Information network security self-defense method and system based on trusted computing

Abstract

The invention provides an information network security self-defense method and system based on trusted computing, and the method comprises the steps: constructing a trusted computing platform which comprises the steps: deploying a trusted platform module TPM, building a trusted software stack TSS, and implementing a trusted network connection TNC; designing a self-defense architecture, wherein the self-defense architecture comprises deployment of a network layer, an application layer and a data layer defense system, integration of an intelligent sensing system and establishment of a central control and decision center; network traffic and user access behaviors are monitored, and embedded attack behaviors are preprocessed; performing anomaly detection on the network flow and the user access behavior by applying a machine learning algorithm; calculating a real-time risk score based on the anomaly detection result, and generating a security situation awareness report; and based on the security situation awareness report, defining a threat level and a response level, and executing automatic defense.

Description

Technical Field

[0001] The present application relates to the field of information network security technology, and specifically to an information network security self-defense method and system based on trusted computing. Background Art

[0002] With the rapid development of information technology, network security threats are becoming increasingly complex and diverse. Traditional network security defense methods mainly rely on static rules and manual intervention, which are difficult to cope with rapidly evolving network attacks. The existing technology has the following problems:

[0003] 1. Lack of trusted computing foundation: Existing systems cannot guarantee the trustworthiness of underlying hardware and software, and are easily infiltrated by attackers using vulnerabilities.

[0004] 2. Insufficient self-defense capabilities: Most systems are unable to perceive security situations in real time and are unable to automatically adjust defense strategies.

[0005] 3. Low anomaly detection accuracy: Traditional methods have difficulty identifying complex attack patterns and unknown threats.

[0006] 4. Inaccurate risk assessment: There is a lack of a comprehensive and dynamic risk assessment mechanism, which cannot accurately reflect the real-time security status of the system.

[0007] 5. Delayed defense measures: Human intervention leads to slow defense response, making it difficult to prevent the spread of attacks in a timely manner.

[0008] In view of this, there is an urgent need for a network security self-defense method and system that can realize automated anomaly detection, real-time risk assessment and intelligent defense based on a trusted computing platform. Summary of the invention

[0009] In view of this, the present application provides an information network security self-defense method and system based on trusted computing, which solves the problems in the prior art of lack of trusted computing foundation, insufficient self-defense capability, low anomaly detection accuracy, inaccurate risk assessment and delayed defense measures.

[0010] The present application provides an information network security self-defense method based on trusted computing, including:

[0011] Constructing a trusted computing platform, wherein the trusted computing platform construction includes deploying a trusted platform module TPM, establishing a trusted software stack TSS, and implementing a trusted network connection TNC;

[0012] Design a self-defense architecture, which includes deploying network layer, application layer and data layer defense systems, integrating intelligent perception systems and establishing a central control and decision-making center;

[0013] Monitor network traffic and user access behavior, and pre-process embedded attack behaviors;

[0014] Applying machine learning algorithms to perform anomaly detection on the network traffic and user access behavior;

[0015] Based on the anomaly detection results, calculate a real-time risk score and generate a security situation awareness report;

[0016] Based on the security situation awareness report, the threat level and response level are defined, and automated defense is performed.

[0017] Monitor network traffic and user access behavior, and pre-process embedded attack behaviors, including:

[0018] Get real-time data on network traffic and user access behavior;

[0019] Use word frequency-based and semantic similarity-based pruning algorithms to preprocess and standardize real-time data on network traffic and user access behavior;

[0020] Performing embedding vector analysis on the real-time data of the network traffic and user access behavior, and using an embedding clustering algorithm to identify abnormal embedding groups, and tracking the embedding trajectory of the abnormal embedding groups;

[0021] Using an autoencoder model to learn the distribution of normal and abnormal embeddings, and using the learned autoencoder model to analyze the abnormal level of the abnormal embedding group;

[0022] If the abnormal level exceeds a preset threshold, an embedding space cleaning algorithm is used to remove potential malicious disturbances, and an embedding projection technique is used to map the abnormal embedding group to a safe area.

[0023] The method further comprises:

[0024] Use sensitive information detectors to identify potential information leaks;

[0025] Use the attention mechanism to implement cross-layer attention consistency checks and identify potential attack traces;

[0026] A gradient fluidity analysis tool is used to implement hidden state analysis of the abnormal embedding group and detect parameter updates of the abnormal embedding group.

[0027] Apply machine learning algorithms to perform anomaly detection on the network traffic and user access behavior, including:

[0028] Extracting the control flow graph CFG of the network traffic and user access behavior;

[0029] Extracting assembly instruction sequences and graph-level statistical features from the CFG, the statistical features including the number of nodes, the number of edges, and the average degree;

[0030] Build a graph neural network (GNN) with adversarial domain adaptation;

[0031] Training the GNN model and evaluating the domain adaptability of the GNN model;

[0032] The assembly instruction sequence and statistical features in the CFG are input into the GNN model to perform anomaly detection on the drifted variants in the network traffic and user access behavior.

[0033] The GNN model is trained and the domain adaptability of the GNN model is evaluated, including:

[0034] Design a domain classifier to distinguish between a source domain and a target domain, wherein the source domain is a known malicious attack and the target domain is a malicious attack after potential drift;

[0035] Design a domain-invariant feature extractor to capture common features across domains;

[0036] Obtain a historical data set, and divide the historical data set into a training set, a validation set, and a test set;

[0037] Using the domain classifier, labeling source domain and target domain data in the historical data set;

[0038] Construct the cross entropy loss function and the adversarial loss function of the domain classifier respectively, and perform weighted combination;

[0039] Optimize model parameters using gradient descent;

[0040] Implement early stopping strategy to prevent overfitting;

[0041] Use the validation set to monitor the performance of the GNN model and adjust hyperparameters;

[0042] Evaluate the GNN model performance on the test set;

[0043] Evaluate the performance of the GNN model on the target domain, and optimize the GNN model based on the evaluation result.

[0044] Calculates real-time risk scores and generates security situation awareness reports, including:

[0045] Construct PriPLTree data structure;

[0046] Define the security indicator PriPLTree;

[0047] Define a risk calculation model based on the PriPLTree data structure, input the anomaly detection result into the risk calculation model, and obtain a risk score;

[0048] Based on the risk score, a security situation awareness report is automatically generated.

[0049] The construction of the PriPLTree data structure includes:

[0050] Design a one-dimensional PriPLTree data structure, including:

[0051] Define a tree structure where each node contains piecewise linear function parameters;

[0052] Using adaptive segmentation algorithm, nodes are dynamically adjusted according to data distribution;

[0053] Use local differential privacy mechanism to protect sensitive information of each node;

[0054] Design a multidimensional PriPLTree data structure, each dimension of the multidimensional PriPLTree uses a one-dimensional PriPLTree data structure;

[0055] Define the security indicator PriPLTree, including:

[0056] Define safety metrics;

[0057] Construct a one-dimensional PriPLTree for each safety indicator;

[0058] Integrate all safety indicators and construct a multidimensional PriPLTree.

[0059] Defining a risk calculation model based on the PriPLTree data structure, inputting the anomaly detection result into the risk calculation model, and obtaining a risk score, including:

[0060] Identify trends and patterns in security indicators using the time series analysis module;

[0061] Build a multi-level risk scoring strategy, including system-level, module-level and single indicator risk scoring strategies;

[0062] After the anomaly detection result is input into the risk calculation model, PriPLTree data is used for retrieval to determine the closest query result, and the confidence interval of the query result is evaluated. The query result is the risk level and corresponding score that are closest to the anomaly detection result.

[0063] The automated defense includes deploying a honeypot network and automated repair.

[0064] The present application also provides a computer device, the computer device comprising:

[0065] at least one processor; and,

[0066] a memory communicatively connected to the at least one processor; wherein,

[0067] The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the above-mentioned information network security self-defense method based on trusted computing.

[0068] An embodiment of the present application also provides a computer-readable storage medium, which stores computer instructions, and the computer instructions are used to enable a computer to execute the above-mentioned information network security self-defense method based on trusted computing.

[0069] An embodiment of the present application also provides a computer program product, including computer instructions, characterized in that when the computer instructions are executed by a processor, the steps of the above-mentioned information network security self-defense method based on trusted computing are implemented.

[0070] This application has the following technical effects:

[0071] 1. By building a trusted computing platform, the basic security of the system is improved, providing a reliable foundation for self-defense.

[0072] 2. A self-defense architecture was designed to implement a multi-level, intelligent defense system, improving the overall defense capabilities of the system.

[0073] 3. Use advanced machine learning algorithms for anomaly detection, which improves the accuracy of identifying complex attacks and unknown threats.

[0074] 4. The introduction of PriPLTree data structure enables efficient and accurate real-time risk assessment, providing a reliable basis for decision-making.

[0075] 5. Through the automated defense mechanism, rapid response and automatic repair are achieved, effectively reducing the need for manual intervention and response time. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] Figure 1 is a flow chart of an information network security self-defense method based on trusted computing provided by an embodiment of the present application;

[0077] Figure 2 It is a structural diagram of the information network security self-defense system based on trusted computing provided in an embodiment of the present application. DETAILED DESCRIPTION

[0078] Example 1

[0079] The embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

[0080] Embodiment 1

[0081] Figure 1 A flow chart of an information network security self-defense method based on trusted computing provided in an embodiment of the present disclosure, wherein the content promotion method comprises steps S1 to S6.

[0082] S1: Building a trusted computing platform

[0083] Building a trusted computing platform is the foundation for achieving network security self-defense. Through the combination of hardware and software, the trusted computing platform provides a trusted operating environment for the entire system, effectively preventing the underlying system from being controlled or tampered with by attackers.

[0084] S1.1: Deploy the Trusted Platform Module (TPM)

[0085] Trusted Platform Module (TPM) is a dedicated security chip that provides hardware-level security protection for the system. The deployment of TPM includes the following steps:

[0086] 1. Hardware integration: Integrate the TPM chip into the motherboard or system chipset.

[0087] 2.BIOS configuration: Enable the TPM function in the system BIOS and set appropriate security policies.

[0088] 3. Initialization: Initialize the TPM at the first startup to generate a unique encryption key pair.

[0089] 4. Key management: Set the TPM storage root key (SRK) and authentication key (AIK).

[0090] TPM provides several security features, including:

[0091] Secure storage: used to store sensitive information such as encryption keys and certificates.

[0092] Remote Attestation: Prove the integrity of the platform through AIK.

[0093] Sealing operation: Binds data to a specific system state so that it can only be decrypted when the system is in a predefined secure state.

[0094] S1.2: Establish a trusted software stack TSS

[0095] The Trusted Software Stack (TSS) is the middle layer that connects the application and the TPM and provides a standardized API interface. The establishment of TSS includes the following steps:

[0096] Install TSS Core Services (TCS): responsible for managing TPM resources and handling concurrent requests.

[0097] Configure TSS device driver (TDD): implement communication between the operating system and TPM.

[0098] Deploy TSS Service Provider (TSP): Provides high-level APIs to applications to simplify TPM operations.

[0099] Implement key and certificate management: Manage the keys and certificates generated by TPM through TSS.

[0100] Key features of TSS include:

[0101] Abstract TPM operations: Convert complex TPM instructions into easy-to-use APIs.

[0102] Multi-application support: Manage concurrent access to the TPM by multiple applications.

[0103] Key lifecycle management: deals with the creation, storage, use, and destruction of keys.

[0104] S1.3: Implement Trusted Network Connection (TNC)

[0105] Trusted Network Connect (TNC) is a network access control technology that ensures that only devices that comply with security policies can access the network. The implementation of TNC includes the following steps:

[0106] Deploy TNC server: responsible for formulating and implementing network access policies.

[0107] Configure network access devices, such as switches and routers, to support the TNC protocol.

[0108] Install the TNC client: Install the TNC client software on the device that needs to access the network.

