A method and system for defense of heterogeneous security devices based on control computing

Abstract

This invention relates to the field of network security technology and provides a method and system for defending heterogeneous security devices based on management and control computing. By constructing a device adaptation module to uniformly manage heterogeneous security devices and converting multi-source monitoring data into standardized event data, a fusion threat identification is performed using a detection model composed of a concatenated convolutional neural network and a long short-term memory network, which includes a penalty term for differences in cross-device threat prediction probability distribution. Dynamic defense actions are generated based on a Q-value table combined with network status. Attack paths are inferred through security entity association networks, and strategies are calibrated. Dynamic priority is applied according to threat confidence and target value level, with closed-loop optimization. This solves the problems of isolated defenses, rigid strategies, and delayed response of heterogeneous security devices, achieving dynamic collaborative detection and linked defense of heterogeneous devices, improving threat response speed and resource utilization efficiency.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a method and system for defending heterogeneous security devices based on control computing. Background Technology

[0002] In the context of increasingly complex and distributed modern information system architectures, enterprise networks typically deploy a variety of heterogeneous security devices, such as firewalls, endpoint detection and response devices, network access control devices, and zero-trust network access devices. This presents challenges due to the heterogeneous technical architectures of these security devices, inconsistent data collection formats, and independent threat detection models. Each device operates independently, with relatively fixed internal security policies, making it difficult to adapt to the dynamic and collaborative defense needs under complex attack scenarios. When advanced persistent threats occur, the scattered alerts generated by each device cannot be automatically correlated, lacking a global collaborative mechanism, resulting in delayed defense response and creating a significant security window. To address the aforementioned issues, existing technologies urgently need improvement. Summary of the Invention

[0003] The purpose of this application is to provide a method and system for defending heterogeneous security devices based on control computing. This method and system have the advantages of enabling dynamic collaborative detection and joint defense of heterogeneous security devices in complex attack scenarios, thereby improving threat response speed and defense resource utilization efficiency.

[0004] Firstly, this application provides a method for defending against heterogeneous security devices based on control and management computation, the method comprising: Acquire monitoring data from various heterogeneous security devices and convert the monitoring data into standardized event data with a unified data format; The standardized event data is input into a detection model composed of a concatenated convolutional neural network and a long short-term memory network. The detection model outputs the threat type prediction probability of each device for the same network data stream. The detection model is trained using a loss function that includes a penalty term for the difference in the predicted probability distribution of the threat type among different devices, and the threat detection result is obtained. Based on the threat confidence level, current network load status parameters, and preset reward value calculation rules in the threat detection results, the defense action corresponding to each device is determined by querying the pre-trained Q-value table. Based on the threat confidence level and the predefined value level of the attacked target, the priority value of each defense action is calculated, and the control command corresponding to the defense action is sent to the corresponding device in descending order of the priority value.

[0005] Furthermore, the step of converting the monitoring data into standardized event data with a unified data format includes: The device adapter collects monitoring data from firewalls, endpoint detection and response devices, network access control devices, and zero-trust network access devices. Based on the network connection quintuple, the network traffic data in the standardized event data is segmented into sessions. Data packets belonging to the same session within a time window are aggregated into stream records, and the duration, data packet size, and byte rate of the stream records are extracted as behavioral features. The behavioral features are normalized to obtain a normalized feature sequence, which is then input into the detection model.

[0006] Furthermore, the step of inputting the standardized event data into the detection model composed of a concatenated convolutional neural network and a long short-term memory network includes: The detection model includes a one-dimensional convolutional layer, a pooling layer, a long short-term memory network layer, and a fully connected layer; the one-dimensional convolutional layer uses multiple convolutional kernels of different scales to extract local spatial features; the long short-term memory network layer contains a preset number of memory units for extracting temporal dependency features; Each device outputs the predicted probability of the threat type, and the predicted probability of the threat type output by each device is averaged to obtain the threat confidence. The source address, destination address and process identifier are extracted from the standardized event data to obtain the threat detection result. Specifically, when training the detection model, the difference penalty term in the loss function is the sum of the KL divergences between each pair of the threat type prediction probability distributions output by each device; the KL divergence between the threat type prediction probability distribution output by each device and the average threat type prediction probability distribution is calculated, and when the KL divergence exceeds a preset threshold, an additional penalty term is added; the maximum KL divergence between the threat type prediction probability distributions output by each device is compared with a preset difference value, and when it exceeds the preset difference value, the corresponding network data stream is marked as a cooperative uncertainty event.

[0007] Furthermore, the step of generating an initial defense strategy based on the threat detection results and the current network status includes: The current network load status parameters are normalized to form a status vector, which includes the network average CPU utilization, the network average memory utilization, the ratio of network throughput to the maximum link bandwidth, the threat confidence, the number of abnormal login attempts, and the key service status identifier. Based on the state vector, query the Q-value table and select the defensive action combination with the largest Q-value as the defensive action corresponding to the current state; After the defense action is executed, the actual reward value is calculated based on the actual security effect, the impact of business delay, and the increase in resource consumption. The Q value of the corresponding state and action pair in the Q value table is updated according to the preset learning rate and discount factor.

[0008] Furthermore, the target defense strategy that covers the entire attack path includes: The source address and destination address are mapped to IP addresses or host nodes in the network associated with the security entity, and the process identifier is mapped to a process node; Starting from the alarm source node, the search extends forward along the access relationship to a preset depth to obtain the forward attack path. Starting from the critical asset node, the search extends backward along the access relationship to a preset depth to obtain the backward attack path. The forward attack path and the backward attack path are merged to obtain the attack behavior path set. When a lateral movement path exists in the set of attack behavior paths, at least one of the following shall be added to the initial defense strategy: add a blocking rule on the firewall side to block access to critical assets by intermediate nodes on the attack path; implement access restrictions on the intermediate nodes on the network access control side; add process monitoring of the intermediate nodes on the terminal detection and response side, thereby obtaining the target defense strategy.

[0009] Furthermore, the calculation of the priority value of each defensive action based on the threat confidence level and the predefined value level of the attacked target includes: Obtain the current CPU utilization of the software-defined network controller and the dynamic threshold corresponding to the current service period; The product of the threat confidence level and the predefined value level is used as the numerator, and the sum of the current CPU utilization of the software-defined network controller and the dynamic threshold is used as the denominator. The result is then input into an S-shaped function to calculate the continuous priority value. The continuous priority value is discretized into multiple integer priority levels, with the highest priority level of defense action being executed first.

[0010] Furthermore, the step of issuing control commands corresponding to the defense actions to the corresponding devices in descending order of priority values ​​includes: The defensive actions are assigned to the corresponding priority queues according to their priority values. The defensive actions with the highest priority values ​​are assigned to the highest priority queue, the second highest priority values ​​are assigned to the second highest priority queue, the third highest priority values ​​are assigned to the third priority queue, and the lowest priority values ​​are assigned to the lowest priority queue. For network layer blocking, rate limiting, or traffic redirection defense actions, the northbound interface of the software-defined network controller is invoked to generate OpenFlow flow table entries and then sent to the switch for execution. For endpoint isolation defense actions, isolation commands are simultaneously issued to the endpoint detection and response management platform, the network access controller, and the zero-trust network access controller.

[0011] Furthermore, the simultaneous issuance of isolation commands to the terminal detection and response management platform, the network access control controller, and the zero-trust network access controller includes: Send a readiness command to each device and wait for a ready response from each device; Once all devices return a ready response, a submit execution command is sent to each device to enable each device to perform the actual isolation operation. If any device fails to return a ready response or returns a failure response, a rollback command is sent to the device that has returned a ready response to undo the prepared operation.

[0012] Secondly, this application also proposes a heterogeneous security device defense system based on control computing, the system comprising: The acquisition module is used to acquire monitoring data from various heterogeneous security devices and convert the monitoring data into standardized event data with a unified data format. The detection module is used to input the standardized event data into a detection model composed of a concatenated convolutional neural network and a long short-term memory network. The detection model outputs the threat type prediction probability of each device for the same network data stream. The detection model is trained using a loss function that includes the KL divergence between each pair of the threat type prediction probability distributions output by each device, and an additional penalty term when the KL divergence with the average probability distribution exceeds a preset threshold. The result is a threat detection result that includes threat confidence, source address, destination address, and process identifier. The decision module is used to generate an initial defense strategy based on the threat detection results and the current network status. It maps the source address, destination address, and process identifier in the threat detection results to a pre-built security entity association network. Starting from the alarm source node, it extends the search forward along the access relationship to a preset depth to obtain a forward attack path. Starting from the critical asset node, it extends the search backward along the access relationship to a preset depth to obtain a backward attack path. It merges the forward attack path and the backward attack path to obtain an attack behavior path. It calibrates the initial defense strategy based on the attack behavior path to obtain a target defense strategy that covers the entire attack path. The execution module is used to calculate the priority value of each defense action based on the threat confidence level and the predefined value level of the attacked target, and to issue the control command corresponding to the defense action to the corresponding device in descending order of the priority value.

