Method and device for vulnerability assessment of large-scale critical information infrastructure
By employing a temporal dynamic hypergraph encoder and a self-supervised learning strategy, the problems of lag and high cost in node vulnerability assessment in large-scale critical information infrastructure are solved, enabling low-cost, real-time node vulnerability ranking to guide operation and maintenance optimization.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- NORTHWEST INST OF NUCLEAR TECH
- Filing Date
- 2026-04-01
- Publication Date
- 2026-06-26
AI Technical Summary
In large-scale critical information infrastructure, existing technologies suffer from problems such as lag caused by dynamic evolution, high cost of predicting cascading failures, and insufficient sorting accuracy, making it impossible to accurately identify and assess the vulnerability of critical nodes in the network.
By employing a temporal dynamic hypergraph encoder combined with a self-supervised learning strategy, a target inference model is constructed by generating dynamic embedding representations and soft labels for nodes, enabling real-time assessment of node vulnerability.
It enables low-cost, real-time node vulnerability sorting, guiding operations and maintenance personnel to perform software upgrades and network architecture optimization, thereby improving system stability and emergency response capabilities.
Smart Images
Figure CN122286779A_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of computer technology, and in particular to a vulnerability assessment method and apparatus for large-scale critical information infrastructure. Background Technology
[0002] With the rapid development of social networks, the Internet of Things, transportation systems, and infrastructure networks, accurately identifying and assessing the vulnerability of key nodes in these networks has become a core issue in complex network research. Node vulnerability typically refers to the importance of a node in a network and the potential disruption to the overall network function caused by its removal. Node vulnerability assessment is of great significance in fields such as public safety, information dissemination, disease control, and network robustness analysis. For example, in infectious disease networks, identifying the most vulnerable nodes can help develop effective isolation or vaccination strategies; in power and transportation systems, timely detection of key nodes helps improve system stability and emergency response capabilities; and in social media platforms, identifying vulnerable nodes allows for a better understanding of the critical links in information dissemination. Therefore, vulnerability prediction has gradually become a research hotspot in complex network analysis.
[0003] In large-scale critical information infrastructure, such as large cloud data centers and smart grid communication networks, the following specific challenges are typically faced during maintenance: 1. The lag caused by dynamic evolution: Traditional static graph analysis methods ignore the fact that network topology changes rapidly over time. For example, server access records from a week ago should have a very low weight in risk assessment at the current moment, but existing algorithms often cannot distinguish the weight difference between "old interactions" and "recently active interactions". 2. High cost of cascading failure prediction: To accurately assess the importance of a node, traditional methods require running complex dynamic simulations, such as simulating virus propagation or load overload. This is too time-consuming in data centers with millions of nodes and cannot meet the needs of real-time early warning. 3. Insufficient sorting accuracy: Traditional regression models struggle to capture the relative importance of nodes, i.e., Top-K sorting (node vulnerability sorting), which makes it difficult for operations and maintenance personnel to accurately locate the core nodes that most need reinforcement. Summary of the Invention
[0004] To address the technical problems of vulnerability analysis being outdated, costly, and lacking accurate ranking precision, thus failing to provide precise node vulnerability ranking results, this invention provides a vulnerability assessment method for large-scale critical information infrastructure, comprising: Collect interaction event information from different large-scale critical information infrastructures; Generate a time-series dynamic hypergraph based on the interactive event information; A temporal hypergraph encoder is constructed, and the temporal hypergraph encoder is trained by combining the temporal dynamic hypergraph, the counterfactual hypergraph and the self-supervised learning strategy. The trained temporal hypergraph encoder is used to generate dynamic embedded representations of nodes by aggregating the temporal dynamic hypergraph. The nodes are network nodes in large-scale critical information infrastructure. Based on dynamic propagation simulation and topological robustness analysis algorithm, soft labels are determined regarding node vulnerability, and different soft labels represent different vulnerabilities; A target inference model is constructed by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels. The target inference model is used to determine the soft labels of each node in the temporal dynamic hypergraph and generate a vulnerability ranking of multiple nodes based on the soft labels. The target inference model is invoked to process the interaction event information of the infrastructure to be evaluated, and the node vulnerability ranking corresponding to the target inference model is obtained.
