An information network security self-defense method and system based on trusted computing

Abstract

The present invention provides an information network security self-defense method and system based on trusted computing, including: constructing a trusted computing platform, where constructing the trusted computing platform includes deploying a Trusted Platform Module (TPM), establishing a Trusted Software Stack (TSS), and implementing Trusted Network Connectivity (TNC); designing a self-defense architecture, where the self-defense architecture includes deploying defense systems for the network layer, application layer, and data layer, integrating an intelligent perception system, and establishing a central control and decision-making center; monitoring network traffic and user access behaviors, and preprocessing embedded attack behaviors; applying machine learning algorithms to perform anomaly detection on the network traffic and user access behaviors; based on the anomaly detection results, calculating a real-time risk score and generating a security situation awareness report; based on the security situation awareness report, defining threat levels and response levels, and executing automated defense.

Description

Technical Field

[0001] This application relates to the field of information network security technology, and particularly to an information network security self-defense method and system based on trusted computing. Background Art

[0002] With the rapid development of information technology, network security threats have become increasingly complex and diverse. Traditional network security defense methods mainly rely on static rules and manual intervention, making it difficult to cope with rapidly evolving network attacks. The following problems exist in the prior art:

[0003] 1. Lack of trusted computing foundation: Existing systems are difficult to ensure the trustworthiness of underlying hardware and software, and are easily exploited by attackers through vulnerabilities for penetration.

[0004] 2. Insufficient self-defense ability: Most systems cannot perceive the security situation in real time and cannot automatically adjust defense strategies.

[0005] 3. Low accuracy of anomaly detection: Traditional methods are difficult to identify complex attack patterns and unknown threats.

[0006] 4. Inaccurate risk assessment: Lack of a comprehensive and dynamic risk assessment mechanism, unable to accurately reflect the real-time security status of the system.

[0007] 5. Lagging defense measures: Manual intervention results in slow defense response and difficulty in preventing the spread of attacks in a timely manner.

[0008] In view of this, there is an urgent need for a network security self-defense method and system that can achieve automated anomaly detection, real-time risk assessment, and intelligent defense based on a trusted computing platform. Summary of the Invention

[0009] In view of this, this application provides an information network security self-defense method and system based on trusted computing, which solves the problems of lack of trusted computing foundation, insufficient self-defense ability, low accuracy of anomaly detection, inaccurate risk assessment, and lagging defense measures in the prior art.

[0010] An embodiment of this application provides an information network security self-defense method based on trusted computing, including:

[0011] Constructing a trusted computing platform, where constructing the trusted computing platform includes deploying a Trusted Platform Module (TPM), establishing a Trusted Software Stack (TSS), and implementing a Trusted Network Connectivity (TNC);

[0012] Designing a self-defense architecture, where the self-defense architecture includes deploying defense systems for the network layer, application layer, and data layer, integrating an intelligent perception system, and establishing a central control and decision-making center;

[0013] Monitor network traffic and user access behavior, and preprocess embedded attack behavior;

[0014] Apply machine learning algorithms to perform anomaly detection on the network traffic and user access behavior;

[0015] Based on the anomaly detection results, calculate real-time risk scores and generate a security situation awareness report;

[0016] Based on the security situation awareness report, define threat levels and response levels, and perform automated defense.

[0017] Monitor network traffic and user access behavior, and preprocess embedded attack behavior, including:

[0018] Obtain real-time data of network traffic and user access behavior;

[0019] Use a pruning algorithm based on word frequency and a pruning algorithm based on semantic similarity to preprocess and standardize the real-time data of network traffic and user access behavior;

[0020] Perform embedded vector analysis on the real-time data of the network traffic and user access behavior, and use an embedded clustering algorithm to identify abnormal embedded groups and track the embedded trajectories of the abnormal embedded groups;

[0021] Use an autoencoder model to learn the distributions of normal and abnormal embeddings, and use the learned autoencoder model to analyze the anomaly levels of the abnormal embedded groups;

[0022] If the anomaly level exceeds a preset threshold, use an embedded space cleaning algorithm to remove potential malicious perturbations, and use an embedded projection technique to map the abnormal embedded groups to a safe area.

[0023] The method further includes:

[0024] Use a sensitive information detector to identify potential information leakage;

[0025] Use an attention mechanism to achieve cross-layer attention consistency checking and identify potential attack traces;

[0026] Use a gradient mobility analysis tool to perform hidden state analysis of the abnormal embedded groups and detect parameter updates of the abnormal embedded groups.

[0027] Apply machine learning algorithms to perform anomaly detection on the network traffic and user access behavior, including:

[0028] Extract the control flow graph CFG of the network traffic and user access behavior;

[0029] Extract the assembly instruction sequence and graph-level statistical features from the CFG, where the statistical features include the number of nodes, the number of edges, and the average degree;

[0030] Construct a graph neural network GNN with adversarial domain adaptation;

[0031] Train the GNN model and evaluate the domain adaptation ability of the GNN model;

[0032] Input the assembly instruction sequence and statistical features in the CFG into the GNN model to detect anomalies in the drifted variants in the network traffic and user access behavior.

[0033] Training the GNN model and evaluating the domain adaptation ability of the GNN model includes:

[0034] Design a domain classifier for distinguishing the source domain and the target domain, where the source domain is known malicious attacks and the target domain is potentially drifted malicious attacks;

[0035] Design a domain-invariant feature extractor for capturing common features across domains;

[0036] Obtain a historical dataset and divide the historical dataset into a training set, a validation set, and a test set;

[0037] Use the domain classifier to label the source domain and target domain data in the historical dataset;

[0038] Construct a cross-entropy loss function and an adversarial loss function for the domain classifier respectively, and perform weighted combination;

[0039] Use the gradient descent method to optimize the model parameters;

[0040] Implement an early stopping strategy to prevent overfitting;

[0041] Use the validation set to monitor the performance of the GNN model and adjust the hyperparameters;

[0042] Evaluate the performance of the GNN model in the test set;

[0043] Evaluate the performance of the GNN model on the target domain, and optimize the GNN model based on the evaluation results.

[0044] Calculate the real-time risk score and generate a security situation awareness report, including:

[0045] Construct a PriPLTree data structure;

[0046] Define the security metric PriPLTree;

[0047] Define a risk calculation model based on the PriPLTree data structure, input the anomaly detection result into the risk calculation model, and obtain a risk score;

[0048] Automatically generate a security situation awareness report based on the risk score.

[0049] The construction of the PriPLTree data structure includes:

[0050] Design a one-dimensional PriPLTree data structure, including:

[0051] Define a tree structure, where each node contains piecewise linear function parameters;

[0052] Use an adaptive segmentation algorithm to dynamically adjust nodes according to data distribution;

[0053] Use the local differential privacy mechanism to protect the sensitive information of each node;

[0054] Design a multi-dimensional PriPLTree data structure, where each dimension of the multi-dimensional PriPLTree uses a one-dimensional PriPLTree data structure;

[0055] Define a security metric PriPLTree, including:

[0056] Define security metrics;

[0057] Construct a one-dimensional PriPLTree for each security metric;

[0058] Integrate all security metrics to construct a multi-dimensional PriPLTree.

[0059] Define a risk calculation model based on the PriPLTree data structure, input the anomaly detection result into the risk calculation model, and obtain a risk score, including:

[0060] Use a time series analysis module to identify the trends and patterns of security metrics;

[0061] Construct a multi-level risk scoring strategy, including risk scoring strategies at the system level, module level, and single metric level;

[0062] After inputting the anomaly detection result into the risk calculation model, use the PriPLTree data for retrieval, determine the closest query result, and evaluate the confidence interval of the query result. The query result is the risk level and corresponding score closest to the anomaly detection result.

[0063] The automated defense includes deploying a honeypot network and automated repair.

[0064] The embodiments of the present application also provide a computer device, which includes:

[0065] At least one processor; and,

[0066] A memory communicatively connected to the at least one processor; wherein,

[0067] The memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the above-mentioned method for information network security self-defense based on trusted computing.

[0068] The embodiments of the present application also provide a computer-readable storage medium, which stores computer instructions for causing a computer to execute the above-mentioned method for information network security self-defense based on trusted computing.

[0069] The embodiments of the present application also provide a computer program product, including computer instructions, characterized in that when the computer instructions are executed by a processor, the steps of the above-mentioned method for information network security self-defense based on trusted computing are implemented.

[0070] The present application has the following technical effects:

[0071] 1. By building a trusted computing platform, the basic security of the system is improved, providing a reliable basis for self-defense.

[0072] 2. A self-defense architecture is designed to implement a multi-level and intelligent defense system, improving the overall defense ability of the system.

[0073] 3. Advanced machine learning algorithms are used for anomaly detection, improving the recognition accuracy of complex attacks and unknown threats.

[0074] 4. The PriPLTree data structure is introduced to achieve efficient and accurate real-time risk assessment, providing a reliable basis for decision-making.

[0075] 5. Through an automated defense mechanism, rapid response and automatic repair are achieved, effectively reducing the need for manual intervention and response time. Brief Description of the Drawings

[0076] Figure 1 is a flowchart of the method for information network security self-defense based on trusted computing provided by the embodiments of the present application;

[0077] Figure 2 is a structural diagram of the information network security self-defense system based on trusted computing provided by the embodiments of the present application. Detailed Embodiments

[0078] Embodiment 1

[0079] The embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings.

[0080] Embodiment 1

[0081] Figure 1 It is a schematic flowchart of a method for self - defense of information network security based on trusted computing provided by the embodiments of the present disclosure. The content promotion method includes steps S1 to S6.

[0082] S1: Build a trusted computing platform

[0083] Building a trusted computing platform is the basis for realizing network security self - defense. The trusted computing platform provides a trusted operating environment for the entire system through the combination of hardware and software, effectively preventing the underlying system from being controlled or tampered with by attackers.

[0084] S1.1: Deploy the Trusted Platform Module TPM

[0085] The Trusted Platform Module (TPM) is a dedicated security chip that provides hardware - level security protection for the system. The deployment of TPM includes the following steps:

[0086] 1. Hardware integration: Integrate the TPM chip into the motherboard or system chipset.