[0013] Thirdly, this application provides an electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, and the programs include steps for performing the heterogeneous security device defense method based on control computing as described in the first aspect.

[0014] As can be seen from the above, the heterogeneous security device defense method and system provided in this application, based on control and computation, unifies the management of heterogeneous security devices by constructing a device adaptation module and converting multi-source monitoring data into standardized event data. It uses a detection model composed of a convolutional neural network and a long short-term memory network, which includes cross-device difference penalty terms, to perform fusion threat identification. It generates dynamic defense actions based on a Q-value table combined with real-time network load status parameters. It performs attack behavior reasoning and strategy calibration through a security entity association network. It calculates dynamic priorities based on threat confidence and predefined value levels of the attacked targets, and performs hierarchical queue collaborative execution and closed-loop feedback optimization. This solves the problems of isolated defenses and delayed response of heterogeneous security devices. It has the advantages of enabling dynamic collaborative detection and linkage defense of heterogeneous security devices in complex attack scenarios, improving threat response speed and defense resource utilization efficiency. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 This is a flowchart illustrating the steps of the heterogeneous security device defense method based on control computing disclosed in an embodiment of the present invention; Figure 2 This is a flowchart illustrating the steps of the method for determining the corresponding defense action for each device after querying a pre-trained Q-value table, as disclosed in an embodiment of the present invention. Figure 3 This is a flowchart illustrating the steps of a method for calculating the priority values ​​of each defensive action based on the threat confidence level and the predefined value level of the attacked target, as disclosed in an embodiment of the present invention. Figure 4 This is the overall process architecture of the heterogeneous security device collaborative defense method based on control computing in this embodiment of the invention; Figure 5 This is a schematic diagram of the heterogeneous security device defense system based on control computing according to an embodiment of the present invention; Figure 6 This is an architecture diagram of a heterogeneous security device defense system based on control computing in a specific implementation of an embodiment of the present invention. Detailed Implementation

[0017] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which these embodiments belong; the terminology used herein and in the specification of the application is for the purpose of describing particular embodiments only and is not intended to limit these embodiments; the terms "comprising" and "having," and any variations thereof, in the specification of these embodiments and the foregoing drawings, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification of these embodiments and the foregoing drawings are used to distinguish different objects, not to describe a particular order.

[0018] The implementation details of the technical solution in this embodiment are described in detail below: This application proposes a heterogeneous security device defense method based on control computation, such as... Figure 1 As shown, the method includes: S101, acquire monitoring data from various heterogeneous security devices, and convert the monitoring data into standardized event data with a unified data format; Specifically, step S101 is executed by the device adapter deployed in the management and control computing operating system. This primarily enables the access, status monitoring, and multi-source data aggregation of heterogeneous devices, providing raw data support for subsequent security testing. First, security device registration is performed. Various heterogeneous security devices, such as firewalls, endpoint detection and response devices, network access control devices, and zero-trust network access devices, are connected to the management and control computing operating system. After connection, the devices are marked as online and included in a unified device resource pool, thereby establishing a unified management view of all heterogeneous security devices across the domain.

[0019] Next, monitoring data is continuously collected from the aforementioned heterogeneous devices via the device adapter. This monitoring data includes two categories: status data, including the online status of each device, policy version, alarm count, etc.; and event data, including network flow logs, terminal processes, file access records, and user authentication information. This data originates from security devices from different manufacturers and with different technical architectures, and their original data formats, field definitions, and encoding methods all differ.

[0020] Then, the device adapter converts the collected raw data into standardized messages in a unified format. Specifically, heterogeneous raw data reported by different devices is mapped to a predefined unified data model, which includes three core entities: device metadata, security events, and network flow characteristics. The device metadata table stores information such as device identifier, type, location, department, and maintenance personnel; the security event table stores standardized alarm, traffic, and log events, with each event containing fields such as timestamp, source object, target object, operation type, result, and associated device; and the network flow characteristic table stores flow-level statistical characteristics based on session aggregation. The converted standardized messages are transmitted to the data processing module of the control and management computing center via a message queue to achieve message reporting.

[0021] After data is received, the system performs data cleaning. Based on unique event identifiers, such as a combination of device identifier, timestamp, and event hash, duplicate events are removed from standardized event data to prevent the same event from being recorded multiple times. Simultaneously, range checks are performed on numerical fields to remove abnormal values ​​that clearly exceed reasonable ranges. This process ultimately forms a comprehensive security database, providing a high-quality data foundation for subsequent threat detection and collaborative defense.

[0022] Furthermore, the step of converting the monitoring data into standardized event data with a unified data format includes: collecting monitoring data from firewalls, terminal detection and response devices, network access control devices, and zero-trust network access devices through device adapters; performing session segmentation on network traffic data in the standardized event data based on network connection quintuples, aggregating data packets belonging to the same session within a time window into flow records, and extracting the duration, data packet size, and byte rate of the flow records as behavioral features; normalizing the behavioral features to obtain a normalized feature sequence and inputting it into the detection model.

[0023] In this embodiment, the above steps are performed by a device adapter deployed in the management and control computing operating system, which mainly realizes the access of heterogeneous devices, status monitoring and multi-source data aggregation.

[0024] Specifically, monitoring data from firewalls, endpoint detection and response devices, network access control devices, and zero-trust network access devices are collected via device adapters. This monitoring data includes two categories: status data, such as the online status of each device, policy version, and alarm counts; and event data, including network flow logs, endpoint processes, file access records, and user authentication information. The device adapter maps the collected raw data to a predefined unified data model, converting it into standardized event data with a unified data format.

[0025] Specifically, for the network traffic data in the standardized event data, session segmentation is first performed based on the network connection 5-tuple. The network connection 5-tuple includes the source IP address, destination IP address, source port, destination port, and transport layer protocol. Through this 5-tuple identifier, the system can uniquely identify a network session link, thereby separating the mixed network traffic data according to the session dimension.

[0026] Based on session segmentation, all data packets belonging to the same session within a time window are aggregated into a single flow record. For each flow record, its behavioral characteristics are extracted, including the duration, packet size, and byte rate. These characteristics reflect the temporal behavior patterns and transmission characteristics of network traffic, providing crucial input for threat detection.

[0027] Subsequently, the extracted behavioral features are normalized using max-min normalization, mapping each feature to the [0,1] interval to eliminate dimensional differences between different features. Specifically, the normalization formula is as follows:

[0028] Where xi is the original i-th feature value; min(xi) is the minimum value of this feature among all samples; and max(xi) is the maximum value. This is the normalized value, thus eliminating dimensional differences between different features.

[0029] Through the above normalization process, each behavioral feature is transformed to a uniform scale, forming a normalized feature sequence. This normalized feature sequence is input into a detection model composed of a concatenated convolutional neural network and a long short-term memory network. The detection model then calculates the probability of threat type prediction based on the feature data at the uniform scale.

[0030] S102, the standardized event data is input into a detection model composed of a concatenated convolutional neural network and a long short-term memory network. The detection model outputs the threat type prediction probability of each device for the same network data stream. The detection model is trained using a loss function that includes the KL divergence between each pair of the threat type prediction probability distributions output by each device and an additional penalty term when the KL divergence with the average probability distribution exceeds a preset threshold. The result is a threat detection result that includes threat confidence, source address, destination address and process identifier. Further, in S102, the step of inputting the standardized event data into the detection model composed of a concatenated convolutional neural network and a long short-term memory network includes: The detection model includes a one-dimensional convolutional layer, a pooling layer, a long short-term memory network layer, and a fully connected layer; the one-dimensional convolutional layer uses multiple convolutional kernels of different scales to extract local spatial features; the long short-term memory network layer contains a preset number of memory units for extracting temporal dependency features; Each device outputs the predicted probability of the threat type, and the predicted probability of the threat type output by each device is averaged to obtain the threat confidence. The source address, destination address and process identifier are extracted from the standardized event data to obtain the threat detection result. Specifically, when training the detection model, the difference penalty term in the loss function is the sum of the KL divergences between each pair of the threat type prediction probability distributions output by each device; the KL divergence between the threat type prediction probability distribution output by each device and the average threat type prediction probability distribution is calculated, and when the KL divergence exceeds a preset threshold, an additional penalty term is added; the maximum KL divergence between the threat type prediction probability distributions output by each device is compared with a preset difference value, and when it exceeds the preset difference value, the corresponding network data stream is marked as a cooperative uncertainty event.