[0005] In one embodiment, the method further includes: Introducing attention coefficients in the temporal hypergraph encoder : ; in, Let || be the initial representation of the hyperedge e, and || denote the concatenation operation. u For super-edge e Any node in the set, and Each in timestamp t -1 node v and nodes u The vectorized embedding, where 'a' is a learnable column vector of weights. T It is its transpose.
[0006] In one embodiment, the temporal supergraph encoder, when performing aggregation processing, includes: By combining the embedding information of other nodes in all hyperedges to which each node belongs with the time-aware gating factor, the aggregated information of the current time step is obtained.
[0007] In one embodiment, the aggregation of embedding information of other nodes in all hyperedges to which each node belongs, using a time-aware gating factor, includes: The time difference between the current time and the time when the hyperedge is generated is embedded into the aggregation weight. The closer the hyperedge is to the current time, the higher the corresponding aggregation weight. The embedding information of other nodes in all hyperedges to which each node belongs is aggregated by combining the aggregation weights.
[0008] In one embodiment, the method further includes: Biased sampling is performed on the temporal dynamic hypergraph to obtain the counterfactual hypergraph that masks high centrality nodes and their associated hyperedges.
[0009] In one embodiment, the method further includes: The loss function applied when constructing and training the temporal hypergraph encoder : ; For nodes Causal weighted terms, V Represents the set of all nodes. For nodes The original feature representation, and These are nodes Constructed positive samples similar to their own context representation and those similar to nodes u The context represents dissimilar negative samples. It is a hyperparameter of temperature coefficient.
[0010] In one embodiment, the algorithm for determining soft labels regarding node vulnerability based on dynamic propagation simulation and topological robustness analysis includes: The global influence range of each node is determined based on the independent cascade or SIR model; After removing each of the aforementioned nodes, determine the collapse rate of the largest connected component in the network formed by the temporal dynamic hypergraph; The vulnerability of each node is determined by combining the global impact range and the crash speed; Multiple different soft tags about node vulnerabilities are generated by combining the vulnerabilities of each node.
[0011] In one embodiment, constructing a target inference model by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels includes: Construct a mapping network; A target inference model is constructed based on the mapping network, the dynamic embedding representation of the nodes output by the temporal hypergraph encoder, and soft labels.
[0012] In one embodiment, the method further includes: Construct a hybrid topology-preserving loss function, and use the hybrid topology-preserving loss function to train the target inference model; The hybrid topology order-preserving loss function includes a point-level regression loss function, a pairwise sorting loss function, and a distribution alignment loss function.
[0013] Another embodiment of the present invention also provides a vulnerability assessment device for large-scale critical information infrastructure, comprising: The data acquisition module is used to collect interactive event information from different large-scale critical information infrastructures. The generation module is used to generate a time-series dynamic hypergraph based on the interactive event information; The first construction module is used to construct a temporal hypergraph encoder and train the temporal hypergraph encoder by combining the temporal dynamic hypergraph, the counterfactual hypergraph and the self-supervised learning strategy. The trained temporal hypergraph encoder is used to generate dynamic embedded representations of nodes by aggregating the temporal dynamic hypergraph. The nodes are network nodes in a large-scale critical information infrastructure. The first determining module is used to determine soft labels about node vulnerability based on dynamic propagation simulation and topological robustness analysis algorithms, wherein different soft labels represent different vulnerabilities; The second construction module is used to construct a target inference model by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels. The target inference model is used to determine the soft labels of each node in the temporal dynamic hypergraph and generate a vulnerability ranking of multiple nodes based on the soft labels. The evaluation module is used to call the target inference model to process the interaction event information of the infrastructure to be evaluated, and obtain the node vulnerability ranking corresponding to the target inference model.
[0014] Based on the above, it is clear that the solution disclosed in this application has low analysis cost and strong real-time performance. It can accurately output the vulnerability ranking results of nodes in the network, thereby guiding operation and maintenance personnel to prioritize software upgrades, vulnerability patching, or the addition of backup power for highly vulnerable nodes. Moreover, during the network architecture design phase, the output results of this solution can also assist staff in adding redundant links to these vulnerabilities, eliminating the risk of single points of failure.