[0109] Define security policies: Set the conditions that devices must meet to access the network, such as operating system patch level, antivirus software update status, etc.

[0110] Implement continuous assessments: Regularly check the security status of connected devices to ensure they continue to comply with security policies.

[0111] The main advantages of TNC include:

[0112] Dynamic access control: Determine whether to allow access based on the real-time security status of the device.

[0113] Automated repair: For devices that do not comply with security policies, they can be automatically guided to update or repair.

[0114] Cross-platform compatibility: supports various operating systems and network devices.

[0115] Through the above steps, a trusted computing platform based on TPM, TSS and TNC is built, which provides a solid foundation for the subsequent self-defense architecture. This platform can ensure the integrity of the system, prevent unauthorized modifications, and implement strict control over network access, greatly improving the security of the entire system.

[0116] S2: Designing a self-defense architecture

[0117] The self-defense architecture is the core of the entire system. It integrates multi-layer defense mechanisms, intelligent perception systems and central control decision-making centers to achieve automated and intelligent security protection.

[0118] S2.1: Deploy network layer, application layer and data layer defense system

[0119] The multi-layer defense system adopts a defense-in-depth strategy, deploying defense measures at different levels of the network to form an all-round protection network.

[0120] 1. Network layer defense:

[0121] Deploy a next-generation firewall (NGFW): Implement application-based access control and threat protection.

[0122] Implement an Intrusion Prevention System (IPS): monitor and block network attacks in real time.

[0123] Configure a virtual private network (VPN): Provides an encrypted channel for remote access.

[0124] 2. Application layer defense:

[0125] Deploy a Web Application Firewall (WAF): Protect Web applications from common attacks such as SQL injection and cross-site scripting (XSS).

[0126] Implement application whitelisting: Only allow approved applications to run.

[0127] Configure content filtering system: filter malicious emails and web page content.

[0128] 3. Data layer defense:

[0129] Deploy data encryption systems: Encrypt sensitive data in storage and transmission.

[0130] Implement data loss prevention (DLP): Prevent unauthorized transmission of sensitive data.

[0131] Configure access control system: implement fine-grained role-based access control.

[0132] S2.2: Integrated Intelligent Perception System

[0133] The intelligent perception system achieves comprehensive perception and understanding of the network environment by collecting and analyzing various data sources.

[0134] 1. Deploy a distributed sensor network:

[0135] Network Traffic Sensor: Captures and analyzes network traffic.

[0136] Host Behavior Sensor: Monitors the behavior and status of the host system.

[0137] User activity sensors: Track users' actions and access patterns.

[0138] 2. Implement a big data analytics platform:

[0139] Data collection module: aggregates data from various sensors.

[0140] Data preprocessing module: cleaning, standardization and feature extraction of raw data.

[0141] Real-time analytics engine: Uses machine learning algorithms to perform real-time data analysis.

[0142] 3. Develop anomaly detection algorithms:

[0143] Statistics-based anomaly detection: using statistical methods to identify abnormal patterns.

[0144] Machine learning-based anomaly detection: Discovering anomalous behavior using supervised and unsupervised learning algorithms.

[0145] Rule-based anomaly detection: Identifies violations based on predefined security rules.

[0146] S2.3: Establish a central control and decision-making center

[0147] The central control and decision-making center is the brain of the entire self-defense system, responsible for coordinating various defense components and making intelligent defense decisions.

[0148] 1. Develop security policy management module:

[0149] Policy creation interface: Allows administrators to define and modify security policies.

[0150] Policy distribution mechanism: automatically distributes policies to various defense components.

[0151] Policy conflict detection: Automatically detect and resolve conflicts between policies at different levels.

[0152] 2. Implement a threat intelligence integration platform:

[0153] External threat intelligence access: Integrate multiple threat intelligence sources, such as national CERT, security vendors, etc.

[0154] Internal threat intelligence generation: Generate localized threat intelligence based on the system’s own detection results.

[0155] Intelligence Analysis and Sharing: Analyze and evaluate intelligence and share it with other agencies when necessary.

[0156] 3. Develop an automated response system:

[0157] Response rules engine: Automatically trigger response actions based on predefined rules.

[0158] Dynamic Response Generator: Based on machine learning algorithms, it dynamically generates response strategies based on the current threat situation.

[0159] Response effectiveness evaluation: Conduct real-time evaluation of the response measures implemented and make adjustments based on the results.

[0160] Through this multi-level, intelligent self-defense architecture, the system can achieve comprehensive security protection, quickly respond to various threats, and continuously optimize itself.

[0161] S3: Monitor network traffic and user access behavior, and pre-process embedded attack behaviors;

[0162] This step is the prerequisite for anomaly detection. By preprocessing and preliminary analysis of the raw data, it provides a basis for subsequent deep anomaly detection.

[0163] S3.1: Obtain real-time data on network traffic and user access behavior;

[0164] Deploy high-performance network probes at key network nodes. Configure mirror ports or use network splitters to replicate network traffic. Implement data collection strategies based on sampling in high-traffic environments.

[0165] Deploy terminal agent programs to collect user operation logs. Implement application layer protocol analysis to extract user access behavior characteristics. Establish a user portrait system to record users' normal behavior patterns.

[0166] Use high-speed message queues (such as Kafka) to achieve real-time data transmission. Implement data compression and encryption to ensure transmission efficiency and security.

[0167] S3.2: Use the word frequency-based trimming algorithm and the semantic similarity-based trimming algorithm to preprocess and standardize the real-time data of network traffic and user access behavior;

[0168] Build a domain-specific word frequency dictionary. Calculate the word frequency of each element in the data. Set a word frequency threshold to remove low-frequency elements and retain key information.

[0169] Use word embedding technology (such as Word2Vec) to map data elements into vector space. Calculate the cosine similarity between elements. Merge or selectively retain elements with similarity above a threshold.

[0170] Perform data type conversion to ensure that all feature formats are consistent. Use MinMax or Zscore methods to normalize numerical features. Perform OneHot Encoding on categorical features.

[0171] S3.3: Perform embedding vector analysis on real-time data of network traffic and user access behavior, and use embedding clustering algorithm to identify abnormal embedding groups and track the embedding trajectory of abnormal embedding groups

[0172] 1. Embedding vector analysis:

[0173] The purpose of this step is to convert complex network traffic and user behavior data into a numerical vector of fixed dimension. The embodiment of the present invention can use a deep learning model (such as BERT) to achieve this conversion. For example, for each network access, the embodiment of the present invention may consider the following information: the URL accessed, the access time, the user ID, the device type, the network protocol used, the amount of data transmitted, etc. This information is input into the model and a vector of fixed dimension (such as 768 dimensions) is output. This vector captures the semantic information of the original data, so that similar behaviors are closer in the vector space.

[0174] 2. Embedded Clustering Algorithm:

[0175] After obtaining the embedding vector, the embodiment of the present invention uses a clustering algorithm (such as DBSCAN) to identify abnormal groups. The DBSCAN algorithm defines clusters based on density. It can find clusters of any shape and identify noise points (which may represent abnormal behavior). In this process:

[0176] Normal behavior usually forms large, dense clusters.

[0177] Abnormal behaviors may form small clusters or exist as outliers.

[0178] The embodiment of the present invention may set a threshold, for example, considering clusters of less than 10 points or points that are not clustered as potential abnormal behaviors.

[0179] Use density clustering algorithms such as DBSCAN to cluster embedding vectors. Set clustering parameters (such as density threshold) to identify anomalous embedding groups. Implement online clustering algorithms to support clustering analysis of real-time data streams.

[0180] 3. Abnormal embedded group tracking:

[0181] Build time series analysis models, such as long short-term memory networks (LSTM), to track the evolution of abnormal groups. Implement multi-dimensional correlation analysis to capture the changes of abnormal groups in different feature spaces. Develop visualization tools to intuitively display the embedding trajectory of abnormal groups.

[0182] This step involves time series analysis of the identified abnormal groups. The present invention can use a sliding time window method to achieve:

[0183] Define a time window (e.g., 1 hour). Repeat the embedding and clustering process in each time window. Track the changes of abnormal groups in different time windows. Through this method, the embodiment of the present invention can observe: the duration of abnormal groups, the size changes of abnormal groups, the emergence of new abnormal groups, and the disappearance of abnormal groups.

[0184] Specific application examples:

[0185] Assume that the embodiment of the present invention is monitoring a large enterprise network. Through the above method, the embodiment of the present invention may find that:

[0186] 1. A small abnormal group persists during the late night hours and involves a large amount of data transfer. This may indicate a risk of data leakage.

[0187] 2. A new anomalous group suddenly appears, containing similar behavior patterns from multiple user accounts. This may indicate botnet activity.

[0188] 3. An abnormal group gradually increases during working hours, involving a large number of visits to specific external URLs. This may be an ongoing phishing attack.

[0189] Through this approach, the system can automatically process and analyze large amounts of complex network data, identifying subtle abnormal patterns that may be overlooked by human analysts. At the same time, by tracking the evolution of these abnormal groups, the embodiments of the present invention can better understand the dynamic nature of attacks and provide an important basis for formulating effective defense strategies.

[0190] The advantage of this approach is that it can adapt to the ever-changing network environment, identify new attack patterns, and provide real-time anomaly detection capabilities, greatly improving the efficiency and effectiveness of network security defense.

[0191] S3.4: Use the autoencoder model to learn the distribution of normal and abnormal embeddings, and use the learned autoencoder model to analyze the abnormal level of the abnormal embedding group

[0192] Build a multi-layer neural network as encoder and decoder. Add noise in the middle layer to improve the robustness of the model. Use sparse autoencoders to enhance sensitivity to abnormal patterns.

[0193] Use a large amount of normal data to train the autoencoder to learn the potential representation of normal behavior. Use a contrastive learning strategy to learn the distribution differences of normal and abnormal samples at the same time. Implement an online learning mechanism to continuously update the model to adapt to environmental changes.

[0194] The reconstruction error is calculated and samples above the threshold are marked as potential anomalies. Using the learned potential representation, an anomaly score function is constructed. Based on the anomaly score, the anomaly embedding groups are graded to determine their threat level.

[0195] Assume that the embodiment of the present invention is monitoring the network activities of a large e-commerce platform. The embodiment of the present invention has obtained the embedded vector representation of the network activities from step S3.3.

[0196] 1. Autoencoder model design:

[0197] An autoencoder is a neural network that attempts to compress (encode) input data and then reconstruct (decode). In this example, an embodiment of the present invention can design an autoencoder with the following structure:

[0198] Input layer: 768 nodes (assuming that the embedding vector of the embodiment of the present invention is 768-dimensional); Encoding layer 1: 256 nodes; Encoding layer 2: 64 nodes; Latent space: 32 nodes; Decoding layer 1: 64 nodes; Decoding layer 2: 256 nodes; Output layer: 768 nodes;

[0199] 2. Model training:

[0200] The embodiment of the present invention mainly uses normal network activity data to train the autoencoder. The training process is as follows:

[0201] a) Data preparation: Collect normal network activity data within a week and convert it into embedding vectors.

[0202] b) Training set division: 80% of the data is used for training and 20% for validation.

[0203] c) Training process: The autoencoder learns how to effectively compress and reconstruct normal network activity data.

[0204] d) Validation: Use the validation set to adjust model parameters to prevent overfitting.

[0205] 3. Abnormal level analysis:

[0206] After training is completed, the embodiment of the present invention uses an autoencoder to analyze the abnormal level of the abnormal embedding group. This process includes:

[0207] a) Reconstruction error calculation:

[0208] The vector of the abnormal embedding group is input to the autoencoder. The mean square error (MSE) between the input vector and the reconstructed vector is calculated. The reconstruction error of normal data is usually small, while the reconstruction error of abnormal data is large.

[0209] b) Anomaly score calculation:

[0210] For each input vector, the embodiment of the present invention may normalize its reconstruction error into an anomaly score.

