Network security monitoring method and system based on distributed computing power state monitoring

Abstract

The invention discloses a network security monitoring method and system based on distributed computing power state monitoring, and relates to the field of intelligent monitoring, and the method comprises the steps: setting a plurality of monitoring nodes in a distributed computing power network, obtaining node state monitoring data (a time queue and a log file of a network traffic value) of the plurality of monitoring nodes, monitoring data from the node state of a first monitoring node in the plurality of monitoring nodes by adopting a data analysis and text processing mode based on machine learning, and then respectively carrying out time sequence extraction and semantic coding on a network flow value and a log text in the data; therefore, whether abnormity exists or not is intelligently judged according to the multi-mode compensation joint representation between the network flow time sequence mode characteristics of the first monitoring node and the log file semantic representation of the first monitoring node, and the abnormity problem is transmitted to other monitoring nodes. Therefore, comprehensive and real-time network state intelligent monitoring can be realized.

Description

Technical Field

[0001] The present application relates to the field of intelligent monitoring, and more specifically, to a network security monitoring method and system based on distributed computing power status monitoring. Background Art

[0002] A distributed computing network is a network composed of multiple computing nodes, which are connected by high-speed networks and work together to complete complex computing tasks. This network is widely used in big data processing, cloud computing, high-performance computing and other fields. The advantage of a distributed computing network is that it can efficiently allocate computing resources, improve computing efficiency and flexibility. However, as the scale of the network expands, network security issues are becoming increasingly prominent, and it is particularly important to effectively monitor and manage these networks.

[0003] However, traditional network security monitoring methods usually only focus on a single type of data, such as network traffic or log files. This single data source method is difficult to fully reflect the network status and may miss important abnormal behaviors, resulting in false positives and false negatives in complex network environments, and cannot effectively respond to various types of threats and attacks. In addition, due to the huge amount of data in network traffic and log files, traditional methods usually rely on simple statistical analysis and threshold setting, which makes it difficult to process and analyze massive data in real time, resulting in processing delays.

[0004] Therefore, an optimized network security monitoring solution based on distributed computing power status monitoring is desired. Summary of the invention

[0005] In order to solve the above technical problems, the present application is proposed. The embodiment of the present application provides a network security monitoring method and system based on distributed computing power status monitoring, which sets multiple monitoring nodes in the distributed computing power network, obtains the node status monitoring data (time queue and log file of network traffic value) of the multiple monitoring nodes, and adopts data analysis and text processing based on machine learning from the node status monitoring data of the first monitoring node among the multiple monitoring nodes, and then respectively extracts the network traffic value and log text in the data in time series and semantically encodes them, so as to intelligently judge whether there is an abnormality according to the multimodal compensation joint representation between the time series pattern characteristics of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node, and transmits the abnormal problem to other monitoring nodes. In this way, by real-time collection and simultaneous analysis of network traffic and log files, the network status can be fully reflected, avoiding the limitations of a single data source. And deeper features can be extracted from network traffic and log files to improve the accuracy of anomaly detection, thereby realizing comprehensive and real-time intelligent monitoring of network status.

[0006] According to one aspect of the present application, a network security monitoring method based on distributed computing power status monitoring is provided, which includes: setting up multiple monitoring nodes in a distributed computing power network; obtaining node status monitoring data of the multiple monitoring nodes, and extracting node status monitoring data of a first monitoring node among the multiple monitoring nodes; respectively encoding a time queue and a log file of a network traffic value in the node status monitoring data of the first monitoring node to obtain a time series pattern feature of the network traffic of the first monitoring node and a semantic representation of the log file of the first monitoring node; performing traffic log feature comparison between the time series pattern feature of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node The compensation combination is used to obtain a multimodal joint representation of the state of the first monitoring node, including: extracting the common features of the network traffic timing pattern characteristics of the first monitoring node and the semantic representation of the log file of the first monitoring node to obtain a common feature representation between the network traffic log file features; based on the common feature representation between the network traffic log file features, performing compensation interaction on the network traffic timing pattern characteristics of the first monitoring node and the semantic representation of the log file of the first monitoring node to obtain a multimodal joint representation of the state of the first monitoring node; based on the multimodal joint representation of the state of the first monitoring node, obtaining a state monitoring result, and determining whether to transmit the state monitoring result to other monitoring nodes.

[0007] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, node status monitoring data of the multiple monitoring nodes are obtained, and node status monitoring data of the first monitoring node among the multiple monitoring nodes are extracted, including: obtaining the node status monitoring data of the multiple monitoring nodes, the node status monitoring data including a time queue and a log file of network traffic values; extracting the node status monitoring data of the first monitoring node among the multiple monitoring nodes.

[0008] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node are encoded respectively to obtain the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation, including: inputting the time queue of the network traffic value in the node status monitoring data of the first monitoring node into a network traffic timing pattern feature extractor based on a bidirectional LSTM model to obtain the first monitoring node network traffic timing pattern feature representation vector as the first monitoring node network traffic timing pattern characteristics; semantically encoding the log file in the node status monitoring data of the first monitoring node to obtain the first monitoring node log file semantic encoding representation vector as the first monitoring node log file semantic representation.

[0009] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, the common features of the first monitoring node network traffic timing pattern features and the first monitoring node log file semantic representation are extracted to obtain the common feature representation between the network traffic log file features, including: inputting the first monitoring node network traffic timing pattern feature representation vector and the first monitoring node log file semantic encoding representation vector into the common feature extraction network to obtain the common feature representation vector between the network traffic log file features as the common feature representation between the network traffic log file features.

[0010] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector are input into the common feature extraction network to obtain the common feature representation vector between network traffic log file features, including: adding the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector by position point to obtain the network traffic-log file point addition vector; multiplying the network traffic-log file point addition vector with the weight matrix, adding the obtained network traffic-log file weight vector and the bias vector by position to obtain the network traffic-log file commonality vector; inputting the network traffic-log file commonality vector into the tanh function for processing to obtain the common feature representation vector between the network traffic log file features.