[0015] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures particularly pointed out in the written description, claims, and drawings.
[0016] The technical solution of this application will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description
[0017] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.
[0018] Figure 1 This is a flowchart illustrating the vulnerability assessment method for large-scale critical information infrastructure in an embodiment of the present invention.
[0019] Figure 2 This is a flowchart illustrating a vulnerability assessment method for large-scale critical information infrastructure according to another embodiment of the present invention.
[0020] Figure 3 This is a flowchart illustrating a vulnerability assessment method for large-scale critical information infrastructure in another embodiment of the present invention.
[0021] Figure 4 This is a schematic diagram of the vulnerability assessment device for large-scale critical information infrastructure in an embodiment of the present invention. Detailed Implementation
[0022] The specific embodiments of the present invention will now be described in detail with reference to the accompanying drawings, but these are not intended to limit the scope of the invention.
[0023] It should be understood that various modifications can be made to the embodiments disclosed herein. Therefore, the following description should not be considered as limiting, but merely as an example of embodiments. Other modifications within the scope of this disclosure will be apparent to those skilled in the art.
[0024] The accompanying drawings, which are included in and form part of this specification, illustrate embodiments of the present disclosure and, together with the general description of the disclosure given above and the detailed description of the embodiments given below, serve to explain the principles of the disclosure.
[0025] These and other features of the invention will become apparent from the following description of preferred forms of embodiments given as non-limiting examples, with reference to the accompanying drawings.
[0026] It should also be understood that although the invention has been described with reference to some specific examples, those skilled in the art can certainly implement many other equivalent forms of the invention, which have the features described in the claims and are therefore all within the scope of protection defined herein.
[0027] The above and other aspects, features and advantages of this disclosure will become more apparent when taken in conjunction with the accompanying drawings and in view of the following detailed description.
[0028] Specific embodiments of the present disclosure are described thereafter with reference to the accompanying drawings; however, it should be understood that the disclosed embodiments are merely examples of the present disclosure and can be implemented in various ways. Well-known and / or repeated functions and structures are not described in detail to avoid unnecessary or redundant details that could obscure the present disclosure. Therefore, the specific structural and functional details disclosed herein are not intended to be limiting, but merely to serve as the basis and representative basis for the claims to teach those skilled in the art to use the present disclosure in a variety of substantially any suitable detailed structures.
[0029] This specification may use the phrases “in one embodiment,” “in another embodiment,” “in yet another embodiment,” or “in still another embodiment,” all of which may refer to one or more of the same or different embodiments according to this disclosure.
[0030] The embodiments of the present invention will now be described in detail with reference to the accompanying drawings.
[0031] As shown in the figure, this embodiment of the invention provides a vulnerability assessment method for large-scale critical information infrastructure, including: S1: Collect interaction event information from different large-scale critical information infrastructures; S2: Generate a time-series dynamic hypergraph based on the interactive event information; S3: Construct a temporal hypergraph encoder and train the temporal hypergraph encoder by combining the temporal dynamic hypergraph, the counterfactual hypergraph, and the self-supervised learning strategy. The trained temporal hypergraph encoder is used to generate dynamic embedded representations of nodes by aggregating the temporal dynamic hypergraph. The nodes are network nodes in large-scale critical information infrastructure. S4: Based on dynamic propagation simulation and topological robustness analysis algorithm, soft labels for node vulnerability are determined, and different soft labels represent different vulnerabilities; S5: Combine the dynamic embedding representation of the node output by the temporal hypergraph encoder with the soft label to construct a target inference model. The target inference model is used to determine the soft label of each node in the temporal dynamic hypergraph and generate a vulnerability ranking of multiple nodes based on the soft label. S6: Call the target inference model to process the interaction event information of the infrastructure to be evaluated, and obtain the node vulnerability ranking corresponding to the target inference model.
