A security analysis and response method and system that dynamically adapts to network threat patterns

Abstract

The present application provides a security analysis and response method and system that dynamically adapts to network threat patterns. By obtaining the target response sequence of the control network traffic of the intrusion detection system that has triggered the threat control strategy in the past, a joint reasoning model is obtained. The joint reasoning model is used to reason about the control response probability of the target network traffic to be responded to in multiple reasoning branches. One reasoning branch corresponds to a threat control strategy. Each reasoning branch contains matching variables. According to the matching variables under each reasoning branch, the target response sequence is matched to obtain the response representation vector of the target response sequence under each reasoning branch. The control response probability of the intrusion detection system to the target network traffic is inferred based on the response representation vectors under multiple reasoning branches through the joint reasoning model. Based on the present application, the accuracy of determining the control response probability of the network traffic by the reasoning intrusion detection system can be increased.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a security analysis and response method and system that dynamically adapts to network threat patterns. Background Art

[0002] With the rapid development of information technology, the application of networks in various fields is becoming more and more extensive. The openness and interconnectedness of networks also make them face many security threats. In order to deal with network threats, intrusion detection systems (IDS) came into being. The main task of intrusion detection systems is to monitor network traffic, identify possible threat behaviors, and take corresponding control strategies when threats are detected. However, traditional intrusion detection systems face many challenges in dealing with increasingly complex and changeable network threats. At present, when judging whether there is a threat that needs to be controlled, no matter what control strategy branch is used, reasoning is based on the same feature information of the target traffic, which makes the difference in reasoning under different control strategy branches too small, resulting in insufficient accuracy of threat analysis of target traffic under different control strategies, and misjudgment occurs. Summary of the invention

[0003] In view of this, the present application provides a security analysis response method and system that dynamically adapts to network threat patterns. The technical solution of the present application is implemented as follows:

[0004] On the one hand, the present application provides a security analysis and response method that dynamically adapts to network threat patterns, the method comprising: obtaining a target response sequence for control network traffic; the control network traffic is the network traffic corresponding to the threat control strategy that has been triggered by an intrusion detection system in the past; obtaining a joint reasoning model; the joint reasoning model is used to infer the control response probability of the target network traffic to be responded to in multiple reasoning branches, one reasoning branch corresponds to a threat control strategy, and each reasoning branch includes respectively corresponding matching variables; based on the matching variables under each reasoning branch, the target response sequence is matched to obtain a response representation vector of the target response sequence under each of the reasoning branches; the response representation vector under an reasoning branch includes a representation vector in the target response sequence that is associated with the threat control strategy of the reasoning branch; through the joint reasoning model, based on the response representation vectors under the multiple reasoning branches, the control response probability of the intrusion detection system to the target network traffic is inferred.

[0005] On the other hand, the present application provides a computer system, including a memory and a processor, wherein the memory stores a computer program executable on the processor, and the processor implements the steps in the above method when executing the program.

[0006] The technical effect of the present application is as follows: the present application obtains a target response sequence of control network traffic; the control network traffic is the network traffic corresponding to the threat control strategy that has been triggered by the intrusion detection system in the past, and obtains a joint reasoning model. The joint reasoning model is used to infer the control response probability of the target network traffic to be responded to in multiple reasoning branches. One reasoning branch corresponds to a threat control strategy, and each reasoning branch includes respectively corresponding matching variables. According to the matching variables under each reasoning branch, the target response sequence is matched to obtain a response representation vector of the target response sequence under each reasoning branch. The response representation vector under an reasoning branch includes a representation vector in the target response sequence associated with the threat control strategy of the reasoning branch. Through the joint reasoning model, the control response probability of the intrusion detection system to the target network traffic is inferred based on the response representation vectors under multiple reasoning branches. Based on this, in the present application, each of the multiple reasoning branches of the joint reasoning model includes a corresponding matching variable. Based on the matching variables of each reasoning branch, different matches can be performed on the same target response sequence, so as to obtain adapted response representation vectors associated with the threat control strategies corresponding to each reasoning branch in the target response sequence. When based on the adapted response representation vectors of each reasoning branch, accurate reasoning of the control response probability of the intrusion detection system to the target network traffic can be completed in each reasoning branch, thereby improving the response quality. BRIEF DESCRIPTION OF THE DRAWINGS

[0007] Figure 1 A schematic diagram of the implementation flow of a security analysis and response method that dynamically adapts to network threat patterns provided in an embodiment of the present application.

[0008] Figure 2 A hardware entity schematic diagram of a computer system provided in an embodiment of the present application. DETAILED DESCRIPTION

[0009] The embodiment of the present application provides a security analysis response method that dynamically adapts to network threat patterns, which can be executed by a processor of a computer system. The computer system can refer to an electronic device with data processing capabilities, such as a server, a laptop, a workstation, a mobile device, a network traffic analysis (NTA) device, etc.

[0010] Figure 1 A schematic diagram of an implementation flow of a security analysis and response method that dynamically adapts to network threat patterns provided in an embodiment of the present application is shown in FIG. Figure 1 As shown, the method includes:

[0011] Step S100: Obtain a target response sequence of reference network traffic; the reference network traffic is the network traffic corresponding to the threat management and control policies that have been triggered by the intrusion detection system in the past.

[0012] Control network traffic refers to the network traffic that has triggered threat management policies in the past. An intrusion detection system is a security mechanism used to monitor network activities, identify possible intrusion behaviors (such as malware propagation, unauthorized access, etc.) and respond accordingly. A threat management policy is a set of pre-set rules and measures to deal with specific threats detected. For example, when an intrusion detection system finds that an IP address frequently attempts to access restricted resources, triggering a policy to block further access to the IP address, the network traffic in this process is control network traffic.

[0013] The target response sequence is an ordered set of response results related to the control network traffic. These response results reflect the various feedback information generated when the intrusion detection system executes the threat management strategy for the control network traffic. For example, during the network traffic monitoring process, when an abnormal traffic pattern (control network traffic) is detected, the intrusion detection system may take a variety of measures, such as issuing an alarm, recording a log, blocking a specific connection, etc. The execution of these different measures is combined in a certain order to form a target response sequence.

[0014] The process of the computer system obtaining the target response sequence of the control network traffic is based on the query and collation of the historical data of the intrusion detection system. The intrusion detection system will continuously monitor the network traffic during operation. Whenever the threat control strategy is triggered, it will record the relevant network traffic information and the response operations made to the traffic. The computer system extracts this information from the database or log file of the intrusion detection system.

[0015] The computer system uses a specific query and screening mechanism to accurately obtain these target response sequences from the large amount of historical data stored in the intrusion detection system. These target response sequences will serve as an important basis for subsequent operations, providing the joint reasoning model with reference information about past threat control situations, so as to better reason about the control response probability of new target network traffic, thereby improving the analysis and response capabilities of network security.

[0016] Step S200: Obtain a joint reasoning model; the joint reasoning model is used to infer the control response probability of the target network traffic to be responded to in multiple reasoning branches, one reasoning branch corresponds to a threat control strategy, and each reasoning branch includes corresponding matching variables.

[0017] The joint reasoning model is constructed to reason about the control response probability of the target network traffic to be responded to in multiple reasoning branches. The reasoning branches represent different analysis dimensions in the joint reasoning model, and each reasoning branch corresponds to a threat control strategy. In the context of network security, the threat control strategy is a series of operation rules formulated to deal with different types of network threats. Take the network security system of a large e-commerce enterprise as an example. The enterprise faces various network threats, such as web crawlers maliciously obtaining commodity price information and hackers attempting to attack user payment systems to steal user funds. For the threat of web crawlers, the threat control strategy formulated by the enterprise may include operations such as detecting abnormal high-frequency requests and analyzing the legitimacy of the request source; for the threat of hackers attacking the payment system, the control strategy may involve measures such as encrypting the transmission of user payment information and real-time monitoring of access to payment interfaces. In the joint reasoning model, there will be reasoning branches corresponding to these two threat control strategies. Each reasoning branch includes a corresponding matching variable. The matching variable is a key element used to perform matching operations with other data during the model reasoning process. These variables are usually set based on the characteristics and requirements of the threat control strategy. Continuing with the example of the e-commerce enterprise mentioned above, for the reasoning branch of preventing web crawlers, matching variables may include the threshold of request frequency, the credibility of the request source, etc. For the reasoning branch of preventing payment system attacks, matching variables may involve the security protocol type of the payment interface, the user permission level for accessing the payment system, etc.

[0018] The process of obtaining a joint reasoning model by a computer system is a process of building or calling an already built model. When building a joint reasoning model, the computer system needs to consider various types of threats in the network environment and the corresponding control strategies. It determines the structure and parameters of the model based on the analysis of a large amount of network security data, the knowledge and experience of network security experts, and pre-set network security goals.

[0019] For example, when a computer system builds a joint reasoning model for the network security of an e-commerce enterprise, it must first conduct a detailed analysis of the various business processes, data flows, and common threat patterns in the enterprise network. For web crawler threats, the structure and matching variables of the corresponding reasoning branches are determined by analyzing the patterns of web crawler attacks in historical data (such as request frequency, source distribution, etc.). For payment system security threats, the corresponding reasoning branches and their matching variables are constructed in combination with the security requirements of payment services (such as compliance, data confidentiality, etc.).

[0020] Step S300: Match the target response sequence according to the matching variables under each reasoning branch to obtain the response representation vector of the target response sequence under each reasoning branch; the response representation vector under a reasoning branch includes the representation vector in the target response sequence associated with the threat management strategy of the reasoning branch.

[0021] The target response sequence is obtained by the computer system in step S100. It is an ordered set of a series of response results generated by the network traffic corresponding to the threat management strategy that has been triggered by the intrusion detection system in the past. The matching variable belongs to each reasoning branch and is a key element for matching operations with the target response sequence. For example, in the reasoning branch for malware intrusion, the matching variable is pre-set for each reasoning branch, which may include the signature code of the suspicious file (if the target response sequence involves the detection and processing of suspicious files), the abnormal port of the network connection (if the response is related to the monitoring of the network connection), etc. In the reasoning branch for data leakage, the matching variable may include the operation permissions involving sensitive data (such as whether an unauthorized user has accessed a folder containing sensitive data), the encryption status of data transmission (if the response involves the monitoring of data transmission security), etc.

[0022] When the computer system performs a matching operation, it compares the matching variables under each reasoning branch with each element in the target response sequence one by one. For each response result in the target response sequence, the computer system checks whether it is associated with the matching variable of a specific reasoning branch. For example, when the target response sequence contains a response result for checking a certain network connection, the computer system will check whether this response result is related to the matching variables of each reasoning branch. If it is a malware intrusion reasoning branch, and the matching variable of the reasoning branch contains the relevant settings of the abnormal network connection port, the computer system will determine whether the response result of the network connection check involves information related to the abnormal port.

[0023] The response representation vector is the result obtained by the computer system after the matching operation. The response representation vector under an inference branch includes the representation vector associated with the threat management strategy of the inference branch in the target response sequence. Continuing with the above-mentioned enterprise network scenario as an example, under the inference branch for malware intrusion, if there is a response result for suspicious file detection in the target response sequence, the computer system will extract the relevant information in this response result to form a representation vector related to the malware intrusion inference branch. This representation vector may contain information such as the discovery location of the suspicious file, the detection time, and the preliminary analysis results of the suspicious file (such as whether it is suspected to be a known malware family). The representation vector composed of this information can reflect the part of the target response sequence that is related to the malware intrusion threat management strategy.

[0024] Step S400: using a joint reasoning model, based on response characterization vectors under multiple reasoning branches, inferring the control response probability of the intrusion detection system to the target network traffic.