[0087] 2. BIOS configuration: Enable the TPM function in the system BIOS and set appropriate security policies.

[0088] 3. Initialization: Initialize the TPM at the first startup to generate a unique encryption key pair.

[0089] 4. Key management: Set the Storage Root Key (SRK) and Attestation Identity Key (AIK) of the TPM.

[0090] TPM provides multiple security functions, including:

[0091] Secure storage: Used to store sensitive information such as encryption keys and certificates.

[0092] Remote attestation: Prove the integrity of the platform through AIK.

[0093] Sealing operation: Bind data to a specific system state, and the data can only be decrypted when the system is in a predefined secure state.

[0094] S1.2: Establish the Trusted Software Stack TSS

[0095] The Trusted Software Stack (TSS) is the middle layer connecting applications and the TPM, providing a standardized API interface. The establishment of TSS includes the following steps:

[0096] Install the TSS Core Service (TCS): Responsible for managing TPM resources and handling concurrent requests.

[0097] Configure the TSS Device Driver (TDD): Implement communication between the operating system and the TPM.

[0098] Deploy the TSS Service Provider (TSP): Provide high-level APIs for applications to simplify TPM operations.

[0099] Implement key and certificate management: Manage the keys and certificates generated by the TPM through TSS.

[0100] The key functions of TSS include:

[0101] Abstract TPM operations: Convert complex TPM instructions into easy-to-use APIs.

[0102] Support for multiple applications: Manage concurrent access to the TPM by multiple applications.

[0103] Key lifecycle management: Handle the creation, storage, use, and destruction of keys.

[0104] S1.3: Implement the Trusted Network Connect TNC

[0105] The Trusted Network Connect (TNC) is a network access control technology that ensures only devices compliant with the security policy can access the network. The implementation of TNC includes the following steps:

[0106] Deploy the TNC server: Responsible for formulating and enforcing network access policies.

[0107] Configure network access devices: Such as switches, routers, etc., to make them support the TNC protocol.

[0108] Install the TNC client: Install the TNC client software on the devices that need to access the network.

[0109] Define the security policy: Set the conditions that devices need to meet to access the network, such as the operating system patch level, antivirus software update status, etc.

[0110] Implement continuous evaluation: Regularly check the security status of the connected devices to ensure they continuously comply with the security policy.

[0111] The main advantages of TNC include:

[0112] Dynamic access control: Determine whether to allow access based on the real-time security status of the device.

[0113] Automated repair: For devices that do not comply with the security policy, they can be automatically guided to update or repair.

[0114] Cross-platform compatibility: Support various operating systems and network devices.

[0115] Through the above steps, a trusted computing platform based on TPM, TSS, and TNC is constructed, providing a solid foundation for the subsequent self-defense architecture. This platform can ensure the integrity of the system, prevent unauthorized modifications, and implement strict control over network access, greatly improving the security of the entire system.

[0116] S2: Design the self-defense architecture

[0117] The self-defense architecture is the core of the entire system. It integrates multi-layer defense mechanisms, an intelligent perception system, and a central control decision-making center to achieve automated and intelligent security protection.

[0118] S2.1: Deploy the defense systems for the network layer, application layer, and data layer

[0119] The multi-layer defense system adopts a defense-in-depth strategy, deploying defense measures at different levels of the network to form an all-round protection network.

[0120] 1. Network layer defense:

[0121] Deploy a new generation firewall (NGFW): Implement application-based access control and threat protection.

[0122] Implement an intrusion prevention system (IPS): Monitor and block network attacks in real time.

[0123] Configure a virtual private network (VPN): Provide an encrypted channel for remote access.

[0124] 2. Application layer defense:

[0125] Deploy a Web application firewall (WAF): Protect Web applications from common attacks such as SQL injection, cross-site scripting (XSS), etc.

[0126] Implement an application whitelist: Only allow approved applications to run.

[0127] Configure a content filtering system: Filter malicious emails and web content.

[0128] 3. Data layer defense:

[0129] Deploy a data encryption system: Encrypt sensitive data during storage and transmission.

[0130] Implement data loss prevention (DLP): Prevent unauthorized transmission of sensitive data.

[0131] Configure an access control system: Implement role-based fine-grained access control.

[0132] S2.2: Integrate an intelligent perception system

[0133] The intelligent perception system realizes a comprehensive perception and understanding of the network environment by collecting and analyzing various data sources.

[0134] 1. Deploy a distributed sensor network:

[0135] Network traffic sensors: Capture and analyze network traffic.

[0136] Host behavior sensors: Monitor the behavior and status of host systems.

[0137] User activity sensors: Track user operations and access patterns.

[0138] 2. Implement a big data analysis platform:

[0139] Data collection module: Aggregate data from various sensors.

[0140] Data preprocessing module: Clean, standardize, and extract features from raw data.

[0141] Real-time analysis engine: Use machine learning algorithms for real-time data analysis.

[0142] 3. Develop anomaly detection algorithms:

[0143] Statistics-based anomaly detection: Use statistical methods to identify anomaly patterns.

[0144] Machine learning-based anomaly detection: Use supervised and unsupervised learning algorithms to discover abnormal behaviors.

[0145] Rule-based anomaly detection: Identify violations according to predefined security rules.

[0146] S2.3: Establish a central control and decision-making center

[0147] The central control and decision-making center is the brain of the entire self-defense system, responsible for coordinating various defense components and making intelligent defense decisions.

[0148] 1. Develop a security policy management module:

[0149] Policy formulation interface: Allow administrators to define and modify security policies.

[0150] Policy distribution mechanism: Automatically distribute policies to each defense component.

[0151] Policy conflict detection: Automatically detect and resolve conflicts between policies at different levels.

[0152] 2. Implement a threat intelligence integration platform:

[0153] External threat intelligence access: Integrate multiple threat intelligence sources, such as national CERTs, security vendors, etc.

[0154] Internal threat intelligence generation: Generate localized threat intelligence based on the system's own detection results.

[0155] Intelligence analysis and sharing: Analyze, evaluate the intelligence, and share it with other agencies when necessary.

[0156] 3. Develop an automated response system:

[0157] Response rule engine: Automatically trigger response actions according to predefined rules.

[0158] Dynamic response generator: Based on machine learning algorithms, dynamically generate response strategies according to the current threat situation.

[0159] Response effect evaluation: Real-time evaluate the executed response measures and adjust according to the results.

[0160] Through this multi-level and intelligent self-defense architecture, the system can achieve comprehensive security protection, quickly respond to various threats, and continuously self-optimize.

[0161] S3: Monitor network traffic and user access behaviors, and preprocess embedded attack behaviors;

[0162] This step is the preliminary work of anomaly detection. By preprocessing and preliminarily analyzing the original data, it provides a basis for subsequent in-depth anomaly detection.

[0163] S3.1: Obtain real-time data of network traffic and user access behaviors;

[0164] Deploy high-performance network probes at key network nodes. Configure mirror ports or use network shunts to copy network traffic. Implement a data collection strategy based on sampling in a large-traffic environment.

[0165] Deploy terminal agent programs to collect user operation logs. Implement application layer protocol parsing to extract user access behavior characteristics. Establish a user profiling system to record the normal behavior patterns of users.

[0166] Use a high-speed message queue (such as Kafka) to achieve real-time data transmission. Implement data compression and encryption to ensure transmission efficiency and security.

[0167] S3.2: Preprocess and standardize the real-time data of network traffic and user access behavior using a word frequency-based pruning algorithm and a semantic similarity-based pruning algorithm;

[0168] Construct a domain-specific word frequency dictionary. Calculate the word frequency of each element in the data. Set a word frequency threshold, remove low-frequency elements, and retain key information.

[0169] Use word embedding technology (such as Word2Vec) to map data elements to a vector space. Calculate the cosine similarity between elements. Merge or selectively retain elements with a similarity higher than the threshold.

[0170] Perform data type conversion to ensure that all feature formats are consistent. Normalize numerical features using the MinMax or Zscore method. Perform one-hot encoding on categorical features.

[0171] S3.3: Perform embedded vector analysis on the real-time data of network traffic and user access behavior, and use an embedded clustering algorithm to identify abnormal embedded groups and track the embedded trajectories of abnormal embedded groups

[0172] 1. Embedded vector analysis:

[0173] The purpose of this step is to convert complex network traffic and user behavior data into numerical vectors with a fixed dimension. Embodiments of the present invention can use a deep learning model (such as BERT) to achieve this conversion. For example, for each network access, embodiments of the present invention may consider the following information: the accessed URL, access time, user ID, device type, network protocol used, data transfer volume, etc. This information is input into the model, and a vector with a fixed dimension (such as 768 dimensions) is output. This vector captures the semantic information of the original data, making similar behaviors closer in the vector space.

[0174] 2. Embedded clustering algorithm:

[0175] After obtaining the embedded vectors, embodiments of the present invention use a clustering algorithm (such as DBSCAN) to identify abnormal groups. The DBSCAN algorithm defines clusters based on density. It can discover clusters of any shape and can identify noise points (which may represent abnormal behaviors). In this process:

[0176] Normal behaviors usually form large and dense clusters.

[0177] Abnormal behaviors may form small clusters or exist as outliers.

[0178] An embodiment of the present invention can set a threshold. For example, clusters with less than 10 points or unclustered points are regarded as potential abnormal behaviors.

[0179] Use density clustering algorithms such as DBSCAN to cluster the embedding vectors. Set clustering parameters (such as density thresholds) to identify abnormal embedding groups. Implement an online clustering algorithm to support the clustering analysis of real-time data streams.

[0180] 3. Tracking of abnormal embedding groups:

[0181] Establish a time series analysis model, such as a long short-term memory network (LSTM), to track the evolution of abnormal groups. Implement multi-dimensional correlation analysis to capture the changes of abnormal groups in different feature spaces. Develop a visualization tool to intuitively display the embedding trajectories of abnormal groups.

[0182] This step involves performing time series analysis on the identified abnormal groups. An embodiment of the present invention can use the method of a sliding time window to achieve this:

[0183] Define a time window (such as 1 hour). Within each time window, repeat the embedding and clustering processes. Track the changes of abnormal groups in different time windows. Through this method, an embodiment of the present invention can observe: the duration of abnormal groups, the size changes of abnormal groups, the emergence of new abnormal groups, and the disappearance of abnormal groups.