[0032] The proposed solution in this embodiment aims to address the challenges of modeling high-order temporal dependencies, acquiring accurate labels, and achieving low inference efficiency in assessing node vulnerability in large-scale dynamic networks. Specifically, the large-scale critical information infrastructure described in this embodiment may include, but is not limited to, large cloud data centers, smart grid communication networks, and financial transaction networks. In large cloud data centers, the method in this embodiment can analyze microservice call chains to prevent single-point failures from causing service avalanches. In smart grid communication networks, the method in this embodiment can identify critical control nodes to prevent localized communication congestion from causing grid scheduling failures. In financial transaction networks, the method in this embodiment can monitor the fund flow network in high-frequency trading to identify core accounts or gateways that may lead to systemic risks. In other words, in these scenarios, the goal of this embodiment is to identify "critical vulnerable nodes" from massive historical interaction logs that, if they fail or are attacked, would cause a significant decline in the connectivity or functionality of the entire network.
[0033] That is, this embodiment processes multi-entity interaction log data with timestamps, including: Entities (Nodes): Specific physical or logical units (such as server IP, microservice instance, substation control terminal, financial account).
[0034] Hyperedges: These record the collaborative or related behaviors of multiple entities within the same time window. For example, "At time t, user A accesses database C through gateway B," which constitutes a hyperedge containing (A, B, C).
[0035] Time information: The precise moment when each interaction occurs. The system then transforms the discrete logs into a time-series dynamic hypergraph, allowing subsequent operations to proceed. In this embodiment, the target model outputs a vulnerability / importance ranking list of network nodes. For example, the output can be an ordered list of nodes, with higher-ranked nodes being more critical to system stability. In other words, the top-ranked node means that if it fails, becomes congested, or is compromised, the network's maximum connected component (LCC) will collapse the fastest, or the network's service capacity will decline the most.
[0036] By applying the solution disclosed in this embodiment, maintenance personnel can be guided to prioritize software upgrades, vulnerability patching, or the addition of backup power to highly vulnerable nodes (i.e., Top-K nodes). Furthermore, during the network architecture design phase, based on the identified Top-K nodes, it can also assist staff in adding redundant links to these vulnerable points, eliminating the risk of single points of failure.
[0037] Because existing hypergraph convolutional networks typically aggregate information from historical snapshots equally, they overlook the crucial characteristic that "recent interactions have a greater impact on current vulnerabilities." Therefore, this embodiment designs a high-order attention aggregation mechanism that is aware of temporal decay.
[0038] Specifically, the method further includes: S7: Introduce attention coefficients into the temporal hypergraph encoder. : ; in, Let || be the initial representation of the hyperedge e, and || denote the concatenation operation. u For super-edge e Any node in the set, and Each in timestamp t -1 node v and nodes u The vectorized embedding, i.e., its original feature representation, 'a' is a learnable column vector of weights. T It is its transpose vector.
[0039] For example, suppose t A snapshot of the hypergraph at a given time (i.e., a time-series dynamic hypergraph) is For nodes v The update process of its dynamic embedded representation includes the computation node v When considering the contribution of a superedge, unlike previous average aggregation processing, this embodiment introduces an attention coefficient. This step is used to ensure that the encoder and subsequent target model can identify the key core nodes that cause the superedge (such as group, team) to fail.
[0040] Furthermore, during the aggregation process performed by the temporal supergraph encoder, the following steps are included: S301: Combine the embedding information of other nodes in all hyperedges to which each node belongs with the time-aware gating factor to obtain the aggregated information of the current time step.
[0041] The above-mentioned scheme refers to the introduction of a time-aware gating factor when updating nodes by aggregating hyperedge information. This embodiment shows that the time-aware gating factor is used to aggregate the embedded information of other nodes in the hyperedge.
[0042] Specifically, such as Figure 2 As shown, the aggregation of embedding information of other nodes in all hyperedges to which each node belongs, using a time-aware gating factor, includes: S302: Embed the time difference between the current time and the time when the hyperedge is generated into the aggregation weight. The closer the time when the hyperedge is generated is to the current time, the higher the corresponding aggregation weight. S303: Combine the aggregation weights to aggregate the embedding information of other nodes in all hyperedges to which each node belongs.