[0025] The target network traffic is the network traffic that currently needs to be security analyzed and controlled response evaluated. When the computer system executes step S400, the response characterization vectors under multiple reasoning branches are input into the joint reasoning model for reasoning. The joint reasoning model calculates the control response probability of the intrusion detection system for the target network traffic based on these input response characterization vectors and its internal logical structure and algorithm (such as a fully connected network or classifier, such as SVM, Softmax). This control response probability represents the possibility of the intrusion detection system taking a corresponding threat control strategy for the target network traffic. For example, the target network traffic contains some suspicious traffic patterns, such as a sudden increase in the traffic of a certain IP segment and a large number of abnormal data packet structures. Different reasoning branches in the joint reasoning model correspond to different threat control strategies, such as strategies for traffic flooding attacks, strategies for malicious data packet transmission, etc. For the reasoning branch for traffic flooding attacks, its response characterization vector may contain the response characteristics of the intrusion detection system in previous similar traffic flooding attack events, such as the time when the abnormal increase in traffic was first discovered, the initial control measures taken at that time, etc. For the reasoning branch for malicious data packet transmission, its response representation vector may include the detection results of malicious data packet characteristics, historical response information of similar malicious data packet processing, etc. After the computer system inputs the response representation vectors under these different reasoning branches into the joint reasoning model, the joint reasoning model will comprehensively consider the situations of each reasoning branch. If the response representation vector under the reasoning branch for traffic flooding attacks shows that similar situations in the past mostly triggered control measures quickly, and the abnormal traffic growth characteristics in the current target network traffic are similar to historical situations, then this reasoning branch will tend to give a higher control response probability. For the reasoning branch for malicious data packet transmission, if the malicious data packet detection results in the response representation vector are not clear enough and do not fully match the typical malicious data packet characteristics in history, then this reasoning branch may give a relatively low control response probability.

[0026] Finally, the joint reasoning model combines the results of each reasoning branch to derive the probability of the intrusion detection system's control response to the target network traffic. This probability will provide an important reference for network security managers to help them decide whether they need to further investigate the target network traffic or whether they need to take corresponding control measures immediately. For example, if the control response probability is high, managers may initiate emergency plans in advance, monitor the target network traffic more strictly, or restrict certain suspicious network connections to prevent potential network threats from damaging the network environment.

[0027] As an embodiment, the method further includes:

[0028] Step S201: Obtaining a traffic encoding vector of target network traffic through a joint reasoning model;

[0029] Step S400, through the joint reasoning model, based on the response characterization vectors under multiple reasoning branches, the probability of the intrusion detection system's control response to the target network traffic is inferred, including:

[0030] Step S410: Inferring the control response probability of the intrusion detection system to the target network traffic based on the traffic coding vector and the response characterization vectors under multiple reasoning branches through the joint reasoning model.

[0031] In step S201, the traffic encoding vector is a vector representation obtained by encoding the target network traffic. It converts various characteristic information in the target network traffic into a vector form that can be processed by a computer according to certain rules and algorithms. For example, for a network data packet, its source IP address can be mapped to a specific value, and the destination IP address, port number, protocol type, etc. are also converted into corresponding values, and then these values ​​are combined to form a traffic encoding vector.

[0032] The computer system first extracts key features from the target network traffic. Taking a network data packet as an example, it will extract information such as the source IP address, destination IP address, port number, protocol type, etc. from the packet header. For some complex network application layer protocols, it may also extract information such as the request method (GET, POST, etc.) and URL path in the HTTP request. These features are the basis for constructing traffic encoding vectors.

[0033] The computer system encodes the extracted features according to the pre-set encoding rules. Assume that the encoding rule of the source IP address is to convert the four bytes of the IP address into a fixed-length value according to a certain mathematical transformation. For example, the IP address 192.168.1.1 is converted into a specific integer through a hash function (such as a simple modulus operation, etc.). Similarly, the destination IP address, port number, protocol type and other features are also encoded according to their respective encoding rules. Then, these encoded values ​​are combined in a certain order to form the traffic encoding vector of the target network traffic.

[0034] The federated reasoning model defines which features are important and should be extracted for encoding, as well as how these features should be encoded. For example, the federated reasoning model may stipulate that for certain types of network traffic (such as data traffic related to the core business of the enterprise), certain fields in the application layer protocol need to be encoded in more detail, while for ordinary network traffic (such as employees' daily Internet browsing traffic), a simpler encoding method can be used. Obtaining the traffic encoding vector through the federated reasoning model can ensure that this vector can accurately reflect the characteristics of the target network traffic and is compatible with subsequent reasoning operations in the federated reasoning model.

[0035] In step S410, as described above, the traffic encoding vector is a coded representation of the target network traffic characteristics. It contains the encoding results of the source IP address, destination IP address, port number, protocol type and other information of the target network traffic. This vector is an abstract representation of the target network traffic by the computer system, and can provide information about the characteristics of the target network traffic itself to the joint reasoning model.

[0036] The response characterization vector is obtained by matching the target response sequence according to the matching variables under each reasoning branch in step S300. The response characterization vector under each reasoning branch contains the characterization vector associated with the threat management strategy of the reasoning branch in the target response sequence. For example, under a reasoning branch for network intrusion, the response characterization vector may contain the response characteristics of the intrusion detection system in previous network intrusion events, such as the time when the intrusion was discovered, relevant information about the source of the intrusion, etc.

[0037] The control response probability indicates the probability that the intrusion detection system will adopt a corresponding threat control strategy for the target network traffic. This probability is the result of the computer system considering multiple factors such as the traffic encoding vector and the response representation vector through a joint reasoning model. For example, if the control response probability is high, it means that the intrusion detection system is likely to take corresponding control measures for the target network traffic, such as blocking suspicious network connections and warning of abnormal behavior.

[0038] The computer system first integrates the traffic encoding vector and the response representation vectors under multiple reasoning branches. The joint reasoning model infers the integrated data according to predefined algorithms and logic. For example, the joint reasoning model may include an algorithm based on probability statistics, which calculates the control response probability of the current target network traffic based on similar traffic characteristics and response characteristics in historical data. If there is network traffic with similar traffic encoding vector characteristics (such as the same source IP address range, destination port, and protocol type) in the historical data, and a higher intrusion risk is shown in the response representation vector (such as frequent abnormal database operations), then the joint reasoning model will tend to give a higher control response probability.

[0039] During the reasoning process, the computer system will comprehensively consider various factors in the traffic encoding vector and the response representation vector under multiple reasoning branches. For example, in the traffic encoding vector, although the source IP address looks legitimate, if the response representation vector finds that this IP address has a history of abnormal network behavior (even if it is not for the current target network traffic type), the joint reasoning model will adjust the control response probability to a certain extent. Similarly, if the protocol type in the traffic encoding vector is a protocol that is easily exploited for attack (such as some insecure file transfer protocols), and the response representation vector shows that a security incident has occurred under this protocol, it will also affect the calculation of the control response probability. By comprehensively considering these various factors, the computer system can more accurately infer the control response probability of the intrusion detection system to the target network traffic, thereby providing a more reliable decision-making basis for network security management.

[0040] As an implementation method, any one of the multiple reasoning branches is used as a target reasoning branch, and the matching variable under the target reasoning branch belongs to the matching representation vector. Step S300, according to the matching variable under each reasoning branch, matches the target response sequence to obtain the response representation vector of the target response sequence under each reasoning branch, including:

[0041] Step S310: extracting a representation vector of the target response sequence through a joint reasoning model to obtain an initial response representation vector of the target response sequence;

[0042] Step S320: performing feature fusion on the traffic coding vector and the matching representation vector under the target reasoning branch to obtain a fused feature vector;

[0043] Step S330: Match the initial response representation vector according to the fused feature vector to generate a response representation vector of the target response sequence under the target reasoning branch.

[0044] In step S310, the target response sequence is obtained by the computer system in the previous step. It is an ordered set of a series of response results generated by the network traffic corresponding to the threat control strategy that has been triggered by the intrusion detection system in the past. For example, in an enterprise network environment, when the intrusion detection system detects that an internal computer sends a large amount of data to the outside abnormally, the responses that may be generated include recording the event to the log (recording the size and time of the sent data, etc.), sending a notification to the network administrator (including the computer's identification and other information), and restricting the computer's network connection (recording the type of restriction, such as limiting the upload speed, etc.). These responses constitute the target response sequence in the order in which they occur.

[0045] Representation vector extraction is the process of converting the information in the target response sequence into a vector form that can be calculated and processed by the computer system. This process requires analyzing each response result in the target response sequence, extracting key feature information, and expressing this information in the form of a vector.

[0046] The computer system first analyzes each response result in the target response sequence. Taking the target response sequence for abnormal outbound data sent by internal computers in the enterprise network as an example, for the response result of logging, the computer system will analyze the size and time of the sent data recorded in it. For the response result of notifying the administrator, the computer identification and other information contained in the notification will be analyzed.

[0047] Next, the computer system extracts key features from each analyzed response. In log records, key features may be the numerical range of data size, the specific time period of the transmission time (such as whether it is outside of working hours), etc. For the response results notifying the administrator, the key feature may be the role identification of the computer in the enterprise network (such as whether it is a computer in the finance department), etc.

[0048] Finally, the computer system combines these extracted key features in a certain order to construct an initial response representation vector. For example, the initial response representation vector may contain elements such as data size, time identifier (such as 0 for working hours, 1 for out of working hours), computer role identifier (such as 0 for non-financial department, 1 for financial department), etc. The vector composed of these elements is the initial response representation vector of the target response sequence.

[0049] In step S320, the traffic encoding vector is a vector representation obtained by encoding the target network traffic. It converts various characteristic information in the target network traffic into a vector form that can be processed by a computer according to certain rules and algorithms. For example, for a network data packet, its source IP address, destination IP address, port number, protocol type and other information are encoded and combined into a traffic encoding vector.

[0050] In the joint reasoning model, each reasoning branch has a corresponding matching representation vector. This matching representation vector contains feature information related to the threat management strategy of the reasoning branch. For example, in the reasoning branch for network malware propagation, the matching representation vector may contain feature identifiers related to the common propagation ports of malware, suspicious file types, etc.

[0051] Feature fusion is the process of integrating the feature information in the traffic encoding vector and the matching representation vector under the target reasoning branch. The purpose is to obtain an integrated feature vector containing the key information of both, so that subsequent operations can use this comprehensive information for processing.

[0052] The computer system determines a method for feature fusion of the traffic encoding vector and the matching representation vector under the target reasoning branch. One method is direct combination. For example, if the traffic encoding vector includes [source IP address encoding value, destination IP address encoding value, port number encoding value, protocol type encoding value], and the matching representation vector under the target reasoning branch includes [malware propagation port identifier, suspicious file type identifier], then the combined integrated feature vector may be [source IP address encoding value, destination IP address encoding value, port number encoding value, protocol type encoding value, malware propagation port identifier, suspicious file type identifier].

[0053] Another way can be merging. For example, when some elements in the traffic encoding vector have similar meanings to elements in the matching representation vector, a merging operation can be performed. Assuming that the port number encoding value in the traffic encoding vector has a certain correlation with the malware propagation port identifier in the matching representation vector, the computer system can merge them into a new element. This new element contains both the basic encoding information of the port number and the identifier information related to the malware propagation port, thereby forming an integrated feature vector.

[0054] In step S330, the fused feature vector is a vector obtained by feature fusion in step S320, which contains comprehensive feature information of the traffic coding vector and the matching representation vector under the target reasoning branch.

[0055] The initial response characterization vector is a vector obtained by extracting the characterization vector of the target response sequence in step S310, and contains key feature information of each response result in the target response sequence.

[0056] The computer system matches the fused feature vector with the initial response representation vector. Taking enterprise network security as an example, it is assumed that the fused feature vector contains the source IP address encoding value of the network traffic (assuming it is the IP segment encoding of a department within the enterprise), the protocol type encoding value (such as HTTP protocol encoding), and the sensitive data access permission identifier in the matching representation vector under the target reasoning branch (such as the reasoning branch for internal data leakage). The initial response representation vector contains information such as the data access time identifier (such as within or outside working hours) and the type identifier of the accessed data (such as financial data or ordinary document identifier) ​​in the previous response results of the internal data access incident.

[0057] The computer system will check the associations between the elements in these vectors. For example, whether the department corresponding to the source IP address encoding value frequently accesses a specific type of data (reflected by the data type identifier in the initial response representation vector), and whether the protocol type is related to a specific data access mode (such as whether there is a special data transmission mode under the HTTP protocol that is related to the risk of data leakage).