[0031] In this embodiment, the above steps are executed by the intelligent detection module in the control and management computing system, which performs real-time threat detection on the standardized event data processed in step S101. Specifically, a CNN-LSTM concatenated network is constructed as the detection model. The detection model receives the input feature sequence and processes it sequentially through a one-dimensional convolutional layer, a pooling layer, a long short-term memory network layer, and a fully connected layer, outputting the predicted probability of threat type for each device on the same network data stream. Unlike traditional CNN-LSTM models that only focus on the classification accuracy of a single device, this embodiment introduces a cross-device collaborative consistency constraint term as a difference penalty term in the loss function, forcing different heterogeneous devices to maintain consistent detection results for the same network stream, thereby alleviating the decision conflict problem caused by defense silos.

[0032] Furthermore, the detection model includes a one-dimensional convolutional layer, a pooling layer, a long short-term memory (LSTM) network layer, and a fully connected layer. The one-dimensional convolutional layer uses multiple convolutional kernels of different scales to extract local spatial features; for example, it can use multiple one-dimensional convolutional kernels with scales of 3, 5, and 7 to capture local spatial patterns in traffic data at different granularities. The pooling layer downsamples the convolutional output, reducing the feature dimensionality and extracting the main features. The LSM network layer contains a preset number of memory units to extract temporal-dependent features, capturing the behavioral patterns and state transitions of network traffic over long time. Finally, the fully connected layer and the Softmax function output the predicted probabilities of various attacks.

[0033] During the inference phase, each detection branch extracts features from the input standardized event data and outputs predicted probabilities for each category. The system averages the predicted probabilities for each category output by each detection branch to obtain the attack type confidence score, which is then used as the threat confidence score. Simultaneously, the source address, destination address, and process identifier are extracted from the standardized event data. The threat confidence score, along with the source address, destination address, and process identifier, constitute the threat detection result.

[0034] During the model training phase, the detection model was trained using a historical attack traffic dataset with a learning rate of 0.001 and a batch size of 128. An early stopping mechanism was employed to prevent overfitting. The total loss function used during training consisted of three parts: classification loss, collaborative consistency loss, and regularization loss, as detailed below:

[0035] The first term is the classification loss function, the second term is the consistency loss function, the third term is the regularization loss function, and λ1 and λ2 are the balance coefficients.

[0036] The classification cross-entropy loss is calculated separately for each device's classification output, and then summed:

[0037] Where M represents the number of devices; N represents the batch size; and C represents the attack type. Let m be the true label of the m-th device on the i-th sample; Let be the predicted probability of the m-th device.

[0038] Cross-device collaborative consistency loss forces the output probability distributions of devices to be similar, thereby avoiding decision conflicts caused by device differences. The consistency loss is defined as the sum of the pairwise KL divergences between the outputs of all devices:

[0039] Where M is the number of devices; p, q are device indices; Let be the KL divergence from distribution q to p; where the formula for calculating the KL divergence is:

[0040] Where j is the category index; Predict the probability that the p-th device belongs to the j-th class; Predict the probability that the q-th device belongs to the j-th class; =10 8 To prevent small constants from being divided by zero.

[0041] Furthermore, to enhance the robustness of consistency loss, this embodiment also introduces a centralized consistency constraint: calculating the average probability distribution of the outputs of all devices:

[0042] Where yˉ is the average probability distribution of all device outputs; M represents the number of devices. Then, the KL divergence between each device's output and this central distribution is forced to not exceed a threshold δ (default δ = 0.1, which can be adjusted as needed). If it exceeds this threshold, an additional penalty term is added.

[0043] The final consistency loss is:

[0044] Furthermore, this embodiment also involves regularization loss to prevent overfitting. The regularization loss uses:

[0045] Where L is the number of layers in the neural network; Wl is the weight matrix of the l-th layer; the purpose of this formula is to penalize excessively large weights and prevent the model from becoming too complex and remembering noise in the training data.

[0046] During inference, each device outputs its own predicted threat type probability. The system takes the average of the outputs from all devices as the final confidence level and determines whether it exceeds a threshold. Simultaneously, it calculates the maximum KL divergence between the predicted threat type probability distributions of each device. When the maximum KL divergence exceeds a preset difference value, the corresponding network data stream is marked as a cooperative uncertainty event, triggering manual review to ensure the reliability of the detection results. Through the above detection model, the system obtains threat detection results including threat type, confidence level, source address, destination address, and process identifier, providing input for subsequent dynamic defense strategy generation.

[0047] S103, an initial defense strategy is generated based on the threat detection results and the current network status. The source address, destination address, and process identifier in the threat detection results are mapped to a pre-built security entity association network. A forward attack path is obtained by extending the search forward along the access relationship from the alarm source node to a preset depth. A backward attack path is obtained by extending the search backward along the access relationship from the critical asset node to a preset depth. The forward attack path and the backward attack path are merged to obtain the attack behavior path. The initial defense strategy is calibrated based on the attack behavior path to obtain a target defense strategy that covers the complete attack path. Further, in S103, the step of generating an initial defense strategy based on the threat detection results and the current network status includes: normalizing the current network load status parameters to form a state vector, the state vector including the network-wide average CPU utilization, the network-wide average memory utilization, the ratio of network throughput to the maximum link bandwidth, the threat confidence level, the number of abnormal login attempts, and the key service status identifier; querying the Q-value table based on the state vector, selecting the defense action combination with the largest Q-value as the defense action corresponding to the current status; after the defense action is executed, calculating the actual reward value based on the actual security effect, the impact of service latency, and the incremental resource consumption, and updating the Q-value of the corresponding state and action pair in the Q-value table according to the preset learning rate and discount factor.

[0048] In this embodiment, the above steps are executed collaboratively by the dynamic decision-making module and the knowledge reasoning module. First, an initial defense strategy is generated based on the current network state and the threat detection results. Then, the source address, destination address, and process identifier in the threat detection results are mapped to a pre-built security entity association network. Attack behavior paths are obtained through graph reasoning, and the initial defense strategy is calibrated accordingly to obtain a target defense strategy that covers the complete attack path.

[0049] Specifically, generating an initial defense strategy based on the threat detection results and the current network state includes: normalizing the current network load state parameters to form a state vector. The system state St is defined as a six-dimensional vector, where each dimension is a continuous value and normalized to [0,1]: St=[s1,s2,s3,s4,s5,s6] The meaning of each dimension and the normalization method are as follows: s1 is the average CPU utilization rate (%) of the entire network, which is directly collected from each device and averaged, then divided by 100; s2 is the average memory usage rate (%) across the entire network, divided by 100; s3 is the network throughput (Mbps), divided by the maximum link bandwidth; s4 represents the attack strength level (1-5), which is mapped from the confidence level output of the model in step S2: s4=max(p), and the value is taken directly; s5 represents the number of abnormal login attempts per minute, which counts the number of failed login attempts in the last 60 seconds, and is truncated to 1 after being divided by 100; S6 represents the critical service status, with 0 indicating normal and 1 indicating abnormal (provided by an external monitoring system).

[0050] In terms of action space, the collaborative defense action At is defined as a four-tuple, corresponding to the instructions of the four devices: firewall (FW), endpoint detection and response (EDR), network access control (NAC), and zero-trust network access (ZTNA). A t ={(a1,FW),(a2,EDR),(a3,NAC),(a4,ZTNA)} Where a i The values ​​and their meanings are shown in Table 1.

[0051] Table 1. This embodiment regarding a i Values ​​and their meanings

[0052] The above action space design can cover a variety of heterogeneous devices to coordinate response combinations, so as to meet the linkage defense needs under different threat scenarios.