[0184] Specific application examples:

[0185] Suppose an embodiment of the present invention is monitoring a large enterprise network. Through the above method, an embodiment of the present invention may find:

[0186] 1. A small abnormal group persists during late night hours, involving a large amount of data transmission. This may indicate a risk of data leakage.

[0187] 2. A new abnormal group suddenly appears, which contains similar behavior patterns from multiple user accounts. This may indicate botnet activities.

[0188] 3. An abnormal group gradually increases during working hours, involving a large number of accesses to a specific external URL. This may be an ongoing phishing attack.

[0189] Through this method, the system can automatically process and analyze a large amount of complex network data, identifying subtle abnormal patterns that may be overlooked by human analysts. At the same time, by tracking the evolution of these abnormal groups, an embodiment of the present invention can better understand the dynamic nature of attacks, providing an important basis for formulating effective defense strategies.

[0190] The advantage of this method is that it can adapt to the changing network environment, identify new attack patterns, and provide real-time anomaly detection capabilities, greatly improving the efficiency and effectiveness of network security defense.

[0191] S3.4: Use the autoencoder model to learn the distributions of normal and abnormal embeddings, and use the learned autoencoder model to analyze the anomaly levels of abnormal embedding groups

[0192] Construct a multi-layer neural network as the encoder and decoder. Add noise to the middle layer to improve the robustness of the model. Use a sparse autoencoder to enhance the sensitivity to abnormal patterns.

[0193] Train the autoencoder using a large amount of normal data to learn the latent representation of normal behavior. Adopt a contrastive learning strategy to simultaneously learn the distribution differences between normal and abnormal samples. Implement an online learning mechanism to continuously update the model to adapt to environmental changes.

[0194] Calculate the reconstruction error, and mark the samples above the threshold as potential anomalies. Use the learned latent representation to construct an anomaly score function. Based on the anomaly scores, grade the abnormal embedding groups to determine their threat levels.

[0195] Assume that the embodiment of the present invention is monitoring the network activities of a large e-commerce platform. The embodiment of the present invention has obtained the embedding vector representation of the network activities from step S3.3.

[0196] 1. Autoencoder model design:

[0197] An autoencoder is a neural network that attempts to compress (encode) and then reconstruct (decode) the input data. In this example, the embodiment of the present invention can design an autoencoder with the following structure:

[0198] Input layer: 768 nodes (assuming the embedding vector of the embodiment of the present invention is 768-dimensional); Encoding layer 1: 256 nodes; Encoding layer 2: 64 nodes; Latent space: 32 nodes; Decoding layer 1: 64 nodes; Decoding layer 2: 256 nodes; Output layer: 768 nodes;

[0199] 2. Model training:

[0200] The embodiment of the present invention mainly uses normal network activity data to train the autoencoder. The training process is as follows:

[0201] a) Data preparation: Collect normal network activity data within one week and convert it into embedding vectors.

[0202] b) Training set division: Use 80% of the data for training and 20% for validation.

[0203] c) Training process: The autoencoder learns how to effectively compress and reconstruct normal network activity data.

[0204] d) Validation: Use the validation set to adjust the model parameters to prevent overfitting.

[0205] 3. Abnormality level analysis:

[0206] After training is completed, the embodiment of the present invention uses the autoencoder to analyze the abnormality level of the abnormal embedding group. This process includes:

[0207] a) Reconstruction error calculation:

[0208] Input the vectors of the abnormal embedding group into the autoencoder. Calculate the mean squared error (MSE) between the input vector and the reconstructed vector. The reconstruction error of normal data is usually small, while the reconstruction error of abnormal data is large.

[0209] b) Abnormality score calculation:

[0210] For each input vector, the embodiment of the present invention can normalize its reconstruction error into an abnormality score.

[0211] For example: Abnormality score = (Reconstruction error - Average reconstruction error) / Standard deviation of reconstruction error

[0212] c) Abnormality level definition:

[0213] The embodiment of the present invention can define different abnormality levels according to the abnormality score. For example:

[0214] 01: Normal; 12: Slightly abnormal; 23: Moderately abnormal; 3+: Seriously abnormal;

[0215] Specific application examples:

[0216] 1. Example of normal behavior:

[0217] A user browses the product page during working hours, adds the product to the shopping cart, and then completes the purchase. After the embedding vector of this behavior is input into the autoencoder, the reconstruction error is very small, and the abnormality score is close to 0, which is determined to be normal behavior.

[0218] 2. Example of slightly abnormal behavior:

[0219] A user quickly browses a large number of product pages during the late night period but does not make any purchases. The reconstruction error of the embedding vector of this behavior is slightly larger, and the abnormality score is about 1.5, which is determined to be slightly abnormal. It may be an automated script collecting product information.

[0220] 3. Example of moderately abnormal behavior:

[0221] An account is logged in from IP addresses in multiple different countries within a short period of time, and attempts to modify account information. The reconstruction error of the embedding vector for this behavior increases significantly, with the anomaly score around 2.5, and it is determined to be moderately anomalous, possibly indicating account theft.

[0222] 4. Examples of severe anomalies:

[0223] The system detects a large number of accounts simultaneously conducting abnormal high-frequency transactions with highly consistent trading patterns. The reconstruction error of the embedding vector for this behavior is extremely large, with the anomaly score exceeding 3, and it is determined to be severely anomalous, possibly indicating a large-scale automated fraud attack.

[0224] This anomaly detection method based on autoencoders provides a powerful tool for network security analysis, capable of effectively identifying and quantifying abnormal behaviors at various levels, thus supporting more precise and timely security responses.

[0225] S3.5: If the anomaly level exceeds the preset threshold, use the embedding space cleaning algorithm to remove potential malicious perturbations, and use the embedding projection technique to map the abnormal embedding group to a safe area.

[0226] 1. Embedding space cleaning algorithm:

[0227] Implement an adversarial sample detection mechanism to identify possible malicious perturbations. Use gradient clipping techniques to limit small changes in the embedding vector. Apply noise suppression algorithms such as wavelet transforms to remove high-frequency perturbations.

[0228] 2. Embedding projection technique:

[0229] Define a safe area representing the range of the embedding space for normal behavior. Use manifold learning methods such as tSNE to project high-dimensional embeddings into a low-dimensional space. Implement nearest neighbor projection to map abnormal embeddings to the boundary of the nearest safe area.

[0230] 3. Security verification:

[0231] Re-evaluate the embeddings after cleaning and projection to ensure that the anomaly level is reduced. Implement multiple rounds of iterative optimization until the predetermined security standard is reached. Record the cleaning and projection process for subsequent analysis.

[0232] Specifically, this step involves processing the detected highly abnormal embedding vectors to attempt to identify and remove potential malicious perturbations and map them to an area considered safe. Explore this process in detail:

[0233] 1. Embedding space cleaning algorithm:

[0234] The purpose of this algorithm is to identify and remove malicious perturbations that may have been added to the original data. It mainly includes the following techniques:

[0235] a) Adversarial sample detection:

[0236] Use an ensemble method: Run multiple detection models with different architectures. If most models detect an anomaly, it is more likely to be a real anomaly rather than an adversarial perturbation.

[0237] Feature squeezing: Reduce the dimensionality of the input and then reconstruct it, which may remove small adversarial perturbations.

[0238] Statistical property detection: Analyze the statistical properties (such as mean, variance) of the embedded vectors. Those that deviate significantly from the normal distribution may be adversarial samples.

[0239] b) Gradient clipping:

[0240] Calculate the gradient of the input with respect to the model output.

[0241] Limit the norm of the gradient to a small threshold.

[0242] Make a small adjustment to the input according to the clipped gradient.

[0243] This can limit the impact of adversarial perturbations because adversarial samples usually use large gradient directions for perturbation.

[0244] c) Noise suppression:

[0245] Apply wavelet transform to decompose the embedded vectors.

[0246] Perform soft thresholding on the high-frequency components to remove possible high-frequency noise.

[0247] Reconstruct the embedded vectors.

[0248] This method can remove some subtle malicious perturbations while preserving the main signal structure.

[0249] 2. Embedding projection technique:

[0250] The purpose of this step is to map the cleaned anomalous embedded vectors to a region considered safe. It mainly includes the following techniques:

[0251] a) Define a safe region:

[0252] Use the embedded vectors of normal data to construct a high-dimensional convex hull or hypersphere.

[0253] The boundary of this region can be defined by Support Vector Data Description (SVDD) or one-class SVM.

[0254] b) Manifold learning:

[0255] Project the high-dimensional embedding vectors into a low-dimensional space using techniques such as tSNE or UMAP.

[0256] Visualize the distribution of normal and abnormal data in the low-dimensional space.

[0257] Identify regions in the normal dataset that are considered "safe".

[0258] c) Nearest neighbor projection:

[0259] For each abnormal embedding vector, find the K nearest normal embedding vectors in the safe region.

[0260] Calculate the weighted average of these K vectors, where the weights can be based on the inverse of the distance.

[0261] Move the abnormal vector a certain distance towards this weighted average point.

[0262] d) Conditional Generative Adversarial Network (CGAN):

[0263] Train a CGAN whose generator learns to transform abnormal embedding vectors into normal embedding vectors.

[0264] The discriminator ensures that the generated embedding vectors look like real normal data.

[0265] Use the trained generator to map the abnormal embedding vectors to the safe region.

[0266] Implementation process:

[0267] 1. Set an anomaly threshold. For example, an anomaly score greater than 2.5 is considered a highly abnormal case that needs to be processed.

[0268] 2. Apply the embedding space cleaning algorithm to the embedding vectors that exceed the threshold:

[0269] First, perform adversarial sample detection.

[0270] If possible adversarial samples are detected, apply gradient clipping techniques.

[0271] Apply noise suppression techniques to all samples.

[0272] 3. Apply the embedding projection technique to the cleaned embedding vectors:

[0273] Use the predefined boundaries of the safe region.

[0274] Apply manifold learning techniques to visualize the data distribution.

[0275] Perform nearest neighbor projection for each abnormal vector.