[0011] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, based on the common feature representation between the network traffic log file features, the first monitoring node network traffic timing pattern features and the first monitoring node log file semantic representation are compensated and interacted to obtain the first monitoring node state multimodal joint representation, including: the first monitoring node network traffic timing pattern feature representation vector, the first monitoring node log file semantic coding representation vector and the common feature representation vector between the network traffic log file features are input into a vector probabilization unit based on the Sigmoid function to obtain a probabilistic first monitoring node network traffic timing pattern feature representation vector, a probabilistic first monitoring node log file semantic coding representation vector and a probabilistic network traffic log file feature common feature representation vector; calculate the probabilistic first monitoring node network traffic timing pattern feature representation vector relative to the probabilistic network traffic log file feature A fine-grained compensation vector for network traffic information of a common feature representation vector; calculating the fine-grained compensation vector for log file information of the probabilistic first monitoring node log file semantic coding representation vector relative to the common feature representation vector between the probabilistic network traffic log file features; inputting the fine-grained compensation vector for network traffic information and the first monitoring node network traffic time series pattern feature representation vector into a fine-grained compensation module to obtain a fine-grained network traffic feature compensation vector; inputting the fine-grained compensation vector for log file information and the first monitoring node log file semantic coding representation vector into the fine-grained compensation module to obtain a fine-grained log file feature compensation vector; cascading the network traffic fine-grained feature compensation vector, the log file fine-grained feature compensation vector and the common feature representation vector between the network traffic log file features to obtain a first monitoring node state multimodal joint representation vector as the first monitoring node state multimodal joint representation.

[0012] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, the network traffic information fine-grained compensation vector of the probabilistic first monitoring node network traffic time series pattern feature representation vector relative to the probabilistic network traffic log file feature common feature representation vector is calculated, including: calculating the position point division of the probabilistic first monitoring node network traffic time series pattern feature representation vector and the probabilistic network traffic log file feature common feature representation vector to obtain a network traffic contribution vector; calculating the logarithmic function value with base two of the absolute value of each eigenvalue of the network traffic contribution vector to obtain a network traffic contribution logarithmic vector; calculating the position point multiplication of the probabilistic first monitoring node network traffic time series pattern feature representation vector and the network traffic contribution logarithmic vector to obtain a point product vector, and calculating an exponential function with the natural constant e as the base and each point product value in the point product vector as the exponent to obtain a network traffic compensation vector; inputting the network traffic compensation vector into the softmax function to obtain the network traffic information fine-grained compensation vector.

[0013] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, the network traffic information fine-grained compensation vector and the first monitoring node network traffic timing pattern feature representation vector are input into the fine-grained compensation module to obtain the network traffic fine-grained feature compensation vector, including: calculating the first monitoring node network traffic timing pattern feature representation vector and the network traffic information fine-grained compensation vector by point-by-point multiplication to obtain the network traffic fine-grained feature compensation vector.

[0014] In the above-mentioned network security monitoring method based on distributed computing power status monitoring, a status monitoring result is obtained based on the multimodal joint representation of the first monitoring node status, and it is determined whether to transmit the status monitoring result to other monitoring nodes, including: inputting the multimodal joint representation vector of the first monitoring node status into a classifier-based status monitoring module to obtain the status monitoring result, and the status monitoring result is used to indicate whether there is an abnormality; in response to the status monitoring result being an abnormality, transmitting the status monitoring result to other monitoring nodes.

[0015] According to another aspect of the present application, a network security monitoring system based on distributed computing power status monitoring is provided, which includes: a monitoring node setting module, which is used to set up multiple monitoring nodes in a distributed computing power network; a node status monitoring data acquisition module, which is used to obtain the node status monitoring data of the multiple monitoring nodes, and extract the node status monitoring data of the first monitoring node among the multiple monitoring nodes; a node status monitoring data encoding module, which is used to encode the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node respectively to obtain the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation; a traffic log feature compensation fusion module, which is used to perform traffic log feature intercompensation on the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation The traffic log feature compensation fusion module comprises: a traffic log common feature extraction unit, used to extract the common features of the network traffic timing pattern features of the first monitoring node and the semantic representation of the first monitoring node log file to obtain the common feature representation between the network traffic log file features; a traffic log feature combination unit, used to compensate and interact the network traffic timing pattern features of the first monitoring node and the semantic representation of the first monitoring node log file based on the common feature representation between the network traffic log file features to obtain the multimodal joint representation of the first monitoring node state; a state monitoring result generation module, used to obtain the state monitoring result based on the multimodal joint representation of the first monitoring node state, and determine whether to transmit the state monitoring result to other monitoring nodes.

[0016] Compared with the prior art, the present application provides a network security monitoring method and system based on distributed computing power status monitoring, which sets multiple monitoring nodes in the distributed computing power network, obtains the node status monitoring data (time queue and log file of network traffic value) of the multiple monitoring nodes, and adopts machine learning-based data analysis and text processing methods to extract the node status monitoring data of the first monitoring node from the multiple monitoring nodes, and then respectively extracts the network traffic value and log text in the data in time series and semantically encodes them, so as to intelligently judge whether there is an abnormality based on the multimodal compensation joint representation between the time series pattern characteristics of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node, and transmits the abnormal problem to other monitoring nodes. In this way, by real-time collection and simultaneous analysis of network traffic and log files, the network status can be fully reflected, avoiding the limitations of a single data source. And deeper features can be extracted from network traffic and log files to improve the accuracy of anomaly detection, thereby realizing comprehensive and real-time intelligent monitoring of network status. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0018] Figure 1 This is a flowchart of a network security monitoring method based on distributed computing power status monitoring according to an embodiment of the present application.

[0019] Figure 2 This is a data flow diagram of a network security monitoring method based on distributed computing power status monitoring according to an embodiment of the present application.

[0020] Figure 3 A flowchart of encoding the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node in the network security monitoring method based on distributed computing power status monitoring according to an embodiment of the present application to obtain the timing pattern characteristics of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node.

[0021] Figure 4 This is a flowchart of a network security monitoring method based on distributed computing power status monitoring according to an embodiment of the present application, in which the network traffic timing pattern characteristics of the first monitoring node and the semantic representation of the log file of the first monitoring node are compensated and combined between the traffic log characteristics to obtain a multimodal joint representation of the first monitoring node status.