[0211] For example: Anomaly score = (reconstruction error average reconstruction error) / reconstruction error standard deviation

[0212] c) Exception level definition:

[0213] In the embodiment of the present invention, different abnormality levels can be defined according to the abnormality score, for example:

[0214] 01: normal; 12: slightly abnormal; 23: moderately abnormal; 3+: severely abnormal;

[0215] Specific application examples:

[0216] 1. Examples of normal behavior:

[0217] A user browses a product page during work hours, adds the item to the shopping cart, and completes the purchase. After the embedding vector of this behavior is input into the autoencoder, the reconstruction error is very small and the anomaly score is close to 0, which is judged as normal behavior.

[0218] 2. Examples of minor exceptions:

[0219] A user quickly browses a large number of product pages late at night, but does not make any purchases. The embedding vector reconstruction error of this behavior is slightly larger, and the anomaly score is around 1.5, which is considered a slight anomaly. It may be that an automated script is collecting product information.

[0220] 3. Moderately abnormal example:

[0221] An account logs in from multiple IP addresses in different countries in a short period of time and attempts to modify account information. The embedding vector reconstruction error of this behavior increases significantly, and the anomaly score is around 2.5, which is judged as moderate anomaly, and the account may be stolen.

[0222] 4. Examples of serious exceptions:

[0223] The system detected a large number of accounts performing abnormal high-frequency transactions at the same time, with highly consistent transaction patterns. The embedding vector reconstruction error of this behavior is extremely large, and the anomaly score exceeds 3, which is judged as a serious anomaly and may be a large-scale automated fraud attack.

[0224] This autoencoder-based anomaly detection approach provides a powerful tool for network security analysis, which can effectively identify and quantify abnormal behaviors at various levels, thereby supporting more precise and timely security responses.

[0225] S3.5: If the anomaly level exceeds the preset threshold, the embedding space cleaning algorithm is used to remove potential malicious disturbances, and the embedding projection technology is used to map the anomaly embedding group to the safe area.

[0226] 1. Embedded space cleaning algorithm:

[0227] Implement adversarial sample detection mechanisms to identify possible malicious perturbations. Use gradient clipping techniques to limit small changes in the embedding vector. Apply noise suppression algorithms, such as wavelet transforms, to remove high-frequency perturbations.

[0228] 2. Embedded projection technology:

[0229] Define safe regions, representing the range of embedding space for normal behavior. Use manifold learning methods, such as tSNE, to project high-dimensional embeddings into low-dimensional space. Implement nearest neighbor projection to map abnormal embeddings to the nearest safe region boundary.

[0230] 3. Security verification:

[0231] Re-evaluate the cleaned and projected embeddings to ensure that the anomaly level is reduced. Perform multiple rounds of iterative optimization until the predetermined safety criteria are met. Record the cleaning and projection process to provide a basis for subsequent analysis.

[0232] Specifically, this step involves processing the detected highly anomalous embedding vectors to try to identify and remove potentially malicious perturbations and map them to a region that is considered safe. Let’s explore this process in detail:

[0233] 1. Embedded space cleaning algorithm:

[0234] The purpose of this algorithm is to identify and remove malicious perturbations that may be added to the original data. It mainly includes the following technologies:

[0235] a) Adversarial sample detection:

[0236] Use an ensemble approach: Run multiple detection models with different architectures. If most models detect an anomaly, it is more likely to be a real anomaly rather than an adversarial perturbation.

[0237] Feature squeezing: reducing the dimension of the input and then reconstructing it, which may remove small adversarial perturbations.

[0238] Statistical property detection: Analyze the statistical properties of the embedded vector (such as mean, variance). Those that deviate significantly from the normal distribution may be adversarial samples.

[0239] b) Gradient Clipping:

[0240] Compute the gradient of the input with respect to the model output.

[0241] Clamp the norm of the gradient to a small threshold.

[0242] Make small adjustments to the input based on the clipped gradients.

[0243] This can limit the impact of adversarial perturbations, since adversarial examples often exploit large gradient directions for perturbations.

[0244] c) Noise suppression:

[0245] Apply wavelet transform to decompose the embedded vector.

[0246] Perform soft threshold processing on high-frequency components to remove possible high-frequency noise.

[0247] Reconstruct the embedding vector.

[0248] This approach can remove some subtle malicious perturbations while preserving the main signal structure.

[0249] 2. Embedded projection technology:

[0250] The purpose of this step is to map the cleaned abnormal embedding vector to an area that is considered safe. It mainly includes the following techniques:

[0251] a) Define the safe area:

[0252] Use the embedding vectors of the normal data to build a high-dimensional convex hull or hypersphere.

[0253] The boundaries of this region can be defined by support vector data description (SVDD) or one-class SVM.

[0254] b) Manifold Learning:

[0255] Project the high-dimensional embedding vector into a low-dimensional space using techniques such as tSNE or UMAP.

[0256] Visualize the distribution of normal and abnormal data in low-dimensional space.

[0257] Identify regions in the normal dataset that are considered "safe".

[0258] c) Nearest neighbor projection:

[0259] For each abnormal embedding vector, find the nearest K normal embedding vectors in the safe region.

[0260] Calculate the weighted average of these K vectors, where the weights can be based on the inverse of the distance.

[0261] Move the outlier vector a certain distance toward this weighted average point.

[0262] d) Conditional Generative Adversarial Network (CGAN):

[0263] Train a CGAN whose generator learns to transform abnormal embedding vectors into normal embedding vectors.

[0264] The discriminator ensures that the generated embedding vectors look like real normal data.

[0265] Use the trained generator to map the abnormal embedding vector to the safe region.

[0266] Implementation process:

[0267] 1. Set an anomaly threshold. For example, an anomaly score greater than 2.5 is considered a high degree of anomaly that needs to be handled.

[0268] 2. Apply the embedding space cleaning algorithm to the embedding vectors that exceed the threshold:

[0269] First, adversarial sample detection is performed.

[0270] If a possible adversarial example is detected, a gradient clipping technique is applied.

[0271] Apply noise suppression techniques to all samples.

[0272] 3. Apply embedding projection technique to the cleaned embedding vector:

[0273] Use pre-defined safe area boundaries.

[0274] Apply manifold learning techniques to visualize data distributions.

[0275] Perform nearest neighbor projection on each outlier vector.

[0276] Alternatively, use a pre-trained CGAN model for mapping.

[0277] 4. Evaluate the processed embedding vector:

[0278] Recalculate the anomaly score.

[0279] If the score is significantly reduced and falls within a safe range, the treatment is considered successful.

[0280] If the score remains high, further security measures may be necessary.

[0281] 5. Record and analyze:

[0282] Log the original exception vector, the cleaned vector, and the final mapped vector.

[0283] Analyze the differences before and after treatment to understand potential attack patterns.

[0284] Through this process, the system is able to try to "repair" the detected highly abnormal network behavior representation, transforming it into a representation that is closer to normal behavior. This not only helps reduce false positives, but also provides security analysts with insights into how potential attacks perturb normal behavior. At the same time, this process also provides a possible mitigation strategy for subsequent automated responses, which is to try to "correct" abnormal behavior to an acceptable range.

[0285] S3.6: Use sensitive information detectors to identify potential information leaks

[0286] 1. Sensitive information model definition:

[0287] Build a dictionary of sensitive information, including personal identity information, financial data, etc. Use regular expressions to define common sensitive information patterns, such as credit card numbers, social security numbers, etc. Implement context-sensitive sensitive information identification rules.

[0288] 2. Deep learning model training:

[0289] Use pre-trained language models (such as BERT) to fine-tune sensitive information identification tasks. Use active learning strategies to optimize the model's ability to identify new types of sensitive information. Implement a continuous update mechanism for the model to adapt to the ever-changing definition of sensitive information.

[0290] 3. Multimodal data analysis:

[0291] Expand the detection scope to image and audio data to identify potential visual and auditory sensitive information. Implement OCR technology to extract text from images for sensitive information detection. Develop audio-to-text technology to analyze sensitive information in voice communications.

[0292] S3.7: Use the attention mechanism to implement cross-layer attention consistency check and identify potential attack traces;

[0293] 1. Multi-layer attention model design:

[0294] Design attention sub-models for the network layer, application layer, and data layer. Use self-attention mechanism to capture key information within the layer. Implement cross-layer attention and establish associations between information at different levels.

[0295] a) Level definition:

[0296] Network layer: involves low-level network features such as IP addresses, ports, and protocols.

[0297] Application layer: includes HTTP requests, SQL queries, application API calls, etc.

[0298] Data layer: focus on data flow pattern, data content, data volume, etc.

[0299] b) Each layer of attention sub-model:

[0300] Use the self-attention mechanism to capture key information within the layer.

[0301] MultiHead Attention is used for each layer to capture features from different aspects.

[0302] c) Cross-layer Attention:

[0303] Implementing an attention mechanism between layers allows information to flow between different layers.

[0304] Using bidirectional attention flow, high-level features can guide the interpretation of low-level features and vice versa.

[0305] 2. Attention consistency measurement:

[0306] Define similarity metrics for attention distribution, such as KL divergence. Design consistency score functions to quantify the consistency of attention at different levels. Implement a dynamic threshold mechanism to adaptively adjust the consistency judgment criteria.

[0307] a) Attention distribution similarity:

[0308] KL divergence (KullbackLeibler Divergence) is used to measure the differences in attention distribution of different layers.

[0309] Calculation formula: KL(P||Q)=ΣP(x)*log(P(x) / Q(x))

[0310] Where P and Q are the attention distributions of two different layers.

[0311] b) Consistency score function:

[0312] Define a weighted sum function to combine multiple levels of consistency:

[0313] Consistency_Score=Σw_i*(1KL(P_i||Q_i))

[0314] Where w_i is the weight of each pair of level comparisons, and P_i and Q_i are the attention distributions for the i-th pair of levels.

[0315] c) Dynamic threshold mechanism:

[0316] Use adaptive thresholds to dynamically adjust consistency judgment criteria based on historical data.

[0317] A sliding window technique can be used to calculate the consistency score distribution over the past N time periods, and a threshold can be set using, for example, the 3σ principle.

[0318] 3. Attack trace identification:

[0319] Analyze the inconsistent attention patterns and build a feature library of potential attacks. Use sequence models (such as LSTM) to capture the temporal characteristics of attack traces. Implement interpretable analysis and visualize attention weights to assist security analysts in understanding potential threats.

[0320] a) Analysis of attention inconsistency patterns:

[0321] Build a baseline library of "normal" conformance patterns.

[0322] Use anomaly detection algorithms such as Isolation Forest or OneClass SVM to identify deviations from normal patterns.

[0323] b) Sequence models capture temporal features:

[0324] Use long short-term memory networks (LSTM) or gated recurrent units (GRU) to model the changes in attention consistency over time.

[0325] Input: Sequence of coherence scores in continuous time windows.

[0326] Output: Predicted consistency score and anomaly probability for the next time step.

[0327] c) Interpretability Analysis:

[0328] Use SHAP (SHapley Additive exPlanations) values ​​to explain which features contribute most to the inconsistency.

[0329] Realize heat map visualization of attention weights and intuitively display the differences in attention distribution between different levels.

[0330] 4. Implementation process:

[0331] a) Data preprocessing:

[0332] The data at each layer is properly encoded and embedded.

[0333] Segment the time series data to ensure that data from different layers are aligned in time.

[0334] b) Model training:

[0335] A multi-layer attention model is trained using a large amount of normal traffic data.

[0336] A contrastive learning strategy is adopted to enable the model to learn to distinguish between normal cross-layer consistency and artificially constructed inconsistency.

[0337] c) Online detection:

[0338] Process incoming data streams in real time and calculate cross-layer attention and consistency scores.

[0339] Use the trained sequence model to predict anomaly probability.

[0340] d) Alert generation:

[0341] An alarm is triggered when a persistent height inconsistency is detected.

