditional interrupt-driven approach. Large page memory is enabled to reduce the loss of TLB (Translation Lookaside Buffer). A lock-free circular queue is used to achieve efficient transmission of data packets, ensuring that line-speed capture can still be achieved in high-bandwidth (e.g., 10Gbps) and high-concurrency scenarios.

[0205] Optionally, zero-copy message processing in user space is implemented based on DPDK. This involves session identification and reassembly of captured data packets. Specifically, based on the sequence number, acknowledgment number, and flag bits of the TCP (Transmission Control Protocol) protocol, data packets belonging to the same TCP session are reassembled sequentially to handle issues such as packet retransmission, out-of-order delivery, and packet loss, restoring the complete TCP data stream. For the UDP (User Datagram Protocol) protocol, data packets belonging to the same UDP stream are aggregated based on the five-tuple information and arranged in order of reception time to restore the complete content of UDP communication. If the traffic has passed through tunnel encapsulation, such as an SSH (Secure Shell) tunnel, the tunnel protocol is first decapsulated to extract the original traffic within the tunnel before session reassembly.

[0206] Secondly, the captured traffic data is parsed layer by layer from the link layer to the transport layer to extract the five-tuple connection metadata, which includes the source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type.

[0207] The quintuple refers to the five core parameters used to uniquely identify a network connection, including the source Internet Protocol address (source IP), the destination Internet Protocol address (destination IP), the source port, the destination port, and the protocol type (such as TCP or UDP).

[0208] Optionally, the captured and reassembled traffic data is parsed layer by layer from the link layer (L2) to the transport layer (L4). Specifically, this includes: extracting Ethernet frame header information, including the source MAC (Media Access Control) address, destination MAC address, and frame type (such as IP frame); and extracting IP packet header information, including the source IP address, destination IP address, IP protocol version (IPv4 / IPv6), TTL (Time To Live), and protocol type (indicating the transport layer protocol).

[0209] Optionally, based on the protocol type in the IP packet header, extract TCP packet header information, including source port, destination port, sequence number, acknowledgment number, window size, flags, etc. Extract UDP packet header information, including source port, destination port, packet length, checksum, etc.

[0210] Optionally, a 5-tuple (source IP, destination IP, source port, destination port, protocol type) can be extracted from the resolution result as core metadata that uniquely identifies a network connection.

[0211] Finally, an identification technology that integrates port number, protocol fingerprint, and traffic behavior characteristics is used to parse the application layer protocol and extract protocol metadata, restore the file entity transmitted by the application layer, and store it securely.

[0212] Protocol fingerprints refer to the characteristic identifiers used to identify application layer protocols, including protocol header field characteristics, data packet length distribution characteristics, data packet interaction sequence characteristics, etc., which are used to accurately identify application layer protocols running on unconventional ports or tunnel encapsulations.

[0213] Application layer protocol metadata refers to the descriptive information contained in the application layer protocol, such as the URL, Host header, User-Agent header, and Cookie of the HTTP protocol; the query domain name, query type, and response result of the DNS protocol; and the server name indication and certificate information of the TLS protocol.

[0214] Optionally, common application layer protocols are matched based on transport layer port numbers (e.g., port 80 corresponds to HTTP, port 443 to HTTPS, and port 53 to DNS). For protocols running on uncommon ports, identification is performed by matching protocol fingerprints (e.g., the "GET / POST" request line of the HTTP protocol and the query header format of the DNS protocol). Analyzing behavioral characteristics such as packet length distribution, interaction sequence, and byte transmission rate of traffic helps identify protocol types, such as the continuous transmission of large data packets in video streaming protocols and the frequent interaction of short data packets in instant messaging protocols.

[0215] Optionally, for HTTP / HTTPS protocols, the request line (method, URL, protocol version), request headers (Host, User-Agent, Cookie, Content-Type), response line (status code, reason phrase), and response headers (Server, Content-Length) are parsed. For HTTPS protocols, the SNI (Server Name Indication) and certificate information are extracted first through TLS (Transport Layer Security) handshake parsing, and then the encrypted traffic characteristics are decrypted or analyzed.

[0216] Optionally, for the DNS protocol, resolve the query domain name, query type (A, AAAA, CNAME, MX, etc.), query class, response code, resource record (such as IP address, domain alias), etc.

[0217] Optionally, for the QUIC (Quick UDP Internet Connections) protocol, metadata such as version number, connection ID, stream ID, frame type, and transmission parameters are parsed.

[0218] Optionally, for protocols such as SMTP (Simple Mail Transfer Protocol), FTP (File Transfer Protocol), and WebSocket, the header information and key fields are parsed according to the corresponding protocol specifications to extract protocol metadata.

[0219] Optionally, the file entities transmitted at the application layer are restored. This includes: identifying the transmitted files from application layer traffic, such as extracting file data from HTTP response bodies, FTP data channels, and SMTP attachments. The identified file data is then restored, preserving the original file format (e.g., PDF files, Office documents, image files), calculating the file's MD5 / SHA256 hash value, and recording associated information such as the file's transmission path (e.g., source IP, destination IP, transmission protocol, URL), transmission time, and file size. The restored files are then securely stored locally, categorized and archived by file type, hash value, and transmission time, providing raw material for subsequent malicious code detection, sample comparison, and forensic analysis.

[0220] This application provides a network security threat monitoring method that, through reverse engineering and runtime monitoring of mobile applications, can penetrate covert methods to extract key backend communication addresses and comprehensively grasp the static and dynamic characteristics of the application. It also performs fine-grained analysis on the terminal host side to obtain host behavior and entity association information; and implements full traffic capture and multi-level analysis on the network side to accurately extract network connection metadata, protocol characteristics, and payload association information. This multi-dimensional and in-depth data analysis and feature extraction approach helps to comprehensively and accurately understand the system's operational status, promptly detect potential security threats, provide rich and accurate data support for security protection, and effectively improve the targeting and effectiveness of security protection.

[0221] Figure 3 This is a flowchart illustrating a network security threat monitoring method according to another embodiment of this application; as shown below. Figure 3 As shown, as an optional implementation, based on any of the above embodiments, cross-platform and cross-protocol data semantic alignment is achieved through a topology-guided sparse anchor alignment mechanism based on standardized entity relationship data to obtain semantically aligned fused entity relationship data, including the following steps:

[0222] S301. Based on standardized entity relationship data, construct mobile application behavior graph and network traffic graph respectively.

[0223] Among them, the mobile application behavior graph refers to a graph structure built based on standardized entity relationship data on the mobile application side. Nodes include App components, system processes, file payloads, etc., and edges include relationships such as process derivation, file operations, and internal calls. It is used to describe the behavioral logic and entity associations of mobile applications.

[0224] Among them, the network traffic graph refers to a graph structure built based on standardized entity relationship data on the network side. Nodes include network assets, digital certificates, network infrastructure, etc., and edges include relationships such as network connections, communication dependencies, and ownership relationships. It is used to describe the interactive characteristics and entity associations of network traffic.

[0225] Optionally, with App components, system processes, and file payloads as core nodes, and process derivation, file operations, internal calls, and host relationships as edges, the standardized entity relationship data on the mobile application side is mapped into a graph structure. Node attributes include the entity attributes defined above, and edge attributes include interaction timestamps, behavior types, etc.

[0226] Optionally, network assets (IP, domain name, port), digital certificates, and network infrastructure are used as core nodes, and network connections, communication dependencies, ownership relationships, and co-occurrence relationships are used as edges. The standardized entity relationship data on the network side is mapped into a graph structure. Node attributes include the entity attributes defined above, and edge attributes include connection timestamps, data transmission volume, protocol type, etc.

[0227] S302. The mobile application behavior graph and network traffic graph are divided into structured communities using an unsupervised community detection algorithm to obtain multiple cohesive community modules.

[0228] Among them, unsupervised community detection algorithms refer to algorithms that can automatically identify subgraphs (community modules) in a graph structure that are internally connected and functionally cohesive without manual annotation, such as Louvain algorithm, GN algorithm, Infomap algorithm, etc., which are used to reduce the complex problem of full graph alignment to pattern matching of local communities.

[0229] Among them, cohesive community modules refer to subgraphs in a graph structure where the connection density between internal nodes is much higher than the connection density with external nodes. Each community module corresponds to a set of entities with relatively independent functions, such as the related processes and files of a certain application, or the related network assets of a certain business.

[0230] Optionally, unsupervised community discovery algorithms (such as the Louvain algorithm) can be used to perform structured community partitioning of mobile application behavior graphs and network traffic graphs. Specifically, this includes: using "application function modules" as the partitioning basis, grouping components, processes, and files belonging to the same application into a single community module; for example, all Activities, Services, related processes, and operation files corresponding to a particular app constitute a community. Alternatively, using "business scenarios" as the partitioning basis, grouping network assets, certificates, and infrastructure belonging to the same business into a single community module; for example, the domain name, IP address, server certificate, and associated network infrastructure of a website constitute a community.

[0231] Optionally, the divided community modules can be optimized by merging communities that are too small (with fewer than the preset threshold number of nodes) and splitting communities that are too large (with more than the preset threshold number of nodes) to ensure the cohesion and reasonable size of each community module.

[0232] S303. Within each community module, anchor entities with key topological locations are mined using a centrality metric.

[0233] Among them, the centrality measurement method refers to the quantitative method used to evaluate the importance of nodes in the graph structure. In this application, the degree centrality method and the betweenness centrality method are adopted.

[0234] Specifically, degree centrality and betweenness centrality methods are used to measure the nodes within the community module.

[0235] Secondly, target nodes whose measurement results meet the preset threshold are used as anchor entities for key topological locations.

[0236] Degree centrality assesses a node's connectivity by calculating the ratio of its degree (the number of nodes directly connected to it) to the total number of nodes in the community. A higher degree centrality indicates a stronger role in information aggregation and dissemination within the community. Betweenness centrality assesses a node's network bridging role by calculating the probability that it appears on the shortest path between any two nodes in the community. A higher betweenness centrality indicates a more crucial role in information flow within the community.