[0022] Figure 5 It is a block diagram of a network security monitoring system based on distributed computing power status monitoring according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] The embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although certain embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be construed as being limited to the embodiments described herein, but rather these embodiments are provided for a more thorough and complete understanding of the present disclosure. It should be understood that the drawings and embodiments of the present disclosure are only for exemplary purposes and are not intended to limit the scope of protection of the present disclosure.

[0024] It should be understood that the various steps described in the method embodiments of the present disclosure may be performed in different orders and / or in parallel. In addition, the method embodiments may include additional steps and / or omit the steps shown. The scope of the present disclosure is not limited in this respect.

[0025] In the description of the embodiments of the present disclosure, the term "including" and similar terms should be understood as open inclusion, that is, "including but not limited to". The term "based on" should be understood as "based at least in part on". The term "one embodiment" or "the embodiment" should be understood as "at least one embodiment". The terms "first", "second", etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0026] It should be noted that the modifications of "one" and "plurality" mentioned in the present disclosure are illustrative rather than restrictive, and those skilled in the art should understand that unless otherwise clearly indicated in the context, it should be understood as "one or more".

[0027] A distributed computing network is a network composed of multiple computing nodes, which are connected by high-speed networks and work together to complete complex computing tasks. This network is widely used in big data processing, cloud computing, high-performance computing and other fields. The advantage of a distributed computing network is that it can efficiently allocate computing resources, improve computing efficiency and flexibility. However, as the scale of the network expands, network security issues are becoming increasingly prominent, and it is particularly important to effectively monitor and manage these networks.

[0028] However, traditional network security monitoring methods usually only focus on a single type of data, such as network traffic or log files. This single data source method is difficult to fully reflect the network status and may miss important abnormal behaviors, resulting in false positives and false negatives in complex network environments, and cannot effectively respond to various types of threats and attacks. In addition, due to the huge amount of data in network traffic and log files, traditional methods usually rely on simple statistical analysis and threshold setting, which makes it difficult to process and analyze massive data in real time, resulting in processing delays.

[0029] Therefore, in response to the above technical problems, the technical concept of the present application is to set up multiple monitoring nodes in a distributed computing network, and obtain the node status monitoring data (time queue and log file of network traffic value) of the multiple monitoring nodes, and adopt machine learning-based data analysis and text processing methods to extract the node status monitoring data of the first monitoring node from the multiple monitoring nodes, and then perform time series extraction and semantic encoding on the network traffic value and log text in the data respectively, so as to intelligently judge whether there is an abnormality based on the multimodal compensation joint representation between the time series pattern characteristics of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node, and transmit the abnormal problem to other monitoring nodes. In this way, by real-time collection and simultaneous analysis of network traffic and log files, the network status can be fully reflected, avoiding the limitations of a single data source. And deeper features can be extracted from network traffic and log files to improve the accuracy of anomaly detection, thereby realizing comprehensive and real-time intelligent monitoring of network status.

[0030] Figure 1 This is a flowchart of a network security monitoring method based on distributed computing power status monitoring according to an embodiment of the present application. Figure 2 Schematic diagram of data flow of a network security monitoring method based on distributed computing power status monitoring according to an embodiment of the present application. Figure 1 and Figure 2 As shown, according to the embodiment of the present application, a network security monitoring method based on distributed computing power status monitoring includes: S110, setting multiple monitoring nodes in a distributed computing power network; S120, obtaining node status monitoring data of the multiple monitoring nodes, and extracting node status monitoring data of a first monitoring node among the multiple monitoring nodes; S130, respectively encoding the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node to obtain the timing pattern characteristics of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node; S140, performing compensation and combination between traffic log features on the timing pattern characteristics of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node to obtain a multimodal joint representation of the state of the first monitoring node; S150, obtaining a state monitoring result based on the multimodal joint representation of the state of the first monitoring node, and determining whether to transmit the state monitoring result to other monitoring nodes.

[0031] In step S110, multiple monitoring nodes are set in the distributed computing power network. It should be understood that, considering that in a large distributed computing power network, certain types of anomalies or attacks may first appear in a specific area, in order to be able to more quickly and accurately identify network security issues in different local areas, in the technical solution of the present application, multiple monitoring nodes are set in the distributed computing power network. In other words, there are obvious risks in single-point monitoring. If the only monitoring node fails or is attacked, the entire monitoring system may fail. By deploying multiple monitoring nodes in different geographical locations or network structures, it is possible to ensure comprehensive coverage of all parts of the entire network. Even if a node has a problem, other nodes can continue to work, thereby improving the effectiveness and accuracy of monitoring.

[0032] In step S120, the node status monitoring data of the multiple monitoring nodes are obtained, and the node status monitoring data of the first monitoring node among the multiple monitoring nodes are extracted. Specifically, in an embodiment of the present application, the node status monitoring data of the multiple monitoring nodes are obtained, and the node status monitoring data of the first monitoring node among the multiple monitoring nodes are extracted, including: obtaining the node status monitoring data of the multiple monitoring nodes, the node status monitoring data including the time queue and log file of the network traffic value; extracting the node status monitoring data of the first monitoring node among the multiple monitoring nodes. Accordingly, considering that the node status monitoring data contains the network traffic value and the log file, these information are all important parameter information for the monitoring supervisor of network security. Specifically, the network traffic value refers to the amount of data transmitted in the network and related statistical information, which can provide the network load and bandwidth usage, which is very useful for detecting network congestion, traffic anomalies and other problems. The log file records the running status of the system and application, including error information, warning information and operation records, etc., which can reflect system failures, security vulnerabilities and abnormal behaviors. Based on this, in the technical solution of the present application, the node status monitoring data of the multiple monitoring nodes are obtained, and the node status monitoring data includes a time queue and a log file of the network traffic value. In this way, it is possible to detect abnormal fluctuations in traffic, such as sudden large traffic, sudden drop in traffic, and identify security vulnerabilities and malicious activities in the system, such as frequent login failure records that may indicate that someone is attempting to crack a password. That is, in order to be able to more carefully analyze the network security status of each monitoring node to improve the accuracy of security monitoring of local areas in the entire network, in the technical solution of the present application, the node status monitoring data of the first monitoring node among the multiple monitoring nodes is extracted, so that the network security status of each monitoring node can be analyzed and processed separately and carefully, thereby comprehensively improving the overall security and stability of the network.