[0053] Regarding the reward calculation rules, a multi-objective reward function is designed to strike a balance between security effectiveness, business continuity, and resource consumption.

[0054] The first item is a security reward; the second is a business reward; and the third is a resource penalty. w1, w2, and w3 are the weights for each item (set based on experience). This reward function enables the defense strategy to effectively intercept threats while taking into account business continuity and system resource overhead, avoiding unnecessary interference to critical business operations caused by high-cost defense actions.

[0055] The Q-value table is queried based on the state vector, and the defensive action combination with the largest Q-value is selected as the defensive action corresponding to the current state. Since the state space is continuous, it is discretized: each state dimension is divided into 10 equally wide intervals, resulting in a total of 10 discrete states. 6 A hash table is used to store Q-values, storing only visited state-action pairs. The Q-learning algorithm is employed to learn the optimal policy. The Q-value function Q(S,A) represents the expected cumulative discounted reward for taking action A in state S. The update formula is:

[0056] Where α is the learning rate, used to control the step size of each update; γ is the discount factor, used to reflect the emphasis on future rewards. The exploration strategy adopts the following:

[0057] initial =0.5, after each training round press ←max(0.1, The decay is 0.995 ×. Since the state space is continuous, we discretize it: each state dimension is divided into 10 equally wide intervals, resulting in a total of 106 discrete states. A hash table is used to store the Q-values, storing only the visited state-action pairs.

[0058] After training, the optimal strategy is:

[0059] During the inference phase, the system maps the currently collected and normalized state vector to the corresponding discrete state, directly queries the Q-value of each action combination in the Q-value table for that state, selects the defensive action combination that maximizes the Q-value as the defensive action corresponding to the current state, and realizes strategy generation.

[0060] After the defensive action is executed, the actual reward value is calculated based on the actual security effect, business latency impact, and resource consumption increment. The Q value of the corresponding state-action pair in the Q value table is then updated according to a preset learning rate and discount factor. Specifically, after each defensive action is executed, the actual reward is calculated based on the actual security effect, business impact, and resource consumption, and the Q value table is updated to continuously bring the strategy closer to the optimal level.

[0061] Furthermore, after generating the initial defense strategy, the source address, destination address, and process identifier in the threat detection results are mapped to a pre-built security entity association network. The security entity association network stores security-related entities and their relationships in a graph structure, specifically represented as KG=(E,R,F), where entity type E includes: IP address, host, process, vulnerability, threat intelligence, and attack technique; relationship type R includes: accesses, runs, exploits, belong to, and targets; F is a set of fact triples, each triple of the form (h,r,t), where h,t∈E, r∈R.

[0062] Specifically, the source address and destination address are mapped to IP addresses or host nodes in the network associated with the security entity, and the process identifier is mapped to a process node. Starting from the alarm source node, a forward attack path is obtained by extending the search forward along the access relationship to a preset depth; starting from the critical asset node, a backward attack path is obtained by extending the search backward along the opposite direction of the access relationship to a preset depth. The forward attack path and the backward attack path are merged to obtain a set of attack behavior paths.

[0063] When a lateral movement path exists within the attack path set, at least one of the following should be added to the initial defense strategy: adding a blocking rule on the firewall side to prevent intermediate nodes along the attack path from accessing critical assets; implementing access restrictions on the intermediate nodes on the network access control side; and adding process monitoring of the intermediate nodes on the endpoint detection and response side, thereby obtaining a target defense strategy covering the entire attack path. Through the above calibration, it is ensured that the response action can accurately block the entire attack behavior, rather than only providing a partial response to a single point of alarm.

[0064] Further, in S103, the target defense strategy that covers the entire attack path is obtained, such as... Figure 2 As shown, it also includes: S3001, map the source address and destination address to IP addresses or host nodes in the security entity association network, and map the process identifier to a process node; S3002, starting from the alarm source node, extend the search forward along the access relationship to a preset depth to obtain a forward attack path, starting from the critical asset node, extend the search backward along the opposite direction of the access relationship to a preset depth to obtain a backward attack path, and merge the forward attack path and the backward attack path to obtain an attack behavior path set. S3003, when there is a lateral movement path in the set of attack behavior paths, add at least one of the following to the initial defense strategy: add a blocking rule on the firewall side to block intermediate nodes on the attack path from accessing critical assets; implement access restrictions on the intermediate nodes on the network access control side; add process monitoring of the intermediate nodes on the terminal detection and response side to obtain the target defense strategy.

[0065] In this embodiment, the above steps are executed by the knowledge reasoning module to calibrate the initial defense strategy generated in step S103 and obtain a target defense strategy that covers the entire attack path.

[0066] Specifically, a pre-constructed secure entity association network is used to store security-related entities and their relationships in a graph structure, specifically represented as KG=(E,R,F). Entity types E include: IP address, host, process, vulnerability, threat intelligence, and attack techniques; relationship types R include: accesses, runs, exploits, belong to, and targets; F is a set of fact triples, each of the form (h,r,t), where h,t∈E and r∈R. The secure entity association network is stored in a database and indexed to accelerate queries.

[0067] S3001, Entity Mapping: The source and destination addresses in the threat detection results are mapped to IP addresses or host nodes in the network associated with the security entity, and the process identifier is mapped to a process node. Specifically, the source and destination addresses are mapped to IPAddress or Host nodes, the process identifier is mapped to a Process node, and the attack type is mapped to an AttackTechnique node through a predefined mapping table, thereby completing the link between the alerting entity and the network node.

[0068] S3002, Attack Path Reasoning: Starting from the alarm source node, the forward attack path is obtained by extending the search forward along the access relationships to a preset depth; starting from the critical asset node, the backward attack path is obtained by extending the search backward along the opposite direction of the access relationships to a preset depth. In this embodiment, a bidirectional breadth-first search algorithm is used for attack path reasoning. The forward extension starts from the alarm source node and extends outward along the accesses relationships, recording all reachable asset nodes within the preset search depth; the backward extension starts from the critical asset set and searches backward along the reverse edges of the accesses relationships, recording all possible paths to the critical assets within the preset search depth. As a specific implementation example, the preset search depth can be limited to 3 layers. The forward attack path and the backward attack path are merged to obtain the attack behavior path set P={P1,P2,...,Pm}. Each path is represented as a node sequence [v0,v1,...,vn], where v0 is the attack starting point and vn is the target asset. Through bidirectional search, the system can identify the complete attack chain from the attack source to the critical target device, including possible intermediate hop nodes, providing a global attack view for policy calibration.

[0069] S3003, Strategy Calibration: When a lateral movement path exists within the attack path set, at least one of the following should be added to the initial defense strategy: add a blocking rule on the firewall side to block access to critical assets by intermediate nodes along the attack path; implement access restrictions on the intermediate nodes on the network access control side; and add process monitoring of the intermediate nodes on the endpoint detection and response side to obtain the target defense strategy. Specifically, if the initial strategy only includes blocking the alarm source address, but the attack path shows the existence of a lateral movement path, it indicates that the attacker may continue to penetrate through intermediate nodes, and blocking a single source address cannot cover the entire attack lifecycle. In this case, a blocking rule should be added to the firewall to prohibit access to the network segment where the critical target device is located from the intermediate hop node; access restrictions should be implemented on the intermediate nodes along the path on the network access control device; and process monitoring of all hosts along the path should be added on the endpoint detection and response device. The calibrated strategy is represented as the union of the initial action set and the newly added action set, thereby ensuring that the response action can accurately block the entire attack behavior, rather than only providing a partial response to a single alarm.

[0070] S104. Based on the threat confidence level and the predefined value level of the attacked target, calculate the priority value of each defense action, and issue the control command corresponding to the defense action to the corresponding device in descending order of the priority value.

[0071] In this embodiment, the above steps are executed by the collaborative execution module, which is responsible for converting the calibrated defense strategy into actual control commands for heterogeneous devices. Unlike existing technologies that use fixed priorities, this embodiment proposes a dynamic priority calculation function. Based on multiple factors such as threat confidence, predefined value level of affected targets, real-time load of the software-defined network controller, and service periods, the priority value of each defense action is calculated in real time, thereby achieving adaptive allocation of defense resources. After calculating the priority values, the system issues the corresponding control commands to the appropriate devices in descending order of priority value, ensuring that high-threat responses are executed first, while avoiding unnecessary interference with core services, achieving a dynamic balance between security protection and business continuity.