[0237] Optionally, anchor entities for key topological locations are mined within each community module using a centrality metric. Specifically, this includes calculating the degree centrality and betweenness centrality of each node within the community module. A degree centrality threshold (e.g., 0.6) and a betweenness centrality threshold (e.g., 0.5) are set, and nodes that simultaneously satisfy both degree centrality ≥ the degree centrality threshold and betweenness centrality ≥ the betweenness centrality threshold are selected as anchor entities. If no node in a community module simultaneously satisfies both thresholds, then the top N (e.g., top 5) nodes in terms of both degree centrality and betweenness centrality are selected as anchor entities.

[0238] S304. Construct a context package for each anchor entity that includes an attribute summary, a neighborhood structure summary, and a behavior sequence summary.

[0239] The context packet refers to a data packet containing the core features of the anchor entity. It is used to describe the attribute information, topological location information and behavioral features of the anchor entity, providing a basis for semantic alignment. It includes attribute summary (standardized description of core attributes), neighborhood structure summary, and behavioral sequence summary (behavioral event sequence within a time window).

[0240] Optionally, a context packet is constructed for each anchor entity, specifically including: extracting the core attributes of the anchor entity and standardizing their description, such as the attribute summary of a network asset anchor being "IP: 192.168.1.100, Protocol type: HTTPS, Geographic location: Beijing, ASN: 12345". Extracting all nodes and relationships within the anchor entity's k-hop (e.g., 2-hop) neighborhood, describing the neighborhood topology, such as "the 1-hop neighborhood of anchor process A includes file B (file operation relationship) and process C (process derivation relationship), and the 2-hop neighborhood includes IP D (network connection relationship, associated through process C)". Extracting the sequence of behavioral events of the anchor entity within a preset time window (e.g., 1 hour), sorted by timestamp, such as "process A creates file B at 10:00, reads file B at 10:05, and initiates an HTTPS request to IP D at 10:10".

[0241] S305. Call the large language model to perform semantic reasoning and alignment determination on the cross-platform anchor entity context package, and output the alignment result.

[0242] Optionally, a large language model with strong contextual semantic understanding capabilities can be selected, which can handle complex technical descriptions and perform logical reasoning.

[0243] Optionally, standardized prompt words are constructed to guide the large language model in semantic alignment determination. An example prompt word is: "Please analyze the context packets of the following two cross-platform anchor entities and determine whether they point to different aspects of the same security event (i.e., whether they are semantically aligned. If aligned, please output the alignment confidence (0-1) and the basis for alignment; if not aligned, please output the alignment confidence 0 and the reason for not aligning. Mobile application side anchor context packet: {context packet A}; network side anchor context packet: {context packet B}."

[0244] Optionally, the context packet of the cross-platform anchor entity (such as the process anchor on the mobile application side and the IP anchor on the network side) and the prompt words are input into the large language model. The large language model analyzes the attributes, topology, and behavior sequence in the context packet, infers the semantic relationship between the two, and outputs the alignment result, including the alignment target (such as "process A is aligned with IP D"), the alignment confidence (such as 0.95), and the evidence summary (such as "the timestamp, protocol type, and data transmission volume of the HTTPS request initiated by process A at 10:10 are consistent with those of the HTTPS request received by IP D at 10:10").

[0245] S306. The confidence propagation algorithm is used to spread the alignment results within the corresponding community module, and entities and events across platforms and protocols are fused to obtain semantically aligned fused entity relationship data.

[0246] The confidence propagation algorithm refers to the algorithm that spreads the alignment results of anchor entities within the community module. During the propagation process, the alignment confidence decreases with the number of hops. At the same time, time consistency constraints (only propagating the alignment results of entities within the same time window) and edge type whitelist constraints (only propagating the alignment results of valid relation types) are applied to ensure the accuracy of the propagation results.

[0247] Optionally, when using a confidence propagation algorithm to diffuse the alignment results within the corresponding community module, the alignment results (alignment target, alignment confidence) of the anchor entity are used as propagation seeds to initialize the propagation process. Within the community module to which the anchor entity belongs, confidence propagation is performed at a preset number of hops (e.g., 3 hops), with the propagation rule being: only entity alignment results within the same community module are propagated. The alignment confidence decays with the number of propagation hops; for example, for each propagation hop, the confidence is multiplied by a decay coefficient (e.g., 0.8).

[0248] Only propagate entity alignment results within the same time window to ensure the timeliness of the alignment results. Only propagate alignment results for valid relationship types such as network connections, file operations, and process derivations, filtering out the propagation of invalid relationships.

[0249] Optionally, the alignment results after propagation are verified, and alignment results with confidence levels lower than a preset confidence threshold (e.g., 0.5) are removed, while high-confidence alignment results are retained. Based on the alignment results, entities and events across platforms and protocols are merged. For example, “Process A” on the mobile application side and “IP D” on the network side are merged into different dimensions of the same entity, and “Process A initiates an HTTPS request” and “IP D receives an HTTPS request” are merged into the same event, resulting in semantically aligned fused entity relationship data.

[0250] This application provides a network security threat monitoring method that constructs mobile application behavior graphs and network traffic graphs, uses an unsupervised community discovery algorithm to divide community modules, accurately locates key topological anchor entities, constructs anchor entity context packets, and leverages a large language model to achieve cross-platform semantic reasoning and alignment determination. Finally, a confidence propagation algorithm is used to diffuse the alignment results and complete entity and event fusion. This effectively integrates multi-source heterogeneous data, overcomes cross-platform and cross-protocol differences, achieves accurate semantic alignment, and provides high-quality fused data for scenarios such as in-depth understanding of system behavior, mining potential correlations, and improving security analysis, thereby enhancing the value of data utilization and the scientific basis of decision-making.

[0251] Figure 4 This is a flowchart illustrating a network security threat monitoring method according to another embodiment of this application; as shown below. Figure 4 As shown, as an optional implementation, based on any of the above embodiments, a dynamic spatiotemporal heterogeneous graph is constructed based on fused entity relationship data, and the dynamic spatiotemporal heterogeneous graph is updated incrementally in streaming to form a unified security graph, including the following steps:

[0252] S401. Based on the fused entity relationship data, define the heterogeneous nodes of terminal hosts, network services, digital certificates, and network infrastructure, as well as the multiple edge relationships of communication, dependency, affiliation, and co-occurrence, to obtain the graph infrastructure.

[0253] Heterogeneous nodes refer to graph nodes of different types and attributes. In this embodiment, they include terminal hosts, network services, digital certificates, network infrastructure, etc., which are used to comprehensively characterize various entities in cyberspace.

[0254] Among them, multiple edge relationships refer to the various types of edge relationships that may exist between the same pair of nodes. In this embodiment, relationships such as communication, dependency, affiliation, and co-occurrence are included to comprehensively characterize the complex interactions between entities.

[0255] Optionally, based on the fused entity relationship data, heterogeneous nodes and multiple edge relationships are defined to construct the graph infrastructure.

[0256] The definition of heterogeneous nodes specifically includes four core heterogeneous node categories: terminal hosts, network services, digital certificates, and network infrastructure. The definition of terminal hosts includes, but is not limited to, IP address, device type (PC / server / IoT terminal), geographical location, operating system version, device fingerprint, active time period, and inflow / outflow ratio. The definition of network services includes, but is not limited to, domain name, port, protocol type, registration information (registrant, registration time, expiration time), TTL value, domain name length, and character entropy. The definition of digital certificates includes, but is not limited to, certificate serial number hash, issuer, validity period (start time, end time), subject, SAN field, self-signature flag, and certificate fingerprint. The definition of network infrastructure includes, but is not limited to, network infrastructure number, affiliated organization, and network prefix range.

[0257] Specifically, the definition of multiple edge relationships includes defining four core edge relationships: communication, dependency, belonging, and co-occurrence, with the following edge attributes:

[0258] The communication relationships (source node: terminal host / network service, target node: network service / terminal host) include: interaction timestamp sequence, total number of bytes, number of packets, average packet length, protocol type, and connection status. The dependency relationships (source node: network service, target node: digital certificate) include: binding first discovery time, binding confidence level, and certificate verification result. The attribution relationships (source node: terminal host / network service, target node: network infrastructure) include: network prefix information, attribution confirmation time, and attribution confidence level. The co-occurrence relationships (source node: terminal host, target node: terminal host) include: time synchronization, number of co-occurrences, resource similarity, and co-occurrence time window.

[0259] S402. Extract entities and relationships from the network observation data, and instantiate the extraction results into timestamped nodes and edges in the graph infrastructure.

[0260] Optionally, attribute information of entities such as terminal hosts, network services, digital certificates, and network infrastructure is extracted from network observation data, matched with node types in the graph infrastructure, and instantiated as graph nodes, with each node assigned a unique identifier (such as a UUID). Interaction relationships between entities are extracted from the network observation data, matched with edge relationship types in the graph infrastructure, and instantiated as timestamped edges, where the edge timestamp represents the time of the entity interaction, with each edge assigned a unique identifier. The extracted nodes and edges are then used to construct an initial graph structure according to the definition of the graph infrastructure, ensuring that the attributes of nodes and edges are complete and formatted correctly.

[0261] S403. The spatiotemporal companion relationship strength is obtained through quantitative calculation of time synchronization and resource similarity. Spatiotemporal companion edges are established between nodes that meet the preset strength threshold to construct a dynamic spatiotemporal heterogeneous graph.

[0262] Among them, time synchronization refers to the temporal correlation of two entities interacting with the same target. It is used to quantify the strength of the spatiotemporal accompaniment relationship between entities, such as the degree of synchronization of two IPs accessing the same domain name within a similar time period.

[0263] Among them, spatiotemporal companion relationship refers to the implicit association between two entities that do not have direct explicit interaction, but exhibit time synchronization and resource similarity within a preset time window.

[0264] Resource similarity refers to the degree of overlap between the resource sets (such as domain names, certificates, and files) accessed by two entities, and is used to quantify the strength of the spatiotemporal relationship between entities.