[0033] In step S130, the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node are encoded respectively to obtain the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation. Figure 3 A flowchart of encoding the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node in the network security monitoring method based on distributed computing power status monitoring according to an embodiment of the present application to obtain the first monitoring node network traffic time series pattern characteristics and the first monitoring node log file semantic representation. Specifically, in the embodiment of the present application, Figure 3As shown, the time queue and log file of the network traffic value in the node state monitoring data of the first monitoring node are respectively encoded to obtain the first monitoring node network traffic time series pattern feature and the first monitoring node log file semantic representation, including: S210, inputting the time queue of the network traffic value in the node state monitoring data of the first monitoring node into the network traffic time series pattern feature extractor based on the bidirectional LSTM model to obtain the first monitoring node network traffic time series pattern feature representation vector as the first monitoring node network traffic time series pattern feature; S220, semantically encoding the log file in the node state monitoring data of the first monitoring node to obtain the first monitoring node log file semantic encoding representation vector as the first monitoring node log file semantic representation. Accordingly, considering that the time queue of the network traffic value in the node state monitoring data of the first monitoring node changes sequentially over time, and the network traffic values ​​between different time intervals are mutually correlated to varying degrees. And considering that the bidirectional LSTM model can simultaneously consider past and future information to better capture the time dependency and dynamic changes of network traffic. Therefore, in the technical solution of the present application, the time queue of the network traffic value in the node status monitoring data of the first monitoring node is input into the network traffic time series pattern feature extractor based on the bidirectional LSTM model to extract and mine the complex time series pattern and deep-level features in the network traffic, and obtain the first monitoring node network traffic time series pattern feature representation vector. Then, considering that the log file in the node status monitoring data of the first monitoring node contains the key semantic information in the log, based on this, in the technical solution of the present application, the log file in the node status monitoring data of the first monitoring node is semantically encoded to obtain the first monitoring node log file semantic encoding representation vector. That is, semantic encoding can capture the contextual information and semantic relationship in the log file to generate a representation vector containing rich contextual semantic features. In particular, in a specific embodiment of the present application, the log file is segmented and then input into a semantic encoding model containing an embedding layer to obtain the first monitoring node log file semantic encoding representation vector, which can more finely capture the semantic relationship and contextual meaning between words and provide a richer feature representation.

[0034] In step S140, the first monitoring node network traffic timing pattern feature and the first monitoring node log file semantic representation are combined by compensating between traffic log features to obtain a multimodal joint representation of the first monitoring node state. It should be understood that, considering that the first monitoring node network traffic timing pattern feature representation vector and the first monitoring node log file semantic coding representation vector are two aspects of network information, that is, network traffic data can reflect the real-time traffic changes of the network, while the log data contains detailed system and application behavior information, but there are also common features between the two, such as the log data may contain error information and warning information related to network communication. Therefore, in the technical solution of the present application, the first monitoring node network traffic timing pattern feature representation vector and the first monitoring node log file semantic coding representation vector are combined by compensating between traffic log features to obtain a multimodal joint representation vector of the first monitoring node state as a multimodal joint representation of the first monitoring node state.

[0035] Specifically, first, the common features of the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic encoding representation vector are extracted through a common feature extraction network to obtain a common feature representation vector between network traffic log file features. It should be understood that through the common feature extraction network, common patterns between network traffic time series pattern features and log file semantic representations can be identified. These common patterns may reflect specific behaviors or events in the network, such as user login, file transfer, abnormal traffic, etc. In particular, the essence of the network is a neural network, for example, the common information between the two is extracted through a fully connected layer. Then, in order to better characterize the importance and influence of each feature, in the technical solution of the present application, a vector probabilization unit based on the Sigmoid function is used to map each value in the common feature representation vector between the first monitoring node network traffic time series pattern feature representation vector, the first monitoring node log file semantic coding representation vector and the network traffic log file feature to the (0, 1) interval, so as to convert the feature vector into a probability form, and obtain a probabilized representation, so that each feature with a probability value close to 1 represents that the feature is very significant in the current context, and the feature with a probability value close to 0 represents that the feature is not very important. Then, the fine-grained compensation vectors of the probabilized network traffic features and the probabilized log file features relative to the common features are calculated respectively to obtain the fine-grained compensation vectors of the network traffic information and the fine-grained compensation vectors of the log file information. In this way, the characteristic information unique to the original network traffic can be highlighted, that is, the information that may be missing or not obvious in the common features, but it is very critical and important details for model processing. Subsequently, the fine-grained compensation vector of network traffic information and the first monitoring node network traffic time series pattern feature representation vector are input into the fine-grained compensation module to add the compensation vector to the original first monitoring node network traffic time series pattern feature representation vector in a certain way, such as calculating the dot product between the two vectors, so as to highlight the key information in the network traffic feature, making it more prominent in the anomaly detection and classification tasks, and obtain the network traffic fine-grained feature compensation vector. At the same time, the fine-grained compensation vector of log file information and the semantic encoding representation vector of the first monitoring node log file are also input into the fine-grained compensation module to obtain the log file fine-grained feature compensation vector through the same processing steps, so as to ensure the consistency and integrity of the final feature fusion. Finally, the network traffic fine-grained feature compensation vector, the log file fine-grained feature compensation vector and the common feature vector are cascaded to obtain a first monitoring node state multimodal joint representation vector that includes the common features between the two and the original individual features.