[0043] For example, the current time With the time of superedge generation t Time difference Embedded into aggregate weights:
[0044] in, It is a learnable temporal decay rate parameter. This mechanism assigns higher weights to recent higher-order structures, making the generated nodes more embedded. It can sensitively reflect the recent dynamic evolution trends of the network, rather than being diluted by outdated historical information.
[0045] To address the label scarcity problem and improve the generalization ability of the target model, this embodiment abandons random Dropout (regularization) and proposes a counterfactual perturbation strategy guided by centrality, and constructs a contrastive learning task based on this strategy. Specifically, it is first defined that if a node is fragile / critical, then masking it and its neighborhood will cause a drastic drift in the network representation; otherwise, the drift is smaller. Based on this, the system in this embodiment estimates a prior probability based on the degree centrality or betweenness centrality of the node. Then, based on this probability, the original hypergraph is sampled, including: S304: Perform biased sampling on the temporal dynamic hypergraph to obtain the counterfactual hypergraph that masks high centrality nodes and their associated hyperedges.
[0046] After obtaining the counterfactual hypergraph, the system trains the temporal hypergraph encoder by combining the temporal dynamic hypergraph, the counterfactual hypergraph, and a self-supervised learning strategy. During training, unlike traditional contrastive learning that maximizes the similarity between two views, the goal of this embodiment is to learn causal invariance. To this end, the method further includes: S305: The loss function applied when constructing and training the temporal hypergraph encoder. : ; For nodes Causal weighted terms, V Represents the set of all nodes. For nodes The original feature representation, and These are nodes Constructed positive samples similar to their own context representation and those similar to nodes uThe context represents dissimilar negative samples. It is a hyperparameter of temperature coefficient, which controls the model's ability to distinguish negative samples.
[0047] When training the encoder using the loss function described above, if the node v In the counterfactual hypergraph, the representation of the node is masked, and the system does not require it to be completely identical to the original (because the structure has indeed changed). Instead, it requires the representation of its neighboring nodes to remain relatively stable. This forces the encoder to capture those robust high-order patterns in the network that are "not easily changed by the removal of individual nodes," thus better distinguishing the real structural vulnerabilities.
[0048] In another embodiment, to avoid the high computational cost of online inference, this embodiment constructs an asymmetric knowledge transfer architecture, comprising two models: a dynamic simulation oracle and a lightweight inference agent. The oracle is used to determine the soft tags, such as... Figure 3 As shown, soft labels regarding node vulnerability are determined based on dynamic propagation simulation and topological robustness analysis algorithms, including: S401: Determine the global influence range of each node based on the independent cascade or SIR model; S402: Determine the collapse rate of the largest connected component in the network formed by the temporal dynamic hypergraph after removing each of the nodes; S403: Determine the vulnerability of each node by combining the global impact range and crash speed; S404: Generate multiple different soft tags about the vulnerability of each node by combining the vulnerability of each node.
[0049] For example, in this embodiment, the oracle does not participate in gradient updates but only acts as an offline high-fidelity signal generator. It integrates two physical processes: Dynamics propagation simulation: Run independent cascade (IC) or SIR models to obtain the global influence range of nodes. ; Topological robustness analysis: Calculate the collapse rate of the maximum connected component (LCC) of the network formed by the hypergraph after removing individual nodes. .
[0050] Next, by combining the global impact range and the crash speed, a comprehensive analysis was conducted to form soft tags for the nodes. : ; Where β is a preset weighting coefficient.
[0051] Furthermore, the step of constructing a target inference model by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels includes: S501: Construct a mapping network; S502: Construct a target inference model based on the mapping network, the dynamic embedding representation of the nodes output by the temporal hypergraph encoder, and soft labels.
[0052] The target inference model in this embodiment is a lightweight inference agent, which is a mapping network based on an MLP model. The input of the model is the node embedding information generated by the encoder. h v The output is the predicted score. .
[0053] The method further includes: S503: Construct a hybrid topology-preserving loss function and train the target inference model using the hybrid topology-preserving loss function; S504: The hybrid topology order-preserving loss function includes a point-level regression loss function, a pairwise sorting loss function, and a distribution alignment loss function.
[0054] Specifically, to address the issue that traditional regression (MSE) cannot accurately capture the "Top-K key node ranking", this embodiment designs a hybrid topology order-preserving loss function. :
[0055] in, and These are the preset weighting coefficients.