[0072] Furthermore, in S104, the priority value of each defensive action is calculated based on the threat confidence level and the predefined value level of the attacked target, such as... Figure 3 As shown, it includes: S4001, obtain the current CPU utilization of the software-defined network controller and the dynamic threshold corresponding to the current service period; In this embodiment, the system collects the current CPU utilization of the software-defined network controller in real time by calling the northbound interface and normalizes the utilization to a preset range. Simultaneously, the system obtains a dynamic threshold θ(t) based on the current business time period. This dynamic threshold is adaptively adjusted according to the business time period, making the system more sensitive and easier to achieve high priority during off-peak periods, and more conservative during peak periods, thereby effectively protecting business continuity. For example, 2:00 PM is a peak business period, and the dynamic threshold is set to a higher value; the early morning period is an off-peak period, and the dynamic threshold is set to a lower value, thus achieving differentiated scheduling sensitivity for different time periods.

[0073] S4002, the product of the threat confidence level and the predefined value level is used as the numerator, and the sum of the current CPU utilization of the software-defined network controller and the dynamic threshold is used as the denominator. The result is then input into an S-shaped function to calculate the continuous priority value. In this embodiment, the priority of the defensive action is defined as P∈{1,2,3,4} (1 is the highest, 4 is the lowest), which is obtained by discretization after calculation by the following continuous function:

[0074] Where σ(x) is the Sigmoid function, which smoothly maps the input to (0,1); k is the kurtosis coefficient, which controls the sensitivity of the priority to input changes; Conf∈[0,1] is the confidence level of the current threat detection (output by step S2); Asset∈[1,5] is the value level of the affected assets, which is predefined in the asset pool (core database=5, ordinary servers=3, terminal=1); Load∈[0,1] is the current CPU utilization rate after normalization by the SDN controller; θ(t) is a dynamic threshold that is adaptively adjusted according to the business period.

[0075] Its physical meaning is as follows: the higher the confidence level (Conf) and the higher the asset value (Asset), the larger the numerator and the higher the priority; the higher the controller load (Load), the larger the denominator and the lower the priority automatically, avoiding excessive high-consumption actions during high loads that could overload the controller; the dynamic threshold θ(t) makes the system more sensitive during business downturns (lower threshold makes it easier to achieve high priority) and more conservative during peak periods, protecting business continuity.

[0076] As a specific implementation example, taking the action of "blocking N1 to the financial network segment" as an example: Confidence level Conf = 0.9075; predefined value level of the attacked target Asset = 5 (database); current load of the SDN controller Load = 0.2. The current time period is 14:00 in the afternoon (peak business period), dynamic threshold θ(t) = 0.5, kurtosis coefficient k = 5.

[0077] Calculation process: Since the priority domain is {1,2,3,4}, the actual value is P=4 (the highest priority is 1; the result of 5 indicates an excess, which is limited by min(4,·) or by adjusting the formula coefficients in practice. In this embodiment, the actual mapping is P=1 (severe)). Similarly, the priority for isolation actions is P=2, and for monitoring actions it is P=3.

[0078] S4003, the continuous priority value is discretized into multiple integer priority levels, wherein the defense action of the highest priority level is executed first.

[0079] In this embodiment, the system maintains four priority queues (Q1~Q4). Each action is enqueued based on the P value calculated in step S4002, thereby enabling differentiated scheduling of response actions for different threat levels. Table 2 Response actions, execution strategies, and business impact control for different threat levels

[0080] A fair queue scheduling mechanism is used to ensure that high-priority actions are executed first.

[0081] Regarding the distribution of control commands corresponding to the defense actions to the appropriate devices in descending order of priority values, for network layer blocking, rate limiting, or traffic redirection defense actions, the system calls the northbound interface of the software-defined network controller to convert the action into an OpenFlow flow table entry. The specific format is consistent with the standard OpenFlow, and the action is distributed to the core switch for execution via the OpenFlow protocol, achieving flow-level network control. For terminal isolation defense actions, the system simultaneously distributes isolation commands to the terminal detection and response management platform, the network access control controller, and the zero-trust network access controller, ensuring complete terminal isolation through cross-device collaborative execution. The system employs a fair queue scheduling mechanism, retrieving defense actions sequentially from the highest priority queue and executing them accordingly, ensuring that high-threat responses are processed first. Simultaneously, a differentiated scheduling strategy controls the impact of different levels of actions on services, achieving optimal allocation of defense resources.

[0082] Furthermore, in S104, the step of sending the control commands corresponding to the defense action to the corresponding devices in descending order of priority values ​​includes: The defensive actions are assigned to the corresponding priority queues according to their priority values. The defensive actions with the highest priority values ​​are assigned to the highest priority queue, the second highest priority values ​​are assigned to the second highest priority queue, the third highest priority values ​​are assigned to the third priority queue, and the lowest priority values ​​are assigned to the lowest priority queue. For network layer blocking, rate limiting, or traffic redirection defense actions, the northbound interface of the software-defined network controller is invoked to generate OpenFlow flow table entries and then sent to the switch for execution. For endpoint isolation defense actions, isolation commands are simultaneously issued to the endpoint detection and response management platform, the network access controller, and the zero-trust network access controller.

[0083] Specifically, in this embodiment, the system maintains four priority queues, corresponding to the four priority levels mentioned above. The collaborative execution module adopts a fair queue scheduling mechanism, always retrieving and executing defensive actions starting from the highest priority queue to ensure that high-threat responses are handled first. When the highest priority queue is empty, defensive actions from the second-highest priority queue, the third-highest priority queue, and the lowest priority queue are processed sequentially. Through this hierarchical queue mechanism, the system achieves differentiated scheduling of response actions for different threat levels, preventing low-priority actions from blocking the urgent execution of high-priority actions and ensuring the rational allocation of critical defense resources.

[0084] For defensive actions requiring network layer control, the collaborative execution module invokes the northbound application programming interface of the software-defined network controller to convert the defensive actions into standard OpenFlow flow table entries. These flow table entries conform to the OpenFlow protocol specification and include a matching field, a priority field, and an action instruction field. The generated OpenFlow flow table entries are distributed to core switches or border switches via the OpenFlow protocol. The switch hardware directly executes traffic blocking, bandwidth limiting, or traffic redirection operations, achieving real-time network control at the data plane level and ensuring that network layer defensive actions take effect within milliseconds.

[0085] When the defense action involves terminal isolation, the collaborative execution module simultaneously sends process isolation instructions to the terminal detection and response management platform, network access restriction instructions to the network access controller, and access permission revocation instructions to the zero-trust network access controller. Through the synchronous operation of multiple control planes, it ensures that the isolated terminal is synchronously restricted on the terminal side, network access side, and application access side, eliminating the security blind spots that may be left by single-point control and realizing collaborative defense across heterogeneous devices.

[0086] Furthermore, the simultaneous issuance of isolation instructions to the terminal detection and response management platform, the network access control controller, and the zero-trust network access controller includes: sending a preparation execution instruction to each device and waiting for each device to return a ready response; after all devices return a ready response, sending a submit execution instruction to each device to enable each device to perform the actual isolation operation; and when any device fails to return a ready response or returns a failure response, sending a rollback instruction to the device that has returned a ready response to cancel the prepared operation.

[0087] In this embodiment, for terminal isolation defense actions, the collaborative execution module employs a two-phase commit mechanism to achieve cross-device atomic transactions. This ensures that isolation operations on heterogeneous devices either all succeed or all roll back, avoiding inconsistencies caused by some devices succeeding while others fail. During the preparation phase, the collaborative execution module simultaneously sends instructions to the terminal detection and response management platform to prepare to isolate a specified host process, to the network access controller to prepare to move the specified host into the isolated virtual LAN, and to the zero-trust network access controller to prepare to revoke the application access permissions of the specified host. Upon receiving the preparation instructions, each device completes resource locking, configuration pre-verification, and other preparatory work locally, and returns a ready response to the collaborative execution module, indicating that it has completed the pre-execution preparations and is ready to execute immediately.