[0265] Optionally, the strength of the spatiotemporal association relationship is obtained through quantitative calculation of time synchronization and resource similarity. Spatiotemporal association edges are established between nodes that meet a preset strength threshold. Specifically, this includes: for any two terminal host nodes a and b, calculating their temporal correlation with the same target (such as the same domain name or the same IP address), and using the Dynamic Time Warping (DTW) algorithm to calculate the temporal sequence similarity to obtain the time synchronization Syn(Ta,Tb), with a value range of [0,1]. The closer the value is to 1, the stronger the time synchronization. Next, the Jaccard similarity coefficients of nodes a and b accessing resource sets (domain names, certificates, files) within a preset time window (such as 1 hour) are calculated to obtain the resource similarity Sim(Ra,Rb), with a value range of [0,1]. The closer the value is to 1, the stronger the resource similarity.

[0266] Alternatively, using a weighted summation formula Calculate the spatiotemporal association strength, where α and β are adjustable weight parameters (e.g., α=0.5, β=0.5), and w ranges from [0,1]. Set a spatiotemporal association strength threshold (e.g., 0.7). When w ≥ the spatiotemporal association strength threshold, establish a spatiotemporal association edge between nodes a and b. The edge attributes include time synchronization Syn(Ta,Tb), resource similarity Sim(Ra,Rb), spatiotemporal association strength wab, and establishment timestamp.

[0267] Among them, the dynamic time warping algorithm is an algorithm used to compare the similarity of two time series sequences. It can handle situations where the lengths of the time series sequences are inconsistent or the phases are offset, and is used to calculate the time synchronization of entity behavior.

[0268] The Jaccard similarity coefficient is an index used to calculate the similarity between two sets, specifically the similarity of how entities access resources.

[0269] S404. Maintain the last active timestamp for each entity and relationship in the dynamic spatiotemporal heterogeneous graph.

[0270] The Last Active Timestamp refers to the latest interaction time of an entity or relationship in the graph. It is used to manage the lifecycle of entities and relationships, such as the last network connection time of an IP address or the last data transmission time of a communication relationship.

[0271] Optionally, when an entity undergoes a new interaction (such as a terminal host initiating a new network connection or a network service receiving a new request), the entity's last active timestamp is updated to the current time; when a relationship undergoes a new interaction (such as a communication relationship transmitting new data or a co-occurrence relationship adding a new co-occurrence count), the relationship's last active timestamp is updated to the current time. The last active timestamp of each entity and relationship is stored in its corresponding attribute field, supporting fast querying and updating.

[0272] S405. Entities and associated edges that have not been updated with the last active timestamp beyond the preset window are aged out and removed. The attributes of continuously active entities are updated in a rolling manner to complete the streaming incremental update and form a unified security graph.

[0273] Optionally, the dynamic spatiotemporal heterogeneous graph is updated incrementally in a streaming manner according to a sliding time window (e.g., 10 minutes). Specifically, this includes setting an aging time threshold (e.g., 24 hours) and aging out and removing entities and associated edges that have exceeded the preset aging time threshold and have not updated their last active timestamp. The specific logic is as follows: with a sliding time window of 10 minutes, after processing the graph data for each window, an aging check is triggered. All entities (terminal hosts, network services, digital certificates, etc.) and relationships (communication, dependency, spatiotemporal association, etc.) in the dynamic spatiotemporal heterogeneous graph are traversed, their last active timestamps are extracted, and the difference between the timestamp and the current system time is calculated. If the difference is ≥ 24 hours, it is determined to be an "expired entity / relationship" and is completely removed from the graph structure. At the same time, the corresponding storage index is cleaned up to avoid invalid data occupying computing resources and storage space, and to maintain the lightweight and timeliness of the graph structure.

[0274] Optionally, the attributes of continuously active entities are updated on a rolling basis, using an Exponentially Weighted Moving Average (EWMA) algorithm to smoothly reflect the latest state of the entity. By calculating and updating the rolling average using the EWMA algorithm, it is ensured that the entity attributes can keep up with its actual operating state in real time, avoiding feature lag caused by static attributes.

[0275] Among them, Exponentially Weighted Moving Average (EWMA) is a method used to smooth time series data, giving higher weight to recent data and updating the attributes of continuously active entities, such as updating the CPU usage attribute of a process entity based on recent CPU usage.

[0276] Optionally, the system continuously receives preprocessed fused entity relationship data and extracts entities and relationships from the new data in real time. If the extracted entity is an existing, continuously active entity in the graph (with its last active timestamp not expired), only its attributes (through the aforementioned rolling update mechanism) and last active timestamp are updated to the current time. If the extracted entity is a new entity (without a corresponding unique identifier in the graph), it is instantiated as a new node with the current timestamp according to the definition of the graph's basic structure. At the same time, its association is extracted, instantiated as a new edge with the current timestamp, and added to the dynamic spatiotemporal heterogeneous graph. For newly extracted relationships, if the associated entity already exists and has not expired, the relationship is directly added and the last active timestamp of the associated entity is updated. If the associated entity has expired, the entity is restored first (by updating the last active timestamp) before the relationship is added.

[0277] This application provides a network security threat monitoring method that constructs a dynamic spatiotemporal heterogeneous graph based on fused entity relationship data. It clearly defines heterogeneous nodes and multiple edge relationships to lay the foundation for the graph. By extracting and instantiating entities and relationships and incorporating the time dimension, it quantifies spatiotemporal accompanying relationships to enhance the graph's dynamism. A streaming incremental update mechanism utilizes the last active timestamp to promptly age and remove outdated entities and edges, and continuously updates the attributes of active entities. This ensures that the unified security graph can reflect the security situation in real time and accurately, providing comprehensive, dynamic, and accurate data support for security monitoring, risk warning, and decision-making, thereby improving the timeliness and accuracy of security management.

[0278] As an optional implementation, based on any of the above embodiments, a unified security graph is used as input, and threat detection is performed through a graph neural network and a spatiotemporal association model to obtain threat detection results, including:

[0279] First, the unified security graph is used as input, and the structure of the unified security graph is encoded through a heterogeneous graph attention network to learn the low-dimensional vector representation of each node.

[0280] Among them, the heterogeneous graph attention network is a variant of the graph neural network. It introduces a relation-aware attention mechanism, which can encode differentiated features of heterogeneous nodes (such as terminal hosts and network services) and edge relationships (such as communication and spatiotemporal association), adapt to the heterogeneous characteristics of the unified security graph, and accurately capture the importance weights of different types of entities / relationships.

[0281] Optionally, the unified security graph is input into a heterogeneous graph attention network (HGAT). Based on a relation-aware attention mechanism, heterogeneous nodes (terminal hosts, network services, etc.) and edge relationships (communication, spatiotemporal association, etc.) in the graph are differentially encoded. For each node, its attention coefficients with different types of neighboring nodes are calculated, and neighbor features and its own attributes are weighted and aggregated to generate a low-dimensional, dense node embedding vector, which integrates the node's own characteristics with the graph structure context information.

[0282] Specifically, for the target node and its neighboring nodes with relationship type r , The attention coefficient represents the set of all neighboring nodes of target node i under relation type r. The calculation is as follows:

[0283]

[0284] in, For the initial features of the nodes, the denominator contains pairs of features. Summation, Representing neighboring nodes The initial eigenvectors. For relationship A unique learnable transformation matrix enables relation-specific mapping. This is an attention vector specific to the relationship. This is the LeakyReLU activation function. This represents a vector concatenation operation. The above formula achieves softmax normalization through exp and summation, mapping the original attention score to the [0,1] interval, so that the sum of the attention coefficients of all neighboring nodes of node i under relation type r is 1, which is used for subsequent weighted aggregation of neighbor features.

[0285] node Update Embedded This is obtained by aggregating neighbor information for all relationship types:

[0286]

[0287] in, For the set of all relation types, This indicates a vector concatenation operation.

[0288] Secondly, the explicit logical relationships and spatiotemporal companion relationships in the unified security graph are deeply mined through the dual-path analysis layer. The dual-path analysis layer includes explicit logical relationship paths and spatiotemporal companion relationship paths. The explicit logical relationship paths handle communication, dependency, and attribution relationships, while the spatiotemporal companion relationship paths analyze time synchronization and network topology proximity.

[0289] The dual-pathway analysis layer includes model components for explicit logical relationship paths and spatiotemporal accompanying relationship paths, which respectively mine explicit interaction logic and implicit collaborative behavior in the graph, achieving decoupling and in-depth mining of multi-dimensional features.

[0290] Among them, the explicit logical relationship path is a model path that handles direct interactive relationships such as communication, dependency, and affiliation. It captures the functional structure of the network (such as the interaction link between the client and the server) by stacking graph convolutional networks (GCN).

[0291] Among them, the spatio-temporal co-occurrence relationship path is a model path specifically for analyzing spatio-temporal co-occurrence edges. It integrates the Spatio-Temporal Co-occurrence Graph Convolution Module (STC-GCM) and the One-Dimensional Temporal Convolutional Network (1D-TCN) to extract the temporal synchronization patterns and resource association features between entities and characterize collaborative attack behavior.

[0292] Optionally, on subgraphs composed of explicit relationships such as communication, dependency, and affiliation, stacked 3-5 layers of graph convolutional networks (GCNs) are used for message passing to capture functional interaction logic between entities (such as the normal access link of "terminal host - network service") and output explicit feature vectors. For subgraphs composed of spatiotemporally associated edges, the spatiotemporally associated graph convolutional module (STC-GCM) is used to perceive the strength of associated relationships and aggregate collaborative behavior features; then, the timestamp sequence in the edge attributes is input into a one-dimensional temporal convolutional network (1D-TCN) to extract time synchronization patterns (such as the temporal features of synchronous access to malicious resources) and output spatiotemporally associated feature vectors.

[0293] Next, the dual-path analysis results are adaptively integrated using a context-based gating fusion module to generate node fusion features.

[0294] The gated fusion module is a context-aware feature fusion component that dynamically allocates fusion weights based on the local graph context of a node (such as degree centrality and subgraph density), achieving adaptive integration of dual-path features and avoiding the limitations of a single feature dimension. The difference between the context-based gated fusion module in this application and a conventional gated fusion module is that it introduces local graph context features of the node to participate in the fusion weight allocation; the specific feature dimensions of the context are the node's degree centrality, the density of its subgraph, and the node's threat score; the core algorithm is dynamic weight calculation based on the sigmoid activation function.