[0276] Alternatively, use a pre-trained CGAN model for mapping.

[0277] 4. Evaluate the processed embedding vectors:

[0278] Recalculate the anomaly score.

[0279] If the score is significantly reduced and falls within the safe range, the processing is considered successful.

[0280] If the score is still high, further security measures may be required.

[0281] 5. Record and analyze:

[0282] Record the original anomaly vectors, the cleaned vectors, and the finally mapped vectors.

[0283] Analyze the differences before and after processing to understand potential attack patterns.

[0284] Through this process, the system can attempt to "repair" the detected highly abnormal network behavior representations, transforming them into representations closer to normal behavior. This not only helps reduce false positives but also provides security analysts with insights into how potential attacks perturb normal behavior. At the same time, this process also provides a possible mitigation strategy for subsequent automated responses, that is, attempting to "correct" abnormal behavior into an acceptable range.

[0285] S3.6: Identify potential information leakage using a sensitive information detector

[0286] 1. Sensitive information pattern definition:

[0287] Build a sensitive information dictionary, including personal identity information, financial data, etc. Use regular expressions to define common sensitive information patterns, such as credit card numbers, social security numbers, etc. Implement context-related sensitive information recognition rules.

[0288] 2. Deep learning model training:

[0289] Use a pre-trained language model (such as BERT) to finetune the sensitive information recognition task. Adopt an active learning strategy to optimize the model's ability to recognize new types of sensitive information. Implement a continuous update mechanism for the model to adapt to changing sensitive information definitions.

[0290] 3. Multimodal data analysis:

[0291] Expand the detection scope to image and audio data to identify potential visual and auditory sensitive information. Implement OCR technology to extract text from images for sensitive information detection. Develop audio-to-text technology for sensitive information analysis of voice communications.

[0292] S3.7: Implement cross - layer attention consistency check using the attention mechanism to identify potential attack traces;

[0293] 1. Multi - layer attention model design:

[0294] Design attention sub - models for the network layer, application layer, and data layer respectively. Use the self - attention mechanism to capture key information within the layer. Implement cross - layer attention to establish associations between information at different levels.

[0295] a) Hierarchy definition:

[0296] Network layer: Involves low - level network features such as IP addresses, ports, protocols, etc.

[0297] Application layer: Includes HTTP requests, SQL queries, application API calls, etc.

[0298] Data layer: Focuses on data flow patterns, data content, data volume, etc.

[0299] b) Attention sub - model for each layer:

[0300] Use the self - attention mechanism (SelfAttention) to capture key information within the layer.

[0301] Use multi - head attention (MultiHead Attention) for each layer to capture features from different aspects.

[0302] c) Cross - layer attention:

[0303] Implement the attention mechanism between layers to allow information to flow between different levels.

[0304] Use bidirectional attention flow so that high - level features can guide the interpretation of low - level features and vice versa.

[0305] 2. Attention consistency measurement:

[0306] Define a similarity measure for the attention distribution, such as KL divergence. Design a consistency score function to quantify the degree of consistency of attention at different levels. Implement a dynamic threshold mechanism to adaptively adjust the consistency judgment criterion.

[0307] a) Attention distribution similarity:

[0308] Use the Kullback - Leibler Divergence (KL divergence) to measure the difference in attention distributions between different layers.

[0309] Calculation formula: KL(P||Q) = ΣP(x) * log(P(x) / Q(x))

[0310] Where P and Q are the attention distributions of two different layers.

[0311] b) Consistency score function:

[0312] Define a weighted sum function to synthesize the consistency of multiple levels:

[0313] Consistency_Score = Σw_i * (1KL(P_i||Q_i))

[0314] Where w_i is the weight of each pair of level comparisons, and P_i and Q_i are the attention distributions of the i-th pair of levels.

[0315] c) Dynamic threshold mechanism:

[0316] Use an adaptive threshold to dynamically adjust the consistency judgment criterion according to historical data.

[0317] The sliding window technique can be used to calculate the distribution of consistency scores in the past N time periods and set the threshold using, for example, the 3σ principle.

[0318] 3. Attack trace recognition:

[0319] Analyze the patterns of attention inconsistency and establish a feature library of potential attacks. Use a sequence model (such as LSTM) to capture the temporal features of attack traces. Implement interpretability analysis to visualize the attention weights to assist security analysts in understanding potential threats.

[0320] a) Analysis of attention inconsistency patterns:

[0321] Establish a baseline library of "normal" consistency patterns.

[0322] Use anomaly detection algorithms (such as Isolation Forest or OneClass SVM) to identify situations that deviate from the normal pattern.

[0323] b) Sequence model to capture temporal features:

[0324] Use long short-term memory networks (LSTM) or gated recurrent units (GRU) to model the change of attention consistency over time.

[0325] Input: The sequence of consistency scores within a continuous time window.

[0326] Output: Predict the consistency score and anomaly probability for the next time step.

[0327] c) Interpretability analysis:

[0328] Use SHAP (SHapley Additive exPlanations) values to explain which features contribute the most to the inconsistency.

[0329] Implement a heatmap visualization of the attention weights to intuitively show the differences in attention distribution between different levels.

[0330] 4. Implementation process:

[0331] a) Data preprocessing:

[0332] Perform appropriate encoding and embedding on the data for each layer.

[0333] Segment the time series data to ensure that the data for different layers is aligned in time.

[0334] b) Model training:

[0335] Train a multi-layer attention model using a large amount of normal traffic data.

[0336] Adopt a contrastive learning strategy to enable the model to learn to distinguish normal cross-layer consistency and artificially constructed inconsistency.

[0337] c) Online detection:

[0338] Process the incoming data stream in real time and calculate the cross-layer attention and consistency scores.

[0339] Use the trained sequence model to predict the anomaly probability.

[0340] d) Alarm generation:

[0341] Trigger an alarm when persistent high inconsistency is detected.

[0342] The alarm includes: the time period of inconsistency, the network layers involved, the main inconsistent features, etc.

[0343] e) Continuous learning:

[0344] Implement an incremental learning mechanism to allow the model to adapt to changes in the network environment.

[0345] Regularly update the model using new normal data and confirmed attack data.

[0346] 5. Optimization and improvement:

[0347] a) Attention optimization:

[0348] Implement a sparse attention mechanism to improve the efficiency of large-scale data processing.

[0349] Use hierarchical attention to allow the model to focus at different levels of abstraction.

[0350] b) Adversarial training:

[0351] Introduce adversarial samples for training to improve the robustness of the model against unknown attacks.

[0352] c) Ensemble learning:

[0353] Combine multiple attention models with different architectures, such as Transformer, CNN-based Attention, etc., to improve detection accuracy through voting or stacking.

[0354] Through this cross-layer attention consistency check, the system can capture complex attacks that may not be obvious at a single level but show inconsistencies at multiple levels. For example, a carefully designed DDoS attack may appear normal at the network layer but exhibit abnormal behavior at the application layer and data layer. This method is particularly effective in detecting complex multi-stage attacks such as advanced persistent threats (APTs) because it can identify the subtle but inconsistent traces left by the attack at different network levels.

[0355] S3.8: Use gradient mobility analysis tools to implement hidden state analysis of abnormal embedding groups and detect parameter updates of abnormal embedding groups

[0356] 1. Development of gradient mobility analysis tools:

[0357] a) Implementation of automatic differentiation framework:

[0358] Utilize the automatic differentiation function of deep learning frameworks such as PyTorch or TensorFlow.

[0359] Implement gradient calculation for each network layer and parameter.

[0360] Use hooks to capture gradient information of intermediate layers.

[0361] b) Design of gradient mobility metrics:

[0362] Gradient norm: Calculate the L2 norm of the gradient of each layer, indicating the magnitude of parameter updates.

[0363]

[0364] Gradient direction consistency: Calculate the cosine similarity of gradients between adjacent layers.

[0365]

[0366] Gradient explosion / vanishing detection: Track the change of gradient norm with network depth.

[0367] c) Gradient visualization tool:

[0368] Implement a gradient flow heatmap to display the gradient intensity at different layers and time steps.

[0369] Develop a gradient flow animation to show the propagation process of gradients in the network.

[0370] Implement the visualization of parameter update trajectories to show the movement paths of parameters during the optimization process.

[0371] 2. Hidden state analysis:

[0372] a) Hidden state extraction:

[0373] For recurrent neural networks such as RNN, LSTM, or GRU, extract the hidden state at each time step.

[0374] For attention-based models such as Transformer, extract the self-attention output of each layer.

[0375] b) Application of dimensionality reduction techniques:

[0376] Use principal component analysis (PCA) to reduce the dimensionality of the hidden state.

[0377] Apply tSNE or UMAP for non-linear dimensionality reduction for visualization.

[0378] Implement incremental PCA to support real-time processing of large-scale data streams.

[0379] c) Analysis of hidden state distribution characteristics:

[0380] Calculate the statistical moments (mean, variance, skewness, kurtosis) of the hidden state.

[0381] Use kernel density estimation (KDE) to analyze the probability distribution of the hidden state.

[0382] Apply Gaussian mixture model (GMM) for clustering analysis of the hidden state.

[0383] d) Time series analysis:

[0384] Implement the sliding window technique to analyze the change of the hidden state over time.

[0385] Use the autoregressive integrated moving average (ARIMA) model to predict the future trend of the hidden state.

[0386] Apply the dynamic time warping (DTW) algorithm to compare the similarity of different time series.

[0387] 3. Detection of abnormal parameter updates:

[0388] a) Establishment of a baseline model:

[0389] Train the model using a large amount of normal data to establish a baseline distribution for parameter updates.

[0390] Calculate the statistical characteristics of the update amplitude and direction for each layer parameter.

[0391] Implement an adaptive baseline that can dynamically adjust over time.

[0392] b) Statistical test methods:

[0393] The differences between individual parameter updates and the baseline distribution were compared using Z tests.

[0394] Hotelling's T2 test was used for multivariate outlier detection.

[0395] Implement the Sequential Probability Ratio Test (SPRT) for continuously monitoring parameter update sequences.

[0396] c) Multi-scale analysis:

[0397] Perform parameter update analysis in different time windows (e.g., per batch, per epoch, per day).