[0058] Through this matching operation, the computer system filters and adjusts information from the initial response representation vector to construct a response representation vector for the target response sequence under the target reasoning branch. For example, if the department corresponding to the source IP address encoding value in the fusion feature vector is the finance department, and the initial response representation vector shows that there is access to financial data outside of working hours (related to data leakage risk), then the response representation vector under the reasoning branch for internal data leakage will highlight these relevant information, such as the time of financial data access (outside of working hours), access source (finance department IP segment) and other key information. The vector composed of this information is the response representation vector of the target response sequence under the target reasoning branch.

[0059] As an implementation method, the target response sequence includes multiple response information of the control network traffic, and the initial response representation vector includes a response representation vector obtained by extracting the representation vector of each response information in the multiple response information. Then, step S330, matching the initial response representation vector according to the fused feature vector, and generating the response representation vector of the target response sequence under the target reasoning branch, includes:

[0060] Step S331: performing commonality measurement on the fused feature vector and the initial response representation vector to obtain the correlation influence coefficient between each response representation vector in the initial response representation vector and the fused feature vector;

[0061] Step S332: According to the correlation influence coefficient between each response representation vector and the fusion feature vector, weight adjustment is performed on each response representation vector to obtain a plurality of adjusted response representation vectors;

[0062] Step S333: merging multiple adjusted response representation vectors to obtain a response representation vector of the target response sequence under the target reasoning branch.

[0063] In step S331, the fused feature vector is a vector obtained by fusion of the traffic encoding vector and the matching representation vector under the target reasoning branch in the previous step (S320). This vector contains the comprehensive features of the target network traffic (represented by the traffic encoding vector) and the feature information related to the target reasoning branch (represented by the matching representation vector). For example, in the enterprise network security scenario, the fused feature vector may contain information such as the source IP address range (encoded) of the network traffic, the protocol type (such as TCP or UDP encoding), and the common intrusion port identification of malware under the target reasoning branch (assuming it is for network intrusion detection).

[0064] The initial response characterization vector is a vector obtained by extracting the characterization vector of the target response sequence in step S310. The commonality metric is used to measure the similarity or correlation between two vectors. In this step, the computer system calculates the degree of commonality between each element in the initial response characterization vector and the element in the fused feature vector through a specific algorithm. This degree of commonality can be calculated in a variety of ways, such as based on numerical distance (such as Euclidean distance), logical relationship (such as the degree of logical matching between elements), etc.

[0065] The correlation influence coefficient is a value calculated by commonality measurement, which indicates the degree of correlation between each response representation vector in the initial response representation vector and the fusion feature vector. The value range of this coefficient is usually between 0 and 1, where 0 means no correlation at all and 1 means complete correlation.

[0066] The computer system first analyzes each element in the fused feature vector and the initial response representation vector. For example, the source IP address range element in the fused feature vector may be a specific network segment code, and the detection time identifier element in the initial response representation vector may be a value indicating daytime or nighttime. The computer system considers whether there is a potential correlation between these elements.

[0067] Next, the computer system applies a specific commonality measurement algorithm. Assuming that an algorithm based on logical relationships is used, for the source IP address range element and the response element related to the source IP address in the initial response characterization vector (such as whether the IP address is from a specific department), if the two logically match (for example, the source IP address range belongs to a specific department, and the response element identifies the activities related to the department), a higher logical matching score is given; if they do not match, a lower score is given. Similar logical relationship analysis is also performed for other elements, such as protocol type and protocol-related response elements (such as response actions for specific protocols).

[0068] If an algorithm based on numerical distance is used, for example, the numerical distance between the fusion feature vector element representing the size of network traffic and the response element related to the size of traffic in the initial response representation vector (such as the flag of whether to perform special treatment on large traffic) is calculated. The smaller the numerical distance, the higher the correlation, and a score between 0 and 1 is calculated based on this distance.

[0069] The computer system integrates the commonality measurement results of each element and calculates the correlation influence coefficient between each response characterization vector in the initial response characterization vector and the fused feature vector.

[0070] In step S332, the correlation influence coefficient is a numerical value representing the degree of correlation between each response characterization vector in the initial response characterization vector and the fused feature vector, and the value range is between 0 and 1.

[0071] Weight adjustment is the operation of adjusting the response representation vector according to the correlation influence coefficient. By using the correlation influence coefficient as the weight, the elements in the response representation vector are weighted, so that the response representation vector with high correlation with the fusion feature vector has a greater influence in subsequent calculations, while the response representation vector with low correlation has a relatively small influence.

[0072] The computer system first determines the weight adjustment method. Usually, a simple multiplication method is used, that is, each element in the response representation vector is multiplied by the corresponding correlation influence coefficient. For example, assuming that an initial response representation vector is [element 1=5, element 2=3], the correlation influence coefficient between it and the fusion feature vector is 0.6.

[0073] For element 1, the adjusted result is 5* 0.6=3; for element 2, the adjusted result is 3* 0.6=1.8. In this way, the adjusted response representation vector [3, 1.8] is obtained.

[0074] In the actual example of enterprise network security, the initial response characterization vector may contain elements related to the detection results of abnormal network activities, such as the frequency identifier of abnormal activities (assuming the initial value is 10, indicating a higher frequency) and the source identifier of abnormal activities (assuming the initial value is 1, indicating an internal source). If the correlation coefficient with the fusion feature vector (including network traffic features and target reasoning branch related features, such as the correlation features between traffic patterns under a specific protocol and internal source traffic) is 0.8.

[0075] For the abnormal activity frequency identification element, the adjusted result is 10* 0.8=8; for the abnormal activity source identification element, the adjusted result is 1* 0.8=0.8. The adjusted response representation vector is [8, 0.8]. Through this weight adjustment, the response representation vector elements with high correlation with the fused feature vector can better reflect their importance in subsequent processing.

[0076] In step S333, the adjusted response characterization vector is the vector obtained by weighting the initial response characterization vector according to the correlation influence coefficient in step S332. These vectors have been adjusted according to the correlation with the fused feature vector so that the element weight in each vector reflects its degree of association with the fused feature vector.

[0077] The computer system first determines the way to merge the operations. A common way is to directly combine the elements in the adjusted response representation vector in order. For example, there are two adjusted response representation vectors, vector 1 is [3, 1.8], vector 2 is [2, 1.2], and the merged vector is [3, 1.8, 2, 1.2].

[0078] The computer system merges multiple adjusted response representation vectors according to the determined merging method to obtain the response representation vector of the target response sequence under the target reasoning branch. For example, after merging the above two adjusted response representation vectors about data access rights and data transmission anomalies, the response representation vector under the target reasoning branch may be [0.5, 0.3]. This vector contains the key information of the target response sequence under the target reasoning branch after matching with the fusion feature vector and adjusting the correlation weight, which will serve as important input data for subsequent steps (such as reasoning about the control response probability of the intrusion detection system to the target network traffic in the joint reasoning model).

[0079] As an implementation method, step S320, performing feature fusion on the traffic coding vector and the matching representation vector under the target reasoning branch to obtain a fused feature vector, includes:

[0080] Step S321: Combine the traffic coding vector and the matching representation vector under the target reasoning branch to obtain a fused feature vector; or, merge the traffic coding vector and the matching representation vector under the target reasoning branch to obtain a fused feature vector; the number of elements of the traffic coding vector is the same as the number of elements of the matching representation vector under the target reasoning branch.

[0081] The traffic encoding vector is a vector representation obtained by encoding the target network traffic. It converts various feature information in the target network traffic into a vector form that can be processed by the computer according to specific rules and algorithms. In the joint reasoning model, each reasoning branch has a corresponding matching representation vector. This vector contains feature information related to the threat management strategy of the reasoning branch. For example, under the reasoning branch for malware intrusion, the matching representation vector may contain related feature identifiers such as common propagation ports of malware (such as the encoding values ​​corresponding to ports 21 and 22, assuming they are 11 and 12), suspicious file types (such as .exe file type encoding 01, .dll file type encoding 02), etc., assuming that the matching representation vector is [11, 12, 01, 02]. The combination operation is to connect the traffic encoding vector and the matching representation vector under the target reasoning branch in a certain order to form a new vector, which is the fused feature vector.

[0082] The merge operation is different from the combination operation. It does not simply connect two vectors, but merges the elements in the traffic encoding vector and the matching representation vector under the target reasoning branch according to certain rules. For example, suppose that an element in the traffic encoding vector has a similar meaning or association with an element in the matching representation vector. If the port number encoding value in the traffic encoding vector has a certain association with the malware propagation port identifier in the matching representation vector, the computer system can merge them into a new element. For example, the actual port 80 corresponding to the port number 080 in the traffic encoding vector is associated with the malware propagation port identifier 11 (corresponding to port 21) in the matching representation vector, so they can be merged into a new element, such as obtaining a new encoding value 105 through a certain algorithm (such as weighted average or specific logical operation) (here is just an example algorithm and result). Then, the other unmerged elements are arranged in a certain order to finally form a fused feature vector.

[0083] As an implementation mode, the joint reasoning model includes multiple joint reasoning branch models, and one joint reasoning branch model represents one reasoning branch among multiple reasoning branches; based on this, step S410, through the joint reasoning model, according to the traffic encoding vector and the response representation vectors under the multiple reasoning branches, the control response probability of the intrusion detection system to the target network traffic is inferred, including:

[0084] Step S411: Based on the traffic coding vector and the response representation vector corresponding to each joint reasoning branch model, the trigger probability corresponding to each joint reasoning branch model is inferred respectively; the trigger probability corresponding to any joint reasoning branch model is the possibility of the intrusion detection system implementing the threat control strategy corresponding to any joint reasoning branch model on the target network traffic;

[0085] Step S412: Determine the control response probability of the intrusion detection system to the target network traffic based on the trigger probability corresponding to each joint reasoning branch model.

[0086] In step S411, each joint reasoning branch model performs reasoning calculations based on the input data. Taking the network intrusion detection joint reasoning branch model as an example, it is assumed that an algorithm based on probability statistics is used inside the model. If the source IP address in the traffic encoding vector is associated with a high-risk network segment in the historical data (such as some IP segments marked as frequently initiating malicious scans), and the response characterization vector shows that in the case of a similar source IP address, the intrusion detection system has an 80% probability of taking control measures. Based on this information, the model may combine other traffic features (such as whether the port number is a common attack port) and response features (such as the similarity between the intrusion method and the historical intrusion method) to calculate a trigger probability through an internal algorithm. Assume that after calculation, the trigger probability corresponding to this network intrusion detection joint reasoning branch model is 0.7, indicating that the intrusion detection system has a 70% probability of taking a threat control strategy corresponding to network intrusion detection for the current target network traffic.

[0087] In step S412, the computer system determines the control response probability of the intrusion detection system to the target network traffic based on the trigger probability corresponding to each joint reasoning branch model.

[0088] The possible way to determine the probability of control response is based on pre-set weights. Assume that the weight of network intrusion detection strategy in the enterprise network security strategy is 0.5, the weight of data leakage prevention strategy is 0.3, and the weight of malware protection strategy is 0.2.

[0089] The process of calculating the control response probability of the computer system is as follows: First, multiply the trigger probability corresponding to each joint reasoning branch model by its corresponding weight. For the network intrusion detection joint reasoning branch model, the calculation result is 0.7*0.5=0.35; for the data leakage prevention joint reasoning branch model, the calculation result is 0.4*0.3=0.12; for the malware protection joint reasoning branch model, the calculation result is 0.5*0.2=0.1. Then, add these product results to get the control response probability of 0.35+0.12+0.1=0.57. This means that there is a 57% probability that the intrusion detection system will take control measures on the current target network traffic.

[0090] In another possible way, if the trigger probability corresponding to the network intrusion detection joint reasoning branch model is higher than a certain threshold (such as 0.6), then regardless of the trigger probability of other joint reasoning branch models, the control response probability directly takes a higher value (such as 0.8), indicating that once the risk of network intrusion is high, the intrusion detection system is very likely to take control measures. If the trigger probability corresponding to the network intrusion detection joint reasoning branch model is lower than the threshold, the computer system determines the control response probability according to other calculation rules (such as the weight calculation method mentioned above).