[0295] Optionally, the gated fusion module receives the explicit feature vector and spatiotemporal associated feature vector of a node, and simultaneously inputs the local graph context information of the node (such as degree centrality and the density of its subgraph). Dynamic fusion weights are generated using the sigmoid activation function, and the dual-path features are weighted and summed to generate node fusion features, highlighting key feature dimensions while avoiding feature redundancy.

[0296] Finally, based on node fusion features, a multi-task learning head is used to complete node-level and graph-level threat detection, and output threat detection results including node threat scores and graph-level collaborative threat identifiers.

[0297] Among them, the multi-task learning head is the output layer component of the model, which can simultaneously complete two types of related task inferences: node-level and graph-level, taking into account both single-point threat identification and group threat determination.

[0298] Among them, the node threat score is a quantitative indicator ranging from 0 to 1. The higher the score, the stronger the threat of a single entity (such as an IP address or domain name), and it is used to determine the malicious attributes of a single point. The graph-level collaborative threat identifier is used to indicate whether a subgraph constitutes a group threat (such as a botnet), enabling the overall identification of collaborative attack behaviors.

[0299] Optionally, the node fusion features are input into a multilayer perceptron (MLP) to output a threat score (0-1) for each node, determining the threat attributes of a single entity (such as whether the IP is a botnet or the domain name is a phishing domain).

[0300] Optionally, the node fusion features are globally aggregated through self-attention pooling to obtain the global representation vector of the subgraph; the global vector is input into the MLP for classification, and the graph-level collaborative threat identifier (such as whether it is a fraud gang) is output.

[0301] Optionally, node threat scores, graph-level collaborative threat identifiers, and key evidence (such as associated malicious subgraph structures and abnormal behavior feature sequences) can be integrated to form standardized threat detection results, including threat type, confidence level, list of involved entities, and evidence summary.

[0302] This application provides a network security threat monitoring method that takes a unified security graph as input and utilizes a heterogeneous graph attention network to achieve efficient structural encoding, obtaining low-dimensional vector representations of nodes to lay the foundation for subsequent analysis. A dual-path analysis layer deeply mines explicit logic and spatiotemporal relationships to comprehensively capture security information. A context-based gating fusion module adaptively integrates the analysis results to generate more representative node fusion features. Finally, a multi-task learning head is used to complete node-level and graph-level threat detection, outputting multi-dimensional threat detection results. Thus, by fully integrating multi-source information, the comprehensiveness and accuracy of threat detection are improved, which helps to promptly discover potential security threats and provides strong support for security protection.

[0303] As an optional implementation, based on any of the above embodiments, threat attribution and family merging are performed using adversarial resilient embedding and reinforcement learning mechanisms based on threat detection results to obtain threat family merging results and attribution information, including the following steps:

[0304] First, suspicious threat subgraphs are extracted from the unified security graph based on threat detection results.

[0305] Optionally, based on the threat detection results, high-threat scoring nodes and related edges are screened from the unified security graph, and suspicious threat subgraphs containing attack behavior logic are extracted. The subgraphs contain entity nodes, relational edges, and corresponding attributes (timestamps, interaction strength, etc.). The extracted subgraphs are preprocessed to remove irrelevant nodes and redundant edges, retaining the main attack links, such as the association structure of "terminal host - malicious domain name - digital certificate".

[0306] Secondly, structural and temporal noise is applied to the suspected threat subgraph to generate adversarial examples.

[0307] Among them, adversarial samples are samples generated by applying structural (such as inserting irrelevant nodes or deleting edge edges) or temporal (such as timing jitter or segmented transmission) noise to suspicious threat subgraphs. They are used to simulate attackers' evasion methods and improve the model's anti-interference ability.

[0308] Optionally, an automated adversarial generator is constructed to apply structural and temporal noise to the suspected threat subgraph. Structural noise includes inserting transit nodes, deleting non-core edges, and modifying edge relationship types; temporal noise includes temporal jitter (offsetting timestamps), segmented transmission (splitting continuous interactions into multiple segments), and periodic masquerading (mimicking normal interaction cycles). Multiple adversarial samples with structural / temporal perturbations but unchanged threat semantics are generated, quantifying the maximum perturbation boundary of the threat family and providing a basis for subsequent resilient embedding.

[0309] Subsequently, an order-preserving contrastive learning strategy was adopted to construct an embedding space with a dynamic tolerance radius, which was used to map the suspected threat subgraph and adversarial examples to the embedding space and extract homologous features.

[0310] Among them, order-preserving contrastive learning is a type of contrastive learning strategy. Its core is to constrain the embedding vectors of the original suspected threat subgraph and adversarial sample within a preset dynamic tolerance radius, while pushing the embedding vectors of non-homologous subgraphs outside the safety boundary to ensure the robustness and discriminability of the embedding features.

[0311] Among them, the dynamic tolerance radius is an elastic boundary in the embedding space that adapts to the characteristics of threat families. The calculation dimension is the cosine similarity dimension of the embedding vector. It can be dynamically adjusted according to the degree of structural variation of the threat family to ensure that subgraphs that are of the same origin but have structural perturbations can still be accurately merged.

[0312] Optionally, an order-preserving contrastive learning strategy is employed to construct an embedding space with a dynamic tolerance radius. Suspicious threat subgraphs and adversarial example input graphs are embedded into the model to learn robust embedding representations of homologous subgraphs. The optimization objective is that the embedding vector distance between homologous subgraphs (original subgraph and adversarial example) is ≤ dynamic tolerance radius, and the embedding vector distance between non-homologous subgraphs is ≥ security boundary, ensuring the discriminativeness and robustness of the embedded features.

[0313] Optionally, an embedding space with a dynamic tolerance radius is constructed using an order-preserving contrastive learning strategy, and the retrieval parameters are dynamically adjusted by a reinforcement learning agent. This also includes the following specific implementation: Specifically, for the suspected threat subgraph... Compared with reference threat patterns The constraints for elastic embedding are as follows:

[0314]

[0315] in, For graph embedding mapping functions, The dynamic tolerance radius is based on threat family characteristics, ensuring that the embedding vectors of subgraphs with the same origin but structural perturbations remain within a controllable range.

[0316] In the adversarial example generation process, perturbation operators (node ​​insertion, edge deletion, time jitter, relation weakening) are applied to the original subgraph G through the adversarial generator A to generate adversarial examples G′=A(G,ε), where ε is the perturbation strength parameter. For each threat family f, the maximum drift in its embedding space is statistically analyzed offline. We obtain the upper bound of the perturbation Δmax(f), which is used for subsequent index boundary expansion.

[0317] Specifically, the optimization objective of the positive sample pair (original sample G and adversarial sample G′) as follows:

[0318]

[0319] in, To determine the tolerance radius of the threat family f, the goal is to constrain the embedding distance of positive sample pairs to within a certain range. Within; the optimization goal of negative sample pairs (non-homologous samples) is to push their embedding distance outside the safe boundary to ensure the discriminative power of the feature space.

[0320] Next, through a two-stage retrieval process of rapid range recall and dynamic radius, family merging analysis was performed on homologous features to obtain threat family merging results.

[0321] Among them, the two-stage retrieval is a retrieval mode of "rapid range recall and dynamic radius fine detection". First, the candidate threat families are quickly identified by expanding the minimum bounding box index, and then precise matching is performed based on the dynamic tolerance radius, which takes into account both retrieval efficiency and accuracy.

[0322] Optionally, the embedding index boundary of the threat family is pre-expanded using a preset maximum perturbation boundary, and candidate threat families that are homologous to the suspicious subgraph are quickly identified by the minimum bounding rectangle (MBR) index.

[0323] Optionally, based on the dynamic tolerance radius, the candidate families are precisely matched, the similarity between the suspicious subgraph and the candidate family embedding vector is calculated, and the candidate families with similarity ≥ similarity threshold are identified as homologous families, thus obtaining the threat family merging result (including family identifier, member entities, and common attack features).

[0324] Finally, by combining the reinforcement learning agent with the dynamic adjustment of the retrieval parameters of the two-stage retrieval based on the detection feedback, the merged threat family is subjected to subgraph source tracing analysis to obtain source tracing information including attack paths, core entities, and threat patterns.

[0325] Among them, the reinforcement learning agent is an intelligent module with environmental perception and parameter adjustment capabilities. It can dynamically optimize the key parameters of the two-stage retrieval (such as the tolerance radius coefficient and the precision detection budget) based on the detection feedback (false alarm rate, false negative rate, and computational cost) to achieve a dynamic balance between detection accuracy and computational efficiency.

[0326] The attack path is the propagation link of a threat in cyberspace, such as "malicious APP → terminal host → C2 server", which includes the entity interaction relationship and time sequence of each link.

[0327] Among them, core entities are those that play a key role in the threat family, such as the master control C2 server and core malicious domains, and are the core targets for threat tracing and crackdown.

[0328] Among them, threat patterns are typical attack characteristics of threat families (such as communication protocols, vulnerability exploitation methods, and payload transmission paths), used to characterize the inherent attack logic of the family.

[0329] Optionally, the key parameters of the two-stage retrieval (such as the tolerance radius coefficient and the precision detection budget) can be dynamically adjusted by real-time monitoring of detection feedback data, including false alarm rate, false negative rate, and retrieval time, through a reinforcement learning agent. Optionally, when the false alarm rate is too high, the dynamic tolerance radius is reduced; when the false negative rate is too high, the dynamic tolerance radius is expanded; when the retrieval time exceeds the limit, the precision detection budget is optimized to balance detection accuracy and computational efficiency.

[0330] Optionally, based on the merged threat families, in-depth source tracing is performed on suspicious threat subgraphs to uncover attack paths, such as the complete chain of "malicious sample delivery → endpoint infection → C2 communication → data theft". Core entities of the threat families (such as master C2 servers and key malicious domains) are identified, and threat patterns (such as communication protocol types, vulnerability exploitation methods, and payload characteristics) are summarized to form source tracing information including attack paths, core entities, and threat patterns.