[0036] Figure 4The present invention is a flowchart of performing compensation and combination between the traffic log features of the first monitoring node network traffic time series pattern features and the first monitoring node log file semantic representation to obtain a multimodal joint representation of the first monitoring node state in the network security monitoring method based on distributed computing power state monitoring according to an embodiment of the present application. Specifically, in the embodiment of the present application, Figure 4 As shown, the network traffic timing pattern characteristics of the first monitoring node and the semantic representation of the log file of the first monitoring node are compensated and combined between the traffic log features to obtain a multimodal joint representation of the first monitoring node state, including: S310, extracting the common features of the network traffic timing pattern characteristics of the first monitoring node and the semantic representation of the log file of the first monitoring node to obtain a common feature representation between network traffic log file features; S320, based on the common feature representation between the network traffic log file features, compensating and interacting the network traffic timing pattern characteristics of the first monitoring node and the semantic representation of the log file of the first monitoring node to obtain a multimodal joint representation of the state of the first monitoring node.

[0037] Specifically, in step S310, the common features of the first monitoring node network traffic timing pattern features and the first monitoring node log file semantic representation are extracted to obtain a common feature representation between network traffic log file features, including: inputting the first monitoring node network traffic timing pattern feature representation vector and the first monitoring node log file semantic encoding representation vector into a common feature extraction network to obtain a common feature representation vector between network traffic log file features as the common feature representation between network traffic log file features.

[0038] Specifically, in an embodiment of the present application, the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector are input into a common feature extraction network to obtain a common feature representation vector between network traffic log file features, including: adding the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector by position point to obtain a network traffic-log file point addition vector; multiplying the network traffic-log file point addition vector with a weight matrix, adding the obtained network traffic-log file weight vector and the bias vector by position to obtain a network traffic-log file commonality vector; inputting the network traffic-log file commonality vector into a tanh function for processing to obtain a common feature representation vector between network traffic log file features.

[0039] Specifically, in step S320, based on the common feature representation between the network traffic log file features, the first monitoring node network traffic timing pattern features and the first monitoring node log file semantic representation are compensated and interacted to obtain the first monitoring node state multimodal joint representation, including: the first monitoring node network traffic timing pattern feature representation vector, the first monitoring node log file semantic coding representation vector and the common feature representation vector between the network traffic log file features are input into a vector probabilization unit based on the Sigmoid function to obtain a probabilistic first monitoring node network traffic timing pattern feature representation vector, a probabilistic first monitoring node log file semantic coding representation vector and a probabilistic network traffic log file feature common feature representation vector; calculate the probabilistic first monitoring node network traffic timing pattern feature representation vector relative to the probabilistic network traffic log file feature common feature representation vector. The invention relates to a method for obtaining a fine-grained compensation vector of network traffic information of a vector; calculating a fine-grained compensation vector of log file information of the probabilistic first monitoring node log file semantic coding representation vector relative to the common feature representation vector between the probabilistic network traffic log file features; inputting the fine-grained compensation vector of network traffic information and the first monitoring node network traffic time series pattern feature representation vector into a fine-grained compensation module to obtain a fine-grained feature compensation vector of network traffic; inputting the fine-grained compensation vector of log file information and the first monitoring node log file semantic coding representation vector into the fine-grained compensation module to obtain a fine-grained feature compensation vector of log file; cascading the fine-grained feature compensation vector of network traffic, the fine-grained feature compensation vector of log file and the common feature representation vector between the network traffic log file features to obtain a multimodal joint representation vector of the first monitoring node state as the multimodal joint representation of the first monitoring node state.

[0040] Specifically, in an embodiment of the present application, a fine-grained compensation vector of network traffic information of the probabilistic first monitoring node network traffic timing pattern feature representation vector relative to the probabilistic network traffic log file feature commonality feature representation vector is calculated, including: calculating the position point division of the probabilistic first monitoring node network traffic timing pattern feature representation vector and the probabilistic network traffic log file feature commonality feature representation vector to obtain a network traffic contribution vector; calculating the base-two logarithmic function value of the absolute value of each eigenvalue of the network traffic contribution vector to obtain a network traffic contribution logarithmic vector; calculating the position point multiplication of the probabilistic first monitoring node network traffic timing pattern feature representation vector and the network traffic contribution logarithmic vector to obtain a point product vector, and calculating an exponential function with the natural constant e as the base and each point product value in the point product vector as the exponent to obtain a network traffic compensation vector; inputting the network traffic compensation vector into a softmax function to obtain the fine-grained compensation vector of network traffic information.

[0041] Specifically, in an embodiment of the present application, the network traffic information fine-grained compensation vector and the first monitoring node network traffic timing pattern feature representation vector are input into a fine-grained compensation module to obtain a network traffic fine-grained feature compensation vector, including: calculating the point-by-point multiplication of the first monitoring node network traffic timing pattern feature representation vector and the network traffic information fine-grained compensation vector to obtain the network traffic fine-grained feature compensation vector.

[0042] In the embodiment of the present application, specifically, the traffic log feature compensation combination is performed on the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector, which can be expressed by the formula: in, and are the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector respectively, To add by location, and are the weight matrix and bias vector respectively, yes function, is the common feature representation vector between network traffic log file features, yes function, is the probabilistic representation vector of the time series pattern of the network traffic of the first monitoring node, is the semantic encoding representation vector of the log file of the first monitoring node in the probabilistic way, is the common feature representation vector between the features of the probabilistic network traffic log file, is the characteristic value of each position in the probabilistic first monitoring node network traffic time series pattern characteristic representation vector, is the characteristic value of each position in the semantic encoding representation vector of the probabilistic first monitoring node log file, is the feature value of each position in the common feature representation vector between the probabilistic network traffic log file features, represents the logarithmic function value with base 2, represents an exponential function with the natural constant e as the base, yes function, is the fine-grained compensation vector of network traffic information, is the log file information fine-grained compensation vector, It is the point multiplication by position. is the network traffic fine-grained feature compensation vector, is the log file fine-grained feature compensation vector, It is a cascade operation on vectors. It is the multimodal joint representation vector of the first monitoring node state.

[0043] In step S150, based on the multimodal joint representation of the state of the first monitoring node, a state monitoring result is obtained, and it is determined whether to transmit the state monitoring result to other monitoring nodes. Specifically, in an embodiment of the present application, based on the multimodal joint representation of the state of the first monitoring node, a state monitoring result is obtained, and it is determined whether to transmit the state monitoring result to other monitoring nodes, including: inputting the multimodal joint representation vector of the state of the first monitoring node into a classifier-based state monitoring module to obtain the state monitoring result, and the state monitoring result is used to indicate whether there is an abnormality; in response to the state monitoring result being an abnormality, the state monitoring result is transmitted to other monitoring nodes.