[0342] The alert includes: inconsistent time period, involved network layers, main inconsistent features, etc.

[0343] e) Continuous Learning:

[0344] Implementing an incremental learning mechanism allows the model to adapt to changes in the network environment.

[0345] The model is regularly updated with new normal data and confirmed attack data.

[0346] 5. Optimization and improvement:

[0347] a) Attention Optimization:

[0348] Implement sparse attention mechanism to improve the efficiency of large-scale data processing.

[0349] Using hierarchical attention allows the model to focus at different levels of abstraction.

[0350] b) Adversarial Training:

[0351] Adversarial samples are introduced for training to improve the robustness of the model against unknown attacks.

[0352] c) Ensemble Learning:

[0353] Combine multiple attention models with different architectures, such as Transformer, CNNbased Attention, etc., to improve detection accuracy through voting or stacking.

[0354] By using this cross-layer attention consistency check, the system is able to capture complex attacks that may not be obvious at a single level but exhibit inconsistencies at multiple levels. For example, a carefully crafted DDoS attack may look normal at the network layer but exhibit anomalous behavior at the application and data layers. This approach is particularly effective in detecting complex multi-stage attacks such as advanced persistent threats (APTs) because it is able to identify subtle but inconsistent traces left by attacks at different network layers.

[0355] S3.8: Use gradient mobility analysis tools to implement hidden state analysis of abnormal embedding groups and detect parameter updates of abnormal embedding groups

[0356] 1. Development of gradient flow analysis tools:

[0357] a) Automatic differentiation framework implementation:

[0358] Leverage the automatic differentiation capabilities of deep learning frameworks such as PyTorch or TensorFlow.

[0359] Implement gradient calculation for each network layer and parameter.

[0360] Use hooks to capture gradient information of intermediate layers.

[0361] b) Gradient liquidity index design:

[0362] Gradient norm: Calculate the L2 norm of the gradient of each layer, which indicates the magnitude of the parameter update.

[0363]

[0364] Gradient direction consistency: Calculate the cosine similarity of gradients of adjacent layers.

[0365]

[0366] Exploding / vanishing gradient detection: Tracking how the norm of the gradient changes with the depth of the network.

[0367] c) Gradient Visualization Tools:

[0368] Implemented gradient flow heatmaps to show gradient strength at different layers and time steps.

[0369] Develop gradient flow animations to show how gradients propagate through the network.

[0370] Visualize the parameter update trajectory and show the movement path of the parameters during the optimization process.

[0371] 2. Hidden state analysis:

[0372] a) Hidden state extraction:

[0373] For recurrent neural networks such as RNN, LSTM, or GRU, extract the hidden state at each time step.

[0374] For attention-based models such as Transformer, extract the self-attention output of each layer.

[0375] b) Application of dimensionality reduction technology:

[0376] Use principal component analysis (PCA) to reduce the dimensionality of the hidden states.

[0377] Apply tSNE or UMAP for nonlinear dimensionality reduction for visualization.

[0378] Implement incremental PCA to support real-time processing of large-scale data streams.

[0379] c) Analysis of hidden state distribution characteristics:

[0380] Compute the statistical moments (mean, variance, skewness, kurtosis) of the hidden state.

[0381] Kernel density estimation (KDE) is used to analyze the probability distribution of hidden states.

[0382] Gaussian mixture model (GMM) is applied to perform cluster analysis on hidden states.

[0383] d) Timing analysis:

[0384] Implement sliding window techniques to analyze how hidden states change over time.

[0385] The future trend of the hidden state is predicted using the Autoregressive Integrated Moving Average (ARIMA) model.

[0386] The dynamic time warping (DTW) algorithm is applied to compare the similarities of different time series.

[0387] 3. Abnormal parameter update detection:

[0388] a) Baseline model establishment:

[0389] Train the model using a large amount of normal data to establish a baseline distribution for parameter updates.

[0390] Calculate the statistical characteristics of the update amplitude and direction for each layer parameter.

[0391] Implement an adaptive baseline that can dynamically adjust over time.

[0392] b) Statistical test methods:

[0393] The differences between individual parameter updates and the baseline distribution were compared using Z tests.

[0394] Hotelling's T2 test was used for multivariate outlier detection.

[0395] Implement the Sequential Probability Ratio Test (SPRT) for continuously monitoring parameter update sequences.

[0396] c) Multi-scale analysis:

[0397] Perform parameter update analysis in different time windows (e.g., per batch, per epoch, per day).

[0398] Implement parameter grouping and analyze the update patterns of different functional groups (e.g., convolutional layers, fully connected layers).

[0399] Develop hierarchical anomaly detection, analyzing from the overall network to individual parameters step by step.

[0400] 4. Implementation process:

[0401] a) Data preparation:

[0402] Collect and preprocess large amounts of normal network traffic data.

[0403] Construct or collect known anomalous data samples.

[0404] b) Model training and baseline establishment:

[0405] Use normal data to train deep learning models (such as LSTM autoencoders).

[0406] During training, gradient flow metrics and parameter update statistics are recorded.

[0407] Build a baseline model of normal behavior.

[0408] c) Anomaly Detection:

[0409] Perform real-time processing on incoming data streams.

[0410] Compute gradient fluidity metrics and hidden state features.

[0411] Compare the current parameter update to the baseline model.

[0412] d) Abnormal analysis:

[0413] Perform multi-dimensional analysis (gradients, hidden states, parameter updates) of detected anomalies.

[0414] Use visualization tools to visualize abnormal patterns.

[0415] Generate detailed exception reports, including the affected network layer, the degree of exception, etc.

[0416] e) Continuous learning and optimization:

[0417] Implement online learning mechanism to continuously update the baseline model.

[0418] Regularly re-evaluate and adjust anomaly detection thresholds.

[0419] 5. Advanced features:

[0420] a) Adversarial Anomaly Detection:

[0421] Implement a Generative Adversarial Network (GAN) to generate potential anomaly samples.

[0422] Use these samples to enhance the robustness of the detection model.

[0423] b) Causal Inference:

[0424] Apply causal inference techniques, such as structural causal modeling (SCM), to analyze the root causes of abnormal parameter updates.

[0425] c) Federated Learning Integration:

[0426] Allows multiple organizations to share updates to anomaly detection models while protecting privacy.

[0427] Through this in-depth gradient and parameter analysis, the system is able to capture subtle anomalies that might be overlooked by traditional methods.

[0428] For example:

[0429] 1. Detect covert data poisoning attacks: These attacks may not be obvious at the input layer but can lead to abnormal updates of internal parameters.

[0430] 2. Identify model degradation: This may be caused by changes in data distribution or continuous adversarial attacks.

[0431] 3. Discovery of Advanced Persistent Threats (APT): This type of attack may result in long-term, small but consistent abnormal parameter updates.

[0432] This approach not only improves the accuracy of anomaly detection, but also provides security analysts with tools to deeply understand the dynamics of network behavior, helping to discover and respond to the most complex network threats. S4: Apply machine learning algorithms to detect anomalies in network traffic and user access behavior

[0433] After completing the preliminary data preprocessing and analysis, this step will apply more complex and sophisticated machine learning algorithms to perform in-depth anomaly detection on network traffic and user access behavior. The core of this step is to use the powerful capabilities of graph neural networks (GNNs) to capture complex network structures and behavior patterns.

[0434] S4.1: Extract the control flow graph CFG of network traffic and user access behavior

[0435] 1. Behavior serialization:

[0436] Convert network traffic and user access behavior into a time-series event sequence. Define event type dictionaries, including network requests, file operations, system calls, etc. Implement event compression algorithms to merge repeated or redundant events.

[0437] 2.CFG construction:

[0438] Design node representation schemes to map events to CFG nodes. Define edge connection rules, such as temporal relationships, causal relationships, etc. Implement incremental CFG construction algorithms to support graph structure updates for real-time data streams.

[0439] 3.CFG optimization:

[0440] Apply graph simplification techniques, such as path compression, to reduce redundant nodes and edges. Implement subgraph isomorphism detection to identify repeated behavior patterns. Develop CFG visualization tools to assist analysts in understanding the behavior structure.

[0441] S4.2: Extract assembly instruction sequence and graph-level statistical features from CFG, including the number of nodes, number of edges, and average degree

[0442] 1. Assembly instruction sequence extraction:

[0443] For executable files, use disassembly tools to extract assembly instructions. For scripting languages, implement a custom instruction-level analyzer. Apply instruction sequence standardization technology to handle differences between different architectures and compilers.

[0444] 2. Graph-level statistical feature calculation:

[0445] Implement efficient graph traversal algorithms and calculate basic statistical features. Develop more complex graph feature extractors, such as clustering coefficient, centrality measure, etc. Use graph kernel methods to capture subgraph-level structural information.

[0446] 3. Feature Fusion:

[0447] Design a multimodal feature fusion strategy that combines instruction sequence and graph statistical features. Implement feature selection algorithms, such as LASSO, to identify the most discriminative feature subsets. Develop an adaptive feature weighting mechanism to dynamically adjust feature importance based on different types of anomalies.

[0448] S4.3: Building a graph neural network (GNN) with adversarial domain adaptation

[0449] 1. GNN architecture design:

[0450] Choose a suitable GNN variant, such as graph convolutional network (GCN) or graph attention network (GAT). Design a multi-layer GNN structure, where each layer contains graph convolution operations and nonlinear activation functions. Implement residual connections and skip connections to improve the model's expressiveness and training stability.

[0451] 2. Node and edge feature encoding:

[0452] Embedding learning is performed on discrete features (such as instruction type). Autoencoders are used to reduce the dimension and denoise continuous features. A dynamic feature update mechanism is implemented to adjust the feature representation according to changes in the graph structure.

[0453] 3. Adversarial Domain Adaptation Mechanism:

[0454] Introduce a domain classifier to distinguish between the source domain (known attack patterns) and the target domain (potential new attacks). Design an adversarial loss function to encourage GNNs to learn domain-invariant feature representations. Implement a gradient reversal layer to automatically adjust the optimization direction of the feature extractor and domain classifier during training.

[0455] By implementing these steps, a powerful anomaly detection system can be created that is able to effectively detect malware using graph neural networks and adversarial domain adaptation techniques, maintaining high performance even in the face of drifted variants. The advantages of this approach are:

[0456] 1. Capable of capturing the structural information of malware in the control flow graph, which is more effective than traditional feature extraction methods.

[0457] 2. Through the adversarial domain adaptation mechanism, the model can learn the key features that are still retained after software drift, improving the detection ability of unknown variants.

[0458] 3. The invariant characteristics of assembly instructions and code execution flow are taken into account, making the model more robust.

[0459] In the field of network security, embodiments of the present invention often face distribution differences between the source domain (known attack patterns) and the target domain (new or variant attacks). The adversarial domain-adapted GNN aims to learn a model that performs well between the two domains.

[0460] S4.4: Train the GNN model and evaluate its domain adaptability

[0461] For example, an embodiment of the present invention has a large labeled Windows malware dataset (source domain), and a small, partially labeled Android malware dataset (target domain). The goal of an embodiment of the present invention is to train a model that performs well in both domains.

[0462] Training and evaluation steps:

[0463] 1. Data preparation:

[0464] a) Source domain data (Windows):

[0465] 80,000 labeled samples, 60,000 of which are used for training and 20,000 for validation.

[0466] Each sample is represented as a graph, where nodes are program components and edges are calling relationships between components.

[0467] Features include: system call sequence, API usage frequency, file operation type, etc.

[0468] b) Target domain data (Android):

[0469] 20,000 samples, only 1,000 of which have labels.

[0470] 15,000 unlabeled samples are used for training, 4,000 for validation, and 1,000 labeled samples are used for testing.

[0471] The graph structure is similar, but the node features include: permission requests, component calls, network operations, etc.

[0472] 2. Model initialization:

[0473] Initialize the GNN model, including feature extractor, task classifier and domain classifier.