[0398] Implement parameter grouping and analyze the update patterns of different functional groups (e.g., convolutional layers, fully connected layers).

[0399] Develop hierarchical anomaly detection, analyzing from the overall network to individual parameters step by step.

[0400] 4. Implementation process:

[0401] a) Data preparation:

[0402] Collect and preprocess large amounts of normal network traffic data.

[0403] Construct or collect known anomalous data samples.

[0404] b) Model training and baseline establishment:

[0405] Use normal data to train deep learning models (such as LSTM autoencoders).

[0406] During training, gradient flow metrics and parameter update statistics are recorded.

[0407] Build a baseline model of normal behavior.

[0408] c) Anomaly Detection:

[0409] Perform real-time processing on incoming data streams.

[0410] Compute gradient fluidity metrics and hidden state features.

[0411] Compare the current parameter updates with the baseline model.

[0412] d) Anomaly analysis:

[0413] Conduct multi-dimensional analysis (gradient, hidden state, parameter updates) on the detected anomalies.

[0414] Use visualization tools to intuitively display the anomaly patterns.

[0415] Generate a detailed anomaly report, including the affected network layers, degree of anomaly, etc.

[0416] e) Continuous learning and optimization:

[0417] Implement an online learning mechanism to continuously update the baseline model.

[0418] Regularly re-evaluate and adjust the anomaly detection threshold.

[0419] 5. Advanced features:

[0420] a) Adversarial anomaly detection:

[0421] Implement a generative adversarial network (GAN) to generate potential anomaly samples.

[0422] Use these samples to enhance the robustness of the detection model.

[0423] b) Causal inference:

[0424] Apply causal inference techniques, such as: Structural Causal Model (SCM), to analyze the root causes of abnormal parameter updates.

[0425] c) Federated learning integration:

[0426] Allow multiple organizations to share updates of the anomaly detection model while protecting privacy.

[0427] Through this in-depth gradient and parameter analysis, the system can capture subtle anomalies that traditional methods may overlook.

[0428] For example:

[0429] 1. Detecting covert data poisoning attacks: These attacks may not be obvious at the input layer but can lead to abnormal updates of internal parameters.

[0430] 2. Identifying model degradation: May be caused by changes in data distribution or continuous adversarial attacks.

[0431] 3. Discovering Advanced Persistent Threats (APT): Such attacks may lead to long-term, minor but consistent parameter abnormal updates.

[0432] This method not only improves the accuracy of anomaly detection but also provides security analysts with tools to deeply understand the dynamics of network behavior, helping to discover and address the most complex network threats. S4: Apply machine learning algorithms to perform anomaly detection on network traffic and user access behavior

[0433] After completing the preliminary data preprocessing and analysis, this step will apply more complex and refined machine learning algorithms to perform in-depth anomaly detection on network traffic and user access behavior. The core of this step is to utilize the powerful capabilities of graph neural networks (GNNs) to capture complex network structures and behavior patterns.

[0434] S4.1: Extract the control flow graph CFG of network traffic and user access behavior

[0435] 1. Behavior serialization:

[0436] Convert network traffic and user access behavior into time-series event sequences. Define an event type dictionary, including network requests, file operations, system calls, etc. Implement an event compression algorithm to merge duplicate or redundant events.

[0437] 2. CFG construction:

[0438] Design a node representation scheme to map events to nodes of the CFG. Define edge connection rules, such as time-series relationships, causal relationships, etc. Implement an incremental CFG construction algorithm to support the update of the graph structure for real-time data streams.

[0439] 3. CFG optimization:

[0440] Apply graph simplification techniques, such as path compression, to reduce redundant nodes and edges. Implement subgraph isomorphism detection to identify duplicate behavior patterns. Develop a CFG visualization tool to assist analysts in understanding the behavior structure.

[0441] S4.2: Extract the assembly instruction sequence and graph-level statistical features from the CFG. The statistical features include the number of nodes, the number of edges, and the average degree

[0442] 1. Assembly instruction sequence extraction:

[0443] For executable files, use a disassembler tool to extract assembly instructions. For script languages, implement a custom instruction-level analyzer. Apply instruction sequence normalization techniques to handle differences in different architectures and compilers.

[0444] 2. Graph-level statistical feature calculation:

[0445] Implement an efficient graph traversal algorithm to calculate basic statistical features. Develop more complex graph feature extractors, such as clustering coefficients, centrality measures, etc. Use graph kernel methods to capture subgraph-level structural information.

[0446] 3. Feature Fusion:

[0447] Design a multi-modal feature fusion strategy that combines instruction sequences and graph statistical features. Implement a feature selection algorithm such as LASSO to identify the most discriminative feature subsets. Develop an adaptive feature weight mechanism to dynamically adjust feature importance according to different types of anomalies.

[0448] S4.3: Construct a Graph Neural Network (GNN) with Adversarial Domain Adaptation

[0449] 1. GNN Architecture Design:

[0450] Select a suitable GNN variant, such as a Graph Convolutional Network (GCN) or a Graph Attention Network (GAT). Design a multi-layer GNN structure with each layer containing graph convolution operations and non-linear activation functions. Implement residual connections and skip connections to improve the model's expressive power and training stability.

[0451] 2. Node and Edge Feature Encoding:

[0452] Perform embedding learning on discrete features (such as instruction types). Use an autoencoder to reduce the dimensionality and denoise continuous features. Implement a dynamic feature update mechanism to adjust the feature representation according to changes in the graph structure.

[0453] 3. Adversarial Domain Adaptation Mechanism:

[0454] Introduce a domain classifier to distinguish between the source domain (known attack patterns) and the target domain (potential new attacks). Design an adversarial loss function to encourage the GNN to learn domain-invariant feature representations. Implement a gradient reversal layer to automatically adjust the optimization directions of the feature extractor and the domain classifier during training.

[0455] By implementing these steps, a powerful anomaly detection system can be created that can effectively detect malware using graph neural networks and adversarial domain adaptation techniques, and maintain high performance even when faced with drifted variants. The advantages of this method are:

[0456] 1. It can capture the structural information of malware in the control flow graph, which is more effective than traditional feature extraction methods.

[0457] 2. Through the adversarial domain adaptation mechanism, the model can learn the key features that still remain after software drift, improving the detection ability for unknown variants.

[0458] 3. It considers the invariant characteristics in assembly instructions and code execution flow, making the model more robust.

[0459] In the field of network security, embodiments of the present invention often face distribution differences between the source domain (known attack patterns) and the target domain (new or variant attacks). The adversarial domain adaptation GNN aims to learn a model that performs well in both domains.

[0460] S4.4: Train the GNN model and evaluate its domain adaptation ability

[0461] For example, embodiments of the present invention have a large labeled Windows malware dataset (source domain) and a small, partially labeled Android malware dataset (target domain). The goal of embodiments of the present invention is to train a model that performs well in both domains.

[0462] Training and evaluation steps:

[0463] 1. Data preparation:

[0464] a) Source domain data (Windows):

[0465] 80,000 labeled samples, of which 60,000 are used for training and 20,000 are used for validation.

[0466] Each sample is represented as a graph, where the nodes are program components and the edges are the call relationships between components.

[0467] The features include: system call sequence, API usage frequency, file operation type, etc.

[0468] b) Target domain data (Android):

[0469] 20,000 samples, of which only 1,000 are labeled.

[0470] 15,000 unlabeled samples are used for training, 4,000 are used for validation, and 1,000 labeled samples are used for testing.

[0471] The graph structure is similar, but the node features include: permission requests, component calls, network operations, etc.

[0472] 2. Model initialization:

[0473] Initialize the GNN model, including a feature extractor, a task classifier, and a domain classifier.

[0474] Set hyperparameters such as the initial learning rate, batch size, and number of training epochs.

[0475] 3. Training process:

[0476] For each training epoch:

[0477] a) Source domain training:

[0478] Extract a batch from the Windows dataset.

[0479] Forward propagation, calculate the malware classification loss and the domain classification loss.

[0480] Backward propagation, update the model parameters.

[0481] b) Target domain training:

[0482] Extract a batch from the Android dataset (mostly unlabeled data).

[0483] Forward propagation, only calculate the domain classification loss.

[0484] Backward propagation, update the model parameters.

[0485] c) Domain adaptation parameter adjustment:

[0486] Dynamically adjust the weight of the domain adversarial loss according to the training progress.

[0487] For example, use the following formula to increase the weight: λ = 2 / (1 + exp(10 * p))1,

[0488] where p is the current training progress (between 0 and 1).

[0489] d) Validation:

[0490] Every fixed number of rounds, evaluate the model performance on the validation sets of the source domain and the target domain.

[0491] Track and record the classification accuracy and the domain classification loss on both domains.

[0492] 4. Evaluate the domain adaptation ability:

[0493] a) Source domain performance:

[0494] Evaluate the malware detection accuracy of the model on the Windows test set.

[0495] Compare the performance difference with the baseline model trained only on the source domain.

[0496] b) Target domain performance:

[0497] Evaluate the malware detection accuracy of the model on the Android test set (1,000 labeled samples).

[0498] Compare the performance difference with directly applying the source domain model to the target domain.

[0499] c) Domain invariance:

[0500] Visualize the distribution of source domain and target domain samples in the feature space using tSNE.

[0501] Calculate the Maximum Mean Discrepancy (MMD) between source domain and target domain features.

[0502] d) Domain classifier performance:

[0503] Evaluate the accuracy of the domain classifier, which should ideally be close to random guessing (50%).

[0504] An accuracy much higher than 50% indicates insufficient domain adaptation, while much lower than 50% may indicate over-adaptation.

[0505] 5. Fine-tuning and improvement:

[0506] a) Minor supervised fine-tuning:

[0507] Fine-tune the model using 1,000 labeled Android samples.

[0508] Evaluate the performance improvement of the fine-tuned model on the Android test set.

[0509] b) Pseudo-labeling technique:

[0510] Generate pseudo-labels for high-confidence unlabeled Android samples.

[0511] Incorporate these samples into the training process to further improve the model performance.

[0512] c) Model ensemble:

[0513] Train multiple models with different initializations or architectures.