[0091] As an implementation method, there are multiple target response sequences, and one target response sequence includes a response representation vector under one reasoning branch, and any one of the multiple joint reasoning branch models is used as the target joint reasoning branch model. Based on this, step S411, according to the traffic coding vector and the response representation vector corresponding to each joint reasoning branch model, respectively infers the trigger probability corresponding to each joint reasoning branch model, including:

[0092] Step S4111: acquiring system configuration data of the intrusion detection system, and extracting a representation vector of the system configuration data through a joint reasoning model to obtain a system configuration representation vector of the intrusion detection system;

[0093] Step S4112: combining the traffic coding vector, the system configuration representation vector, and multiple response representation vectors of multiple target response sequences under the reasoning branch of the target joint reasoning branch model to obtain an execution feature vector of the target joint reasoning branch model;

[0094] Step S4113: inferring the trigger probability corresponding to the target joint reasoning branch model based on the execution feature vector of the target joint reasoning branch model.

[0095] In step S4111, the system configuration data of the intrusion detection system includes various information related to the intrusion detection system's own settings and operating environment. For example, in an enterprise network environment, the system configuration data may include the settings of intrusion detection rules, such as the detection threshold settings for different types of network attacks (such as DDoS attacks, port scanning attacks, etc.). If for port scanning attacks, more than 10 port connection attempts in a short period of time (such as within 1 minute) are considered suspicious behavior, this threshold setting is part of the system configuration data. It may also include the monitoring scope setting of the intrusion detection system, such as whether to monitor only the traffic between the enterprise's internal network, or also include the traffic between the enterprise's internal network and the external network. In addition, the system configuration data also covers settings related to alarms, such as when suspicious behavior is detected, whether to send an email alarm to the network administrator immediately or only record it in the log, as well as the detailed level of the alarm (such as a simple prompt or a detailed attack analysis report).

[0096] The computer system first obtains the system configuration data of the intrusion detection system. Assuming that in a large enterprise network, the computer system reads relevant data from the configuration file and database of the intrusion detection system. For the setting part of the intrusion detection rule, the computer system analyzes the detection thresholds corresponding to various attack types. For example, in addition to the port scan attack threshold mentioned above, for DDoS attacks, it may be set that traffic per second exceeding 100Mbps and coming from more than 5 different source IP addresses is considered a suspected DDoS attack.

[0097] Next, the computer system extracts key features from the analyzed system configuration data. For example, from the attack detection threshold setting, the threshold value of each attack type (such as the port scan attack threshold is 10, the DDoS attack threshold is 100Mbps traffic and 5 source IPs) is extracted as part of the vector element. For the monitoring scope, binary code is used to indicate whether different departments are monitored (such as 0 for no monitoring, 1 for monitoring, assuming that the R&D department is 1, the finance department is 1, and the marketing department is 1). For the alarm setting, it is encoded according to the alarm method and detail level (such as email alarm and detailed report is 10, SMS alarm and simple prompt is 01, etc.). Finally, the computer system combines these extracted key features in a certain order to construct a system configuration representation vector of the intrusion detection system. For example, a possible system configuration representation vector is [10,100, 5, 111, 10], where 10 represents the port scan attack threshold, 100 represents the DDoS attack traffic threshold, 5 represents the DDoS attack source IP number threshold, 111 represents monitoring of the R&D, finance, and marketing departments, and 10 represents the alarm setting of email alerts and detailed reports.

[0098] In step S4112, as described above, the traffic encoding vector is a vector representation obtained after encoding the target network traffic, and includes the encoding results of various characteristic information such as the source IP address, destination IP address, port number, protocol type, etc. in the target network traffic.

[0099] The system configuration characterization vector is a vector obtained by extracting the characterization vector of the system configuration data of the intrusion detection system in step S4111, and includes the detection threshold, monitoring range, alarm settings and other related feature information of the intrusion detection system. Among the multiple joint reasoning branch models included in the joint reasoning model, the target joint reasoning branch model is the joint reasoning branch model that is currently being analyzed and processed. For example, among the multiple joint reasoning branch models for network intrusion detection, data leakage prevention, malware protection, etc., if the joint reasoning branch model of network intrusion detection is currently being analyzed, then it is the target joint reasoning branch model.

[0100] The execution feature vector is a vector obtained by combining the traffic encoding vector, the system configuration representation vector and multiple response representation vectors. This vector will be used as the input data for the target joint reasoning branch model for reasoning calculation. It contains comprehensive information such as the target network traffic, intrusion detection system configuration and historical responses related to the target joint reasoning branch model.

[0101] The computer system first determines the order of combination. For example, taking the target joint reasoning branch model of network intrusion detection as an example, the computer system puts the traffic encoding vector first, then the system configuration representation vector, and finally the response representation vector of multiple target response sequences under the target joint reasoning branch model. Assume that the traffic encoding vector is [1001, 2005, 0808, 02] (where 1001 is the source IP address code, 2005 is the destination IP address code, 0808 is the port number code, and 02 is the protocol type code), and the system configuration representation vector is [10, 100, 5, 111, 10] (the meaning of each element has been explained above).

[0102] Suppose there are two target response sequences in the network intrusion detection target joint reasoning branch model. The response representation vectors are as follows: vector 1 is [5, 1, 01] (where 5 may represent the time mark of the discovery of the intrusion, 1 represents the mark of the source of the intrusion, and 01 represents the preliminary judgment mark of the intrusion method), and vector 2 is [3, 0, 10] (different time, source and intrusion method marks).

[0103] The computer system combines these vectors in order and obtains the execution feature vector of the target joint reasoning branch model as [1001, 2005, 0808, 02, 10, 100, 5, 111, 10, 5, 1, 01, 3, 0, 10]. This execution feature vector contains the basic characteristics of the target network traffic, the configuration information of the intrusion detection system, and the historical response characteristics related to network intrusion detection, providing a comprehensive data basis for the reasoning operation of the target joint reasoning branch model.

[0104] In step S4113, the execution feature vector of the target joint reasoning branch model is a vector obtained by combining the traffic coding vector, the system configuration characterization vector and the response characterization vector in step S4112, which contains comprehensive information from many aspects and is the basis for the target joint reasoning branch model to perform reasoning calculations.

[0105] The target joint reasoning branch model processes the execution feature vector according to its internal algorithms and logic. Taking the target joint reasoning branch model of network intrusion detection as an example, it is assumed that the model uses a machine learning-based algorithm, such as a decision tree algorithm. The model analyzes each element in the execution feature vector. For example, for the source IP address code (1001), if this source IP address segment has a certain correlation with the network intrusion risk in the historical data (perhaps there has been an attack record from this IP segment in the past), the model will give a certain weight based on this information.

[0106] For the intrusion detection threshold element in the system configuration characterization vector (such as the port scan attack threshold of 10), if the connection attempts of the port corresponding to the port number code (0808) in the execution feature vector approach or exceed this threshold in a short period of time, the model will consider that the risk of network intrusion has increased. For the discovery intrusion time mark in the response characterization vector (such as 5), if this time mark is similar to the previous high-risk intrusion time pattern (such as there were many intrusion events in this time period in the past), the model will also consider this factor.

[0107] By comprehensively considering all elements in the execution feature vector, the model calculates the trigger probability corresponding to the target joint reasoning branch model. Assuming that after complex calculations, under this target joint reasoning branch model of network intrusion detection, the calculated trigger probability is 0.6, indicating that the intrusion detection system has a 60% probability of adopting the threat control strategy corresponding to network intrusion detection for the current target network traffic.

[0108] As an implementation mode, the joint reasoning model includes a common sub-model, which is used to extract common representation information of multiple joint reasoning branch models in the target response sequence, and the common sub-model includes a corresponding execution feature vector; based on this, step S4113, according to the execution feature vector of the target joint reasoning branch model, infers the trigger probability corresponding to the target joint reasoning branch model, including:

[0109] Step S41131: extracting implicit representation information of the execution feature vector of the target joint reasoning branch model through the target joint reasoning branch model to obtain a first implicit representation vector of the execution feature vector of the target joint reasoning branch model;

[0110] Step S41132: extracting implicit representation information of the execution feature vector of the general sub-model through the general sub-model to obtain a second implicit representation vector of the execution feature vector of the general sub-model;

[0111] Step S41133: Infer the trigger probability corresponding to the target joint reasoning branch model based on the first implicit representation vector and the second implicit representation vector through the target joint reasoning branch model.

[0112] In step S41131, the target joint reasoning branch model is a specific branch model in the joint reasoning model, which focuses on the reasoning of a specific type of threat management strategy. For example, in a network security scenario, there may be a target joint reasoning branch model for network intrusion detection, a target joint reasoning branch model for data leakage prevention, etc. Each target joint reasoning branch model has its own unique structure and parameters, which is used to process data related to a specific threat management strategy.

[0113] The first representation information extraction component is a component in the target joint reasoning branch model used to extract specific representation information. These components focus on extracting implicit representation information related to the target joint reasoning branch model from the execution feature vector. The second representation information extraction component is similar to the first representation information extraction component, but may belong to a different part of the target joint reasoning branch model or have a different functional focus. For example, in the target joint reasoning branch model of network intrusion detection, the first representation information extraction component may focus on extracting intrusion risk information from the characteristics of the network traffic itself, while the second representation information extraction component may focus on extracting information related to the current intrusion risk judgment from the historical response characteristics of the intrusion detection system.

[0114] The integration influence coefficient is a weighted data used to measure the importance of each representation information extraction component in the integration process. For each first representation information extraction component and each second representation information extraction component, the integration influence coefficient indicates the degree of their influence on the final result (such as the extraction and integration of implicit representation information). The value range of these coefficients is usually between 0 and 1, and the larger the value, the greater the influence of the component in the integration process.

[0115] The computer system first analyzes the execution feature vector of the target joint reasoning branch model. Taking the target joint reasoning branch model of network intrusion detection as an example, it is assumed that the execution feature vector is [1001, 2005, 0808, 02, 10,100, 5, 111, 10, 5, 1, 01, 3, 0, 10] (where 1001 is the source IP address code, 2005 is the destination IP address code, 0808 is the port number code, 02 is the protocol type code, 10 is the port scan attack threshold, 100 is the DDoS attack traffic threshold, 5 is the DDoS attack source IP number threshold, 111 represents the monitoring of certain departments, 10 represents the alarm setting, and 5, 1, 01, 3, 0, 10 are the response feature codes related to historical network intrusion events).

[0116] The computer system will check each element in the execution feature vector to determine which elements are related to different characterization information extraction components. For example, the source IP address code (1001) may be related to the first characterization information extraction component specifically used to analyze source IP address risks, the port number code (0808) may be related to the first characterization information extraction component for port number risk analysis, and the response feature code (such as 5, 1, 01, etc.) related to historical network intrusion events may be related to the second characterization information extraction component.

[0117] The computer system generates integrated variables based on the analysis results of the execution feature vector according to the algorithm and logic inside the target joint reasoning branch model. Assume that in the target joint reasoning branch model of network intrusion detection, there are three first representation information extraction components, which are used to analyze the source IP address risk, port number risk and protocol type risk respectively; there are two second representation information extraction components, which are used to analyze the time risk and source risk in historical intrusion events.

[0118] For the first characterization information extraction component of source IP address risk, the computer system generates an integrated impact coefficient, such as 0.4, based on the intrusion risk association of the source IP address code (1001) in the execution feature vector in historical data (assuming that the IP address segment has a moderate degree of intrusion risk association in history). For the first characterization information extraction component of port number risk, based on the relationship between the port number code (0808) and the common attack port (assuming that the port has a certain attack association), an integrated impact coefficient of 0.3 is generated. For the first characterization information extraction component of protocol type risk, based on the security of the protocol type code (02) (assuming that the HTTP protocol has a certain security risk), an integrated impact coefficient of 0.2 is generated.

[0119] For the second characterization information extraction component of time risk in historical intrusion events, the integrated impact coefficient is 0.6 based on the similarity between the time-related response feature code (such as 5, indicating the time mark of the discovery of the intrusion) and the high-risk intrusion time pattern in the execution feature vector (assuming a certain similarity). For the second characterization information extraction component of source risk, the integrated impact coefficient is 0.7 based on the correlation between the source-related response feature code (such as 1, indicating the mark of the intrusion source) and the suspicious source (assuming a strong correlation).