[0056] The hybrid loss function includes: Point-level regression loss ( ): Using MSE ensures that the predicted value numerically approximates the soft label generated by the oracle.
[0057] Pair sorting loss ( This embodiment randomly samples node pairs in the training batch. i , j This forces the surrogate model's ranking to match the oracle's ranking. This is crucial for vulnerability prediction.
[0058] The above formula indicates that if the oracle considers a node... i Compare j It is more fragile, but the target reasoning model predicts the opposite result, which will impose a huge penalty on the model; if the direction is consistent, the loss is 0.
[0059] Distribution alignment loss ( KL divergence constraint: The overall distribution of predicted scores is consistent with the distribution of oracle scores, preventing predicted values from collapsing into a local interval.
[0060] Finally, this embodiment combines self-supervised learning with the surrogate mapping task to form an end-to-end training objective:
[0061] During the inference phase, the simulated oracle is completely removed. The system extracts features solely using a trained temporally decaying aware hypergraph encoder and directly outputs the vulnerability ranking through a lightweight inference agent.
[0062] The above scheme reduces the inference time complexity of this method on large-scale dynamic networks from [previous level]. The time complexity of traditional simulation methods is reduced to O(|E| + N) (linear complexity), achieving a perfect balance between accuracy and efficiency.
[0063] like Figure 4 As shown, another embodiment of the present invention also provides a vulnerability assessment device for large-scale critical information infrastructure, comprising: The data acquisition module is used to collect interactive event information from different large-scale critical information infrastructures. The generation module is used to generate a time-series dynamic hypergraph based on the interactive event information; The first construction module is used to construct a temporal hypergraph encoder and train the temporal hypergraph encoder by combining the temporal dynamic hypergraph, the counterfactual hypergraph and the self-supervised learning strategy. The trained temporal hypergraph encoder is used to generate dynamic embedded representations of nodes by aggregating the temporal dynamic hypergraph. The nodes are network nodes in a large-scale critical information infrastructure. The first determining module is used to determine soft labels about node vulnerability based on dynamic propagation simulation and topological robustness analysis algorithms, wherein different soft labels represent different vulnerabilities; The second construction module is used to construct a target inference model by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels. The target inference model is used to determine the soft labels of each node in the temporal dynamic hypergraph and generate a vulnerability ranking of multiple nodes based on the soft labels. The evaluation module is used to call the target inference model to process the interaction event information of the infrastructure to be evaluated, and obtain the node vulnerability ranking corresponding to the target inference model.
[0064] In one embodiment, the device further includes: A configuration module is used to introduce attention coefficients in the temporal hypergraph encoder. : ; in, Let || be the initial representation of the hyperedge e, and || denote the concatenation operation. u For super-edge e Any node in the set, and Each in timestamp t -1 node v and nodes u The vectorized embedding, where 'a' is a learnable column vector of weights. T It is its transpose vector.
[0065] In one embodiment, the temporal supergraph encoder, when performing aggregation processing, includes: By combining the embedding information of other nodes in all hyperedges to which each node belongs with the time-aware gating factor, the aggregated information of the current time step is obtained.
[0066] In one embodiment, the aggregation of embedding information of other nodes in all hyperedges to which each node belongs, using a time-aware gating factor, includes: The time difference between the current time and the time when the hyperedge is generated is embedded into the aggregation weight. The closer the hyperedge is to the current time, the higher the corresponding aggregation weight. The embedding information of other nodes in all hyperedges to which each node belongs is aggregated by combining the aggregation weights.
[0067] In one embodiment, the device further includes: A biased sampling module is used to perform biased sampling on the temporal dynamic hypergraph to obtain the counterfactual hypergraph that masks high centrality nodes and their associated hyperedges.
[0068] In one embodiment, the device further includes: The second construction module is used to construct the loss function applied when training the temporal hypergraph encoder. : ; For nodes Causal weighted terms, V Represents the set of all nodes. For nodes The original feature representation, and These are nodes Constructed positive samples similar to their own context representation and those similar to nodes u The context represents dissimilar negative samples. It is a hyperparameter of temperature coefficient.