[0474] Set hyperparameters such as initial learning rate, batch size, and number of training rounds.

[0475] 3. Training process:

[0476] For each training epoch:

[0477] a) Source domain training:

[0478] Extract a batch from the Windows dataset.

[0479] Forward propagation, calculates malware classification loss and domain classification loss.

[0480] Back propagation, updating model parameters.

[0481] b) Target domain training:

[0482] Extract a batch from the Android dataset (mostly unlabeled data).

[0483] In the forward propagation, only the domain classification loss is calculated.

[0484] Back propagation, updating model parameters.

[0485] c) Domain Adaptation Parameter Adjustment:

[0486] The weight of the domain adversarial loss is dynamically adjusted according to the training progress.

[0487] For example, use the following formula to increase the weight: λ = 2 / (1+exp(10*p))1,

[0488] Where p is the current training progress (between 0 and 1).

[0489] d) Verification:

[0490] At fixed intervals, the model performance is evaluated on the validation sets of the source and target domains.

[0491] Track and record the classification accuracy and domain classification loss on both domains.

[0492] 4. Evaluate domain adaptability:

[0493] a) Source domain performance:

[0494] Evaluate the malware detection accuracy of the model on the Windows test set.

[0495] Compare the performance with a baseline model trained only on the source domain.

[0496] b) Target domain performance:

[0497] The malware detection accuracy of the model is evaluated on the Android test set (1,000 labeled samples).

[0498] Compare the performance differences with directly applying the source domain model to the target domain.

[0499] c) Domain Invariance:

[0500] Use tSNE to visualize the distribution of source and target domain samples in the feature space.

[0501] The maximum mean difference (MMD) between source and target domain features is calculated.

[0502] d) Domain Classifier Performance:

[0503] The accuracy of the evaluation domain classifier should ideally be close to random guessing (50%).

[0504] Accuracy well above 50% indicates insufficient domain adaptation, while accuracy well below 50% may indicate over-adaptation.

[0505] 5. Fine-tuning and improvements:

[0506] a) Small-Scale Supervised Fine-tuning:

[0507] The model is fine-tuned using 1,000 labeled Android samples.

[0508] Evaluate the performance improvement of the fine-tuned model on the Android test set.

[0509] b) Pseudo-labeling technology:

[0510] Generate pseudo labels for unlabeled Android samples with high confidence.

[0511] Incorporating these samples into the training process can further improve model performance.

[0512] c) Model Ensemble:

[0513] Train multiple models with different initializations or architectures.

[0514] Use ensemble methods (such as voting or averaging) to improve the stability of the final prediction.

[0515] Example of evaluation results:

[0516] 1. Source domain (Windows) performance:

[0517] Baseline model (source domain training only): 95% accuracy

[0518] Domain Adaptation Model: 93% Accuracy

[0519] 2. Target domain (Android) performance:

[0520] Directly transferred source domain model: 60% accuracy

[0521] Domain Adaptation Model: 85% Accuracy

[0522] Fine-tuned domain adaptation model: 89% accuracy

[0523] 3. Domain Invariance:

[0524] Feature space visualization shows that the distribution of source and target domain samples overlap significantly.

[0525] The MMD value decreased from the initial 0.8 to 0.3, indicating that the domain difference was significantly reduced.

[0526] 4. Domain Classifier Performance:

[0527] Initial training: 90% accuracy

[0528] Late training: 55% accuracy, close to random guessing

[0529] This example shows how to systematically train and evaluate a GNN model with domain adaptation capabilities. By comparing the model performance at different stages and settings, the embodiments of the present invention can clearly see the improvements brought by domain adaptation technology. The model significantly improves its performance on the target domain (Android) while maintaining high performance in the source domain (Windows), demonstrating its good domain adaptation capabilities. This approach enables the model to better cope with the domain shift problem in malware detection, providing a powerful tool for dealing with evolving network security threats.

[0530] S4.4.1: Design a domain classifier to distinguish between source domain and target domain. The source domain is a known malicious attack, and the target domain is a potential malicious attack after drift.

[0531] 1. Domain Classifier Architecture:

[0532] Design a multi-layer fully connected neural network as a domain classifier. Introduce batch normalization in the middle layer of the classifier to improve training stability. Use Dropout technology to prevent overfitting and improve generalization ability.

[0533] 2. Feature input design:

[0534] Use the graph-level embedding of GNN as the input of the domain classifier. Implement a feature selection mechanism to dynamically select the most domain-discriminative feature subset. Develop feature enhancement techniques, such as feature interpolation, to increase the robustness of the domain classifier.

[0535] 3. Loss function design:

[0536] Use cross entropy loss as the main optimization objective for domain classification. Introduce regularization terms, such as L2 regularization, to control model complexity. Design a loss weighting mechanism based on uncertainty, focusing on difficult-to-classify samples.

[0537] S4.4.2: Design a domain-invariant feature extractor to capture common features across domains

[0538] 1. Multi-task learning framework:

[0539] Design a shared feature extraction layer to serve both anomaly detection and domain classification tasks. Implement task-specific output layers for anomaly detection and domain classification respectively. Develop a dynamic task weight adjustment mechanism to balance the learning process of different tasks.

[0540] 2. Adversarial training strategy:

[0541] Implement a gradient reversal layer to reverse the gradient between the domain classifier and the feature extractor. Design an adversarial loss function to encourage the feature extractor to generate domain-independent representations. Develop an adaptive adversarial strength adjustment mechanism to dynamically adjust the adversarial strength based on the training progress.

[0542] 3. Invariance constraints:

[0543] The maximum mean difference (MMD) loss is introduced to minimize the difference in feature distribution between the source domain and the target domain. The adversarial autoencoder is implemented to enhance the domain invariance of features through reconstruction tasks. The consistency regularization term is designed to ensure that similar samples have similar representations in different domains.

[0544] S4.4.3: Obtain historical data sets and divide them into training sets, validation sets, and test sets

[0545] 1. Data collection and preprocessing:

[0546] Collect historical attack data from multiple sources, including public datasets and internal logs. Implement data cleaning processes to remove noise and duplicate samples. Apply data augmentation techniques, such as mutation and synthesis, to expand samples of rare attack types.

[0547] 2. Dataset division strategy:

[0548] Use stratified sampling methods to ensure consistent distribution of attack types in each subset. Implement time window division to simulate concept drift in real scenarios. Design a cross-validation scheme to improve the reliability of model performance evaluation.

[0549] 3. Dataset quality control:

[0550] Develop label consistency checking tools to correct potential labeling errors. Implement dataset version control to track the evolution history of datasets. Establish a dataset documentation system to record the source and characteristics of each sample in detail.

[0551] S4.4.4: Use domain classifiers to label source and target domain data in historical datasets

[0552] 1. Domain Tagging Strategy:

[0553] Based on timestamp information, mark early data as source domains and latest data as target domains. Use clustering algorithms, such as Kmeans, to automatically identify potential emerging attack patterns as target domains. Implement semi-supervised learning methods to guide domain segmentation using a small number of expert-annotated samples.

[0554] 2. Uncertainty handling:

[0555] Fuzzy set theory is introduced to assign membership of source domain and target domain to each sample. Entropy-based uncertainty measurement is designed to identify boundary samples that are difficult to clearly divide. Active learning strategy is implemented to give priority to high uncertainty samples for manual review.

[0556] 3. Dynamic domain adjustment:

[0557] Develop incremental learning mechanisms to continuously update domain classification models. Design domain drift detection algorithms to promptly identify significant changes in data distribution. Implement adaptive domain relabeling strategies to adjust domain labels based on detected drift dynamics.

[0558] S4.4.5: Construct the cross entropy loss function and the adversarial loss function of the domain classifier respectively, and perform weighted combination

[0559] 1. Cross Entropy Loss Function:

[0560] Implement cross entropy with class weights to balance the difference in sample numbers of different attack types. Introduce focal loss to focus on difficult-to-classify samples. Design a dynamic weight adjustment mechanism based on sample difficulty.

[0561] 2. Domain classifier adversarial loss function:

[0562] Implement reverse gradient propagation to maximize the uncertainty of domain classifiers. Introduce Wasserstein distance as a domain difference metric to improve training stability. Design cycle consistency loss to ensure reversible mapping of features between source and target domains.

[0563] 3. Loss-weighted combination:

[0564] Use grid search to optimize the weights of different loss terms. Implement a dynamic weight adjustment strategy to adaptively adjust weights based on performance indicators during training. Design a multi-objective optimization framework, such as Pareto optimization, to balance different loss objectives.

[0565] S4.4.6: Optimize model parameters using gradient descent

[0566] 1.Optimizer selection:

[0567] Implement the Adam optimizer and use adaptive learning rate to improve convergence speed. Introduce the weight decay mechanism to control model complexity.

[0568] 2. Gradient clipping and normalization:

[0569] Implement gradient clipping to prevent gradient explosion. Apply gradient accumulation technology to support large-scale training. Design gradient centralization methods to accelerate the training of deep networks.

[0570] S4.4.7: Implement early stopping strategy to prevent overfitting

[0571] 1. Verify performance monitoring:

[0572] Design a multi-index evaluation system that comprehensively considers accuracy, recall, and F1 score. Implement sliding window averaging to reduce the impact of short-term fluctuations in performance indicators. Develop visualization tools to display the changing trends of training and validation performance in real time.

[0573] 2. Stop condition design:

[0574] Set a tolerance for performance degradation to allow for short-term performance fluctuations. Implement a stopping mechanism based on Patience to terminate training when performance does not improve for a long time. Design a combined stopping condition that takes into account both performance indicators and training rounds.

[0575] 3. Model preservation strategy:

[0576] Implement a checkpoint mechanism to save the model status regularly. Design the best model selection strategy, such as saving the model with the best performance on the validation set. Develop model integration techniques, such as saving multiple best checkpoints and integrating them during inference.

[0577] S4.4.8: Use the validation set to monitor the performance of the GNN model and adjust the hyperparameters

[0578] 1. Performance index design:

[0579] Implement performance metrics for graph classification tasks, such as graph-level accuracy and F1 score. Design evaluation metrics for domain adaptability, such as the difference between source and target domain performance. Develop interpretability metrics to evaluate the model's ability to identify different types of attacks.

[0580] 2. Hyperparameter Optimization:

[0581] Implement grid search and random search to explore the optimal hyperparameter combination. Apply Bayesian optimization algorithms, such as TPE (Treestructured Parzen Estimator), to improve search efficiency. Design a multi-objective hyperparameter optimization framework to balance model performance and computational complexity.

[0582] 3.Automated parameter adjustment system:

[0583] Develop reinforcement learning-based hyperparameter optimization agents, such as using policy gradient methods. Implement hyperparameter importance analysis to identify the parameters that have the greatest impact on model performance. Design parallel hyperparameter search strategies to accelerate the tuning process using distributed computing resources.

[0584] S4.4.9: Evaluate GNN model performance on the test set

[0585] 1. Comprehensive performance evaluation:

[0586] Calculate common classification metrics such as accuracy, precision, recall, and F1 score.

[0587] Plot the ROC curve and PR curve to evaluate the performance of the model at different decision thresholds.

[0588] Implement confusion matrix analysis to gain insight into the recognition of different attack types.

[0589] 2. Robustness test:

[0590] Design adversarial example generation strategies and evaluate the sensitivity of the model to small perturbations.

[0591] Implement data contamination testing to analyze the performance of the model in the presence of incorrect labels.

[0592] Develop a concept drift simulator to evaluate the model's adaptability to changes in attack patterns.

[0593] 3. Efficiency analysis:

[0594] Measure the inference time and resource consumption of the model to evaluate the real-time detection capability.

[0595] Analyze the performance changes of the model on graph structures of different scales and evaluate the scalability.

[0596] Implement incremental learning testing to evaluate how quickly the model adapts to new data.