[0514] Use ensemble methods (such as voting or averaging) to improve the stability of the final prediction.

[0515] Example of evaluation results:

[0516] 1. Source domain (Windows) performance:

[0517] Baseline model (trained only on the source domain): 95% accuracy

[0518] Domain adaptation model: 93% accuracy

[0519] 2. Target domain (Android) performance:

[0520] Directly migrated source domain model: 60% accuracy

[0521] Domain adaptation model: 85% accuracy

[0522] Fine-tuned domain adaptation model: 89% accuracy

[0523] 3. Domain Invariance:

[0524] Visualization of the feature space shows a significant overlap in the sample distributions of the source domain and the target domain.

[0525] The MMD value decreases from the initial 0.8 to 0.3, indicating a significant reduction in domain differences.

[0526] 4. Performance of the Domain Classifier:

[0527] At the beginning of training: 90% accuracy

[0528] At the end of training: 55% accuracy, close to random guessing

[0529] This example demonstrates how to systematically train and evaluate a GNN model with domain adaptation capabilities. By comparing the model performance at different stages and settings, the embodiments of the present invention can clearly see the improvements brought by domain adaptation techniques. While maintaining high performance in the source domain (Windows), the model significantly improves its performance in the target domain (Android), demonstrating its good domain adaptation ability. This method enables the model to better handle the domain shift problem in malware detection and provides a powerful tool for dealing with evolving cybersecurity threats.

[0530] S4.4.1: Design a domain classifier to distinguish between the source domain and the target domain, where the source domain is known malicious attacks and the target domain is potentially drifted malicious attacks

[0531] 1. Domain Classifier Architecture:

[0532] Design a multi-layer fully connected neural network as the domain classifier. Introduce batch normalization in the middle layer of the classifier to improve training stability. Use the Dropout technique to prevent overfitting and improve generalization ability.

[0533] 2. Feature Input Design:

[0534] Use the graph-level embedding of the GNN as the input to the domain classifier. Implement a feature selection mechanism to dynamically select the most domain-discriminative feature subset. Develop feature enhancement techniques, such as feature interpolation, to increase the robustness of the domain classifier.

[0535] 3. Loss Function Design:

[0536] Use cross-entropy loss as the main optimization objective for domain classification. Introduce regularization terms, such as L2 regularization, to control the model complexity. Design an uncertainty-based loss weighting mechanism to focus on difficult-to-classify samples.

[0537] S4.4.2: Design a domain-invariant feature extractor to capture common features across domains

[0538] 1. Multi-Task Learning Framework:

[0539] Design a shared feature extraction layer to serve both anomaly detection and domain classification tasks simultaneously. Implement task-specific output layers for anomaly detection and domain classification respectively. Develop a dynamic task weight adjustment mechanism to balance the learning processes of different tasks.

[0540] 2. Adversarial training strategy:

[0541] Implement a gradient reversal layer to reverse the gradient between the domain classifier and the feature extractor. Design an adversarial loss function to encourage the feature extractor to generate domain-invariant representations. Develop an adaptive adversarial intensity adjustment mechanism to dynamically adjust the degree of adversarial training according to the training process.

[0542] 3. Invariance constraints:

[0543] Introduce the maximum mean discrepancy (MMD) loss to minimize the difference in feature distributions between the source domain and the target domain. Implement an adversarial autoencoder to enhance the domain invariance of features through a reconstruction task. Design a consistency regularization term to ensure that the representations of similar samples are close in different domains.

[0544] S4.4.3: Obtain the historical dataset and divide it into a training set, a validation set, and a test set

[0545] 1. Data collection and preprocessing:

[0546] Collect historical attack data from multiple sources, including public datasets and internal logs. Implement a data cleaning process to remove noise and duplicate samples. Apply data augmentation techniques such as mutation and synthesis to augment samples of rare attack types.

[0547] 2. Dataset partitioning strategy:

[0548] Use the stratified sampling method to ensure that the distribution of attack types is consistent in each subset. Implement time window partitioning to simulate concept drift in real-world scenarios. Design a cross-validation scheme to improve the reliability of model performance evaluation.

[0549] 3. Dataset quality control:

[0550] Develop a label consistency checking tool to correct potential annotation errors. Implement dataset version control to track the evolution history of the dataset. Establish a dataset documentation system to record in detail the source and features of each sample.

[0551] S4.4.4: Use the domain classifier to label the source domain and target domain data in the historical dataset

[0552] 1. Domain labeling strategy:

[0553] Based on the timestamp information, mark the early data as the source domain and the latest data as the target domain. Use clustering algorithms such as Kmeans to automatically identify potential emerging attack patterns as the target domain. Implement a semi-supervised learning method and use a small number of expert-annotated samples to guide domain division.

[0554] 2. Uncertainty handling:

[0555] Introduce fuzzy set theory to assign membership degrees of the source domain and the target domain to each sample. Design an entropy-based uncertainty metric to identify boundary samples that are difficult to clearly divide. Implement an active learning strategy and preferentially select samples with high uncertainty for manual review.

[0556] 3. Dynamic domain adjustment:

[0557] Develop an incremental learning mechanism to continuously update the domain classification model. Design a domain drift detection algorithm to timely identify significant changes in the data distribution. Implement an adaptive domain relabeling strategy to dynamically adjust domain labels according to the detected drift.

[0558] S4.4.5: Construct a cross-entropy loss function and an adversarial loss function for the domain classifier respectively, and perform weighted combination

[0559] 1. Cross-entropy loss function:

[0560] Implement cross-entropy with class weights to balance the differences in the number of samples of different attack types. Introduce Focal Loss to focus on difficult-to-classify samples. Design a dynamic weight adjustment mechanism based on sample difficulty.

[0561] 2. Adversarial loss function for the domain classifier:

[0562] Implement reverse gradient propagation to maximize the uncertainty of the domain classifier. Introduce the Wasserstein distance as a domain difference metric to improve training stability. Design a cycle consistency loss to ensure reversible mapping of features between the source domain and the target domain.

[0563] 3. Loss weighted combination:

[0564] Use grid search to optimize the weights of different loss terms. Implement a dynamic weight adjustment strategy to adaptively adjust weights according to performance metrics during the training process. Design a multi-objective optimization framework such as Pareto optimization to balance different loss objectives.

[0565] S4.4.6: Use the gradient descent method to optimize model parameters

[0566] 1. Optimizer selection:

[0567] Implement the Adam optimizer to improve the convergence speed by using an adaptive learning rate. Introduce the WeightDecay mechanism to control the model complexity.

[0568] 2. Gradient clipping and normalization:

[0569] Implement gradient clipping to prevent the gradient explosion problem. Apply gradient accumulation techniques to support large-batch training. Design a gradient centering method to accelerate the training of deep networks.

[0570] S4.4.7: Implement an early stopping strategy to prevent overfitting

[0571] 1. Validation performance monitoring:

[0572] Design a multi-metric evaluation system that comprehensively considers accuracy, recall, and F1 score. Implement a moving window average to reduce the impact of short-term fluctuations in performance metrics. Develop a visualization tool to display the changing trends of training and validation performance in real time.

[0573] 2. Stopping condition design:

[0574] Set a tolerance for performance degradation to allow for short-term performance fluctuations. Implement a Patience-based stopping mechanism to terminate training when performance does not improve for a long time. Design a combined stopping condition that considers both performance metrics and the number of training epochs.

[0575] 3. Model saving strategy:

[0576] Implement a Checkpoint mechanism to save the model state regularly. Design a strategy for selecting the best model, such as saving the model with the optimal performance on the validation set. Develop model ensemble techniques, such as saving multiple best checkpoints and integrating them during inference.

[0577] S4.4.8: Monitor the performance of the GNN model using the validation set and adjust hyperparameters

[0578] 1. Performance metric design:

[0579] Implement performance metrics for graph classification tasks, such as graph-level accuracy and F1 score. Design evaluation metrics for domain adaptation ability, such as the difference in performance between the source domain and the target domain. Develop interpretability metrics to evaluate the model's ability to identify different types of attacks.

[0580] 2. Hyperparameter optimization:

[0581] Implement grid search and random search to explore the optimal hyperparameter combinations. Apply Bayesian optimization algorithms, such as TPE (Tree-structured Parzen Estimator), to improve the search efficiency. Design a multi-objective hyperparameter optimization framework to balance model performance and computational complexity.

[0582] 3. Automated Hyperparameter Tuning System:

[0583] Develop a hyperparameter optimization agent based on reinforcement learning, such as using policy gradient methods. Implement hyperparameter importance analysis to identify the parameters that have the greatest impact on model performance. Design a parallel hyperparameter search strategy to accelerate the tuning process using distributed computing resources.

[0584] S4.4.9: Evaluate the performance of the GNN model on the test set

[0585] 1. Comprehensive Performance Evaluation:

[0586] Calculate common classification metrics, such as accuracy, precision, recall, and F1-score.

[0587] Plot the ROC curve and PR curve to evaluate the model's performance at different decision thresholds.

[0588] Implement confusion matrix analysis to gain in-depth understanding of the identification of different attack types.

[0589] 2. Robustness Testing:

[0590] Design an adversarial sample generation strategy to evaluate the model's sensitivity to minor perturbations.

[0591] Conduct data contamination testing to analyze the model's performance in the presence of mislabeled data.

[0592] Develop a concept drift simulator to evaluate the model's adaptability to changes in attack patterns.

[0593] 3. Efficiency Analysis:

[0594] Measure the inference time and resource consumption of the model to evaluate its real-time detection ability.

[0595] Analyze the performance changes of the model on graph structures of different scales to evaluate its scalability.

[0596] Implement incremental learning testing to evaluate the model's adaptation speed to new data.

[0597] S4.4.10: Evaluate the performance of the GNN model on the target domain and optimize the GNN model based on the evaluation results

[0598] 1. Target Domain Performance Evaluation:

[0599] Use unlabeled target domain data for inference and analyze the distribution of detection results.

[0600] Conduct clustering analysis to identify emerging attack patterns in the target domain.

[0601] Calculate the performance difference between computing domains and quantify the domain adaptation ability of the model.

[0602] 2. Model optimization strategies:

[0603] Implement a fine-tuning mechanism to adjust the model using a small amount of labeled target domain data.