[0331] This application provides a network security threat monitoring method. Based on threat detection results, it first extracts suspicious threat subgraphs and generates adversarial examples. Then, it utilizes order-preserving contrastive learning to construct a dynamic embedding space to extract homogeneous features. A two-stage retrieval process is used to merge threat families, and finally, a reinforcement learning agent is combined to dynamically adjust parameters for source tracing analysis. Thus, by introducing adversarial examples to enhance model robustness, the dynamic embedding space to improve feature extraction accuracy, and the combination of two-stage retrieval and reinforcement learning to optimize the family merging and source tracing analysis process, it can more accurately locate threat sources and merge threat families, providing comprehensive and reliable information support for security defense.

[0332] As an optional implementation, based on any of the above embodiments, and based on detection results, threat family merging results, and source tracing information, a structured disposal suggestion is generated through a metagraph-based mechanism, including the following steps:

[0333] First, based on the detection results, threat family merging results, and source tracing information, key subgraphs, event sequences, and hit indicators of the threat context are extracted to construct a standardized threat context.

[0334] Optionally, threat detection results, threat family merging results, and source tracing information are integrated to extract key threat sub-graphs (attack chains), event sequences (attack behaviors sorted by timestamps), and hit indicators (such as triggered detection rules and abnormal features). Then, redundant information is removed, and entity identifiers (such as unified IP and domain name formats) and event descriptions (according to preset template specifications) are standardized to construct a standardized threat context, providing clear input for generating remediation recommendations.

[0335] Secondly, a metagraph structure is defined at the graph pattern layer, and defense knowledge is abstracted into disposal suggestion nodes. Based on the standardized threat context, the large language model is driven to generate an initial disposal suggestion draft.

[0336] Metagraph is an abstract structure that graphs defense knowledge, containing defense elements such as disposal suggestion nodes, evidence packages, and approval strategies, as well as relationships such as combination, dependency, and mutual exclusion between elements. It is the basic framework for generating structured disposal suggestions.

[0337] Among them, the disposal suggestion node is the core entity in the metagraph, which carries atomic defense actions (such as blocking IPs and issuing detection rules). Its attributes include suggestion ID, type, target object, risk level, applicable time window, triggering conditions, etc.

[0338] The standardized threat context is a standardized data structure built based on threat detection results, family merging results, and source tracing information. It includes information such as key threat subgraphs, event sequences, hit indicators, and core entities, providing a complete background for generating handling recommendations.

[0339] Optionally, a metagraph structure is defined at the graph pattern layer, abstracting defense knowledge (such as blocking IPs and revoking certificates) into disposal suggestion nodes, and clarifying the node attributes and types (such as blocking, detection, and early warning). Standardized threat context is input into the large language model, and combined with predefined disposal suggestion templates (including execution actions, applicable scenarios, and format requirements), an initial disposal suggestion draft is generated, including suggestion type, target object, and preliminary execution plan.

[0340] Next, the relationships of combination, dependency, mutual exclusion, and escalation between the disposal suggestion nodes are defined, and the initial disposal suggestion draft is dynamically arranged into an initial disposal plan chain.

[0341] The initial response proposal is a preliminary response plan generated by the large language model based on standardized threat context, which includes specific defensive actions, scope of application, and implementation methods.

[0342] Among them, the disposal plan chain refers to the orderly disposal process formed by dynamically arranging the initial disposal proposal draft according to relationships such as dependence, mutual exclusion, and escalation, to ensure the rationality and feasibility of the disposal proposal, such as "observation before blocking" and "gray-scale testing before full network coverage".

[0343] Optionally, define the constraints between the suggested nodes, such as combination dependencies (e.g., "observe first, then block"), mutual exclusion (e.g., "blocking IPs and allowing IPs cannot be executed simultaneously"), escalation relationships (e.g., "gray-scale blocking → full network blocking"), and priority relationships (e.g., "blocking core C2 servers takes precedence over blocking secondary domains").

[0344] Optionally, based on the constraints, the draft initial handling recommendations can be dynamically arranged, conflicting recommendations can be eliminated, dependent recommendations can be added, and an orderly initial handling plan chain can be formed to avoid confusion and collateral damage in handling actions.

[0345] Subsequently, historical attack chain patterns and cross-domain spatiotemporal accompanying patterns are studied, and combined with the family characteristics and source information of the current threat, the development path and key attack links of the current threat are predicted.

[0346] Optionally, offline learning of historical attack chain patterns and cross-domain spatiotemporal accompanying patterns can be used to construct a path prediction model for threat families, clarifying the typical development trajectory of different threat types, such as "phishing domain access → malicious sample download → terminal infection → C2 communication". Combining the family characteristics and source tracing information of the current threat, a time-series prediction algorithm (such as Long Short-Term Memory network) is used to predict the subsequent development path and key attack links of the current threat, and the prediction results (including confidence level and expected occurrence time window) are output.

[0347] Subsequently, based on the initial handling plan link, corresponding handling suggestion nodes are pre-attached to the key attack links of the predicted path to obtain the target handling plan link; among them, the pre-attached handling suggestion nodes are associated with preset trigger conditions and expected effective time windows.

[0348] Among them, pre-mounting involves binding the suggested handling node to the key links of the predicted attack path in advance, and placing it in a "waiting to be triggered" state. When the predicted behavior is detected, it is activated immediately, thus moving the defense forward.

[0349] Optionally, based on the predicted threat development path, virtual nodes are generated at key attack stages, and directed edges (with attributes including confidence and expected time window) are established between the current end-of-attack entity and the virtual nodes. The metagraph structure is queried to match the corresponding action suggestion node for the virtual node, which is then pre-attached to the virtual node, set to "pending trigger", and associated with preset trigger conditions (such as detecting the attack behavior corresponding to the virtual node) and the expected effective time window.

[0350] Finally, the target disposal plan chain is linked with the corresponding evidence package and approval strategy to form a structured disposal recommendation that includes execution priority, scope of application, potential impact and rollback mechanism.

[0351] The evidence package is a standardized data unit containing key evidence for threat detection. Its attributes include indicator sets, evidence citation keys, and associated event / entity IDs, which are used to ensure the interpretability and auditability of the handling recommendations.

[0352] The approval strategy is a set of rules that define the execution process of handling recommendations, including approval level (automatic / semi-automatic / manual), co-signing parties, rollback strategy, etc., which are adapted to the actual security operation process.

[0353] Optionally, the initial handling plan chain is integrated with the pre-attached handling suggestion nodes to form the target handling plan chain, clarifying the execution order, triggering conditions, and effective time window of each handling suggestion. Each handling suggestion is associated with a corresponding evidence package (including hit indicators and core evidence citations) and approval strategy (including approval level, co-signing parties, and rollback strategy), supplementing information such as execution priority, scope of application, potential impact, and cost of accidental damage, ultimately forming a structured handling suggestion.

[0354] This application provides a network security threat monitoring method that integrates detection results, threat family merging, and attribution information. First, it constructs a standardized threat context. Then, using a metagraph structure and a large language model, it generates an initial draft of handling suggestions and arranges them into an initial chain. Next, it predicts threat development paths by learning historical patterns, pre-attaches handling suggestion nodes at key stages to form a target chain, and finally, it associates evidence packages and approval strategies to generate structured handling suggestions. This allows for accurate understanding of the threat landscape, generating targeted, comprehensive, and flexible handling solutions, effectively improving the efficiency and quality of security incident response, and reducing potential risks and losses.

[0355] As an optional implementation, based on any of the above embodiments, displaying the handling suggestions and threat detection results includes the following steps:

[0356] First, the threat detection results are aggregated, deduplicated, and correlated to generate interpretable alert events with accompanying contextual information, attack chain stage annotations, and confidence scores.

[0357] Among them, interpretable alert events are standardized alerts generated after aggregating, deduplicating, and correlating threat detection results. They include contextual information (such as attack scenarios and involved entities), attack chain stage annotations (such as delivery, exploitation, and C2 communication), confidence scores, and key evidence summaries, thus solving the problem of fragmented traditional alert information.

[0358] Optionally, the threat detection results can be aggregated, and duplicate alerts can be merged according to the attack chain stage, involved entities, threat type, etc., and related alerts can be associated, such as multiple single-point alerts of the same threat family.

[0359] Optionally, each alarm event can be supplemented with contextual information (such as the network area where the attack occurred and the business systems involved), attack chain stage labeling (determined based on source tracing information), confidence score (taken from threat detection results), and key evidence summary (such as abnormal behavior characteristics and associated malicious subgraphs) to generate an interpretable alarm event.

[0360] Secondly, a multi-view visualization dashboard displays the overall threat landscape, threat distribution, and attack chain map, and an interactive browser enables dynamic exploration and drilling into the unified security map.

[0361] Among them, the multi-view visualization dashboard is a visual interface for displaying the overall threat situation. It supports presenting data from multiple perspectives, such as threat distribution, attack family activity, attack chain model, and protocol distribution, and intuitively reflects the network security status.

[0362] Among them, the interactive graph browser is a tool that supports dynamic exploration and drill-down of the unified security graph. It can filter subgraphs by entities (such as IP, domain name), relationships (such as communication, spatiotemporal accompaniment), time windows and other conditions, and display complex relationship paths between entities to assist security operations personnel in making judgments.

[0363] Optionally, a multi-view visualization dashboard can be used to display the distribution of threat hotspots (the number of threats is counted by geographical location and network area), the activity trend of attack families (the number of alarms for each family is counted by time dimension), the distribution of protocols across the network (the traffic share and threat share are counted by protocol type), and the attack chain model (visually displaying the alarm distribution and flow relationship of each attack stage).

[0364] Optionally, through an interactive graph browser, security operations personnel can view the entities, relationships, and time series associated with an entity (such as entering a suspicious IP), drill down into the details of the attack chain (such as communication time and data transmission volume), and transform hidden relationships into a visible attack storyline.

[0365] Finally, the handling recommendations are linked with the explainable alarm events, displaying the scope of application, execution priority, and potential impact of the handling recommendations.

[0366] Among them, the associated display is a way to link explainable alarm events with structured handling suggestions one by one, so that security operations personnel can directly obtain the corresponding defense solutions while viewing alarms, thus shortening response time.