[0597] S4.4.10: Evaluate the performance of the GNN model on the target domain and optimize the GNN model based on the evaluation results

[0598] 1. Target domain performance evaluation:

[0599] Use unlabeled target domain data for inference and analyze the distribution of detection results.

[0600] Perform cluster analysis to identify emerging attack patterns in target domains.

[0601] Calculate the performance differences between domains and quantify the domain adaptability of the model.

[0602] 2. Model optimization strategy:

[0603] Implement a fine-tuning mechanism to adjust the model using a small amount of labeled target domain data.

[0604] Design a self-training framework to enhance the model with high-confidence target domain predictions.

[0605] Develop model distillation techniques to transfer knowledge from source domain models to target domain specific models.

[0606] 3. Continuous learning mechanism:

[0607] Implement online learning algorithms and support continuous updating of models on streaming data.

[0608] Design knowledge retention strategies, such as elastic weight merging, to prevent catastrophic forgetting.

[0609] Develop a model version control system to support the management and rollback of multiple versions of models.

[0610] S4.5: Input the assembly instruction sequence and statistical features in CFG into the GNN model to detect anomalies of drifted variants in network traffic and user access behavior

[0611] 1. Feature Fusion:

[0612] Design a multimodal feature fusion layer to integrate assembly instruction sequences and graph statistical features.

[0613] Implement the attention mechanism to dynamically adjust the importance of different features.

[0614] Develop a feature interaction module to capture the association between instruction sequences and graph structures.

[0615] 2. Incremental graph processing:

[0616] Implement a dynamic graph update algorithm to support real-time changes of CFG.

[0617] Design graph batch processing mechanism to efficiently process large-scale network traffic data.

[0618] Develop subgraph sampling techniques to reduce computational complexity while preserving key information.

[0619] 3. Anomaly Detection and Interpretation:

[0620] Implement a threshold-based anomaly detection strategy to mark samples with anomaly scores above a certain threshold as potential threats.

[0621] A multi-level anomaly detection mechanism is designed to identify anomalies at the node, subgraph and full-graph levels.

[0622] Develop interpretability modules, such as attention visualization and feature importance analysis, to help understand the decision-making process of the model.

[0623] Implement an exception tracing mechanism to locate the key instructions or subgraph structures that cause the exception.

[0624] Through this series of in-depth anomaly detection steps, the system can effectively identify abnormal patterns in network traffic and user access behavior, including those attacks that have drifted or mutated. The use of the GNN model enables the system to capture complex structured information, while domain adaptation technology ensures the generalization ability of the model in the face of new attacks. This approach not only improves detection accuracy, but also adapts to the evolving network threat environment.

[0625] S5: Calculate real-time risk scores based on anomaly detection results and generate security situation awareness reports

[0626] This step aims to transform the results of anomaly detection into actionable risk assessments and intuitive security posture reports to support decision-making.

[0627] S5.1: Constructing the PriPLTree data structure

[0628] PriPLTree (PrivacyPreserving Piecewise Linear Tree) is a special data structure for efficiently storing and querying piecewise linear functions while protecting sensitive information.

[0629] S5.1.1: Design a one-dimensional PriPLTree data structure

[0630] 1. Tree structure definition:

[0631] Design node structure, including segmentation points, linear function parameters and child node pointers. Implement balanced tree algorithms, such as AVL tree or red-black tree, to ensure query efficiency. Develop dynamic adjustment mechanism to support real-time update of tree structure.

[0632] 2. Piecewise linear function parameterization:

[0633] Implement the least squares method to fit discrete data points into piecewise linear functions. Design an adaptive segmentation strategy to dynamically adjust the segmentation points based on the data distribution characteristics. Develop an error control mechanism to ensure the fitting accuracy of each segment.

[0634] 3. Node segmentation algorithm:

[0635] Implement information gain-based segmentation criteria to maximize the ability to distinguish subtrees. Design pre-pruning and post-pruning strategies to control tree complexity. Develop dynamic segmentation thresholds to adaptively adjust segmentation conditions based on data characteristics. Use adaptive segmentation algorithms to dynamically adjust node positions based on data distribution.

[0636] 1. Data distribution analysis:

[0637] Implement kernel density estimation (KDE) to obtain the probability density function of the data. Design a change point detection algorithm to identify significant change points in the data distribution. Develop multi-scale analysis techniques to capture data features of different granularities.

[0638] 2. Adaptive segmentation strategy:

[0639] Implement an entropy-based segmentation criterion to segment at the point with the most information. Design a dynamic threshold mechanism to adjust the segmentation sensitivity based on the local data density. Develop an incremental segmentation algorithm to support real-time processing of online data streams.

[0640] 3. Node merging and splitting:

[0641] Implement similar node merging algorithm to reduce redundant segmentation. Design node splitting trigger mechanism to handle local data distribution changes. Develop balance factor to dynamically adjust the depth and width of the tree. Use local differential privacy mechanism to protect sensitive information of each node.

[0642] 1. Differential privacy implementation:

[0643] Design a Laplace mechanism to add random noise to sensitive data. Implement an exponential mechanism to handle non-numerical sensitive attributes. Develop a combined privacy budget allocation strategy to balance the privacy protection strength of nodes at different levels.

[0644] 2. Local sensitivity calculation:

[0645] Implement a smoothed sensitivity method to reduce the impact of noise addition on data usefulness. Design an adaptive privacy budget allocation to dynamically adjust the privacy protection level based on data importance. Develop a privacy risk assessment module to monitor the privacy leakage risk of data in real time.

[0646] 3. Query result calibration:

[0647] Implement post-processing techniques, such as the median mechanism, to improve the consistency of noisy data. Design confidence interval estimation methods to quantify the uncertainty of query results. Develop multiple query synthesis techniques to improve accuracy by aggregating multiple query results.

[0648] Assume that the embodiment of the present invention uses PriPLTree to represent and analyze the threshold function of network traffic anomaly detection. This function takes time as input and outputs the corresponding traffic anomaly threshold.

[0649] Design steps:

[0650] 1. Define the tree structure:

[0651] a)Node design:

[0652] Each node contains the segment point (x coordinate), linear function parameters (slope and intercept), left child node pointer and right child node pointer.

[0653] b) Tree balance:

[0654] Use AVL tree or red-black tree to keep the tree balanced and ensure query efficiency.

[0655] After insertion and deletion operations, necessary rotations are performed to maintain balance.

[0656] 2. Piecewise linear function parameterization:

[0657] a) Data collection:

[0658] Collect network traffic data and corresponding anomaly thresholds over a period of time.

[0659] b) Segment point selection:

[0660] The dynamic programming algorithm is used to select the optimal segmentation points to minimize the fitting error.

[0661] c) Linear fitting:

[0662] A linear fit was performed for each segment using the least squares method to obtain the slope and intercept.

[0663] 3. Node segmentation algorithm:

[0664] a) Initialization:

[0665] Create a root node, containing the entire time range.

[0666] b) Recursive segmentation:

[0667] The best segmentation point (eg, the point with the largest error) is selected.

[0668] Create a new node and update the left and right child nodes of the parent node.

[0669] c) Stop condition:

[0670] When the number of segments reaches a predefined maximum value or the fitting error is less than a certain threshold, the segmentation stops. 4. Adaptive segmentation algorithm:

[0671] a) Data distribution analysis:

[0672] Kernel density estimation (KDE) was used to analyze the data distribution.

[0673] Identify areas where data is dense and sparse.

[0674] b) Dynamically adjust segmentation:

[0675] Use more segments in data-dense areas.

[0676] Use fewer segments in data-sparse areas.

[0677] c) Error monitoring:

[0678] The fitting error of each segment is continuously monitored.

[0679] When the error of a segment exceeds a threshold, re-segmentation is triggered.

[0680] 5. Local differential privacy protection:

[0681] a) Sensitivity analysis:

[0682] Determine the sensitivity of the function parameters (slope and intercept).

[0683] b) Noise addition:

[0684] Noise is added to the parameters of each node using a Laplace mechanism.

[0685] The amount of noise is proportional to the sensitivity and privacy budget.

[0686] c) Privacy budget allocation:

[0687] The privacy budget is allocated according to the depth of the tree and the importance of the nodes.

[0688] More privacy budget can be allocated to nodes closer to the root.

[0689] 6. Query and update operations:

[0690] a) Query:

[0691] Starting from the root node, the tree is recursively traversed based on the query time.

[0692] When a leaf node is reached, the threshold is calculated using the linear function of that node.

[0693] b) Insert:

[0694] Find the appropriate leaf node location.

[0695] Insert new nodes and adjust the tree structure if necessary.

[0696] c) Delete:

[0697] Find the node you want to delete.

[0698] Delete the node and rebalance the tree.

[0699] d) Update:

[0700] Periodically recalculate the linear function parameters.

[0701] Rebuild subtrees if necessary.

[0702] Example of use:

[0703] 1. Build PriPLTree:

[0704] Using the collected 24-hour network traffic data to build the initial tree, there may be 4 main segments corresponding to different time periods.

[0705] 2. Query abnormal threshold:

[0706] Enter a specific time, the system traverses the tree to find the corresponding leaf node, calculates and outputs the traffic anomaly threshold for that time.

[0707] 3. Dynamic adjustment:

[0708] Monitor real-time traffic data. If the actual data in a certain time period differs greatly from the prediction, refitting of the segment is triggered.

[0709] 4. Privacy protection enquiry:

[0710] When an external system queries, a result with added noise is returned, and the noise level is dynamically adjusted according to the query frequency and the preset privacy budget.

[0711] This design allows embodiments of the present invention to efficiently store and query network traffic anomaly threshold functions while protecting sensitive information by adding controlled noise. The adaptability of PriPLTree enables it to adjust over time to reflect changes in network behavior, while its privacy protection mechanism ensures that detailed information of individual data points is not leaked while providing useful information.

[0712] S5.1.2: Design a multidimensional PriPLTree data structure, where each dimension of the multidimensional PriPLTree uses a one-dimensional PriPLTree data structure

[0713] 1. Multidimensional index structure:

[0714] Implement multidimensional index structures such as kd-tree or R-tree to support efficient multidimensional data query. Design dynamic balancing strategies to maintain the query efficiency of multidimensional tree structures. Develop dimension importance evaluation mechanisms to optimize high-impact dimensions.

[0715] 2. Dimensional correlation analysis:

[0716] Implement principal component analysis (PCA) to identify the main influencing factors. Design association rule mining algorithms to discover potential relationships between dimensions. Develop dynamic feature selection mechanisms to adjust the dimensions of interest based on real-time data.

[0717] 3. Multi-dimensional query optimization:

[0718] Implement multi-dimensional range query algorithms to support complex condition combinations. Design query plan optimizers to select the optimal query execution path. Develop parallel query processing frameworks to improve the processing efficiency of large-scale multi-dimensional data.

[0719] 3. Multi-dimensional query optimization:

[0720] a) Range query algorithm:

[0721] Implement efficient multi-dimensional range queries, such as "find all time points in the past 24 hours when traffic anomaly > 0.8 and resource usage > 70%".

[0722] b) Query plan optimization:

[0723] Optimize query paths based on historical query patterns and data distribution, and create caches or indexes for frequently queried dimension combinations.

[0724] 4. Implementation process:

[0725] a) Initialization: Create an independent one-dimensional PriPLTree for each dimension (traffic, resource, behavior). Construct a kd tree as a multidimensional index structure.

[0726] b) Data insertion:

[0727] Receive a new record containing three-dimensional data. Update each one-dimensional PriPLTree. Insert the new multidimensional data point into the kd-tree.

[0728] c) Query processing:

[0729] Receive multi-dimensional query requests, such as "find time points where traffic anomaly > 0.9 and resource usage > 85%". Use kd-tree to quickly locate areas that meet the conditions. Perform detailed queries in the related one-dimensional PriPLTree.

[0730] d) Privacy protection:

[0731] The differential privacy mechanism is applied independently in each one-dimensional PriPLTree, and the privacy budget consumption of each dimension is comprehensively considered in the multi-dimensional query results.