[0088] After confirming that the Terminal Detection and Response Management Platform, the Network Access Control Controller, and the Zero Trust Network Access Controller have all returned ready responses, the collaborative execution module enters the commit phase, sending a unified commit execution command to all devices. Upon receiving the commit command, the Terminal Detection and Response Management Platform terminates the malicious process on the target host and isolates related files; the Network Access Control Controller moves the target host into an isolated virtual LAN, cutting off its network communication with other network segments; and the Zero Trust Network Access Controller revokes all application access permissions for the host. This atomic commit mechanism ensures that the target terminal is simultaneously isolated on the terminal side, the network access side, and the application access side, eliminating security blind spots that might be left by single-point control. The total execution time of the entire two-phase commit can be controlled within milliseconds, and the transaction log is persistently stored for subsequent auditing and fault tracing.

[0089] If any device fails to return a ready response or returns a failure response, a rollback command is sent to the devices that have already returned a ready response to cancel the prepared operation. In this embodiment, if any device among the terminal detection and response management platform, network access control controller, and zero-trust network access controller fails to return a ready response or explicitly returns a failure response within a preset timeout period, the collaborative execution module immediately triggers the rollback mechanism. The collaborative execution module sends a rollback command to all devices that have returned a ready response, instructing each device to release locked resources, clear pre-verified temporary configurations, and restore the system state to the state before the issuance of the preparation execution command, thereby avoiding intermediate state residue caused by some devices completing preparation while others are not ready. Through the above two-phase commit and rollback mechanism, the system ensures the atomicity and consistency of collaborative isolation operations across heterogeneous devices.

[0090] Furthermore, this embodiment also proposes an incremental learning step for updating the CNN-LSTM model.

[0091] Specifically, the system collects new labeled samples periodically (e.g., weekly), including: high-confidence alarms (confidence ≥ 0.95) automatically labeled as positive samples; false alarms / missed alarms manually reported by security personnel; and attack events confirmed by post-incident investigation.

[0092] To avoid forgetting, an incremental learning method is used to protect important parameters from old tasks and prevent catastrophic forgetting.

[0093] Where θ represents the current model parameters; θ For old model parameters; F i The diagonal elements of the information matrix measure the parameter θ. i The importance of the old task; λ is the regularization strength. During incremental training, a smaller learning rate is used to avoid overfitting to new samples.

[0094] Furthermore, such as Figure 4The diagram illustrates the overall workflow architecture of the heterogeneous security device collaborative defense method based on control computing in this embodiment. The process begins with system initialization, including loading adapter configurations, registering devices, initializing the knowledge base, and other conditions. It then proceeds to multi-source data collection, encompassing feature extraction and log collection of firewall data, controller data, endpoint detection data, and network access data. Next, threat detection is performed, generating alarms through CNN-LSTM (convolutional neural network-long short term memory) fusion threat detection. Finally, system state awareness is established, constructing a state space based on CPU utilization, memory utilization, network throughput, and attack intensity. During offline training, supported by model structure design, loss function design, training environment construction, and reward function design, the process enters dynamic policy generation, involving action space design, Q-learning action selection, and multi-objective reward prediction. After policy calibration, relying on security knowledge graph construction, entity mapping, attack chain reasoning, and policy calibration, priority calculation and execution are performed, including priority calculation, hierarchical priority queues, and device collaborative execution. Control commands are issued, and finally, through closed-loop feedback and model optimization, including Q-value table updates and knowledge graph filling, the optimization results are fed back to the front end, forming a complete closed loop of perception-decision-execution-optimization until the process ends.

[0095] Secondly, this embodiment also proposes a heterogeneous security device defense system based on control and management computing, such as... Figure 5 As shown, the system includes: The acquisition module 501 is used to acquire monitoring data from various heterogeneous security devices and convert the monitoring data into standardized event data with a unified data format. Detection module 502 is used to input the standardized event data into a detection model composed of a concatenated convolutional neural network and a long short-term memory network, and output the threat type prediction probability of each device for the same network data stream. The detection model is trained using a loss function that includes the KL divergence between each pair of the threat type prediction probability distributions output by each device, and an additional penalty term when the KL divergence with the average probability distribution exceeds a preset threshold, to obtain a threat detection result including threat confidence, source address, destination address and process identifier. The decision module 503 is used to generate an initial defense strategy based on the threat detection results and the current network status, map the source address, destination address and process identifier in the threat detection results to a pre-built security entity association network, extend the search forward along the access relationship from the alarm source node to a preset depth to obtain a forward attack path, extend the search backward along the access relationship from the critical asset node to a preset depth to obtain a backward attack path, merge the forward attack path and the backward attack path to obtain an attack behavior path, and calibrate the initial defense strategy based on the attack behavior path to obtain a target defense strategy that covers the complete attack path; The execution module 504 is used to calculate the priority value of each defense action based on the threat confidence level and the predefined value level of the attacked target, and to send the control command corresponding to the defense action to the corresponding device in descending order of the priority value.

[0096] This system can be used to execute the heterogeneous security device defense method based on control computing described in the first aspect, which will not be elaborated further here.

[0097] Furthermore, in some embodiments, a specific ransomware lateral movement attack can be used as an example to fully demonstrate the implementation process of a heterogeneous security device defense system based on control computing. The system's software is deployed on one or more high-performance computing servers interconnected by a network. These servers are equipped with multi-core CPUs, large-capacity memory, high-speed solid-state drives, and dedicated graphics processing units. The network environment includes core switches, SDN switches, and multiple terminals and servers.

[0098] like Figure 6 The diagram shown is an architecture diagram of a heterogeneous security device defense system based on control computing in a specific implementation of this embodiment.

[0099] The first step is to implement unified management of heterogeneous devices.

[0100] 1. Data Acquisition: The terminal agent (EDR component) deployed on host_OA captured the process ransom.exe initiating a large number of file encryption operations, while simultaneously initiating a network connection to port 445 of host_Data; the traffic probe deployed on the network core switch captured TCP SYN packets from host_OA to host_Data, with the number of connections suddenly increasing to 50 per minute.

[0101] 2. Format Conversion and Feature Construction: The adapter formats the above events into standard triples: Event 1: {Source Object: “Host_OA::ransom.exe”, Operation Type: “File Encryption”, Target Object: “Host_OA::*.docx”, Timestamp: t1, Metadata: {Number of Files: 200}} Event 2: {Source Object: “Host_OA”, Operation Type: “Network Connection”, Target Object: “Host_Data::445”, Timestamp: t2, Metadata: {Number of Connections: 50, Data Size: 2MB}} The system deduplicates and normalizes the data, and extracts streaming features.

[0102] The second step is to perform CNN-LSTM-based fusion threat detection.

[0103] The intelligent detection module reads the feature sequence of Host_OA using a sliding window (window length 60 seconds, step size 1 second) and inputs it into a pre-trained CNN-LSTM model (four device heads: FW, EDR, NAC, ZTNA). The model outputs the probability distribution of the four device heads and calculates the relevant metrics for collaborative consistency loss.

[0104] 1. Model output: FW device: Ransomware 0.91, Lateral movement 0.07, Normal 0.02 EDR device: Ransomware 0.93, Lateral movement 0.05, Normal 0.02 NAC device: Ransomware 0.89, Lateral movement 0.08, Normal 0.03 ZTNA device: Ransomware 0.90, Lateral movement 0.07, Normal 0.03 2. Average confidence level and judgment:

[0105] It was determined to be a ransomware attack.

[0106] 3. Cross-device consistency check: Calculate the KL divergence between the FW head and the EDR head:

[0107] Similarly, the KL divergence between NAC and ZTNA is approximately 0.008, with a maximum KL divergence of 0.012 < 0.2, requiring no manual verification.

[0108] Generate an alert: {alert_id: “A001”, attack_type: “ransomware”, confidence:0.9075, src_ip: “Host_OA”, dst_ip: “Host_Data”, timestamp: t2}.

[0109] The third step is to generate dynamic collaborative strategies based on reinforcement learning.

[0110] The dynamic decision-making module reads the current network state and uses the Q-learning algorithm to generate an initial collaborative defense strategy.

[0111] 1. Status Acquisition and Normalization: s1 (average CPU utilization across the entire network) = 30% → 0.3 s2 (average memory usage across the entire network) = 40% → 0.4 S3 (network throughput) = 800 Mbps, maximum link bandwidth 10000 Mbps → 0.08 s4 (Attack Strength Level) = 0.9075 (direct confidence level) s5 (number of abnormal login attempts) = 0 times / minute → 0 s6 (critical service status) = 0 (normal) State vector S = [0.3, 0.4, 0.08, 0.9075, 0, 0] 2. Action Selection: Query the Q-value table trained offline. The action combination corresponding to the maximum Q-value in state S is: FW: 1 (Block) EDR: 3 (Isolation Process) NAC: 3 (Isolated VLAN) ZTNA: 1 (Blocked Access) The initial policy is A_init = {(1,FW), (3,EDR), (3,NAC), (1,ZTNA)}.