[0367] Optionally, structured handling suggestions can be associated with one-to-one interpretable alarm events. While displaying the details of the alarm event, the corresponding handling suggestion information can be displayed simultaneously, including execution priority (high / medium / low), applicable scope (such as specific network area, business system), potential impact (such as normal users who may be affected, business availability), triggering conditions (such as meeting a certain attack stage, detection confidence ≥ threshold), and rollback mechanism (such as recovery steps after false triggering).

[0368] Optionally, a one-click triggering function is provided, allowing security operations personnel to directly trigger handling suggestions (such as one-click blocking of malicious IPs) through the interface. The handling suggestions are directly connected to execution nodes such as firewalls, WAFs, and endpoint protection (EDR) to achieve rapid connection from alarm to handling. At the same time, the handling operation log is recorded, such as the personnel, time, and results, supporting the traceability of the operation process.

[0369] This application provides a network security threat monitoring method. First, it performs in-depth processing on threat detection results to generate interpretable alert events, allowing security personnel to clearly understand the threat situation. Then, it utilizes a multi-view visualization dashboard and an interactive browser to intuitively present the overall threat landscape and support dynamic exploration, improving information acquisition efficiency. Finally, it links handling recommendations with alert events, clearly presenting key information such as the scope of application to assist security personnel in making quick and accurate decisions. This method enhances the readability and operability of threat information, effectively improving security response capabilities and the scientific nature of decision-making.

[0370] As an optional implementation, based on any of the above embodiments, the following steps are also included:

[0371] First, we monitor the changes in prediction confidence of graph neural networks and spatiotemporally associated models in real time, and perceive the conceptual drift of network traffic characteristic distribution by calculating the moving average and standard deviation of prediction entropy.

[0372] Concept drift refers to the phenomenon that network traffic characteristics change continuously and dynamically due to the emergence of new attack methods, upgrades to encryption protocols, or changes in network services. It is the main reason for the failure of traditional static detection models.

[0373] Among them, prediction entropy refers to the uncertainty measure of the model's prediction results. The higher the prediction entropy, the greater the uncertainty of the model's prediction of the current data. It is an indicator of perceptual concept drift.

[0374] Optionally, the changes in prediction confidence of the graph neural network and the spatiotemporal association model are monitored in real time, and the moving average (e.g., a sliding time window of 1 hour) and standard deviation of the prediction entropy are calculated to construct a concept drift monitoring index. A historical baseline is set (e.g., the mean and standard deviation of the prediction entropy during the model's stable operation period). If, within the current window, the mean of the prediction entropy continuously increases by more than a threshold (e.g., an increase of 30%) compared to the historical baseline, and the standard deviation also increases (e.g., an increase of 20%), a potential concept drift is determined to have occurred.

[0375] Secondly, when a conceptual shift in the distribution of network traffic features is detected, a meta-learner is used to perform rapid gradient updates on the graph neural network and the spatiotemporal associated model to generate temporary adaptation parameters.

[0376] Among them, the meta-learner is a learning module based on the Model-Agnostic Meta-Learning (MAML) architecture, which enables the base model to quickly adapt to new tasks (such as identifying new threats) with a small number of samples, and achieves rapid gradient updates of model parameters.

[0377] Optionally, when concept drift is detected, recent high-confidence anomalous and normal samples are collected to construct a small support set (e.g., 100-500 samples). These samples include graph snapshots and ground truth labels (malicious / normal). The support set is then input into a meta-learner, which, based on a model-agnostic meta-learning (MAML) architecture, performs rapid gradient updates (e.g., 1-3 steps of gradient descent) on the graph neural network and the spatiotemporal association model, generating temporary adaptation parameters to enable the model to quickly adapt to new threat features.

[0378] Finally, the temporary adaptation parameters are jointly trained with the example data of the historical threat pattern library, and the incremental update of the graph neural network and spatiotemporal association model is completed by combining knowledge distillation technology.

[0379] Among them, the example library is a structured database that stores representative graph patterns of historical threats. The storage units include graph-level embedding vectors, the original predicted probability distribution of the model, and the extracted prototype graph key substructures, which are used to avoid forgetting previously learned old features when the model is learning incrementally.

[0380] Knowledge distillation is a technique that transfers knowledge from an old model to a new model. By having the new model fit the prediction results of the old model, it ensures that the model does not forget the old threat features it has already mastered when learning new features.

[0381] Incremental update involves updating model parameters through joint training with a small number of new samples and historical example data without full retraining, thus balancing the learning of new features with the memorization of old features.

[0382] Optionally, temporary adaptation parameters are jointly trained with example data from a historical threat pattern library to construct an incremental training dataset, with new samples accounting for 20%-30% and example library samples accounting for 70%-80%. Knowledge distillation is introduced, allowing the model to learn new sample features while simultaneously fitting the prediction results (soft labels) of old threat samples in the example library, balancing new feature learning with old feature memorization. A gradient descent optimizer (such as AdamW) is used for training, monitoring the model's performance on both the old and new threat sample sets during training to ensure that the model's detection accuracy for both new and old threats meets requirements. After training, the features of new threat patterns are extracted into graph-level embedding vectors, prototype graph key substructures, etc., and updated to the example library to achieve knowledge consolidation and iteration, effectively overcoming forgetting. The updated model parameters are then deployed online, replacing the original model, completing the incremental update of the detection model and ensuring its long-term effectiveness in dynamic adversarial environments.

[0383] This application provides a network security threat monitoring method that, by real-time monitoring of model prediction confidence changes and calculating prediction entropy-related indicators, can keenly perceive conceptual drift in network traffic characteristic distribution and promptly capture the impact of dynamic data changes on the model. When conceptual drift is detected, a meta-learner is used to quickly update the model with gradients to generate temporary adaptation parameters, allowing the model to rapidly adapt to new data features. Furthermore, incremental updates are performed using historical threat pattern example databases and knowledge distillation techniques, which not only fully utilize historical knowledge but also effectively improve the model's generalization ability to new features. This ensures that the model maintains high threat detection accuracy and stability under different network environments, enhancing the adaptability and reliability of the entire security system.

[0384] Figure 5 This application provides a schematic diagram of the structure of a network security threat monitoring system according to an embodiment of the present application. Figure 5 As shown, the network security threat monitoring system provided in this embodiment is located in an electronic device. The network security threat monitoring system 50 provided in this embodiment includes: a data collection module 51, a data processing module 52, an entity relationship standardization module 53, a cross-domain semantic alignment module 54, a security graph construction module 55, a threat collaborative detection module 56, a threat tracing and merging module 57, a handling suggestion generation module 58, and a monitoring result display module 59.

[0385] Specifically, the data collection module 51 is used to acquire multimodal raw data collected and uploaded by the mobile application side, terminal host side, and network side; the data processing module 52 is used to parse, extract features, and refine the multimodal raw data to obtain structured and semantic information elements; the entity relationship standardization module 53 is used to standardize and generalize the information elements based on a preset network security threat analysis ontology architecture to obtain standardized entity relationship data; the cross-domain semantic alignment module 54 is used to achieve cross-platform and cross-protocol data semantic alignment based on the standardized entity relationship data through a topology-guided sparse anchor alignment mechanism to obtain semantically aligned fused entity relationship data; and the security graph construction module 55 is used to construct the security graph based on the fused entity relationship data. The system constructs a dynamic spatiotemporal heterogeneous graph from relational data and performs streaming incremental updates on the graph to form a unified security map. A threat collaborative detection module 56 takes the unified security map as input and performs threat detection using a graph neural network and a spatiotemporal association model to obtain the detection results. A threat attribution and merging module 57 performs threat attribution and family merging based on the threat detection results using adversarial elastic embedding and reinforcement learning mechanisms to obtain threat family merging results and attribution information. A disposal suggestion generation module 58 generates structured disposal suggestions based on the detection results, threat family merging results, and attribution information using a metagraph-based mechanism. A monitoring result display module 59 displays the disposal suggestions and threat detection results.

[0386] Optionally, the data processing module 52, when parsing, extracting features, and refining multimodal raw data, specifically performs the following: reverse engineering and runtime behavior monitoring of the raw data on the mobile application side, extracting static and dynamic behavior features, and extracting the background communication address by penetrating code obfuscation and string encryption concealment methods; fine-grained parsing of the raw data on the terminal host side for processes, files, and network connections, extracting host behavior features and entity association information; and full traffic capture and layer-by-layer protocol parsing of the raw data on the network side, completing session reassembly and extracting network connection metadata, protocol features, and payload association information.

[0387] Optionally, the data processing module 52, when performing reverse engineering analysis and runtime behavior monitoring on the raw data of the mobile application side, extracting static and dynamic behavioral features, and extracting the background communication address by penetrating code obfuscation and string encryption concealment methods, specifically performs the following: structural analysis and reverse engineering of the mobile application installation package to extract static features; wherein, the static features include application components, permission lists, and control flow graphs; running the mobile application in a controlled environment, monitoring and recording the runtime dynamic behavioral features of the mobile application; constructing a dedicated removal rule base based on the threat application family characteristics and code homology analysis results, and locating the network request initiation point and configuration decryption interface of the mobile application according to the dedicated removal rule base, and extracting the background communication address containing the domain name, Internet Protocol address, and network address path.

[0388] Optionally, the data processing module 52, when performing full traffic capture and layer-by-layer protocol parsing on the raw data from the network side, completing session reassembly, and extracting network connection metadata, protocol features, and payload association information, specifically performs the following: full traffic capture of the raw traffic from the network side using probes; implementing zero-copy message processing and session reassembly in user space based on the data plane development kit; performing layer-by-layer parsing on the captured traffic data from the link layer to the transport layer; extracting the five-tuple connection metadata of source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type; and using identification technology that integrates port number, protocol fingerprint, and traffic behavior features to parse application layer protocols and extract protocol metadata, restore the file entities transmitted at the application layer, and store them securely.