[0120] Thus, the integrated variable generated by the computer system includes the integrated influence coefficient for each first representation information extraction component (0.4, 0.3, 0.2) and for each second representation information extraction component (0.6, 0.7).

[0121] In step S41132, the first implicit representation vector is a vector composed of implicit representation information extracted from the execution feature vector by the first representation information extraction component. These vectors contain potential information related to the target joint reasoning branch model in the execution feature vector, but this information may not be directly visible and needs to be mined through specific extraction components and algorithms. Weight adjustment is the operation of adjusting the first implicit representation vector according to the integrated influence coefficient. By using the integrated influence coefficient as a weight, the elements in the first implicit representation vector are weighted, so that the first implicit representation vector related to the first representation information extraction component with a larger integrated influence coefficient in the integrated variable has a greater influence in subsequent calculations, while the first implicit representation vector related to the first representation information extraction component with a smaller integrated influence coefficient has a relatively small influence.

[0122] In step S41133, the second implicit representation vector is a vector composed of implicit representation information extracted by the second representation information extraction component from the execution feature vector. For example, in the target joint reasoning branch model of network intrusion detection, the second representation information extraction component used to analyze the time risk in historical intrusion events may extract a second implicit representation vector, which contains information such as the correlation between the time difference between the occurrence time of the historical intrusion event and the current time, the frequency of the intrusion event in a specific time period, etc.

[0123] Similar to the weight adjustment of the first implicit representation vector, this is an operation of adjusting the second implicit representation vector according to the integrated influence coefficient. By using the integrated influence coefficient as the weight, the elements in the second implicit representation vector are weighted, so that the second implicit representation vectors corresponding to the second representation information extraction components with different degrees of importance play a role in subsequent calculations according to their importance.

[0124] As an implementation manner, step S41133, inferring the trigger probability corresponding to the target joint reasoning branch model according to the first implicit representation vector and the second implicit representation vector through the target joint reasoning branch model, includes:

[0125] Step S411331: integrating the first implicit representation vector and the second implicit representation vector through the target joint reasoning branch model to obtain an integrated feature vector;

[0126] Step S411332: Infer the trigger probability corresponding to the target joint reasoning branch model based on the integrated feature vector through the target joint reasoning branch model.

[0127] In step S411331, the target joint reasoning branch model is a specific branch in the joint reasoning model, which is specifically used for reasoning about a specific type of threat management strategy. For example, in a network security scenario, if there are joint reasoning branch models for different types of threats such as network intrusion detection and data leakage prevention, the current processing may be the target joint reasoning branch model of network intrusion detection. It contains various components and algorithms for processing data related to the specific threat.

[0128] The integration operation is a process of comprehensively processing the information in the first implicit representation vector and the second implicit representation vector to obtain an integrated feature vector containing the key information of both. This process aims to fuse the implicit representation information from different sources (the first representation information extraction component and the second representation information extraction component) so as to more comprehensively reflect the features related to the target joint reasoning branch model, thereby providing a more accurate data basis for the trigger probability corresponding to the subsequent reasoning target joint reasoning branch model. A common integration method is to directly combine the elements of the two vectors in a certain order. In the above example, the integrated feature vector after integration is [1.2, 2, 2.4, 3.6]. This combination method simply integrates the information in the first implicit representation vector and the second implicit representation vector, so that the subsequent reasoning operation can simultaneously consider the source IP address risk and the information related to the historical intrusion event. Another possible integration method is based on weighted summation. For example, the computer system can perform weighted summation on the elements in the first implicit representation vector and the second implicit representation vector according to a pre-set weight. Assume that the weight of the first implicit representation vector is 0.4 and the weight of the second implicit representation vector is 0.6. For the intrusion correlation depth of the source IP address in the historical network (1.2 in the first implicit representation vector), the weighted result is 1.2* 0.4=0.48; for the overall risk rating of the network segment where the source IP address is located (2 in the first implicit representation vector), the weighted result is 2* 0.4=0.8; for the time difference correlation between the time of historical intrusion events and the current time (2.4 in the second implicit representation vector), the weighted result is 2.4* 0.6=1.44; for the frequency of intrusion events in a specific time period (3.6 in the second implicit representation vector), the weighted result is 3.6* 0.6=2.16. Then these weighted results are combined to obtain the integrated feature vector [0.48, 0.8, 1.44, 2.16]. This weighted summation integration method can adjust the contribution of different implicit representation vectors in the integrated feature vector according to their importance (reflected by the weight).

[0129] In step S411332, the computer system infers the trigger probability corresponding to the target joint reasoning branch model based on the integrated feature vector through the target joint reasoning branch model.

[0130] As an implementation mode, the target joint reasoning branch model includes x first representation information extraction components, the first representation information extraction component is used to extract a first implicit representation vector; the general sub-model includes y second representation information extraction components, the second representation information extraction component is used to extract a second implicit representation vector, and x and y are both natural numbers greater than 1; based on this, step S411331, through the target joint reasoning branch model, the first implicit representation vector and the second implicit representation vector are integrated to obtain an integrated feature vector, including:

[0131] Step S4113311: Generate an integrated variable according to the execution feature vector of the target joint reasoning branch model through the target joint reasoning branch model; the integrated variable includes an integrated influence coefficient for each first representation information extraction component and an integrated influence coefficient for each second representation information extraction component;

[0132] Step S4113312: according to the integrated influence coefficient of each first representation information extraction component, weight adjustment is performed on each first implicit representation vector extracted by the first representation information extraction component to obtain x adjusted first implicit representation vectors;

[0133] Step S4113313: According to the integrated influence coefficient of each second representation information extraction component, weight adjustment is performed on the second implicit representation vector corresponding to each second representation information extraction component to obtain y adjusted second implicit representation vectors;

[0134] Step S4113314: merge the x adjusted first implicit representation vectors and the y adjusted second implicit representation vectors to obtain an integrated feature vector.

[0135] In step S4113311, the target joint reasoning branch model is a specific part of the joint reasoning model, which focuses on the reasoning of a specific type of threat management strategy. The execution feature vector is a comprehensive vector that contains various information related to the target joint reasoning branch model. The first representation information extraction component is a specific component in the target joint reasoning branch model, and its function is to extract implicit representation information related to the target joint reasoning branch model from the execution feature vector. The second representation information extraction component is similar to the first representation information extraction component and is also a component in the target joint reasoning branch model, but its focus is on extracting different aspects of implicit representation information from the execution feature vector. The integration influence coefficient is a numerical value that indicates the importance of each representation information extraction component in the integration process. These coefficients are generated for each first representation information extraction component and each second representation information extraction component, and the value range is usually between 0 and 1. For example, for a first representation information extraction component, if the information it extracts is very critical to the final reasoning result, it may be assigned a higher integration influence coefficient, such as 0.8; and if the information extracted by a component is relatively unimportant, it may be assigned a lower integration influence coefficient, such as 0.2. These coefficients will be used in the subsequent weight adjustment operation of the first implicit representation vector and the second implicit representation vector to reflect the different contributions of different components in the integration process.

[0136] The computer system first analyzes the relationship between the execution feature vector of the target joint reasoning branch model and the first representation information extraction component and the second representation information extraction component. Taking the target joint reasoning branch model of network intrusion detection as an example, it is assumed that the execution feature vector is [1001, 2005, 0808, 02, 10, 100, 5, 111, 10, 5, 1, 01, 3,0, 10] (where 1001 is the source IP address code, 2005 is the destination IP address code, 0808 is the port number code, 02 is the protocol type code, 10 is the port scan attack threshold, 100 is the DDoS attack traffic threshold, 5 is the DDoS attack source IP number threshold, 111 represents the monitoring of certain departments, 10 represents the alarm setting, and 5, 1, 01, 3, 0, 10 are the response feature codes related to historical network intrusion events).

[0137] For the first characterization information extraction component, it is assumed that there are three components: one for source IP address analysis, one for port number analysis, and one for protocol type analysis. The computer system will determine which elements in the execution feature vector are related to these components. For example, the source IP address code 1001 is related to the source IP address analysis component, the port number code 0808 is related to the port number analysis component, and the protocol type code 02 is related to the protocol type analysis component. For the second characterization information extraction component, it is assumed that there are two components: one for historical intrusion event time analysis and one for intrusion source analysis. The computer system will determine which parts of the response feature codes (such as 5, 1, 01, 3, 0, 10) related to historical intrusion events are related to these components. For example, element 5 (which may indicate the time mark of the discovery of the intrusion) is related to the historical intrusion event time analysis component, and element 1 (which may indicate the mark of the source of the intrusion) is related to the intrusion source analysis component.

[0138] The computer system generates an integrated variable based on the analysis results of the relationship between the execution feature vector and the component according to the algorithm and logic inside the target joint reasoning branch model. Continuing with the example of network intrusion detection, for the first characterization information extraction component of source IP address analysis, the computer system generates an integrated impact coefficient, such as 0.4, based on the situation of the source IP address code 1001 in historical data (assuming that the IP address segment has a certain intrusion association in history, but not a very high risk). For the first characterization information extraction component of port number analysis, based on the relationship between port number code 0808 and common attack ports (assuming that the port has a certain attack association), an integrated impact coefficient of 0.3 is generated. For the first characterization information extraction component of protocol type analysis, based on the security of protocol type code 02 (assuming that the HTTP protocol has a certain security risk), an integrated impact coefficient of 0.2 is generated.

[0139] For the second characterization information extraction component of the historical intrusion event time analysis, based on the similarity between element 5 (the time mark of the discovery of the intrusion) and the high-risk intrusion time pattern (assuming a certain similarity), an integrated influence coefficient of 0.6 is generated. For the second characterization information extraction component of the intrusion source analysis, based on the correlation between element 1 (the mark of the intrusion source) and the suspicious source (assuming a strong correlation), an integrated influence coefficient of 0.7 is generated. In this way, the integrated variable generated by the computer system includes the integrated influence coefficients for each first characterization information extraction component (0.4, 0.3, 0.2) and for each second characterization information extraction component (0.6, 0.7).

[0140] In step S4113312, the computer system performs weight adjustment on the first implicit representation vector extracted by each first representation information extraction component according to the integrated influence coefficient of each first representation information extraction component to obtain x adjusted first implicit representation vectors.

[0141] Weight adjustment is an operation of adjusting the first implicit representation vector according to the integrated influence coefficient. By using the integrated influence coefficient as a weight, the elements in the first implicit representation vector are weighted, so that the first implicit representation vector associated with the first representation information extraction component with a larger integrated influence coefficient in the integrated variable has a greater influence in subsequent calculations, while the first implicit representation vector associated with the first representation information extraction component with a smaller integrated influence coefficient has a relatively smaller influence.

[0142] In step S4113313, the computer system performs weight adjustment on the second implicit representation vector corresponding to each second representation information extraction component according to the integrated influence coefficient of each second representation information extraction component, and obtains y adjusted second implicit representation vectors.

[0143] Similar to the weight adjustment of the first implicit representation vector, this is an operation of adjusting the second implicit representation vector according to the integrated influence coefficient. By using the integrated influence coefficient as a weight, the elements in the second implicit representation vector are weighted, so that the second implicit representation vectors corresponding to the second representation information extraction components of different importance levels play a role in the subsequent calculation according to their importance.

[0144] In step S4113314, the computer system merges the x adjusted first implicit representation vectors and the y adjusted second implicit representation vectors to obtain an integrated feature vector.

[0145] The adjusted first implicit representation vector is a vector obtained by weight-adjusting the first implicit representation vector extracted by the first representation information extraction component according to the integrated influence coefficient in step S4113312. These vectors have been adjusted according to the importance of the first representation information extraction component to which they correspond (reflected by the integrated influence coefficient), so that they can more reasonably reflect their contribution to the final result in the subsequent integration operation. The adjusted second implicit representation vector is a vector obtained by weight-adjusting the second implicit representation vector corresponding to the second representation information extraction component according to the integrated influence coefficient in step S4113313. Similar to the adjusted first implicit representation vector, these vectors are also adjusted according to the importance of the second representation information extraction component to which they correspond.