[0044] More specifically, in an embodiment of the present application, the first monitoring node state multimodal joint representation vector is input into a classifier-based state monitoring module to obtain the state monitoring result, and the state monitoring result is used to indicate whether an abnormality exists. That is, the first monitoring node state multimodal joint representation obtained by combining common features using the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic encoding representation vector is classified to intelligently determine whether an abnormality exists. In particular, in a specific implementation of the present application, the first monitoring node state multimodal joint representation vector is input into a classifier-based state monitoring module to obtain a state monitoring result, and the state monitoring result is used to indicate whether an abnormality exists, including: using the fully connected layer of the classifier-based state monitoring module to fully connect encode the first monitoring node state multimodal joint representation vector to obtain a first monitoring node state multimodal joint encoding vector; inputting the first monitoring node state multimodal joint encoding vector into the Softmax classification function of the classifier-based state monitoring module to obtain the probability value of the first monitoring node state multimodal joint representation vector belonging to each classification label, and the classification labels include those for indicating the presence and absence of an abnormality; and determining the classification label corresponding to the largest of the probability values ​​as the state monitoring result.

[0045] More specifically, in an embodiment of the present application, in response to the state monitoring result being an abnormality, the state monitoring result is transmitted to other monitoring nodes. Correspondingly, in response to the state monitoring result being an abnormality, the state monitoring result is transmitted to other monitoring nodes. In this way, information sharing between multiple monitoring nodes can form a multi-level defense system, thereby improving the overall security of the network. In particular, in a specific embodiment of the present application, information transmission between nodes can be achieved by using a suitable communication mechanism (such as message queues, Socket communications, etc.). In this way, by real-time collection and simultaneous analysis of network traffic and log files, the network status can be fully reflected, avoiding the limitations of a single data source. And deeper features can be extracted from network traffic and log files to improve the accuracy of anomaly detection, thereby achieving comprehensive and real-time intelligent monitoring of network status.

[0046] It should be understood that when the first monitoring node network traffic timing pattern feature representation vector and the first monitoring node log file semantic coding representation vector respectively represent the short-range-long-range bidirectional timing correlation characteristics of the network traffic value of the node status monitoring data of the first monitoring node and the coding semantic characteristics of the log file of the node status monitoring data of the first monitoring node, when performing compensatory interaction between features with common features as masks, the sparsity between the common mask features corresponding to the differences in the timing-semantic feature dimensions of the cross-modal data will lead to the lack of local compensatory interaction between features, that is, the interaction distribution representation of the first monitoring node status multimodal joint representation vector is simply repeated in the local interaction domain, which affects its semantic logical dependency and reduces the accuracy of the classification results.

[0047] Therefore, preferably, when the first monitoring node state multimodal joint representation vector is input into a classifier-based state monitoring module to obtain a state monitoring result, the first monitoring node state multimodal joint representation vector is optimized, specifically including: determining a first monitoring node state multimodal joint association response matrix and a first monitoring node state multimodal joint distance response matrix based on the square root of the association value of the eigenvalue of the first monitoring node state multimodal joint representation vector and the L2 distance value. The process can be expressed by the formula: ;in, is the multimodal joint representation vector of the first monitoring node state, and are respectively the first monitoring node state multimodal joint representation vector Position and The eigenvalues ​​at the positions, is the length of the multimodal joint representation vector of the first monitoring node state, is the first monitoring node state multimodal joint correlation response matrix The eigenvalues ​​of the positions, is the multimodal joint distance response matrix of the first monitoring node state The characteristic value of the position; matrix multiplying the first monitoring node state multimodal joint representation vector with the first monitoring node state multimodal joint association response matrix to obtain the first monitoring node state multimodal joint association response vector; matrix multiplying the first monitoring node state multimodal joint distance response matrix with the transposed vector of the first monitoring node state multimodal joint representation vector to obtain the first monitoring node state multimodal joint distance response vector; after dot multiplying the first monitoring node state multimodal joint association response matrix and the first monitoring node state multimodal joint distance response matrix, matrix multiplying them with the transposed vector of the first monitoring node state multimodal joint representation vector to obtain the first monitoring node state multimodal joint bias vector; dot multiplying the first monitoring node state multimodal joint association response vector, the first monitoring node state multimodal joint distance response vector and the first monitoring node state multimodal joint bias vector to obtain the optimized first monitoring node state multimodal joint representation vector.

[0048] Here, the optimized first monitoring node state multimodal joint representation vector It is expressed as: ;in, is the multimodal joint representation vector of the first monitoring node state, is the multimodal joint association response vector of the first monitoring node state, is the multimodal joint distance response vector of the first monitoring node state, is the multimodal joint bias vector of the first monitoring node state, ,and , is the length of the vector to which it belongs, is the multimodal joint association response matrix of the first monitoring node state, is the multimodal joint distance response matrix of the first monitoring node state, is matrix multiplication, is the transpose vector of the vector, For point-by-position multiplication, It is added by location point. is the optimized multimodal joint representation vector of the first monitoring node state.

[0049] That is, by using the first monitoring node state multimodal joint representation vector as its statistical reference-free distribution response framework based on the self-association matrix and the self-distance matrix, and constructing the retrieval-enhanced reverse response to the first monitoring node state multimodal joint representation vector to avoid simple repetition of feature distribution, and by ensuring the intrinsic mapping logic of the first monitoring node state multimodal joint representation vector based on the retrieval-response context to avoid its surface combination mapping, so as to achieve the semantic logic dependency mapping of the first monitoring node state multimodal joint representation vector while maintaining the intuitive response correlation, thereby improving the accuracy of the state monitoring result obtained by the first monitoring node state multimodal joint representation vector input to the classifier-based state monitoring module. In this way, by real-time collection and simultaneous analysis of network traffic and log files, the network status can be fully reflected, avoiding the limitations of a single data source. And deeper features can be extracted from network traffic and log files to improve the accuracy of anomaly detection, thereby achieving comprehensive and real-time intelligent monitoring of network status.