[0604] Design a self-training framework to enhance the model using high-confidence target domain predictions.

[0605] Develop model distillation technology to transfer the knowledge of the source domain model to the target domain specific model.

[0606] 3. Continual learning mechanism:

[0607] Implement an online learning algorithm to support the continuous update of the model on streaming data.

[0608] Design a knowledge retention strategy, such as elastic weight consolidation, to prevent catastrophic forgetting.

[0609] Develop a model version control system to support the management and rollback of multiple model versions.

[0610] S4.5: Input the assembly instruction sequence and statistical features in the CFG into the GNN model to detect anomalies in the drifted variants in network traffic and user access behavior

[0611] 1. Feature fusion:

[0612] Design a multi-modal feature fusion layer to integrate the assembly instruction sequence and graph statistical features.

[0613] Implement an attention mechanism to dynamically adjust the importance of different features.

[0614] Develop a feature interaction module to capture the correlation between the instruction sequence and the graph structure.

[0615] 2. Incremental graph processing:

[0616] Implement a dynamic graph update algorithm to support real-time changes in the CFG.

[0617] Design a graph batch processing mechanism to efficiently process large-scale network traffic data.

[0618] Develop a subgraph sampling technique to reduce the computational complexity while retaining key information.

[0619] 3. Anomaly detection and interpretation:

[0620] Implement a threshold-based anomaly detection strategy to label samples with anomaly scores higher than a certain threshold as potential threats.

[0621] Design a multi-level anomaly detection mechanism to identify anomalies at the node, subgraph, and full-graph levels respectively.

[0622] Develop an interpretability module, such as attention visualization and feature importance analysis, to help understand the model's decision-making process.

[0623] Implement an anomaly traceability mechanism to locate the key instructions or subgraph structures that cause anomalies.

[0624] Through this series of in-depth anomaly detection steps, the system can effectively identify anomaly patterns in network traffic and user access behaviors, including those attacks with drift or variants. The use of the GNN model enables the system to capture complex structured information, while domain adaptation techniques ensure the generalization ability of the model in the face of new types of attacks. This method can not only improve the detection accuracy but also adapt to the evolving network threat environment.

[0625] S5: Based on the anomaly detection results, calculate the real-time risk score and generate a security situation awareness report

[0626] This step aims to convert the anomaly detection results into actionable risk assessments and intuitive security situation reports to support decision-making.

[0627] S5.1: Construct the PriPLTree data structure

[0628] PriPLTree (PrivacyPreserving Piecewise Linear Tree) is a special data structure used to efficiently store and query piecewise linear functions while protecting sensitive information.

[0629] S5.1.1: Design the one-dimensional PriPLTree data structure

[0630] 1. Tree structure definition:

[0631] Design the node structure, including breakpoints, linear function parameters, and child node pointers. Implement a balanced tree algorithm, such as an AVL tree or a red-black tree, to ensure query efficiency. Develop a dynamic adjustment mechanism to support real-time updates of the tree structure.

[0632] 2. Parameterization of piecewise linear functions:

[0633] Implement the least squares method to fit discrete data points into piecewise linear functions. Design an adaptive segmentation strategy to dynamically adjust breakpoints according to the characteristics of data distribution. Develop an error control mechanism to ensure the fitting accuracy of each segment.

[0634] 3. Node splitting algorithm:

[0635] Implement a splitting criterion based on information gain to maximize the discriminative ability of subtrees. Design pre-pruning and post-pruning strategies to control the complexity of the tree. Develop a dynamic splitting threshold to adaptively adjust the splitting conditions according to data characteristics. Utilize an adaptive splitting algorithm to dynamically adjust nodes according to data distribution

[0636] 1. Data distribution analysis:

[0637] Implement kernel density estimation (KDE) to obtain the probability density function of data. Design a change point detection algorithm to identify significant change points in data distribution. Develop multi-scale analysis techniques to capture data characteristics at different granularities.

[0638] 2. Adaptive splitting strategy:

[0639] Implement an entropy-based splitting criterion to split at the point with the maximum information content. Design a dynamic threshold mechanism to adjust the splitting sensitivity according to local data density. Develop an incremental splitting algorithm to support real-time processing of online data streams.

[0640] 3. Node merging and splitting:

[0641] Implement a similar node merging algorithm to reduce redundant splitting. Design a node splitting trigger mechanism to handle local data distribution changes. Develop a balance factor to dynamically adjust the depth and width of the tree. Utilize the local differential privacy mechanism to protect sensitive information for each node

[0642] 1. Differential privacy implementation:

[0643] Design the Laplace mechanism to add random noise to sensitive data. Implement the exponential mechanism to handle non-numerical sensitive attributes. Develop a combined privacy budget allocation strategy to balance the privacy protection strength of different levels of nodes.

[0644] 2. Local sensitivity calculation:

[0645] Implement a smooth sensitivity method to reduce the impact of noise addition on data usefulness. Design an adaptive privacy budget allocation to dynamically adjust the privacy protection level according to data importance. Develop a privacy risk assessment module to monitor the privacy leakage risk of data in real time.

[0646] 3. Query result calibration:

[0647] Implement post-processing techniques, such as the median mechanism, to improve the consistency of noisy data. Design a confidence interval estimation method to quantify the uncertainty of query results. Develop a multiple query synthesis technique to improve accuracy through the aggregation of multiple query results.

[0648] Suppose that in the embodiments of the present invention, PriPLTree is to be used to represent and analyze the threshold function for network traffic anomaly detection. This function takes time as input and outputs the corresponding traffic anomaly threshold.

[0649] Design steps:

[0650] 1. Define the tree structure:

[0651] a) Node design:

[0652] Each node contains a break point (x coordinate), linear function parameters (slope and intercept), a pointer to the left child node, and a pointer to the right child node.

[0653] b) Tree balancing:

[0654] Use an AVL tree or a red - black tree to maintain the balance of the tree and ensure query efficiency.

[0655] After insertion and deletion operations, perform necessary rotations to maintain balance.

[0656] 2. Parametrize the piece - wise linear function:

[0657] a) Data collection:

[0658] Collect network traffic data and corresponding anomaly thresholds over a period of time.

[0659] b) Break point selection:

[0660] Use a dynamic programming algorithm to select the optimal break points and minimize the fitting error.

[0661] c) Linear fitting:

[0662] Perform linear fitting for each segment using the least - squares method to obtain the slope and intercept.

[0663] 3. Node splitting algorithm:

[0664] a) Initialization:

[0665] Create the root node, which contains the entire time range.

[0666] b) Recursive splitting:

[0667] Select the best split point (e.g., the point with the largest error).

[0668] Create a new node and update the left and right child nodes of the parent node.

[0669] c) Stopping condition:

[0670] Stop splitting when the number of segments reaches a predefined maximum value, or when the fitting error is less than a certain threshold. 4. Adaptive splitting algorithm:

[0671] a) Data distribution analysis:

[0672] Use kernel density estimation (KDE) to analyze the data distribution.

[0673] Identify data-dense and sparse regions.

[0674] b) Dynamic adjustment of segmentation:

[0675] Use more segments in data-dense regions.

[0676] Use fewer segments in data-sparse regions.

[0677] c) Error monitoring:

[0678] Continuously monitor the fitting error of each segment.

[0679] When the error of a segment exceeds the threshold, trigger re-segmentation.

[0680] 5. Local differential privacy protection:

[0681] a) Sensitivity analysis:

[0682] Determine the sensitivity of the function parameters (slope and intercept).

[0683] b) Noise addition:

[0684] Use the Laplace mechanism to add noise to the parameters of each node.

[0685] The size of the noise is proportional to the sensitivity and the privacy budget.

[0686] c) Privacy budget allocation:

[0687] Allocate the privacy budget according to the depth of the tree and the importance of the nodes.

[0688] More privacy budget can be allocated to the nodes closer to the root.

[0689] 6. Query and update operations:

[0690] a) Query:

[0691] Start from the root node and recursively traverse the tree according to the query time.

[0692] After reaching the leaf node, calculate the threshold using the linear function of the node.

[0693] b) Insertion:

[0694] Find the appropriate leaf node position.

[0695] Insert a new node and adjust the tree structure if necessary.

[0696] c) Deletion:

[0697] Find the node to be deleted.

[0698] Delete the node and rebalance the tree.

[0699] d) Update:

[0700] Recalculate the linear function parameters periodically.

[0701] Rebuild the subtree if necessary.

[0702] Usage example:

[0703] 1. Construct PriPLTree:

[0704] Construct an initial tree using the collected 24-hour network traffic data. There may be 4 main segments corresponding to different time periods.

[0705] 2. Query the anomaly threshold:

[0706] Input a specific time. The system traverses the tree to find the corresponding leaf node, calculates and outputs the traffic anomaly threshold at that time.

[0707] 3. Dynamic adjustment:

[0708] Monitor the real-time traffic data. If the actual data in a certain time period differs significantly from the prediction, trigger the refitting of that segment.

[0709] 4. Privacy-preserving query:

[0710] When queried by an external system, return the result with added noise. The size of the noise is dynamically adjusted according to the query frequency and the preset privacy budget.

[0711] This design allows the embodiments of the present invention to efficiently store and query the network traffic anomaly threshold function, while protecting sensitive information by adding controlled noise. The self-adaptability of PriPLTree enables it to adjust over time to reflect changes in network behavior, and its privacy protection mechanism ensures that while providing useful information, the detailed information of individual data points is not leaked.

[0712] S5.1.2: Design a multi-dimensional PriPLTree data structure. Each dimension of the multi-dimensional PriPLTree uses a one-dimensional PriPLTree data structure

[0713] 1. Multi-dimensional index structure:

[0714] Implement a multi-dimensional index structure such as a kd-tree or an R-tree to support efficient multi-dimensional data query. Design a dynamic balancing strategy to maintain the query efficiency of the multi-dimensional tree structure. Develop a dimension importance evaluation mechanism to optimize the dimensions with high influence.

[0715] 2. Dimensional correlation analysis:

[0716] Implement principal component analysis (PCA) to identify the main influencing factors. Design an association rule mining algorithm to discover potential relationships between dimensions. Develop a dynamic feature selection mechanism to adjust the dimensions of concern based on real-time data.