[0389] Optionally, the cross-domain semantic alignment module 54, when achieving cross-platform and cross-protocol data semantic alignment based on standardized entity relationship data and using a topology-guided sparse anchor alignment mechanism to obtain semantically aligned fused entity relationship data, specifically performs the following: Constructing a mobile application behavior graph and a network traffic graph based on the standardized entity relationship data; performing structured community division on the mobile application behavior graph and network traffic graph using an unsupervised community detection algorithm to obtain multiple cohesive community modules; mining anchor entities at key topological locations within each community module using a centrality metric method; constructing a context packet for each anchor entity containing attribute summaries, neighborhood structure summaries, and behavior sequence summaries; calling a large language model to perform semantic reasoning and alignment determination on the cross-platform anchor entity context packets, and outputting the alignment results; and using a confidence propagation algorithm to diffuse the alignment results within the corresponding community modules, fusing cross-platform and cross-protocol entities and events to obtain semantically aligned fused entity relationship data.

[0390] Optionally, the cross-domain semantic alignment module 54, when mining anchor entities of key topological locations within each community module using a centrality measurement method, specifically uses: degree centrality and betweenness centrality methods to measure nodes within the community module; wherein, the degree centrality method is used to evaluate the connectivity breadth of a node, and the betweenness centrality method is used to identify the network bridging role of a node; and target nodes whose measurement results meet a preset threshold are used as anchor entities of key topological locations.

[0391] Optionally, the security graph construction module 55, when constructing a dynamic spatiotemporal heterogeneous graph based on fused entity relationship data and performing streaming incremental updates on the dynamic spatiotemporal heterogeneous graph to form a unified security graph, specifically performs the following: Based on fused entity relationship data, it defines heterogeneous nodes and multiple edge relationships of communication, dependency, affiliation, and co-occurrence among terminal hosts, network services, digital certificates, and network infrastructure to obtain the graph infrastructure structure; it extracts entities and relationships from network observation data and instantiates the extraction results into timestamped nodes and edges in the graph infrastructure structure; it obtains the spatiotemporal companion relationship strength through quantitative calculation of time synchronization and resource similarity, establishes spatiotemporal companion edges between nodes that meet a preset strength threshold, and constructs a dynamic spatiotemporal heterogeneous graph; it maintains the corresponding last active timestamp for each entity and relationship in the dynamic spatiotemporal heterogeneous graph; it ages and removes entities and associated edges that have not updated their last active timestamps beyond a preset window, and performs rolling updates on the attributes of continuously active entities to complete the streaming incremental updates and form a unified security graph.

[0392] Optionally, the threat collaborative detection module 56, when taking a unified security graph as input and performing threat detection through a graph neural network and a spatiotemporal association model to obtain threat detection results, specifically performs the following: taking the unified security graph as input, structurally encoding the unified security graph through a heterogeneous graph attention network to learn a low-dimensional vector representation of each node; deeply mining the explicit logical relationships and spatiotemporal association relationships in the unified security graph through a dual-path analysis layer; the dual-path analysis layer includes explicit logical relationship paths and spatiotemporal association relationship paths, wherein the explicit logical relationship paths handle communication, dependency, and attribution relationships, and the spatiotemporal association relationship paths analyze time synchronization and network topological proximity; adaptively integrating the dual-path analysis results through a context-based gating fusion module to generate node fusion features; and completing node-level and graph-level threat detection based on the node fusion features through a multi-task learning head, outputting threat detection results including node threat scores and graph-level collaborative threat identifiers.

[0393] Optionally, the threat attribution and merging module 57, when performing threat attribution and family merging based on threat detection results through adversarial resilient embedding and reinforcement learning mechanisms to obtain threat family merging results and attribution information, specifically performs the following: extracting suspicious threat subgraphs from the unified security graph based on threat detection results; applying structural and temporal noise to the suspicious threat subgraphs to generate adversarial examples; constructing an embedding space with a dynamic tolerance radius using an order-preserving contrastive learning strategy, mapping the suspicious threat subgraphs and adversarial examples to the embedding space, and extracting common features; performing family merging analysis on the common features through a two-stage retrieval of fast range recall and dynamic radius to obtain threat family merging results; and combining the reinforcement learning agent to dynamically adjust the retrieval parameters of the two-stage retrieval based on detection feedback, performing subgraph attribution analysis on the merged threat families to obtain attribution information including attack paths, core entities, and threat patterns.

[0394] Optionally, the disposal suggestion generation module 58, when generating structured disposal suggestions based on detection results, threat family merging results, and source tracing information through a metagraph-based mechanism, specifically performs the following: Based on detection results, threat family merging results, and source tracing information, it extracts key subgraphs, event sequences, and hit indicators of the threat context to construct a standardized threat context; defines a metagraph structure at the graph pattern layer, abstracting defense knowledge into disposal suggestion nodes, and drives the large language model to generate an initial draft disposal suggestion based on the standardized threat context; defines the combination, dependency, mutual exclusion, and escalation relationships between disposal suggestion nodes, and dynamically generates the initial draft disposal suggestion. The system orchestrates the initial response plan link; it learns from historical attack chain patterns and cross-domain spatiotemporal accompanying patterns, and combines the family characteristics and source information of the current threat to predict the development path and key attack links of the current threat; based on the initial response plan link, it pre-attaches corresponding response suggestion nodes to the key attack links of the predicted path to obtain the target response plan link; among them, the pre-attached response suggestion nodes are associated with preset trigger conditions and expected effective time windows; the target response plan link is associated and bound with the corresponding evidence package and approval strategy to form a structured response suggestion that includes execution priority, scope of application, potential impact, and rollback mechanism.

[0395] Optionally, the monitoring results display module 59, when displaying handling suggestions and threat detection results, is specifically used for: aggregating, deduplicating, and performing correlation analysis on threat detection results to generate explainable alarm events with accompanying contextual information, attack chain stage annotations, and confidence scores; displaying the global threat landscape, threat distribution, and attack chain map through a multi-view visualization dashboard, and enabling dynamic exploration and drill-down of the unified security map through an interactive browser; and displaying the handling suggestions and explainable alarm events in association, showing the scope of application, execution priority, and potential impact information of the handling suggestions.

[0396] Optionally, the network security threat monitoring system provided in this application embodiment further includes an update module.

[0397] Optionally, the update module is specifically used for: real-time monitoring of the prediction confidence changes of the graph neural network and spatiotemporal association model; perceiving the conceptual drift of network traffic feature distribution by calculating the moving average and standard deviation of the prediction entropy; when the conceptual drift of network traffic feature distribution is detected, performing fast gradient updates on the graph neural network and spatiotemporal association model through a meta-learner to generate temporary adaptation parameters; jointly training the temporary adaptation parameters with the example library data of historical threat patterns, and completing the incremental update of the graph neural network and spatiotemporal association model by combining knowledge distillation technology.

[0398] Figure 6 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this application, as shown below. Figure 6 As shown, the electronic device 60 provided in this embodiment includes a processor 61 and a memory 62 communicatively connected to the processor 61.

[0399] The memory 62 stores computer execution instructions; the processor 61 executes the computer execution instructions stored in the memory 62 to implement the method provided in any of the above embodiments.

[0400] The program may include program code, which includes computer-executable instructions. Memory 62 may include high-speed RAM, and may also include non-volatile memory, such as at least one disk storage device.

[0401] In this embodiment, the memory 62 and the processor 61 are connected via a bus. The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. The bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 6 The bus is represented by a single straight line, but this does not mean that there is only one bus or one type of bus.

[0402] This application also provides a computer-readable storage medium, including computer-executable instructions stored in the computer-readable storage medium, which, when executed by a processor, are used to implement the method provided in any of the above embodiments.

[0403] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the method provided in any of the above embodiments.

[0404] The modules described as separate components may or may not be physically separate. The components shown as modules may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to implement the solution of this embodiment according to actual needs.

[0405] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing unit, or each module can exist physically separately, or two or more modules can be integrated into one unit. The unit composed of the above modules can be implemented in hardware or in the form of hardware plus software functional units.

[0406] The integrated modules described above, implemented as software functional modules, can be stored in a computer-readable storage medium. These software functional modules, stored in a storage medium, include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) or processor to execute some steps of the methods of the various embodiments of this application.

[0407] It should be understood that the aforementioned processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. A general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly manifested as execution by a hardware processor, or execution by a combination of hardware and software modules within the processor.

[0408] The memory may include high-speed RAM, and may also include non-volatile storage (NVM), such as at least one disk storage device, and may also be a USB flash drive, external hard drive, read-only memory, disk or optical disc, etc.

[0409] The aforementioned storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The storage medium can be any available medium that can be accessed by a general-purpose or special-purpose computer.

[0410] An exemplary storage medium is coupled to a processor, enabling the processor to read information from and write information to the storage medium. Alternatively, the storage medium can be an integral part of the processor. The processor and storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and storage medium can exist as discrete components in an electronic control unit or main control device.

[0411] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0412] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of this application.

Claims

1. A method for monitoring network security threats, characterized in that, include: Acquire multimodal raw data collected and uploaded by the mobile application side, terminal host side, and network side; The multimodal raw data is parsed, features are extracted and refined to obtain structured and semantic information elements; Based on a pre-defined network security threat analysis ontology architecture, the information elements are standardized and generalized abstracted to obtain standardized entity relationship data. Based on the standardized entity relationship data, cross-platform and cross-protocol data semantic alignment is achieved through a topology-guided sparse anchor alignment mechanism to obtain semantically aligned fused entity relationship data. A dynamic spatiotemporal heterogeneous graph is constructed based on the fused entity relationship data, and the dynamic spatiotemporal heterogeneous graph is updated incrementally in a streaming manner to form a unified security graph. Using the unified security graph as input, threat detection is performed through a graph neural network and a spatiotemporal association model to obtain the threat detection results; Based on the threat detection results, threat attribution and family merging are performed through adversarial resilient embedding and reinforcement learning mechanisms to obtain threat family merging results and attribution information; Based on the detection results, the threat family merging results, and the source tracing information, structured disposal suggestions are generated through a metagraph-based mechanism. The proposed actions and the threat detection results are displayed.