[0050] In summary, a network security monitoring method based on distributed computing power status monitoring based on the embodiment of the present application is explained, which sets up multiple monitoring nodes in the distributed computing power network, and obtains the node status monitoring data (time queue and log file of network traffic value) of the multiple monitoring nodes, and adopts data analysis and text processing based on machine learning from the node status monitoring data of the first monitoring node among the multiple monitoring nodes, and then respectively extracts the network traffic value and log text in the data in time series and semantically encodes them, so as to intelligently judge whether there is an abnormality based on the multimodal compensation joint representation between the time series pattern characteristics of the network traffic of the first monitoring node and the semantic representation of the log file of the first monitoring node, and transmits the abnormal problem to other monitoring nodes. In this way, by real-time collection and simultaneous analysis of network traffic and log files, the network status can be fully reflected, avoiding the limitations of a single data source. And deeper features can be extracted from network traffic and log files to improve the accuracy of anomaly detection, thereby realizing comprehensive and real-time intelligent monitoring of network status.

[0051] Figure 5 FIG. 1 is a block diagram of a network security monitoring system based on distributed computing power status monitoring according to an embodiment of the present application. Figure 5As shown, according to the embodiment of the present application, the network security monitoring system 100 based on distributed computing power status monitoring includes: a monitoring node setting module 110, which is used to set multiple monitoring nodes in the distributed computing power network; a node status monitoring data acquisition module 120, which is used to obtain the node status monitoring data of the multiple monitoring nodes, and extract the node status monitoring data of the first monitoring node among the multiple monitoring nodes; a node status monitoring data encoding module 130, which is used to encode the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node respectively to obtain the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation; a traffic log feature compensation fusion module 140, which is used to perform traffic log feature on the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation. The features are compensated and combined to obtain a multimodal joint representation of the state of the first monitoring node, wherein the traffic log feature compensation fusion module includes: a traffic log common feature extraction unit, used to extract the common features of the network traffic timing pattern features of the first monitoring node and the semantic representation of the first monitoring node log file to obtain a common feature representation between network traffic log file features; a traffic log feature combination unit, used to compensate and interact the network traffic timing pattern features of the first monitoring node and the semantic representation of the first monitoring node log file based on the common feature representation between the network traffic log file features to obtain a multimodal joint representation of the state of the first monitoring node; a state monitoring result generation module 150, used to obtain a state monitoring result based on the multimodal joint representation of the state of the first monitoring node, and determine whether to transmit the state monitoring result to other monitoring nodes.

[0052] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned network security monitoring system based on distributed computing power status monitoring have been referred to above. Figures 1 to 5 The network security monitoring method based on distributed computing power status monitoring has been introduced in detail, and therefore, its repeated description will be omitted.

[0053] As described above, the network security monitoring system 100 based on distributed computing power status monitoring according to the embodiment of the present disclosure can be implemented in various wireless terminals, such as a server with a network security monitoring algorithm based on distributed computing power status monitoring. In one possible implementation, the network security monitoring system 100 based on distributed computing power status monitoring according to the embodiment of the present disclosure can be integrated into the wireless terminal as a software module and / or a hardware module. For example, the network security monitoring system 100 based on distributed computing power status monitoring can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the network security monitoring system 100 based on distributed computing power status monitoring can also be one of the many hardware modules of the wireless terminal.

[0054] Alternatively, in another example, the network security monitoring system 100 based on distributed computing power status monitoring and the wireless terminal may also be separate devices, and the network security monitoring system 100 based on distributed computing power status monitoring may be connected to the wireless terminal via a wired and / or wireless network and transmit interactive information in accordance with an agreed data format.

[0055] The above is merely an example of the principles of the present disclosure, and various modifications may be made by those skilled in the art without departing from the scope of the present disclosure. The above embodiments are presented for the purpose of illustration rather than limitation. The present disclosure may also take many forms other than those explicitly described herein.

Claims

1. A network security monitoring method based on distributed computing power status monitoring, characterized in that: include: Set up multiple monitoring nodes in the distributed computing network; Obtain node status monitoring data of the multiple monitoring nodes, and extract node status monitoring data of a first monitoring node among the multiple monitoring nodes; respectively encode the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node to obtain the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation; perform traffic log feature inter-compensation combination on the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation to obtain a first monitoring node state multimodal joint representation, including: extracting the common features of the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation to obtain a common feature representation between network traffic log file features; Based on the common feature representation between the network traffic log file features, the network traffic timing pattern features of the first monitoring node and the semantic representation of the first monitoring node log file are compensated and interacted to obtain a multimodal joint representation of the state of the first monitoring node; based on the multimodal joint representation of the state of the first monitoring node, a state monitoring result is obtained, and it is determined whether to transmit the state monitoring result to other monitoring nodes.

2. The network security monitoring method based on distributed computing power status monitoring according to claim 1 is characterized in that: Obtaining node status monitoring data of the multiple monitoring nodes, and extracting node status monitoring data of a first monitoring node among the multiple monitoring nodes, includes: obtaining node status monitoring data of the multiple monitoring nodes, the node status monitoring data including a time queue and a log file of network traffic values; extracting node status monitoring data of a first monitoring node among the multiple monitoring nodes.

3. The network security monitoring method based on distributed computing power status monitoring according to claim 2 is characterized in that: The time queue of network traffic values ​​in the node status monitoring data of the first monitoring node and the log file are respectively encoded to obtain the first monitoring node network traffic timing pattern characteristics and the first monitoring node log file semantic representation, including: inputting the time queue of network traffic values ​​in the node status monitoring data of the first monitoring node into a network traffic timing pattern feature extractor based on a bidirectional LSTM model to obtain the first monitoring node network traffic timing pattern feature representation vector as the first monitoring node network traffic timing pattern characteristics; semantically encoding the log file in the node status monitoring data of the first monitoring node to obtain the first monitoring node log file semantic encoding representation vector as the first monitoring node log file semantic representation.