[0146] The integrated feature vector is a vector obtained by merging the adjusted first implicit representation vector and the adjusted second implicit representation vector. This vector will contain the adjusted comprehensive information related to the target joint reasoning branch model, providing a data basis for the subsequent reasoning of the trigger probability corresponding to the target joint reasoning branch model.

[0147] The computer system first determines a way to combine the adjusted first implicit representation vector and the adjusted second implicit representation vector. One way is to directly combine the elements in these vectors in order. For example, suppose that in the target joint reasoning branch model of network intrusion detection, two adjusted first implicit representation vectors [1.2, 2] and [0.6, 1.2] and two adjusted second implicit representation vectors [2.4, 3.6] and [2.1, 3.5] are obtained through the previous steps.

[0148] The computer system operates according to the determined merging method to merge these vectors to obtain an integrated feature vector. In the above example, the merged integrated feature vector is [1.2, 2, 0.6, 1.2, 2.4, 3.6, 2.1, 3.5]. This integrated feature vector contains the implicit representation information adjusted from different representation information extraction components (the first representation information extraction component and the second representation information extraction component), and integrates the source IP address risk, port number risk, historical intrusion event time risk, intrusion source risk and other information, providing a comprehensive data basis for the target joint reasoning branch model to infer the corresponding trigger probability based on this integrated feature vector.

[0149] As an implementation mode, step S412 determines the control response probability of the intrusion detection system to the target network traffic according to the trigger probability corresponding to each joint reasoning branch model, including:

[0150] Step S4121: Obtaining the impact factor of the threat management strategy corresponding to each joint reasoning branch model;

[0151] Step S4122: According to the influencing factor of the threat control strategy corresponding to each joint reasoning branch model, weight adjustment is performed on the trigger probability corresponding to each joint reasoning branch model to obtain the adjusted trigger probability corresponding to each joint reasoning branch model;

[0152] Step S4123: Merge the adjusted trigger probabilities corresponding to each joint reasoning branch model to obtain the control response probability of the intrusion detection system to the target network traffic.

[0153] In step S4121, the computer system obtains the impact factor of the threat management strategy corresponding to each joint reasoning branch model.

[0154] The joint reasoning model includes multiple joint reasoning branch models, each of which represents a reasoning branch among multiple reasoning branches, and each reasoning branch corresponds to a threat management strategy.

[0155] The impact factor of the threat control strategy is a weight corresponding to each joint reasoning branch model, which reflects the relative importance of the threat control strategy in the overall network security system. The value range of this impact factor is usually between 0 and 1. The larger the value, the greater the influence of the threat control strategy on determining the probability of control response. For example, in an enterprise network, if the confidentiality of data is critical, the impact factor of the data leakage prevention strategy may be relatively high; if the availability of the network is the primary concern, the impact factor of the network intrusion detection strategy may be assigned a higher value based on the network architecture and business needs.

[0156] The computer system first queries the influencing factors of the threat management strategy corresponding to each pre-set joint reasoning branch model. These influencing factors are usually determined based on factors such as network security strategy, business needs, and previous security incident analysis. For example, in the network security system of a financial institution, there are three joint reasoning branch models: network intrusion detection, data leakage prevention, and malware protection.

[0157] Assuming that financial data is highly sensitive and network transactions require real-time performance, the impact factor of the data leakage prevention strategy is set to 0.5, because data leakage may lead to serious financial risks and customer trust crisis; the impact factor of the network intrusion detection strategy is set to 0.3, because although intrusion detection is important, data confidentiality is more critical in this scenario; the impact factor of the malware protection strategy is set to 0.2, because although malware can pose a threat, its direct impact on the core business is slightly smaller than the first two.

[0158] When obtaining the impact factor, the computer system also considers the dynamic changes of the network environment. For example, if a series of malware attacks have occurred recently, resulting in network service interruptions, the computer system may adjust the impact factor of the malware protection strategy based on the new situation. Suppose the impact factor of the malware protection strategy is increased from 0.2 to 0.3 to reflect the greater impact of current malware threats on overall network security.

[0159] In step S4122, the computer system weights and adjusts the trigger probability corresponding to each joint reasoning branch model according to the influencing factor of the threat management strategy corresponding to each joint reasoning branch model, and obtains the adjusted trigger probability corresponding to each joint reasoning branch model.

[0160] The computer system multiplies the trigger probability corresponding to each joint reasoning branch model by the impact factor of the corresponding threat management strategy according to the pre-set calculation method. For example, continuing to take the network security system of the above financial institution as an example, the trigger probability of the network intrusion detection joint reasoning branch model is 0.6, and the impact factor of the corresponding threat management strategy is 0.3.

[0161] The adjusted trigger probability calculated by the computer system is 0.6*0.3=0.18. For the data leakage prevention joint reasoning branch model, assuming the trigger probability is 0.4, its impact factor is 0.5, and the adjusted trigger probability is 0.4*0.5=0.2. For the malware protection joint reasoning branch model, assuming the trigger probability is 0.5, its impact factor is 0.3 (after adjustment), the adjusted trigger probability is 0.5*0.3=0.15.

[0162] Through this weight adjustment, the computer system adjusts the trigger probability corresponding to each joint reasoning branch model according to the importance of its threat control strategy. In this example, data leakage prevention has a higher impact factor, even though its original trigger probability is not the highest, but it accounts for a large proportion of the adjusted trigger probability, which reflects the importance of data leakage prevention strategy in the overall network security system.

[0163] In step S4123, the computer system merges the adjusted trigger probabilities corresponding to each joint reasoning branch model to obtain the control response probability of the intrusion detection system to the target network traffic.

[0164] The computer system sums the adjusted trigger probabilities corresponding to each joint reasoning branch model to obtain the control response probability of the intrusion detection system for the target network traffic. For example, in the previous example of the financial institution, the adjusted trigger probability of the network intrusion detection joint reasoning branch model is 0.18, the adjusted trigger probability of the data leakage prevention joint reasoning branch model is 0.2, and the adjusted trigger probability of the malware protection joint reasoning branch model is 0.15. The computer system calculates the control response probability as 0.18+0.2+0.15=0.53. This means that under the current network security situation, the intrusion detection system has a 53% chance of taking control measures on the target network traffic.

[0165] This control response probability provides an important basis for network security managers to make decisions. If the control response probability is high, such as more than 0.7, managers may decide to immediately take stricter control measures, such as restricting specific network access, strengthening monitoring of suspicious traffic, etc. If the probability is low, such as less than 0.3, managers may choose to continue to observe or conduct more in-depth analysis to determine whether there are potential security threats that have been overlooked.

[0166] As an implementation mode, step S10, the process of obtaining the joint reasoning model, that is, the training process of the joint reasoning model, includes the following steps:

[0167] Step S11: obtaining training response information of training control network traffic; the training control network traffic is the network traffic corresponding to the threat control strategy that has been triggered by the training intrusion detection system in the past;

[0168] Step S12: obtaining a joint reasoning model to be trained; the joint reasoning model to be trained is used to reason about the control response probability of the training intrusion detection system to the training network traffic in multiple reasoning branches, each reasoning branch has its own matching variable to be trained, and the matching variable belongs to the model parameter of the joint reasoning model to be trained;

[0169] Step S13: matching the training response information according to the matching variables to be trained under each reasoning branch, and obtaining the training response representation vector of the training response information under each reasoning branch;

[0170] Step S14: obtaining a training traffic encoding vector of the training network traffic through the joint inference model to be trained;

[0171] Step S15: Through the joint reasoning model to be trained, according to the training response representation vector and the training traffic encoding vector under each reasoning branch, the training trigger probability corresponding to each reasoning branch is inferred respectively; the training trigger probability corresponding to any reasoning branch is the possibility that the training intrusion detection system executes the threat control strategy of any reasoning branch on the training network traffic, and the training trigger probabilities corresponding to multiple reasoning branches represent the control response probability of the training intrusion detection system on the training network traffic;

[0172] Step S16: According to the training trigger probability corresponding to each reasoning branch, the model parameters of the joint reasoning model to be trained are adjusted to obtain the joint reasoning model.

[0173] The training control network traffic refers to the network traffic corresponding to the training intrusion detection system when the threat control strategy has been triggered in the past. The training response information is a record of various response situations related to these training control network traffic.

[0174] The computer system then obtains a joint reasoning model to be trained. The joint reasoning model to be trained is a model used to reason about the control response probability of the training intrusion detection system to the training network traffic in multiple reasoning branches. Each reasoning branch has its own matching variables to be trained, and these matching variables belong to the model parameters of the joint reasoning model to be trained.

[0175] Assume that the joint inference model to be trained is a model built on a neural network architecture. Multiple inference branches can be understood as different paths or modules in the model, and each inference branch is specifically designed for inference on a threat management strategy. For example, in network security, threat management strategies may include different types such as preventing virus intrusion, preventing data leakage, and resisting DDoS attacks. Then for the inference branch for preventing virus intrusion, its matching variables to be trained may be associated with network traffic characteristics related to the virus's characteristic pattern, propagation path, etc.; and for the inference branch for preventing data leakage, its matching variables to be trained may be associated with network traffic characteristics related to data access rights, data transmission mode, etc. These matching variables to be trained will be continuously adjusted during the model training process to improve the accuracy of the model's inference of the control response probability on each inference branch.

[0176] The computer system performs a matching operation on the previously acquired training response information according to the matching variables to be trained under each reasoning branch. The purpose of this step is to extract a relevant representation vector from the training response information for each reasoning branch, namely, the training response representation vector.

[0177] Taking the inference branch of virus intrusion prevention as an example, if its to-be-trained matching variables contain virus-related network traffic features (such as the communication port and feature code of a specific virus), the computer system will search for parts related to these features in the training response information. Assume that the training response information contains information such as the network connection record of the infected device in a certain virus intrusion event and the response operation of the intrusion detection system. By matching the to-be-trained matching variables of the virus intrusion prevention inference branch, the computer system may extract information related to the IP address of the virus-infected device, the fluctuation of network traffic during virus infection, and the specific blocking measures of the intrusion detection system against the virus, and convert this information into vector form to obtain the training response representation vector under the virus intrusion prevention inference branch.

[0178] For the reasoning branch for preventing data leakage, if the matching variables to be trained involve network traffic characteristics related to data access rights and transmission modes, the computer system will search for information such as which users have abnormal data access behaviors before and after the data leakage incident, changes in the encryption status of data transmission, etc. in the training response information, and convert these related information into vectors, thereby obtaining the training response representation vector under the reasoning branch for preventing data leakage. In this way, for each reasoning branch, the corresponding training response representation vector can be obtained from the training response information, and these vectors will play an important role in the subsequent model training process.

[0179] The computer system obtains the training traffic encoding vector of the training network traffic through the joint inference model to be trained. The training traffic encoding vector is a vector representation obtained after performing a certain encoding operation on the training network traffic input to the joint inference model to be trained.

[0180] For example, suppose that the training network traffic contains a series of data packets with different source IP addresses, destination IP addresses, port numbers, protocol types, and other information. The joint inference model to be trained may adopt a specific encoding algorithm, such as mapping each feature in the network traffic to a high-dimensional vector space according to certain rules. For the source IP address, it may be mapped to a subspace of the vector space based on a predefined IP address range; the destination IP address, port number, and protocol type will also have corresponding mapping rules. In this way, the entire training network traffic is converted into a training traffic encoding vector, which can characterize the characteristics of the training network traffic to a certain extent, and can be used by the joint inference model to be trained for subsequent reasoning calculations.

[0181] The computer system uses the joint reasoning model to be trained to infer the training trigger probability corresponding to each reasoning branch based on the training response representation vector and training traffic encoding vector under each reasoning branch obtained previously. Among them, the training trigger probability corresponding to any reasoning branch represents the possibility that the training intrusion detection system executes the threat control strategy of the reasoning branch on the training network traffic.

[0182] Taking the virus intrusion prevention reasoning branch as an example, the joint reasoning model to be trained will take the training response representation vector and training traffic encoding vector of the virus intrusion prevention reasoning branch as input. The model may contain multiple neural network layers, which perform various calculation operations on the input vectors, such as linear transformation, nonlinear activation, etc. Through these operations, the model will calculate the probability of the training intrusion detection system triggering the virus intrusion prevention threat management strategy under this training network traffic situation based on the patterns and relationships in the training data, that is, the training trigger probability.