[0069] In one embodiment, the algorithm for determining soft labels regarding node vulnerability based on dynamic propagation simulation and topological robustness analysis includes: The global influence range of each node is determined based on the independent cascade or SIR model; After removing each of the aforementioned nodes, determine the collapse rate of the largest connected component in the network formed by the temporal dynamic hypergraph; The vulnerability of each node is determined by combining the global impact range and the crash speed; Multiple different soft tags about node vulnerabilities are generated by combining the vulnerabilities of each node.
[0070] In one embodiment, constructing a target inference model by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels includes: Construct a mapping network; A target inference model is constructed based on the mapping network, the dynamic embedding representation of the nodes output by the temporal hypergraph encoder, and soft labels.
[0071] In one embodiment, the device further includes: Construct a hybrid topology-preserving loss function, and use the hybrid topology-preserving loss function to train the target inference model; The hybrid topology order-preserving loss function includes a point-level regression loss function, a pairwise sorting loss function, and a distribution alignment loss function.
[0072] Another embodiment of the present invention also provides an electronic device, comprising: One or more processors; Memory, configured to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the vulnerability assessment method for large-scale critical information infrastructure as described in any one of the above descriptions.
[0073] Furthermore, one embodiment of the present invention also provides a storage medium storing a computer program thereon, which, when executed by a processor, implements the vulnerability assessment method for large-scale critical information infrastructure as described above. It should be understood that the various solutions in this embodiment have the corresponding technical effects in the above-described method embodiments, and will not be repeated here.
[0074] Furthermore, embodiments of the present invention also provide a computer program product tangibly stored on a computer-readable medium and comprising computer-readable instructions that, when executed, cause at least one processor to perform a vulnerability assessment method for large-scale critical information infrastructure, such as those described in the embodiments above.
[0075] It should be noted that the computer storage medium of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable medium can be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, system, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, a random access storage medium (RAM), a read-only storage medium (ROM), an erasable programmable read-only storage medium (EPROM or flash memory), an optical fiber, a portable compact disk read-only storage medium (CD-ROM), an optical storage medium, a magnetic storage medium, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, system, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, carrying computer-readable program code. Such propagated data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. Computer-readable signal media can also be any computer-readable medium other than computer-readable storage media, which can send, propagate, or transmit a program configured for use by or in connection with an instruction execution system, system, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to: wireless, antenna, optical fiber, RF, etc., or any suitable combination thereof.
[0076] Furthermore, those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage and optical storage) containing computer-usable program code.
[0077] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.
[0078] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.
[0079] Those skilled in the art should understand that the discussion of any of the above embodiments is merely exemplary and is not intended to imply that the scope of protection of this application is limited to these examples; within the framework of this application, the technical features of the above embodiments or different embodiments can also be combined, the steps can be implemented in any order, and there are many other variations of different aspects of one or more embodiments of this application as described above, which are not provided in detail for the sake of brevity.
Claims
1. A vulnerability assessment method for large-scale critical information infrastructure, characterized in that, include: Collect interaction event information from different large-scale critical information infrastructures; Generate a time-series dynamic hypergraph based on the interactive event information; A temporal hypergraph encoder is constructed, and the temporal hypergraph encoder is trained by combining the temporal dynamic hypergraph, the counterfactual hypergraph and the self-supervised learning strategy. The trained temporal hypergraph encoder is used to generate dynamic embedded representations of nodes by aggregating the temporal dynamic hypergraph. The nodes are network nodes in large-scale critical information infrastructure. Based on dynamic propagation simulation and topological robustness analysis algorithm, soft labels are determined regarding node vulnerability, and different soft labels represent different vulnerabilities; A target inference model is constructed by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels. The target inference model is used to determine the soft labels of each node in the temporal dynamic hypergraph and generate a vulnerability ranking of multiple nodes based on the soft labels. The target inference model is invoked to process the interaction event information of the infrastructure to be evaluated, and the node vulnerability ranking corresponding to the target inference model is obtained.