[0112] The fourth step is attack behavior reasoning and strategy calibration based on knowledge graphs. The knowledge reasoning module links entities in the alarm to the security knowledge graph, performs attack behavior reasoning, and calibrates the initial strategy.

[0113] 1. Entity Links: Host_OA → Node N1 (Office server, asset value = 2) Host_Data → Node N2 (Financial Database Server, Asset Value = 5) ransomware.exe → Node N3 (Known ransomware family, associated with the T1043 lateral movement attack technique) 2. Reasoning about aggressive behavior: Forward expansion: Starting from N1, search along the accesses relation at a depth of 2 to find the edge from N1 to N2 (SMB access).

[0114] Backward expansion: Search backward from the key asset set (containing N2) to confirm that N2 is reachable from N1.

[0115] The path merging revealed the attack behavior as N1 → N2, and the historical baseline showed that the normal access frequency of N1 to N2 was very low (≤2 times per hour), indicating that the current behavior is significantly abnormal.

[0116] 3. Policy Calibration: The initial policy only blocks N1's access to N2. After calibration, the following actions are added: Add a blocking rule to the firewall: prohibit all access from N1 to the financial database network segment (including N2). Implement temporary VLAN isolation for N1 on the NAC. Add suspicious process monitoring for N2 on the EDR.

[0117] The post-calibration policy is A_calib = A_init ∪ {(1,FW, financial network segment), (3,NAC,N1 isolation), (5,EDR,N2 monitoring)}.

[0118] The fifth step is collaborative execution based on SDN and dynamic priority calculation. The collaborative execution module transforms the calibrated policy into specific device instructions and uses the dynamic priority function to achieve adaptive resource scheduling.

[0119] 1. Dynamic priority calculation: Taking the action "Block N1 to the financial network segment" as an example: Confidence level Conf = 0.9075; Asset value Asset = 5 (database); SDN controller current load Load = 0.2; current time period is 14:00 (peak business period); dynamic threshold θ(t) = 0.5; kurtosis coefficient k = 5. Calculation process:

[0120] Since the priority domain is {1,2,3,4}, the actual value is P=4 (the highest priority is 1; the calculated result of 5 indicates an excess. In implementation, this is limited by min(4,·) or by adjusting the formula coefficients. In this embodiment, the actual mapping is P=1 (severe)). Similarly, the priority for isolation actions is P=2, and for monitoring actions it is P=3.

[0121] 2. SDN flow table distribution: The scheduler retrieves the blocking action from the Q1 queue, calls the northbound interface of the SDN controller, generates an OpenFlow 1.3 flow table entry, and distributes the flow table to the core switch via the OpenFlow protocol.

[0122] 3. Cross-device atomic transaction execution. For terminal isolation actions (involving EDR, NAC, and ZTNA), a two-phase commit is used: Preparation phase: Send "Prepare to isolate Host_OA process" to the EDR management platform, "Prepare to move Host_OA to the isolation VLAN" to the NAC controller, and "Prepare to revoke Host_OA permissions" to the ZTNA controller. All devices return "Ready".

[0123] Commit Phase: A commit command is sent, and each device executes the actual actions. The EDR terminates the ransom.exe process and isolates related files; the NAC moves Host_OA to the isolated VLAN; the ZTNA revokes all application access permissions for this host. Total execution time is 32ms, and the transaction log is persisted.

[0124] Step 6: Closed-loop feedback and model optimization. Actual reward calculation: After execution, the system monitored no abnormal traffic to Host_OA, the attack was successfully contained, business latency was less than 100ms, and CPU increment was 3%.

[0125] R_security = +10 (Interception successful) R_business = 0 (Delay < 100ms) R_resource = -0.01×3 = -0.03 The actual reward R_actual = 0.6×10 + 0.3×0 - 0.1×(-0.03) = 6 + 0.003 = 6.003.

[0126] Q-value table update: Update the Q-value of action A_calib in state S (α=0.01, γ=0.9) according to the Q-learning formula:

[0127] Incremental learning and knowledge graph expansion: The sample (feature sequence + attack label) is added to the incremental training set, and the elastic weight consolidation update of the CNN-LSTM model is triggered at intervals.

[0128] Extract the entity "ransom.exe" and its hash value from this incident, link it to existing nodes, establish an "exploits" relationship to the SMB vulnerability (CVE-2020-0796), and write it to the Neo4j graph database.

[0129] Compared with existing technologies, the heterogeneous security device collaborative defense method and system based on control computing provided by this invention has achieved certain technological progress and brought about the following beneficial effects by introducing core technologies such as cross-device collaborative consistency constraints, reinforcement learning dynamic decision-making, knowledge graph attack behavior reasoning, and dynamic priority execution: 1. Resolve the lack of collaboration among heterogeneous devices and achieve globally unified collaborative defense. This invention unifies heterogeneous security devices such as FW, EDR, NAC, and ZTNA into a management and control computing operating system through a smart adapter, constructing a global security data foundation and breaking the limitations of traditional "defense silos." Furthermore, it introduces a cross-device collaborative consistency constraint term into the loss function of the traditional CNN-LSTM detection model.

[0130] This constraint forces the probability distributions of detection outputs from different devices to be similar, making the judgments of each device on the same network flow more consistent. Simultaneously, through knowledge graph attack behavior reasoning, the system can correlate attack events scattered across multiple layers such as terminals, networks, and boundaries into complete attack behavior paths, enabling defense strategies to cover the entire attack lifecycle rather than just targeting single-point alarms. Compared to existing linkage methods that rely on static scripts, the collaborative strategy of this invention can be dynamically calibrated based on attack behavior, avoiding repeated blocking or response gaps, and realizing a transformation from "device silos" to "global collaboration."

[0131] 2. Solve the problem of low utilization of defense resources and achieve dynamic optimization of resource allocation. To address the shortcomings of existing solutions that rely on static scenarios and cannot dynamically adjust strategies based on real-time environments, this invention introduces a reinforcement learning-driven dynamic decision-making mechanism. Using the Q-learning algorithm, the system generates an optimal collaborative defense strategy based on real-time network conditions (CPU load, memory utilization, network throughput, attack intensity, critical service status, etc.). The reward function is R = w1Rsecurity + w2Rbusiness. w3Rresource seeks a dynamic balance between security effectiveness, business continuity, and resource consumption, enabling defense resources to be allocated on demand.

[0132] Based on this, the present invention proposes a dynamic priority calculation function:

[0133] This function dynamically adjusts the priority of each defense action based on threat confidence, the value of affected assets, the real-time load of the SDN controller, and the business period. When the controller load increases, the priority automatically decreases to avoid overloading the controller due to high-consumption actions; during peak business periods, the dynamic threshold θ(t) increases, making the system more conservative and protecting business continuity; during off-peak periods, the threshold decreases, making the system more sensitive and capable of executing more aggressive defenses, thus achieving a dynamic balance between security and business.

[0134] 3. Address the issue of delayed response and shorten the safety window. To address the slow response time caused by the traditional sequential process of "periodic detection + manual analysis + manual configuration," this invention constructs a fully automated closed-loop mechanism of "perception-decision-execution." At the perception level, a CNN-LSTM model continuously analyzes network traffic; at the decision level, a reinforcement learning module generates defense strategies in seconds based on real-time status through table lookups; at the execution level, the SDN controller directly converts the strategies into OpenFlow flow table entries for distribution. This fully automated process effectively curbs attackers' lateral movement and data theft during the "security window," enabling defenders to shift from passive response to proactive control.

[0135] Thirdly, this application provides an electronic device comprising: one or more processors, and a memory for storing one or more computer programs; the computer programs are configured to be executed by the one or more processors, and the programs include steps for performing the heterogeneous security device defense method based on control computing as described in the first aspect.

[0136] In this embodiment, the aforementioned electronic device is specifically embodied as one or more high-performance computing servers interconnected via a network. These servers are equipped with multi-core central processing units, large-capacity memory, high-speed solid-state drives, and professional graphics processing units. The network environment includes core switches, SDN switches, and multiple terminals and servers. The computer program stored in the memory is loaded into the execution space of the multi-core central processing unit, which then executes the following steps of the heterogeneous security device defense method based on control computing as described in the first aspect, according to the program instructions.