[0183] The process is similar for the reasoning branch for preventing data leakage. Based on the training response representation vector and the training traffic encoding vector of the reasoning branch for preventing data leakage, the model uses internal calculation logic to derive the training trigger probability of the training intrusion detection system triggering the data leakage threat control strategy under this training network traffic. In this way, for each reasoning branch, the corresponding training trigger probability can be obtained, and the training trigger probabilities corresponding to these multiple reasoning branches together represent the control response probability of the training intrusion detection system to the training network traffic.

[0184] The computer system adjusts the model parameters of the joint reasoning model to be trained according to the training trigger probability corresponding to each reasoning branch, thereby obtaining the final joint reasoning model.

[0185] During the model training process, the goal of the model is to make the calculated training trigger probability as close to the actual situation as possible. Assume that in the initial training stage, for the anti-virus intrusion reasoning branch, the calculated training trigger probability deviates greatly from the actual situation (for example, the anti-virus intrusion strategy should be triggered with a high probability, but the probability calculated by the model is very low). Based on this deviation, the computer system will adjust the model parameters related to the anti-virus intrusion reasoning branch, such as the matching variables to be trained mentioned above. The adjustment of these parameters may be based on some optimization algorithm, such as the gradient descent algorithm.

[0186] Taking the gradient descent algorithm as an example, if there is an error between the calculated training trigger probability and the expected true probability, the computer system will calculate the adjustment amount of the model parameters according to the direction and size of the error. For the training matching variables related to the anti-virus intrusion reasoning branch, if a parameter related to the virus feature is found to have a large impact on the calculation result and causes an error, the value of this parameter will be adjusted according to a certain ratio (determined by the gradient descent algorithm) to change in the direction of reducing the error.

[0187] Similarly, for other reasoning branches, such as the data leakage prevention reasoning branch, the relevant model parameters will be adjusted according to the deviation between the corresponding training trigger probability and the actual situation. By adjusting the model parameters corresponding to each reasoning branch, the joint reasoning model to be trained is continuously optimized until the training trigger probability calculated by the model on each reasoning branch can better match the actual situation. At this time, the obtained model is a trained joint reasoning model, which can be used to accurately infer the control response probability of the target network traffic.

[0188] As an implementation method, the joint reasoning model to be trained includes multiple joint reasoning branch models to be trained, one joint reasoning branch model to be trained is used to represent one reasoning branch among multiple reasoning branches, and each joint reasoning branch model to be trained corresponds to a different priori mark of the training network traffic; the priori mark corresponding to any joint reasoning branch model to be trained indicates that the training intrusion detection system has triggered or has not triggered the threat management strategy corresponding to any joint reasoning branch model to be trained for the training network traffic process; based on this, step S16, according to the training trigger probability corresponding to each reasoning branch, adjusts the model parameters of the joint reasoning model to be trained to obtain the joint reasoning model, including:

[0189] Step S161: obtaining the inference loss of each joint reasoning branch model to be trained for the corresponding training trigger probability according to the error between the training trigger probability corresponding to each joint reasoning branch model to be trained and the priori mark;

[0190] Step S162: merging the reasoning losses of each joint reasoning branch model to be trained to obtain the total reasoning loss of the joint reasoning model to be trained;

[0191] Step S163: adjusting the model parameters of the joint reasoning model to be trained according to the total reasoning loss to obtain the joint reasoning model.

[0192] In step S161, each joint reasoning branch model to be trained has its corresponding task, that is, to reason about a specific threat management strategy. The training trigger probability corresponding to the joint reasoning branch model to be trained is the possibility that the training intrusion detection system executes the threat management strategy corresponding to the branch on the training network traffic, calculated by the model based on the input (such as the training traffic encoding vector and the training response representation vector under each reasoning branch). The prior mark indicates whether the training intrusion detection system has actually triggered the threat management strategy corresponding to the joint reasoning branch model to be trained during the training network traffic. This is a known real situation mark.

[0193] For example, consider a joint inference branch model to be trained to prevent virus intrusion. Assume that in a set of training data, for a specific training network traffic instance, the prior mark indicates that the training intrusion detection system actually triggers the threat control strategy to prevent virus intrusion (for example, because there are indeed characteristic patterns of known viruses in the network traffic). However, the training trigger probability calculated by the joint inference branch model to be trained is 0.3, which means that the model believes that there is a 30% chance of triggering the strategy. There is an error here, which reflects the degree of deviation between the model calculation result and the actual situation.

[0194] The computer system determines the inference loss of each joint inference branch model to be trained for its training trigger probability by calculating the error between this training trigger probability and the prior mark. Inference loss is an indicator to measure the prediction accuracy of the model, usually calculated using loss functions such as the mean square error (MSE) function and the cross entropy loss function. For the joint inference branch models to be trained corresponding to different threat management strategies, the inference loss is calculated in this way according to the error between their respective training trigger probabilities and the prior marks. This inference loss will serve as the basis for subsequent adjustments to the model parameters, because the goal of model training is to minimize this inference loss so that the model's prediction results are as close to the actual situation as possible.

[0195] In step S162, the joint reasoning model to be trained includes multiple joint reasoning branch models to be trained, each branch model is for a different threat management strategy (such as preventing virus intrusion, preventing data leakage, resisting DDoS attacks, etc.), and each branch model has its own calculated reasoning loss. The computer system needs to merge the reasoning losses of these different branch models into a total reasoning loss in order to evaluate the performance of the joint reasoning model to be trained as a whole.

[0196] For example, in addition to the aforementioned joint inference branch model to be trained to prevent virus intrusion, which calculates an inference loss of 0.49, suppose the joint inference branch model to be trained to prevent data leakage calculates an inference loss of 0.25 (calculated based on the error between its corresponding training trigger probability and the prior mark), and the joint inference branch model to be trained to resist DDoS attacks calculates an inference loss of 0.36. The computer system cannot simply add these inference losses directly to get the total inference loss, because different inference branch models may have different importance in the entire joint inference model to be trained.

[0197] This involves the question of how to reasonably combine these inference losses. One possible way is based on the weight of each joint inference branch model to be trained in the entire model (although this step itself does not involve detailed calculation of the weight, it can be understood as a potential influencing factor). Assuming that after some analysis or pre-setting, the importance of the joint inference branch model to be trained for preventing virus intrusion is relatively high, the importance of the joint inference branch model to be trained for preventing data leakage is second, and the importance of the joint inference branch model to be trained for resisting DDoS attacks is third. The computer system will use a weighted method to merge these inference losses based on these relative importances. For example, assuming that the weight of preventing virus intrusion is 0.4, the weight of preventing data leakage is 0.3, and the weight of resisting DDoS attacks is 0.3, then the total inference loss = 0.4* 0.49+0.3* 0.25+0.3* 0.36=0.371. This weighted merging method can more comprehensively and accurately reflect the overall inference error of the joint inference model to be trained, and provide an overall performance evaluation indicator for the subsequent adjustment of model parameters based on the total inference loss.

[0198] In step S163, after obtaining the total reasoning loss of the joint reasoning model to be trained, the computer system adjusts the model parameters of the joint reasoning model to be trained according to the total reasoning loss. The model parameters of the joint reasoning model to be trained include the matching variables to be trained of each reasoning branch mentioned above, etc. These parameters determine how the model processes the input data (such as training network traffic and related response information) and the final reasoning result.

[0199] Taking the joint inference branch model to be trained for preventing virus intrusion as an example, assume that one of the matching variables to be trained is the weight of the network traffic pattern associated with a specific virus feature. If the total inference loss is large, it indicates that the overall prediction accuracy of the model is poor, and the computer system needs to adjust the model parameters to reduce the total inference loss. For this specific matching variable to be trained, if it is found that increasing its weight can reduce the inference loss of the joint inference branch model to be trained for preventing virus intrusion in subsequent training iterations (for example, by analyzing the direction of the influence of this variable on the result in the process of calculating the training trigger probability), the computer system will increase the value of this weight according to certain rules (such as based on the gradient descent algorithm).

[0200] Similarly, similar adjustments will be made to the relevant model parameters in other reasoning branch models. For example, in the joint reasoning branch model to be trained to prevent data leakage, if the adjustment of a matching variable to be trained related to data access rights can help reduce the total reasoning loss, the computer system will adjust it accordingly. This adjustment process is an iterative process. The computer system will continuously re-evaluate and adjust the model parameters according to the new total reasoning loss until the total reasoning loss reaches an acceptable range or meets the pre-set stop condition (such as reaching the maximum number of training rounds or the change in total reasoning loss is less than a certain threshold). When this adjustment process is completed, the joint reasoning model to be trained is optimized into a joint reasoning model. This joint reasoning model can more accurately infer the control response probability of the target network traffic on multiple reasoning branches, thereby meeting the accurate judgment requirements for different threat control strategies in network security analysis and response.

[0201] As an implementation mode, step S162, merging the inference loss of each joint inference branch model to be trained to obtain the total inference loss of the joint inference model to be trained, includes:

[0202] Step S1621: Obtain the debugging influence coefficient of each joint reasoning branch model to be trained;

[0203] Step S1622: weight-adjust the inference loss of each joint reasoning branch model to be trained according to the debugging influence coefficient of each joint reasoning branch model to be trained, and obtain the adjusted inference loss of each joint reasoning branch model to be trained;

[0204] Step S1623: Merge the adjusted reasoning losses of each joint reasoning branch model to be trained to obtain a total reasoning loss.

[0205] In step S1621, the computer system obtains the debugging impact coefficient of each joint reasoning branch model to be trained. This debugging impact coefficient is a parameter used to measure the relative importance of each joint reasoning branch model to be trained in the entire joint reasoning model to be trained. For example, in an enterprise network security system, preventing virus intrusion may be considered a very critical task, because once a virus invades, it may cause serious damage to the data, system operation, etc. in the entire enterprise network. Therefore, the joint reasoning branch model to be trained to prevent virus intrusion may be assigned a higher debugging impact coefficient, assuming it is 0.5. As for the task of preventing data leakage, although it is also very important, its urgency or overall impact on the entire network may be slightly lower than preventing virus intrusion, so the joint reasoning branch model to be trained to prevent data leakage may be assigned a debugging impact coefficient, such as 0.3. For the joint reasoning branch model to be trained to resist DDoS attacks, it is assumed that according to the characteristics and needs of the enterprise network, the debugging impact coefficient assigned is 0.2. The determination of these debugging impact coefficients may be based on the comprehensive consideration of multiple factors such as the risk assessment of different threat types by network security policy makers, the architectural characteristics of the enterprise network, and historical security event data.

[0206] Next, in step S1622, the computer system weights the reasoning loss of each joint reasoning branch model to be trained according to the debugging influence coefficient of each joint reasoning branch model to be trained, thereby obtaining the adjusted reasoning loss of each joint reasoning branch model to be trained. Continuing with the above example, assuming that the original reasoning loss of the joint reasoning branch model to be trained for preventing virus intrusion is 0.49 (based on the error between the training trigger probability and the prior mark calculated previously), since its debugging influence coefficient is 0.5, then the reasoning loss after weight adjustment is 0.5*0.49=0.245. For the joint reasoning branch model to be trained to prevent data leakage, its original reasoning loss is 0.25, the debugging influence coefficient is 0.3, and the adjusted reasoning loss is 0.3*0.25=0.075. The original reasoning loss of the joint reasoning branch model to be trained to resist DDoS attacks is 0.36, the debugging influence coefficient is 0.2, and the adjusted reasoning loss is 0.2*0.36=0.072. This weight adjustment method takes into account the different importance of each joint reasoning branch model to be trained in the entire model, so that when merging the reasoning loss, the contribution of each branch model to the total reasoning loss can be more reasonably reflected.