2. The vulnerability assessment method for large-scale critical information infrastructure according to claim 1, characterized in that, The method further includes: Introducing attention coefficients in the temporal hypergraph encoder : ； in, For super-edge e The initialization representation, || represents the concatenation operation, u For super-edge e Any node in the set, and Each in timestamp t -1 node v and nodes u The vectorized embedding, where 'a' is a learnable column vector of weights. T It is its transpose vector.
3. The vulnerability assessment method for large-scale critical information infrastructure according to claim 1, characterized in that, The temporal supergraph encoder, when performing aggregation processing, includes: By combining the embedding information of other nodes in all hyperedges to which each node belongs with the time-aware gating factor, the aggregated information of the current time step is obtained.
4. The vulnerability assessment method for large-scale critical information infrastructure according to claim 3, characterized in that, The aggregation of embedding information of other nodes in all hyperedges to which each node belongs, using a time-aware gating factor, includes: The time difference between the current time and the time when the hyperedge is generated is embedded into the aggregation weight. The closer the hyperedge is to the current time, the higher the corresponding aggregation weight. The embedding information of other nodes in all hyperedges to which each node belongs is aggregated by combining the aggregation weights.
5. The vulnerability assessment method for large-scale critical information infrastructure according to claim 1, characterized in that, The method further includes: Biased sampling is performed on the temporal dynamic hypergraph to obtain the counterfactual hypergraph that masks high centrality nodes and their associated hyperedges.
6. The vulnerability assessment method for large-scale critical information infrastructure according to claim 1, characterized in that, The method further includes: The loss function applied when constructing and training the temporal hypergraph encoder : ； For nodes Causal weighted terms, V Represents the set of all nodes. For nodes The original feature representation, and These are nodes Constructed positive samples similar to their own context representation and those similar to nodes u The context represents dissimilar negative samples. It is a hyperparameter of temperature coefficient.
7. The vulnerability assessment method for large-scale critical information infrastructure according to claim 1, characterized in that, The algorithm based on dynamic propagation simulation and topological robustness analysis determines soft labels regarding node vulnerability, including: The global influence range of each node is determined based on the independent cascade or SIR model; After removing each of the aforementioned nodes, determine the collapse rate of the largest connected component in the network formed by the temporal dynamic hypergraph; The vulnerability of each node is determined by combining the global impact range and the crash speed; Multiple different soft tags about node vulnerabilities are generated by combining the vulnerabilities of each node.
8. The vulnerability assessment method for large-scale critical information infrastructure according to claim 1, characterized in that, The step of constructing a target inference model by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels includes: Construct a mapping network; A target inference model is constructed based on the mapping network, the dynamic embedding representation of the nodes output by the temporal hypergraph encoder, and soft labels.
9. The vulnerability assessment method for large-scale critical information infrastructure according to claim 1, characterized in that, The method further includes: Construct a hybrid topology-preserving loss function, and use the hybrid topology-preserving loss function to train the target inference model; The hybrid topology order-preserving loss function includes a point-level regression loss function, a pairwise sorting loss function, and a distribution alignment loss function.
10. A vulnerability assessment device for large-scale critical information infrastructure, characterized in that, include: The data acquisition module is used to collect interactive event information from different large-scale critical information infrastructures. The generation module is used to generate a time-series dynamic hypergraph based on the interactive event information; The first construction module is used to construct a temporal hypergraph encoder and train the temporal hypergraph encoder by combining the temporal dynamic hypergraph, the counterfactual hypergraph and the self-supervised learning strategy. The trained temporal hypergraph encoder is used to generate dynamic embedded representations of nodes by aggregating the temporal dynamic hypergraph. The nodes are network nodes in a large-scale critical information infrastructure. The first determining module is used to determine soft labels about node vulnerability based on dynamic propagation simulation and topological robustness analysis algorithms, wherein different soft labels represent different vulnerabilities; The second construction module is used to construct a target inference model by combining the dynamic embedding representation of the node output by the temporal hypergraph encoder with soft labels. The target inference model is used to determine the soft labels of each node in the temporal dynamic hypergraph and generate a vulnerability ranking of multiple nodes based on the soft labels. The evaluation module is used to call the target inference model to process the interaction event information of the infrastructure to be evaluated, and obtain the node vulnerability ranking corresponding to the target inference model.