[0137] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A method for defending heterogeneous security devices based on control and management computation, characterized in that, The method includes: Acquire monitoring data from various heterogeneous security devices and convert the monitoring data into standardized event data with a unified data format; The standardized event data is input into a detection model composed of a concatenated convolutional neural network and a long short-term memory network. The detection model outputs the threat type prediction probability of each device for the same network data stream. The detection model is trained using a loss function that includes the KL divergence between each pair of the threat type prediction probability distributions output by each device, and an additional penalty term when the KL divergence with the average probability distribution exceeds a preset threshold. The result is a threat detection result that includes threat confidence, source address, destination address, and process identifier. An initial defense strategy is generated based on the threat detection results and the current network status. The source address, destination address, and process identifier in the threat detection results are mapped to a pre-built security entity association network. A forward attack path is obtained by extending the search forward along the access relationship from the alarm source node to a preset depth. A backward attack path is obtained by extending the search backward along the access relationship from the critical asset node to a preset depth. The forward attack path and the backward attack path are merged to obtain the attack behavior path. The initial defense strategy is calibrated based on the attack behavior path to obtain a target defense strategy that covers the complete attack path. Based on the threat confidence level and the predefined value level of the attacked target, the priority value of each defense action is calculated, and the control command corresponding to the defense action is sent to the corresponding device in descending order of the priority value.

2. The heterogeneous security device defense method based on control computing according to claim 1, characterized in that, The step of converting the monitoring data into standardized event data with a unified data format includes: The device adapter collects monitoring data from firewalls, endpoint detection and response devices, network access control devices, and zero-trust network access devices. Based on the network connection quintuple, the network traffic data in the standardized event data is segmented into sessions. Data packets belonging to the same session within a time window are aggregated into stream records, and the duration, data packet size, and byte rate of the stream records are extracted as behavioral features. The behavioral features are normalized to obtain a normalized feature sequence, which is then input into the detection model.

3. The heterogeneous security device defense method based on control computing according to claim 1, characterized in that, The step of inputting the standardized event data into a detection model composed of a concatenated convolutional neural network and a long short-term memory network includes: The detection model includes a one-dimensional convolutional layer, a pooling layer, a long short-term memory network layer, and a fully connected layer; the one-dimensional convolutional layer uses multiple convolutional kernels of different scales to extract local spatial features; the long short-term memory network layer contains a preset number of memory units for extracting temporal dependency features; Each device outputs the predicted probability of the threat type, and the predicted probability of the threat type output by each device is averaged to obtain the threat confidence. The source address, destination address and process identifier are extracted from the standardized event data to obtain the threat detection result. Specifically, when training the detection model, the difference penalty term in the loss function is the sum of the KL divergences between each pair of the threat type prediction probability distributions output by each device; the KL divergence between the threat type prediction probability distribution output by each device and the average threat type prediction probability distribution is calculated, and when the KL divergence exceeds a preset threshold, an additional penalty term is added; the maximum KL divergence between the threat type prediction probability distributions output by each device is compared with a preset difference value, and when it exceeds the preset difference value, the corresponding network data stream is marked as a cooperative uncertainty event.

4. The heterogeneous security device defense method based on control and management computing according to claim 1, characterized in that, The step of generating an initial defense strategy based on the threat detection results and the current network status includes: The current network load status parameters are normalized to form a status vector, which includes the network average CPU utilization, the network average memory utilization, the ratio of network throughput to the maximum link bandwidth, the threat confidence, the number of abnormal login attempts, and the key service status identifier. Based on the state vector, query the Q-value table and select the defensive action combination with the largest Q-value as the defensive action corresponding to the current state; After the defense action is executed, the actual reward value is calculated based on the actual security effect, the impact of business delay, and the increase in resource consumption. The Q value of the corresponding state and action pair in the Q value table is updated according to the preset learning rate and discount factor.

5. The heterogeneous security device defense method based on control computing according to claim 4, characterized in that, The target defense strategy that covers the entire attack path includes: The source address and destination address are mapped to IP addresses or host nodes in the network associated with the security entity, and the process identifier is mapped to a process node; Starting from the alarm source node, the search extends forward along the access relationship to a preset depth to obtain the forward attack path. Starting from the critical asset node, the search extends backward along the access relationship to a preset depth to obtain the backward attack path. The forward attack path and the backward attack path are merged to obtain the attack behavior path set. When a lateral movement path exists in the set of attack behavior paths, at least one of the following shall be added to the initial defense strategy: add a blocking rule on the firewall side to block access to critical assets by intermediate nodes on the attack path; implement access restrictions on the intermediate nodes on the network access control side; add process monitoring of the intermediate nodes on the terminal detection and response side, thereby obtaining the target defense strategy.

6. The heterogeneous security device defense method based on control computing according to claim 1, characterized in that, The calculation of priority values ​​for each defensive action based on the threat confidence level and the predefined value level of the attacked target includes: Obtain the current CPU utilization of the software-defined network controller and the dynamic threshold corresponding to the current service period; The product of the threat confidence level and the predefined value level is used as the numerator, and the sum of the current CPU utilization of the software-defined network controller and the dynamic threshold is used as the denominator. The result is then input into an S-shaped function to calculate the continuous priority value. The continuous priority value is discretized into multiple integer priority levels, with the highest priority level of defense action being executed first.

7. The heterogeneous security device defense method based on control computing according to claim 1, characterized in that, The step of issuing control commands corresponding to the defense action to the corresponding devices in descending order of priority values ​​includes: The defensive actions are assigned to the corresponding priority queues according to their priority values. The defensive actions with the highest priority values ​​are assigned to the highest priority queue, the second highest priority values ​​are assigned to the second highest priority queue, the third highest priority values ​​are assigned to the third priority queue, and the lowest priority values ​​are assigned to the lowest priority queue. For network layer blocking, rate limiting, or traffic redirection defense actions, the northbound interface of the software-defined network controller is invoked to generate OpenFlow flow table entries and then sent to the switch for execution. For endpoint isolation defense actions, isolation commands are simultaneously issued to the endpoint detection and response management platform, the network access controller, and the zero-trust network access controller.

8. The heterogeneous security device defense method based on control computing according to claim 7, characterized in that, The simultaneous issuance of isolation commands to the terminal detection and response management platform, network access control controller, and zero-trust network access controller includes: Send a readiness command to each device and wait for a ready response from each device; Once all devices return a ready response, a submit execution command is sent to each device to enable each device to perform the actual isolation operation. If any device fails to return a ready response or returns a failure response, a rollback command is sent to the device that has returned a ready response to undo the prepared operation.

9. A heterogeneous security device defense system based on control and management computing, characterized in that, The system includes: The acquisition module is used to acquire monitoring data from various heterogeneous security devices and convert the monitoring data into standardized event data with a unified data format. The detection module is used to input the standardized event data into a detection model composed of a concatenated convolutional neural network and a long short-term memory network. The detection model outputs the threat type prediction probability of each device for the same network data stream. The detection model is trained using a loss function that includes the KL divergence between each pair of the threat type prediction probability distributions output by each device, and an additional penalty term when the KL divergence with the average probability distribution exceeds a preset threshold. The result is a threat detection result that includes threat confidence, source address, destination address, and process identifier. The decision module is used to generate an initial defense strategy based on the threat detection results and the current network status. It maps the source address, destination address, and process identifier in the threat detection results to a pre-built security entity association network. Starting from the alarm source node, it extends the search forward along the access relationship to a preset depth to obtain a forward attack path. Starting from the critical asset node, it extends the search backward along the access relationship to a preset depth to obtain a backward attack path. It merges the forward attack path and the backward attack path to obtain an attack behavior path. It calibrates the initial defense strategy based on the attack behavior path to obtain a target defense strategy that covers the entire attack path. The execution module is used to calculate the priority value of each defense action based on the threat confidence level and the predefined value level of the attacked target, and to issue the control command corresponding to the defense action to the corresponding device in descending order of the priority value.

10. An electronic device, the electronic device comprising: One or more processors, a memory for storing one or more computer programs; characterized in that the computer programs are configured to be executed by the one or more processors, the programs including steps for performing the heterogeneous security device defense method based on control computing as described in any one of claims 1-8.

Images