2. The method according to claim 1, characterized in that, The process of parsing, extracting features, and refining the multimodal raw data includes: The original data from the mobile application side is reverse engineered and analyzed, and runtime behavior is monitored to extract static and dynamic features. The backend communication address is extracted by penetrating code obfuscation and string encryption. The raw data on the terminal host side is subjected to fine-grained parsing of processes, files, and network connections to extract host behavior features and entity association information; The system performs full traffic capture and layer-by-layer protocol parsing on the raw data from the network side, completes session reassembly, and extracts network connection metadata, protocol features, and payload association information.

3. The method according to claim 2, characterized in that, The process of reverse engineering and runtime behavior monitoring of the raw data from the mobile application side, extracting static and dynamic features, and extracting the backend communication address by penetrating code obfuscation and string encryption techniques includes: The mobile application installation package is subjected to structural parsing and reverse analysis to extract the static features; wherein, the static features include application components, permission list and control flow graph; Run the mobile application in a controlled environment, monitor and record the dynamic behavior characteristics of the mobile application during runtime; Based on the analysis results of threat application family characteristics and code homology, a special removal rule base is constructed. The network request initiation point and configuration decryption interface of the mobile application are located according to the special removal rule base, and the background communication address containing domain name, Internet Protocol address and network address path is extracted.

4. The method according to claim 2, characterized in that, The process of capturing all traffic and parsing the raw data from the network side layer by layer to complete session reassembly and extract network connection metadata, protocol features, and payload association information includes: The probe captures the full amount of raw traffic on the network side, and zero-copy packet processing and session reassembly in user space are achieved based on the data plane development kit. The captured traffic data is parsed layer by layer from the link layer to the transport layer to extract the five-tuple connection metadata, including source Internet Protocol address, destination Internet Protocol address, source port, destination port, and protocol type. It employs a recognition technology that integrates port number, protocol fingerprint, and traffic behavior characteristics to parse application layer protocols and extract protocol metadata, restore the file entities transmitted at the application layer, and store them securely.

5. The method according to claim 1, characterized in that, The process of achieving cross-platform and cross-protocol data semantic alignment based on the standardized entity relationship data, through a topology-guided sparse anchor alignment mechanism, to obtain semantically aligned fused entity relationship data, includes: Based on the standardized entity relationship data, a mobile application behavior graph and a network traffic graph are constructed respectively. The mobile application behavior graph and the network traffic graph are divided into structured communities using an unsupervised community detection algorithm, resulting in multiple cohesive community modules. Within each of the aforementioned community modules, anchor entities with key topological locations are mined using a centrality metric method; For each anchor entity, a context packet is constructed that includes an attribute summary, a neighborhood structure summary, and a behavior sequence summary; The large language model is invoked to perform semantic reasoning and alignment determination on the cross-platform anchor entity context package, and the alignment result is output. The alignment results are propagated within the corresponding community modules using a confidence propagation algorithm, and entities and events across platforms and protocols are fused to obtain semantically aligned fused entity relationship data.

6. The method according to claim 5, characterized in that, The step of mining anchor entities with key topological locations within each of the community modules using a centrality metric method includes: The degree centrality method and the betweenness centrality method are used to measure the nodes within the community module; wherein, the degree centrality method is used to evaluate the connectivity breadth of a node, and the betweenness centrality method is used to identify the network bridging role of a node. Target nodes whose measurement results meet the preset threshold are used as anchor entities for key topological locations.

7. The method according to claim 1, characterized in that, The process of constructing a dynamic spatiotemporal heterogeneous graph based on the fused entity relationship data, and performing streaming incremental updates on the dynamic spatiotemporal heterogeneous graph to form a unified security graph, includes: Based on the fused entity relationship data, heterogeneous nodes of terminal hosts, network services, digital certificates, and network infrastructure are defined, along with multiple edge relationships of communication, dependency, affiliation, and co-occurrence, to obtain the basic graph structure. Entities and relationships are extracted from the network observation data, and the extraction results are instantiated into timestamped nodes and edges in the graph infrastructure. The spatiotemporal companion relationship strength is obtained by quantifying time synchronization and resource similarity. Spatiotemporal companion edges are established between nodes that meet the preset strength threshold to construct the dynamic spatiotemporal heterogeneous graph. Maintain a corresponding last active timestamp for each entity and each relationship in the dynamic spatiotemporal heterogeneous graph; Entities and associated edges that have not updated the last active timestamp beyond the preset window are aged out and removed, while the attributes of continuously active entities are updated in a rolling manner to complete the streaming incremental update and form the unified security graph.

8. The method according to claim 1, characterized in that, The step of using the unified security graph as input and performing threat detection through a graph neural network and a spatiotemporal association model to obtain threat detection results includes: The unified security graph is used as input, and a heterogeneous graph attention network is used to encode the structure of the unified security graph to learn the low-dimensional vector representation of each node. The explicit logical relationships and spatiotemporal associated relationships in the unified security graph are deeply mined through a dual-path analysis layer. The dual-path analysis layer includes explicit logical relationship paths and spatiotemporal associated relationship paths. The explicit logical relationship paths handle communication, dependency, and attribution relationships, while the spatiotemporal associated relationship paths analyze time synchronization and network topology proximity. The dual-path analysis results are adaptively integrated using a context-based gating fusion module to generate node fusion features; Based on the node fusion features, a multi-task learning head is used to complete node-level and graph-level threat detection, and output threat detection results including node threat scores and graph-level collaborative threat identifiers.

9. The method according to claim 1, characterized in that, The threat attribution and family merging are performed based on the threat detection results using adversarial resilient embedding and reinforcement learning mechanisms, yielding threat family merging results and attribution information, including: Based on the threat detection results, a suspicious threat sub-graph is extracted from the unified security graph; Structural and temporal noise is applied to the suspected threat subgraph to generate adversarial examples; An order-preserving contrastive learning strategy is used to construct an embedding space with a dynamic tolerance radius. The suspected threat subgraph and the adversarial sample are mapped to the embedding space, and homologous features are extracted. By using a two-stage retrieval process of rapid range recall and dynamic radius, family merging analysis is performed on the homologous features to obtain threat family merging results. By combining reinforcement learning agents to dynamically adjust the retrieval parameters of the two-stage retrieval based on detection feedback, subgraph source tracing analysis is performed on the merged threat families to obtain source tracing information including attack paths, core entities, and threat patterns.

10. The method according to claim 1, characterized in that, Based on the detection results, the threat family merging results, and the source tracing information, structured handling suggestions are generated through a metagraph-based mechanism, including: Based on the detection results, the threat family merging results, and the source tracing information, key sub-graphs, event sequences, and hit indicators of the threat context are extracted to construct a standardized threat context. A metagraph structure is defined at the graph pattern layer, and defense knowledge is abstracted into disposal suggestion nodes. Based on the standardized threat context, the large language model is driven to generate an initial disposal suggestion draft. Define the combination, dependency, mutual exclusion, and escalation relationships between the proposed disposal nodes, and dynamically arrange the initial disposal proposal draft into an initial disposal scheme chain; By learning from historical attack chain patterns and cross-domain spatiotemporal accompanying patterns, and combining the family characteristics and source information of current threats, we can predict the development path and key attack links of current threats. Based on the initial handling scheme link, corresponding handling suggestion nodes are pre-attached to the key attack links of the predicted path to obtain the target handling scheme link; wherein, the pre-attached handling suggestion nodes are associated with preset triggering conditions and expected effective time windows; The target disposal plan link is associated and bound with the corresponding evidence package and approval strategy to form a structured disposal suggestion that includes execution priority, scope of application, potential impact and rollback mechanism.

11. The method according to claim 1, characterized in that, The display of the proposed actions and the threat detection results includes: The threat detection results are aggregated, deduplicated, and correlated to generate interpretable alert events with accompanying contextual information, attack chain stage annotations, and confidence scores. The unified security graph is displayed through a multi-view visualization dashboard, showing the global threat situation, threat distribution, and attack chain map. The interactive browser enables dynamic exploration and drill-down of the unified security graph. The proposed handling measures are displayed in association with the explainable alarm events, showing the scope of application, execution priority, and potential impact of the proposed measures.

12. The method according to any one of claims 1-11, characterized in that, Also includes: The prediction confidence changes of the graph neural network and the spatiotemporally associated model are monitored in real time, and the concept drift of the network traffic characteristic distribution is perceived by calculating the moving average and standard deviation of the prediction entropy. When a conceptual shift in the distribution of network traffic features is detected, the graph neural network and the spatiotemporal associated model are updated rapidly using a meta-learner to generate temporary adaptation parameters. The temporary adaptation parameters are jointly trained with the example data of historical threat patterns, and the incremental update of the graph neural network and spatiotemporal association model is completed by combining knowledge distillation technology.

13. A network security threat monitoring system, characterized in that, include: The data collection module is used to acquire multimodal raw data collected and uploaded by the mobile application side, the terminal host side, and the network side; The data processing module is used to parse, extract features, and refine the multimodal raw data to obtain structured and semantic information elements; The entity relationship standardization module is used to standardize and generalize the information elements based on a preset network security threat analysis ontology architecture to obtain standardized entity relationship data. The cross-domain semantic alignment module is used to achieve cross-platform and cross-protocol data semantic alignment based on the standardized entity relationship data through a topology-guided sparse anchor alignment mechanism, so as to obtain semantically aligned fused entity relationship data. The security graph construction module is used to construct a dynamic spatiotemporal heterogeneous graph based on the fused entity relationship data, and to perform streaming incremental updates on the dynamic spatiotemporal heterogeneous graph to form a unified security graph. The threat collaborative detection module is used to take the unified security graph as input and perform threat detection through a graph neural network and a spatiotemporal association model to obtain threat detection results. The threat tracing and merging module is used to perform threat tracing and family merging based on the threat detection results through adversarial elastic embedding and reinforcement learning mechanisms, so as to obtain threat family merging results and tracing information; The disposal suggestion generation module is used to generate structured disposal suggestions based on the detection results, the threat family merging results, and the source tracing information, through a metagraph-based mechanism. The monitoring results display module is used to display the proposed actions and the threat detection results.

14. An electronic device, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1-12.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-12.

16. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method of any one of claims 1-12.

Images