[0207] Finally, in step S1623, the computer system combines the adjusted reasoning losses of each joint reasoning branch model to be trained to obtain the total reasoning loss. According to the previous example, the computer system adds the adjusted reasoning losses of the three joint reasoning branch models to be trained, namely, the total reasoning loss = 0.245 + 0.075 + 0.072 = 0.392. This total reasoning loss comprehensively considers the reasoning loss of each joint reasoning branch model to be trained and their relative importance in the entire model, and can more comprehensively and accurately reflect the reasoning error of the joint reasoning model to be trained as a whole. This total reasoning loss will serve as an important basis for adjusting the model parameters of the joint reasoning model to be trained according to the total reasoning loss in subsequent steps (such as step S163), so as to optimize the model so that it can more accurately reason about the control response probability of the target network traffic on each reasoning branch, thereby improving the accuracy and effectiveness of the network security analysis response. In this way, the computer system gradually adjusts the model parameters during the training process of the joint reasoning model to adapt to different network security threat control requirements, and ensures the effectiveness of the model in multiple threat scenarios.

[0208] Figure 2 A hardware entity diagram of a computer system provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the hardware entity of the computer system 1000 includes: a processor 1001 and a memory 1002, wherein the memory 1002 stores a computer program that can be run on the processor 1001, and the processor 1001 implements the steps in the method of any of the above embodiments when executing the program.

Claims

1. A security analysis and response method that dynamically adapts to network threat patterns, characterized in that: The method comprises: Obtain a target response sequence for control network traffic; the control network traffic is the network traffic corresponding to the threat management and control strategy that has been triggered by the intrusion detection system in the past; the target response sequence is an ordered set of a series of response results related to the control network traffic, and the response results reflect various feedback information generated when the intrusion detection system executes the threat management and control strategy for the control network traffic; Acquire a joint reasoning model; the joint reasoning model is used to reason about the control response probability of the target network traffic to be responded to in multiple reasoning branches, one reasoning branch corresponds to a threat control strategy, and each reasoning branch includes a corresponding matching variable; the control response probability represents the possibility of the intrusion detection system adopting a corresponding threat control strategy for the target network traffic; the matching variable is used as an element for matching operations with other data during the model reasoning process; According to the matching variables under each reasoning branch, the target response sequence is matched to obtain the response representation vector of the target response sequence under each reasoning branch; the response representation vector under a reasoning branch includes the representation vector associated with the threat management strategy of the reasoning branch in the target response sequence; Through the joint reasoning model, the control response probability of the intrusion detection system to the target network traffic is inferred based on the response characterization vectors under the multiple reasoning branches.

2. The method according to claim 1, characterized in that The method further comprises: Acquire the traffic encoding vector of the target network traffic through the joint reasoning model; The method of inferring the control response probability of the intrusion detection system to the target network traffic based on the response characterization vectors under the multiple reasoning branches through the joint reasoning model includes: Inferring the control response probability of the intrusion detection system to the target network traffic based on the traffic encoding vector and the response characterization vectors under the multiple reasoning branches through the joint reasoning model; Among them, taking any one of the multiple reasoning branches as a target reasoning branch, the matching variable under the target reasoning branch belongs to a matching representation vector; matching the target response sequence according to the matching variable under each reasoning branch to obtain the response representation vector of the target response sequence under each reasoning branch includes: Extracting a representation vector of the target response sequence through the joint reasoning model to obtain an initial response representation vector of the target response sequence; Performing feature fusion on the traffic coding vector and the matching representation vector under the target reasoning branch to obtain a fused feature vector; The initial response representation vector is matched according to the fused feature vector to generate a response representation vector of the target response sequence under the target reasoning branch.

3. The method according to claim 2, characterized in that The target response sequence includes a plurality of response information of the control network traffic, and the initial response representation vector includes a response representation vector obtained by extracting a representation vector from each response information in the plurality of response information; The matching the initial response representation vector according to the fused feature vector to generate a response representation vector of the target response sequence under the target reasoning branch includes: Performing commonality measurement on the fused feature vector and the initial response representation vector to obtain a correlation influence coefficient between each response representation vector in the initial response representation vector and the fused feature vector; According to the correlation influence coefficient between each of the response representation vectors and the fusion feature vector, weight adjustment is performed on each of the response representation vectors to obtain a plurality of adjusted response representation vectors; Merging the multiple adjusted response representation vectors to obtain a response representation vector of the target response sequence under the target reasoning branch; The performing feature fusion on the traffic coding vector and the matching representation vector under the target reasoning branch to obtain a fused feature vector includes: The flow coding vector and the matching characterization vector under the target reasoning branch are combined to obtain the fused feature vector; or, the flow coding vector and the matching characterization vector under the target reasoning branch are merged to obtain the fused feature vector; the number of elements of the flow coding vector is the same as the number of elements of the matching characterization vector under the target reasoning branch; The joint reasoning model includes multiple joint reasoning branch models, and one joint reasoning branch model represents one reasoning branch among the multiple reasoning branches; the control response probability of the intrusion detection system to the target network traffic is inferred by the joint reasoning model according to the traffic encoding vector and the response representation vectors under the multiple reasoning branches, including: According to the traffic encoding vector and the response representation vector corresponding to each joint reasoning branch model, the trigger probability corresponding to each joint reasoning branch model is inferred respectively; the trigger probability corresponding to any joint reasoning branch model is the possibility that the intrusion detection system performs the threat control strategy corresponding to any joint reasoning branch model on the target network traffic; According to the trigger probability corresponding to each of the joint reasoning branch models, the control response probability of the intrusion detection system to the target network traffic is determined.

4. The method according to claim 3, characterized in that There are multiple target response sequences, each target response sequence includes a response representation vector under one reasoning branch, and any joint reasoning branch model among the multiple joint reasoning branch models is used as the target joint reasoning branch model; The inferring the trigger probability corresponding to each joint reasoning branch model according to the traffic coding vector and the response representation vector corresponding to each joint reasoning branch model respectively includes: Acquire system configuration data of the intrusion detection system, and extract representation vectors of the system configuration data through the joint reasoning model to obtain a system configuration representation vector of the intrusion detection system; Combining the traffic encoding vector, the system configuration representation vector, and multiple response representation vectors of multiple target response sequences under the reasoning branch of the target joint reasoning branch model to obtain an execution feature vector of the target joint reasoning branch model; According to the execution feature vector of the target joint reasoning branch model, the trigger probability corresponding to the target joint reasoning branch model is inferred.

5. The method according to claim 4, characterized in that The joint reasoning model includes a common sub-model, the common sub-model is used to extract the common representation information of the multiple joint reasoning branch models in the target response sequence, and the common sub-model includes a corresponding execution feature vector; The inferring the trigger probability corresponding to the target joint reasoning branch model according to the execution feature vector of the target joint reasoning branch model includes: Extracting implicit representation information of the execution feature vector of the target joint reasoning branch model through the target joint reasoning branch model to obtain a first implicit representation vector of the execution feature vector of the target joint reasoning branch model; Extracting implicit representation information of the execution feature vector of the general sub-model through the general sub-model to obtain a second implicit representation vector of the execution feature vector of the general sub-model; The target joint reasoning branch model is used to infer a trigger probability corresponding to the target joint reasoning branch model based on the first implicit representation vector and the second implicit representation vector.

6. The method according to claim 5, characterized in that The inferring the trigger probability corresponding to the target joint reasoning branch model according to the first implicit representation vector and the second implicit representation vector through the target joint reasoning branch model includes: Performing an integration operation on the first implicit representation vector and the second implicit representation vector through the target joint reasoning branch model to obtain an integrated feature vector; The target joint reasoning branch model is used to infer the trigger probability corresponding to the target joint reasoning branch model based on the integrated feature vector.

7. The method according to claim 6, characterized in that The target joint reasoning branch model includes x first representation information extraction components, the first representation information extraction components are used to extract the first implicit representation vector; the general sub-model includes y second representation information extraction components, the second representation information extraction components are used to extract the second implicit representation vector, and x and y are both natural numbers greater than 1; The step of integrating the first implicit representation vector and the second implicit representation vector through the target joint reasoning branch model to obtain an integrated feature vector includes: Generate an integrated variable according to the execution feature vector of the target joint reasoning branch model through the target joint reasoning branch model; the integrated variable includes an integrated influence coefficient for each of the first representation information extraction components and an integrated influence coefficient for each of the second representation information extraction components; According to the integrated influence coefficient of each first representation information extraction component, weight adjustment is performed on each first implicit representation vector extracted by the first representation information extraction component to obtain x adjusted first implicit representation vectors; According to the integrated influence coefficient of each second representation information extraction component, weight adjustment is performed on the second implicit representation vector corresponding to each second representation information extraction component to obtain y adjusted second implicit representation vectors; Merging the x adjusted first implicit representation vectors and the y adjusted second implicit representation vectors to obtain the integrated feature vector; Determining the control response probability of the intrusion detection system to the target network traffic based on the trigger probability corresponding to each of the joint reasoning branch models includes: Obtaining an impact factor of a threat management strategy corresponding to each of the joint reasoning branch models; According to the influencing factor of the threat control strategy corresponding to each of the joint reasoning branch models, weight adjustment is performed on the trigger probability corresponding to each of the joint reasoning branch models to obtain the adjusted trigger probability corresponding to each of the joint reasoning branch models; The adjusted trigger probabilities corresponding to each of the joint reasoning branch models are merged to obtain the control response probability of the intrusion detection system to the target network traffic.

8. The method according to claim 1, characterized in that The obtaining of the joint reasoning model includes: Obtaining training response information of training control network traffic; the training control network traffic is the network traffic corresponding to the threat control strategy that has been triggered by the training intrusion detection system in the past; Obtain a joint reasoning model to be trained; the joint reasoning model to be trained is used to infer the control response probability of the training intrusion detection system to the training network traffic in the multiple reasoning branches, each of the reasoning branches has its own matching variable to be trained, and the matching variable belongs to the model parameter of the joint reasoning model to be trained; According to the matching variable to be trained under each of the reasoning branches, the training response information is matched to obtain a training response representation vector of the training response information under each of the reasoning branches; Obtaining a training traffic encoding vector of the training network traffic through the joint inference model to be trained; Through the joint reasoning model to be trained, according to the training response representation vector and the training traffic encoding vector under each of the reasoning branches, the training trigger probability corresponding to each of the reasoning branches is inferred respectively; the training trigger probability corresponding to any reasoning branch is the possibility that the training intrusion detection system executes the threat control strategy of any reasoning branch on the training network traffic, and the training trigger probabilities corresponding to the multiple reasoning branches represent the control response probability of the training intrusion detection system on the training network traffic; According to the training trigger probability corresponding to each of the reasoning branches, the model parameters of the joint reasoning model to be trained are adjusted to obtain the joint reasoning model.

9. The method according to claim 8, characterized in that The joint reasoning model to be trained includes multiple joint reasoning branch models to be trained, one joint reasoning branch model to be trained is used to represent one reasoning branch among the multiple reasoning branches, and each joint reasoning branch model to be trained corresponds to a different priori mark of the training network traffic; the priori mark corresponding to any joint reasoning branch model to be trained indicates that the training intrusion detection system has triggered or not triggered the threat management and control strategy corresponding to any joint reasoning branch model to be trained for the training network traffic process; The step of adjusting the model parameters of the to-be-trained joint reasoning model according to the training trigger probability corresponding to each of the reasoning branches to obtain the joint reasoning model includes: According to the error between the training trigger probability corresponding to each of the joint reasoning branch models to be trained and the priori mark, the reasoning loss of each of the joint reasoning branch models to be trained for the respectively corresponding training trigger probability is obtained; Merging the reasoning losses of each of the joint reasoning branch models to be trained to obtain the total reasoning loss of the joint reasoning model to be trained; Adjusting the model parameters of the to-be-trained joint reasoning model according to the total reasoning loss to obtain the joint reasoning model; The step of merging the inference loss of each of the joint inference branch models to be trained to obtain the total inference loss of the joint inference model to be trained includes: Obtaining a debugging influence coefficient of each of the joint reasoning branch models to be trained; According to the debugging influence coefficient of each of the joint reasoning branch models to be trained, weight adjustment is performed on the reasoning loss of each of the joint reasoning branch models to be trained to obtain the adjusted reasoning loss of each of the joint reasoning branch models to be trained; The adjusted reasoning losses of each of the joint reasoning branch models to be trained are combined to obtain the total reasoning loss.

10. A computer system comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, wherein: When the processor executes the program, the steps in the method according to any one of claims 1 to 9 are implemented.

Images