[0732] 5. Specific application examples:

[0733] Assume that the system receives the following query:

[0734] "Find all the time points in the past 6 hours where the network traffic anomaly > 0.8, system resource usage > 75%, and user behavior anomaly > 0.6."

[0735] Processing steps:

[0736] a) Use kd-tree to quickly locate multidimensional space regions that may meet the conditions.

[0737] b) In the located area, query the one-dimensional PriPLTree in three dimensions respectively:

[0738] Traffic PriPLTree: Find the time point where the anomaly degree is > 0.8

[0739] Resource PriPLTree: Find time points where usage > 75%

[0740] Behavioral PriPLTree: Find time points where the abnormality is > 0.6

[0741] c) Perform an intersection operation on the query results of the three dimensions to obtain the time points that meet all conditions simultaneously.

[0742] d) Apply differential privacy mechanism to add appropriate amount of noise to the final result to protect sensitive information.

[0743] 6. Dynamic adjustment and optimization:

[0744] a) Adaptive Segmentation:

[0745] Monitor changes in data distribution in each dimension.

[0746] Dynamically adjust the split point of the kd tree to maintain the balance of the tree and query efficiency.

[0747] b) Dimension importance assessment:

[0748] Regularly analyze the contribution of each dimension to the security situation.

[0749] Adjust query optimization strategies to prioritize important dimensions.

[0750] c) Association mode update:

[0751] Continuously update the association rules between dimensions.

[0752] Leverage newly discovered associations to optimize multidimensional query strategies.

[0753] Through this multidimensional PriPLTree structure, the embodiments of the present invention can efficiently store and analyze complex multidimensional security data. It allows the embodiments of the present invention to perform complex multi-condition queries while maintaining efficient data management and privacy protection in each dimension. This method is particularly suitable for advanced security analysis and decision support systems that need to comprehensively consider multiple security indicators, and can provide comprehensive and in-depth security situation awareness capabilities.

[0754] S5.2: Define the safety index PriPLTree

[0755] S5.2.1: Define safety metrics

[0756] 1. Design of indicator system:

[0757] Establish a multi-level indicator system, including system-level, network-level and application-level indicators.

[0758] Define key performance indicators (KPIs) such as intrusion detection rate, false alarm rate, response time, etc.

[0759] Design risk exposure indicators to quantify the potential vulnerability of the system.

[0760] 2. Indicator quantification method:

[0761] Standardization is achieved by converting indicators of different dimensions into comparable scales.

[0762] Design a weighting mechanism to assign weights according to the importance of indicators.

[0763] Develop a dynamic threshold setting method to adaptively adjust indicator thresholds based on historical data and current situations.

[0764] 3.Indicator correlation analysis:

[0765] Implement correlation analysis to identify linear and nonlinear relationships between indicators.

[0766] Design causal inference models to analyze the root causes of indicator changes.

[0767] Develop indicator prediction models to predict future security trends based on historical trends.

[0768] S5.2.2: Construct a one-dimensional PriPLTree for each safety indicator

[0769] 1.Indicator characteristic analysis:

[0770] Analyze the data distribution characteristics of the indicator and select an appropriate segmentation strategy.

[0771] Implement outlier detection to identify and handle extreme data points.

[0772] Design seasonality and trend decompositions to capture the temporal patterns of indicators.

[0773] 2. Tree structure optimization:

[0774] Implement a self-balancing mechanism to maintain the depth of the tree and query efficiency.

[0775] Design caching strategies to optimize the performance of frequently accessed nodes.

[0776] Develop incremental update algorithms to support efficient processing of real-time data streams.

[0777] 3. Enhanced privacy protection:

[0778] An index mechanism that implements differential privacy protects the privacy of discrete indicators.

[0779] Design a secure multi-party computing protocol to support privacy aggregation of multi-source indicator data.

[0780] Develop a dynamic privacy budget allocation strategy to adjust the protection strength according to the sensitivity of the indicator.

[0781] S5.2.3: Integrate all safety indicators and construct a multidimensional PriPLTree

[0782] 1. Dimension selection and combination:

[0783] Implement feature importance sorting and select the most representative indicator as the main dimension.

[0784] Design dimension combination strategies and reduce the number of dimensions through indicator clustering or principal component analysis.

[0785] Develop an adaptive dimension adjustment mechanism to dynamically select key dimensions based on the real-time security situation.

[0786] 2. Multi-dimensional tree structure optimization:

[0787] Implement space-filling curves, such as the Zorder curve, to map multi-dimensional space into one dimension to improve query efficiency.

[0788] Design a dynamic partitioning strategy to adaptively adjust partition boundaries based on data distribution characteristics.

[0789] Develop parallel construction algorithms and use distributed computing to accelerate the construction process of large-scale multidimensional trees.

[0790] 3. Query and update optimization:

[0791] Implement batch query processing to improve the efficiency of simultaneous query of multiple indicators.

[0792] Design an incremental update mechanism to support rapid reflection of real-time data streams.

[0793] Develop a query result caching system to optimize frequently executed similar queries.

[0794] S5.3: Define a risk calculation model based on the PriPLTree data structure, input the anomaly detection results into the risk calculation model, and obtain the risk score

[0795] S5.3.1: Use the time series analysis module to identify trends and patterns in safety indicators

[0796] 1. Time series decomposition:

[0797] Implement the STL (Seasonal and Trend decomposition using Loess) algorithm to decompose the time series into trend, seasonality, and residual components.

[0798] Design wavelet transform analysis to capture patterns at different time scales.

[0799] Develop anomaly detection algorithms, such as Isolation Forest, to identify outliers in time series.

[0800] 2. Trend analysis:

[0801] Implement the ARIMA (Autoregressive Integrated Moving Average) model to predict the short-term trend of the indicator.

[0802] Design a long short-term memory network (LSTM) to capture long-term dependencies.

[0803] Develop trend change point detection algorithms to identify significant changes in indicator trends.

[0804] 3. Periodic analysis:

[0805] Implement Fourier transform to identify periodic patterns in time series.

[0806] Design a dynamic time warping (DTW) algorithm to compare the similarities of different time series.

[0807] Develop autocorrelation analysis tools to detect underlying cyclical and seasonal patterns.

[0808] S5.3.2: Build a multi-level risk scoring strategy, including system-level, module-level, and single indicator risk scoring strategies

[0809] 1. System-level risk scoring:

[0810] Implement a weighted sum model to comprehensively consider the impact of all key indicators.

[0811] The analytic hierarchy process (AHP) was designed to determine the relative importance of different indicators.

[0812] Develop a fuzzy comprehensive evaluation model to deal with the uncertainty in indicator evaluation.

[0813] 2. Module-level risk scoring:

[0814] Implement a graph-based risk propagation model to analyze the mutual impact of risks between modules.

[0815] Design Bayesian networks to capture conditional dependencies between modules.

[0816] Develop a dynamic risk aggregation algorithm to update the module risk status in real time.

[0817] 3. Single indicator risk score:

[0818] Implement the Zscore method to evaluate the abnormality of a single indicator based on historical data distribution.

[0819] Design a dynamic threshold mechanism to adjust risk judgment criteria based on real-time data.

[0820] Develop a multi-scale scoring strategy that considers short-, medium-, and long-term changes in indicators.

[0821] S5.3.3: After the anomaly detection results are input into the risk calculation model, PriPLTree data is used for retrieval to determine the closest query result and evaluate the confidence interval of the query result. The query result is the risk level and corresponding score that are closest to the anomaly detection result.

[0822] 1. Anomaly detection result mapping:

[0823] Implement feature vector conversion and map the anomaly detection results to the multidimensional space of PriPLTree.

[0824] Design normalization processing to ensure that anomaly detection results from different sources are comparable.

[0825] Develop exception type encoding mechanisms to convert complex exception descriptions into structured representations.

[0826] 2. Nearest neighbor search:

[0827] Implement the kNN (k nearest neighbor) algorithm to find the nodes in the PriPLTree that are most similar to the input.

[0828] Design distance metric functions, such as Mahalanobis distance, to take into account the correlation between features.

[0829] Develop approximate nearest neighbor search algorithms, such as Locality Sensitive Hashing (LSH), to improve the retrieval efficiency of large-scale data.

[0830] 3. Confidence interval evaluation:

[0831] Implement the Bootstrap method to estimate the confidence interval of the risk score by resampling.

[0832] Design Bayesian posterior analyses to quantify uncertainty in risk assessment.

[0833] Develop multi-model integration techniques, such as bagging, to improve the stability and reliability of risk assessment.

[0834] The embodiment of the present invention is operating a security monitoring system of a large enterprise network. The system uses PriPLTree to store historical risk assessment data and needs to quickly assess the current risk level based on real-time anomaly detection results.

[0835] example:

[0836] The embodiment of the present invention will focus on the indicator of network traffic anomaly.

[0837] Step 1: Anomaly detection result input

[0838] Assume that the anomaly detection system of the embodiment of the present invention reports that the current network traffic anomaly degree is 0.78.

[0839] Step 2: Search using PriPLTree

[0840] a) PriPLTree structure:

[0841] Assume that the PriPLTree of the embodiment of the present invention stores data for the past 30 days, and each node contains:

[0842] Timestamp

[0843] Abnormality value

[0844] Corresponding risk level

[0845] Risk Scoring

[0846] b) Retrieval process:

[0847] Starting from the root node, compare 0.78 with the abnormality value of each node.

[0848] Recursively traverse the tree and find the node closest to 0.78.

[0849] Suppose we find the three closest nodes:

[0850] Node 1: {Abnormality: 0.75, Risk level: "high", Risk score: 7.5}

[0851] Node 2: {Abnormality: 0.80, Risk Level: "High", Risk Score: 8.0}

[0852] Node 3: {Abnormality: 0.77, Risk Level: "High", Risk Score: 7.7}

[0853] Step 3: Identify the closest query result

[0854] a) Calculate distance:

[0855] The distance between the current value (0.78) and each node is calculated using Euclidean distance.

[0856] b) Select the nearest neighbor:

[0857] Assume that node 3 (anomalousness 0.77) is closest.

[0858] c) Preliminary results:

[0859] Based on the nearest neighbor, the embodiment of the present invention obtains a preliminary risk assessment:

[0860] Risk level: "High"

[0861] Risk score: 7.7

[0862] Step 4: Evaluate the confidence interval of the query result

[0863] a) Constructing sample set:

[0864] The sample set is constructed using the closest k nodes (in this example, k = 3).

[0865] b) Calculate the confidence interval:

[0866] 1. Calculate the mean and standard deviation of the risk score:

[0867] Mean μ = (7.5 + 8.0 + 7.7) / 3 = 7.73

[0868] Standard deviation σ≈0.25

[0869] 2. Assume that the embodiment of the present invention is to calculate a 95% confidence interval using a t distribution (with 2 degrees of freedom):

[0870] Confidence interval = μ ± (t*σ / √n), where t ≈ 4.303 (95% confidence, 2 degrees of freedom)

[0871] Confidence interval = 7.73 ± (4.303 * 0.25 / √3) ≈ (7.07, 8.39)

[0872] c) Interpret the confidence interval:

[0873] The embodiment of the present invention can be 95% sure that the true risk score falls between 7.07 and 8.39.

[0874] Step 5: Final Risk Assessment Report

[0875] Based on the above analysis, the embodiment of the present invention generates the following risk assessment report:

[0876] 1. Current network traffic abnormality: 0.78

[0877] 2. Evaluation results:

[0878] Risk level: High

[0879] Risk score: 7.7 (95% confidence interval: 7.07 8.39)

[0880] 3. Explanation: The current network traffic anomaly is at a high risk level, and there is a 97.5% probability that the risk score is higher than 7.07.

[0881] Step 6: Additional Considerations

[0882] a) Time decay:

[0883] If the timestamp of the nearest neighbor node is older, a time decay factor can be applied to adjust the risk score.