4. The network security monitoring method based on distributed computing power status monitoring according to claim 3 is characterized in that: Extracting common features of the first monitoring node network traffic timing pattern features and the first monitoring node log file semantic representation to obtain a common feature representation between network traffic log file features, including: inputting the first monitoring node network traffic timing pattern feature representation vector and the first monitoring node log file semantic encoding representation vector into a common feature extraction network to obtain a common feature representation vector between network traffic log file features as the common feature representation between network traffic log file features.

5. The network security monitoring method based on distributed computing power status monitoring according to claim 4 is characterized in that: The first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector are input into a common feature extraction network to obtain a common feature representation vector between network traffic log file features, including: adding the first monitoring node network traffic time series pattern feature representation vector and the first monitoring node log file semantic coding representation vector by position point to obtain a network traffic-log file point-added vector; multiplying the network traffic-log file point-added vector by a weight matrix, adding the obtained network traffic-log file weight vector and the bias vector by position to obtain a network traffic-log file commonality vector; inputting the network traffic-log file commonality vector into a tanh function for processing to obtain a common feature representation vector between network traffic log file features.

6. The network security monitoring method based on distributed computing power status monitoring according to claim 5 is characterized in that: Based on the common feature representation between the network traffic log file features, the first monitoring node network traffic time series pattern feature and the first monitoring node log file semantic representation are compensated and interacted to obtain the first monitoring node state multimodal joint representation, including: inputting the first monitoring node network traffic time series pattern feature representation vector, the first monitoring node log file semantic coding representation vector and the common feature representation vector between the network traffic log file features into a vector probabilization unit based on the Sigmoid function to obtain a probabilistic first monitoring node network traffic time series pattern feature representation vector, a probabilistic first monitoring node log file semantic coding representation vector and a probabilistic network traffic log file feature common feature representation vector; calculating the network flow of the probabilistic first monitoring node network traffic time series pattern feature representation vector relative to the probabilistic network traffic log file feature common feature representation vector The method comprises the steps of: calculating a fine-grained compensation vector for log file information of the probabilistic first monitoring node log file semantic coding representation vector relative to the probabilistic network traffic log file feature commonality feature representation vector; inputting the network traffic information fine-grained compensation vector and the first monitoring node network traffic time series pattern feature representation vector into a fine-grained compensation module to obtain a network traffic fine-grained feature compensation vector; inputting the log file information fine-grained compensation vector and the first monitoring node log file semantic coding representation vector into the fine-grained compensation module to obtain a log file fine-grained feature compensation vector; cascading the network traffic fine-grained feature compensation vector, the log file fine-grained feature compensation vector and the network traffic log file feature commonality feature representation vector to obtain a first monitoring node state multimodal joint representation vector as the first monitoring node state multimodal joint representation.

7. The network security monitoring method based on distributed computing power status monitoring according to claim 6 is characterized in that: The method comprises: calculating a fine-grained compensation vector of network traffic information of the probabilistic first monitoring node network traffic time series pattern feature representation vector relative to the probabilistic network traffic log file feature commonality feature representation vector, including: calculating the position point division of the probabilistic first monitoring node network traffic time series pattern feature representation vector and the probabilistic network traffic log file feature commonality feature representation vector to obtain a network traffic contribution vector; calculating the logarithmic function value with base two of the absolute value of each eigenvalue of the network traffic contribution vector to obtain a network traffic contribution logarithmic vector; calculating the position point multiplication of the probabilistic first monitoring node network traffic time series pattern feature representation vector and the network traffic contribution logarithmic vector to obtain a point product vector, and calculating an exponential function with base e as the natural constant and each point product value in the point product vector as the exponent to obtain a network traffic compensation vector; and inputting the network traffic compensation vector into a softmax function to obtain the fine-grained compensation vector of network traffic information.

8. The network security monitoring method based on distributed computing power status monitoring according to claim 7 is characterized in that: The network traffic information fine-grained compensation vector and the first monitoring node network traffic timing pattern feature representation vector are input into a fine-grained compensation module to obtain a network traffic fine-grained feature compensation vector, including: calculating the point-by-point multiplication of the first monitoring node network traffic timing pattern feature representation vector and the network traffic information fine-grained compensation vector to obtain the network traffic fine-grained feature compensation vector.

9. The network security monitoring method based on distributed computing power status monitoring according to claim 8 is characterized in that: Based on the multimodal joint representation of the state of the first monitoring node, a state monitoring result is obtained, and it is determined whether the state monitoring result is transmitted to other monitoring nodes, including: inputting the multimodal joint representation vector of the state of the first monitoring node into a classifier-based state monitoring module to obtain the state monitoring result, and the state monitoring result is used to indicate whether there is an abnormality; in response to the state monitoring result indicating that an abnormality exists, the state monitoring result is transmitted to other monitoring nodes.

10. A network security monitoring system based on distributed computing power status monitoring, characterized in that: include: A monitoring node setting module is used to set up multiple monitoring nodes in a distributed computing network; A node status monitoring data acquisition module, used to acquire the node status monitoring data of the multiple monitoring nodes, and extract the node status monitoring data of the first monitoring node among the multiple monitoring nodes; A node status monitoring data encoding module is used to encode the time queue and log file of the network traffic value in the node status monitoring data of the first monitoring node respectively to obtain the first monitoring node network traffic time series pattern characteristics and the first monitoring node log file semantic representation; a traffic log feature compensation fusion module is used to compensate and combine the first monitoring node network traffic time series pattern characteristics and the first monitoring node log file semantic representation to obtain the first monitoring node state multimodal joint representation, wherein the traffic log feature compensation fusion module includes: a traffic log common feature extraction unit, which is used to extract the common features of the first monitoring node network traffic time series pattern characteristics and the first monitoring node log file semantic representation to obtain the common feature representation between network traffic log file features; a traffic log feature combination unit, which is used to compensate and interact the first monitoring node network traffic time series pattern characteristics and the first monitoring node log file semantic representation based on the common feature representation between the network traffic log file features to obtain the first monitoring node state multimodal joint representation; a state monitoring result generation module is used to obtain a state monitoring result based on the first monitoring node state multimodal joint representation, and determine whether to transmit the state monitoring result to other monitoring nodes.

Images