[0884] b) Multi-dimensional analysis:

[0885] If PriPLTree stores multiple indicators, the nearest neighbor results of all relevant indicators can be considered comprehensively.

[0886] c) Abnormal pattern matching:

[0887] Compare the current abnormal pattern with the pattern similarity of historical high-risk events to further adjust the risk assessment.

[0888] Step 7: Continue to optimize

[0889] a) Dynamic Update:

[0890] Insert the results of this assessment into PriPLTree for future risk assessment.

[0891] Clean up old data regularly to keep the tree structure efficient.

[0892] b) Model Validation:

[0893] Track actual security incidents and verify the accuracy of risk assessments.

[0894] According to the verification results, adjust the structure of PriPLTree or the risk calculation model.

[0895] Through this process, the embodiment of the present invention uses PriPLTree to efficiently retrieve historical data, quickly assess the current risk level, and provide confidence intervals to quantify uncertainty. This approach not only considers the current anomaly detection results, but also utilizes the context of historical data to provide more reliable and insightful risk assessments. The use of PriPLTree ensures query efficiency and data privacy, while the calculation of confidence intervals provides decision makers with credibility information for risk assessments, which helps to formulate more informed security strategies.

[0896] S5.4: Automatically generate security situation awareness reports based on risk scores

[0897] Through this series of steps, the system is able to transform complex anomaly detection results into intuitive and actionable risk assessments and security situation reports. The use of the PriPLTree data structure not only improves the efficiency of data processing and querying, but also enhances the protection of sensitive information. The multi-level risk scoring strategy ensures the comprehensiveness of the assessment, while automated report generation greatly improves the efficiency and effectiveness of information delivery.

[0898] S6: Based on the security situation awareness report, define the threat level and response level, and perform automated defense

[0899] This is the last step of the entire self-defense process and the most critical execution stage. Based on the security situation awareness report generated in the previous steps, the system will automatically determine the threat level, formulate corresponding response strategies, and execute automated defense measures.

[0900] 1. Threat Level Definition:

[0901] Implement a multi-dimensional threat assessment model that comprehensively considers factors such as attack type, impact scope, and duration.

[0902] Design a dynamic threshold mechanism to adaptively adjust the threat level standards based on historical data and the current network environment.

[0903] Develop a threat level visualization tool to intuitively display different levels and types of threats.

[0904] 2. Response level determination:

[0905] Establish a threat response mapping matrix to associate different threat levels with corresponding defense measures.

[0906] Implement a context-aware response policy generator that considers factors such as network topology and business importance.

[0907] Design response conflict detection and resolution mechanisms to ensure that multiple simultaneously executed response measures are coordinated with each other.

[0908] 3. Automated response execution:

[0909] Develop a response orchestration engine to automate the execution of a series of predefined defense actions.

[0910] Implement a real-time feedback loop to continuously monitor the effectiveness of response measures and adjust them dynamically.

[0911] Design rollback mechanisms to quickly restore the system state when response actions produce unexpected results.

[0912] S6.1: Deploy a honeypot network

[0913] Honeypot is an active defense technology that attracts attackers by simulating real systems, thereby dispersing attacks and collecting threat intelligence.

[0914] Implement a dynamic honeypot generator to automatically create and configure honeypots based on the current network environment. Design a distributed honeypot network and deploy multiple honeypots in different network areas to form a collaborative defense system.

[0915] S6.2: Perform automated repair

[0916] Automated remediation is one of the core functions of self-defense systems, which can take quick action after a threat is detected to minimize potential damage.

[0917] 1. Bug fixes:

[0918] Implement an automated patch management system to automatically download and apply security updates based on threat intelligence.

[0919] Design virtual patching technology to provide temporary protection before the official patch is released.

[0920] Develop a rollback mechanism to enable quick recovery when a patch causes system instability.

[0921] 2. Configuration modification:

[0922] Implement security baseline checking tools to automatically identify and correct system configurations that deviate from security standards.

[0923] Design an intelligent firewall rule generator to dynamically adjust access control policies based on detected threats.

[0924] Develop a configuration version control system to track all configuration changes and support fast rollback.

[0925] 3. Malware Removal:

[0926] Implement a malware detection engine based on behavioral analysis to identify unknown or mutated malicious programs.

[0927] Design a sandbox isolation environment to safely analyze and remove suspicious files.

[0928] Develop system integrity repair tools to restore system files and registries that have been tampered with by malware.

[0929] 4. Network isolation and recovery:

[0930] Implement automated network segmentation technology to quickly isolate infected devices when a threat is detected.

[0931] Design a traffic redirection mechanism to direct suspicious traffic to the deep packet inspection system for analysis.

[0932] Develop an automatic network topology reconstruction tool to re-optimize the network structure after an attack to enhance security.

[0933] Through these automated defense and repair measures, the system can respond quickly after detecting a threat, greatly reducing the need for manual intervention and improving defense efficiency. At the same time, the deployment of the honeypot network can not only disperse attacks, but also provide valuable threat intelligence, further enhancing the defense capabilities of the entire system. This combination of active and passive defense methods can provide comprehensive and in-depth protection for network security.

[0934] like Figure 2 As shown, the embodiment of the present invention also provides an information network security self-defense system 30 based on trusted computing, including:

[0935] A construction module 31 is used to construct a trusted computing platform, wherein the construction of the trusted computing platform includes deploying a trusted platform module TPM, establishing a trusted software stack TSS, and implementing a trusted network connection TNC;

[0936] Design module 32, for designing a self-defense architecture, the self-defense architecture includes deploying network layer, application layer and data layer defense systems, integrating intelligent perception systems and establishing a central control and decision center;

[0937] A monitoring and preprocessing module 33, used to monitor network traffic and user access behavior, and preprocess embedded attack behaviors;

[0938] Anomaly detection module 34, used to apply machine learning algorithms to perform anomaly detection on the network traffic and user access behavior;

[0939] A calculation module 35, for calculating a real-time risk score based on the anomaly detection result, and generating a security situation awareness report;

[0940] The defense module 36 is used to define the threat level and response level based on the security situation awareness report and perform automated defense.

[0941] The above are only specific implementations of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. An information network security self-defense method based on trusted computing, characterized in that: The method comprises: Constructing a trusted computing platform, wherein the trusted computing platform construction includes deploying a trusted platform module TPM, establishing a trusted software stack TSS, and implementing a trusted network connection TNC; Design a self-defense architecture, which includes deploying network layer, application layer and data layer defense systems, integrating intelligent perception systems and establishing a central control and decision-making center; Monitor network traffic and user access behavior, and pre-process embedded attack behaviors; Applying machine learning algorithms to perform anomaly detection on the network traffic and user access behavior; Based on the anomaly detection results, calculate a real-time risk score and generate a security situation awareness report; Based on the security situation awareness report, the threat level and response level are defined, and automated defense is performed.

2. The method according to claim 1, characterized in that Monitor network traffic and user access behavior, and pre-process embedded attack behaviors, including: Get real-time data on network traffic and user access behavior; Use word frequency-based and semantic similarity-based pruning algorithms to preprocess and standardize real-time data on network traffic and user access behavior; Performing embedding vector analysis on the real-time data of the network traffic and user access behavior, and using an embedding clustering algorithm to identify abnormal embedding groups, and tracking the embedding trajectory of the abnormal embedding groups; Using an autoencoder model to learn the distribution of normal and abnormal embeddings, and using the learned autoencoder model to analyze the abnormal level of the abnormal embedding group; If the abnormal level exceeds a preset threshold, an embedding space cleaning algorithm is used to remove potential malicious disturbances, and an embedding projection technique is used to map the abnormal embedding group to a safe area.

3. The method according to claim 2, characterized in that The method further comprises: Use sensitive information detectors to identify potential information leaks; Use the attention mechanism to implement cross-layer attention consistency checks and identify potential attack traces; A gradient fluidity analysis tool is used to implement hidden state analysis of the abnormal embedding group and detect parameter updates of the abnormal embedding group.

4. The method according to claim 1, characterized in that: Apply machine learning algorithms to perform anomaly detection on the network traffic and user access behavior, including: Extracting the control flow graph CFG of the network traffic and user access behavior; Extracting assembly instruction sequences and graph-level statistical features from the CFG, the statistical features including the number of nodes, the number of edges, and the average degree; Build a graph neural network (GNN) with adversarial domain adaptation; Training the GNN model and evaluating the domain adaptability of the GNN model; The assembly instruction sequence and statistical features in the CFG are input into the GNN model to perform anomaly detection on the drifted variants in the network traffic and user access behavior.

5. The method according to claim 4, characterized in that The GNN model is trained and the domain adaptability of the GNN model is evaluated, including: Design a domain classifier to distinguish between a source domain and a target domain, wherein the source domain is a known malicious attack and the target domain is a malicious attack after potential drift; Design a domain-invariant feature extractor to capture common features across domains; Obtain a historical data set, and divide the historical data set into a training set, a validation set, and a test set; Using the domain classifier, labeling source domain and target domain data in the historical data set; Construct the cross entropy loss function and the adversarial loss function of the domain classifier respectively, and perform weighted combination; Optimize model parameters using gradient descent; Implement early stopping strategy to prevent overfitting; Use the validation set to monitor the performance of the GNN model and adjust hyperparameters; Evaluate the GNN model performance on the test set; Evaluate the performance of the GNN model on the target domain, and optimize the GNN model based on the evaluation result.

6. The method according to claim 1, characterized in that Calculates real-time risk scores and generates security situation awareness reports, including: Construct PriPLTree data structure; Define the security indicator PriPLTree; Define a risk calculation model based on the PriPLTree data structure, input the anomaly detection result into the risk calculation model, and obtain a risk score; Based on the risk score, a security situation awareness report is automatically generated.

7. The method according to claim 6, characterized in that The construction of the PriPLTree data structure includes: Design a one-dimensional PriPLTree data structure, including: Define a tree structure where each node contains piecewise linear function parameters; Using adaptive segmentation algorithm, nodes are dynamically adjusted according to data distribution; Use local differential privacy mechanism to protect sensitive information of each node; Design a multidimensional PriPLTree data structure, each dimension of the multidimensional PriPLTree uses a one-dimensional PriPLTree data structure; Define the security indicator PriPLTree, including: Define safety metrics; Construct a one-dimensional PriPLTree for each safety indicator; Integrate all safety indicators and construct a multidimensional PriPLTree.

8. The method according to claim 6, characterized in that Defining a risk calculation model based on the PriPLTree data structure, inputting the anomaly detection result into the risk calculation model, and obtaining a risk score, including: Identify trends and patterns in security indicators using the time series analysis module; Build a multi-level risk scoring strategy, including system-level, module-level and single indicator risk scoring strategies; After the anomaly detection result is input into the risk calculation model, PriPLTree data is used for retrieval to determine the closest query result, and the confidence interval of the query result is evaluated. The query result is the risk level and corresponding score that are closest to the anomaly detection result.

9. The method according to claim 1, characterized in that: The automated defense includes deploying a honeypot network and automated repair.

10. An information network security self-defense system based on trusted computing, characterized in that: include: A construction module is used to construct a trusted computing platform, wherein the construction of the trusted computing platform includes deploying a trusted platform module TPM, establishing a trusted software stack TSS, and implementing a trusted network connection TNC; A design module for designing a self-defense architecture, which includes deploying network layer, application layer and data layer defense systems, integrating intelligent perception systems and establishing a central control and decision center; Monitoring and preprocessing module, used to monitor network traffic and user access behavior, and preprocess embedded attack behaviors; An anomaly detection module, used to apply a machine learning algorithm to perform anomaly detection on the network traffic and user access behavior; A calculation module, used to calculate a real-time risk score based on the anomaly detection result and generate a security situation awareness report; The defense module is used to define the threat level and response level based on the security situation awareness report and perform automated defense.

Images