[0717] 3. Multidimensional query optimization:

[0718] Implement a multidimensional range query algorithm to support complex condition combinations. Design a query plan optimizer to select the optimal query execution path. Develop a parallel query processing framework to improve the processing efficiency of large-scale multidimensional data.

[0719] 3. Multidimensional query optimization:

[0720] a) Range query algorithm:

[0721] Implement an efficient multidimensional range query, such as "find all time points where the traffic anomaly > 0.8 and the resource utilization rate > 70% in the past 24 hours".

[0722] b) Query plan optimization:

[0723] Optimize the query path based on historical query patterns and data distribution. Establish caches or indexes for frequently queried dimension combinations.

[0724] 4. Implementation process:

[0725] a) Initialization: Create independent one-dimensional PriPLTrees for each dimension (traffic, resources, behavior). Construct a kd-tree as a multidimensional index structure.

[0726] b) Data insertion:

[0727] Receive new records containing data for three dimensions. Update each one-dimensional PriPLTree. Insert the new multidimensional data points into the kd-tree.

[0728] c) Query processing:

[0729] Receive a multidimensional query request, such as "find time points where the traffic anomaly > 0.9 and the resource utilization rate > 85%". Use the kd-tree to quickly locate the qualified region. Execute a detailed query in the relevant one-dimensional PriPLTree.

[0730] d) Privacy protection:

[0731] Independently apply the differential privacy mechanism in each dimension's one-dimensional PriPLTree. Comprehensively consider the privacy budget consumption of each dimension in the multidimensional query results.

[0732] 5. Specific application examples:

[0733] Suppose the system receives the following query:

[0734] "Find all time points in the past 6 hours where the network traffic anomaly degree > 0.8, the system resource utilization rate > 75%, and the user behavior anomaly degree > 0.6."

[0735] Processing steps:

[0736] a) Use a kd-tree to quickly locate the multi-dimensional space region that may meet the conditions.

[0737] b) In the located region, query the one-dimensional PriPLTree for each of the three dimensions:

[0738] Traffic PriPLTree: Find time points where the anomaly degree > 0.8

[0739] Resource PriPLTree: Find time points where the utilization rate > 75%

[0740] Behavior PriPLTree: Find time points where the anomaly degree > 0.6

[0741] c) Perform an intersection operation on the query results of the three dimensions to obtain time points that meet all conditions simultaneously.

[0742] d) Apply the differential privacy mechanism to add an appropriate amount of noise to the final result to protect sensitive information.

[0743] 6. Dynamic adjustment and optimization:

[0744] a) Adaptive segmentation:

[0745] Monitor the change in the data distribution of each dimension.

[0746] Dynamically adjust the segmentation points of the kd-tree to maintain the balance of the tree and the query efficiency.

[0747] b) Dimension importance evaluation:

[0748] Regularly analyze the contribution degree of each dimension to the security situation.

[0749] Adjust the query optimization strategy to give priority to processing important dimensions.

[0750] c) Association pattern update:

[0751] Continuously update the association rules between dimensions.

[0752] Use the newly discovered associations to optimize the multi-dimensional query strategy.

[0753] With this multi-dimensional PriPLTree structure, the embodiments of the present invention can efficiently store and analyze complex multi-dimensional security data. It allows the embodiments of the present invention to perform complex multi-condition queries while maintaining efficient data management and privacy protection in each dimension. This method is particularly suitable for advanced security analysis and decision support systems that need to comprehensively consider multiple security metrics, and can provide comprehensive and in-depth security situation awareness capabilities.

[0754] S5.2: Define the security metric PriPLTree

[0755] S5.2.1: Define security metrics

[0756] 1. Index system design:

[0757] Establish a multi-level index system, including system-level, network-level, and application-level metrics.

[0758] Define key performance indicators (KPIs), such as intrusion detection rate, false alarm rate, response time, etc.

[0759] Design risk exposure metrics to quantify the potential vulnerabilities of the system.

[0760] 2. Index quantization method:

[0761] Implement standardization processing to convert metrics with different dimensions into comparable scales.

[0762] Design a weighting mechanism to assign weights according to the importance of the metrics.

[0763] Develop a dynamic threshold setting method to adaptively adjust the metric thresholds based on historical data and the current situation.

[0764] 3. Index correlation analysis:

[0765] Implement correlation analysis to identify linear and non-linear relationships between metrics.

[0766] Design a causal inference model to analyze the root causes of metric changes.

[0767] Develop an index prediction model to predict the future security situation based on historical trends.

[0768] S5.2.2: Construct a one-dimensional PriPLTree for each security metric

[0769] 1. Index characteristic analysis:

[0770] Analyze the data distribution characteristics of the metrics and select an appropriate segmentation strategy.

[0771] Implement outlier detection to identify and handle extreme data points.

[0772] Design seasonal and trend decomposition to capture the time patterns of metrics.

[0773] 2. Tree structure optimization:

[0774] Implement a self-balancing mechanism to maintain the depth and query efficiency of the tree.

[0775] Design a caching strategy to optimize the performance of frequently accessed nodes.

[0776] Develop an incremental update algorithm to support the efficient processing of real-time data streams.

[0777] 3. Enhanced privacy protection:

[0778] Implement the exponential mechanism of differential privacy to protect the privacy of discrete metrics.

[0779] Design a secure multi-party computation protocol to support the privacy aggregation of multi-source metric data.

[0780] Develop a dynamic privacy budget allocation strategy to adjust the protection intensity according to the metric sensitivity.

[0781] S5.2.3: Integrate all security metrics to construct a multi-dimensional PriPLTree

[0782] 1. Dimension selection and combination:

[0783] Implement feature importance ranking and select the most representative metrics as the main dimensions.

[0784] Design a dimension combination strategy to reduce the number of dimensions through metric clustering or principal component analysis.

[0785] Develop an adaptive dimension adjustment mechanism to dynamically select key dimensions according to the real-time security situation.

[0786] 2. Multi-dimensional tree structure optimization:

[0787] Implement a space-filling curve, such as the Zorder curve, to map the multi-dimensional space to one dimension to improve query efficiency.

[0788] Design a dynamic partitioning strategy to adaptively adjust the partitioning boundaries according to the data distribution characteristics.

[0789] Develop a parallel construction algorithm to utilize distributed computing to accelerate the construction process of large-scale multi-dimensional trees.

[0790] 3. Query and update optimization:

[0791] Implement batch query processing to improve the efficiency of simultaneous multi-metric queries.

[0792] Design an incremental update mechanism to support the rapid response to real-time data streams.

[0793] Develop a query result caching system to optimize frequently executed similar queries.

[0794] S5.3: Define a risk calculation model based on the PriPLTree data structure, input the anomaly detection results into the risk calculation model, and obtain a risk score

[0795] S5.3.1: Use the time series analysis module to identify the trends and patterns of security metrics

[0796] 1. Time series decomposition:

[0797] Implement the STL (Seasonal and Trend decomposition using Loess) algorithm to decompose the time series into trend, seasonal, and residual components.

[0798] Design wavelet transform analysis to capture patterns at different time scales.

[0799] Develop an anomaly detection algorithm, such as Isolation Forest, to identify anomaly points in the time series.

[0800] 2. Trend analysis:

[0801] Implement the ARIMA (Autoregressive Integrated Moving Average) model to predict the short-term trend of metrics.

[0802] Design a Long Short-Term Memory network (LSTM) to capture long-term dependencies.

[0803] Develop a trend change point detection algorithm to identify significant changes in the metric trend.

[0804] 3. Periodicity analysis:

[0805] Implement the Fourier transform to identify periodic patterns in the time series.

[0806] Design the Dynamic Time Warping (DTW) algorithm to compare the similarity of different time series.

[0807] Develop an autocorrelation analysis tool to detect potential periodic and seasonal patterns.

[0808] S5.3.2: Build a multi-level risk scoring strategy, including system-level, module-level, and single metric risk scoring strategies

[0809] 1. System-level risk scoring:

[0810] Implement a weighted summation model to comprehensively consider the impacts of all key metrics.

[0811] Design the Analytic Hierarchy Process (AHP) to determine the relative importance of different metrics.

[0812] Develop a fuzzy comprehensive evaluation model to handle the uncertainty in index evaluation.

[0813] 2. Module-level risk scoring:

[0814] Implement a graph-based risk propagation model to analyze the mutual influence of risks among modules.

[0815] Design a Bayesian network to capture the conditional dependence relationships among modules.

[0816] Develop a dynamic risk aggregation algorithm to update the risk status of modules in real time.

[0817] 3. Single-index risk scoring:

[0818] Implement the Zscore method to evaluate the abnormality degree of a single index based on the historical data distribution.

[0819] Design a dynamic threshold mechanism to adjust the risk judgment criteria according to real-time data.

[0820] Develop a multi-scale scoring strategy considering short-term, medium-term, and long-term index changes.

[0821] S5.3.3: After inputting the anomaly detection results into the risk calculation model, use the PriPLTree data for retrieval, determine the closest query result, and evaluate the confidence interval of the query result. The query result is the risk level and corresponding score closest to the anomaly detection result.

[0822] 1. Anomaly detection result mapping:

[0823] Implement feature vector transformation to map the anomaly detection results into the multi-dimensional space of PriPLTree.

[0824] Design normalization processing to ensure the comparability of anomaly detection results from different sources.

[0825] Develop an anomaly type coding mechanism to convert complex anomaly descriptions into a structured representation.

[0826] 2. Nearest neighbor retrieval:

[0827] Implement the kNN (k-nearest neighbor) algorithm to find the node in PriPLTree that is most similar to the input.

[0828] Design a distance metric function, such as Mahalanobis distance, considering the correlation between features.

[0829] Develop an approximate nearest neighbor search algorithm, such as locality-sensitive hashing (LSH), to improve the retrieval efficiency for large-scale data.

[0830] 3. Confidence interval evaluation:

[0831] Implement the Bootstrap method to estimate the confidence interval of the risk score through resampling.

[0832] Design Bayesian posterior analysis to quantify the uncertainty of risk assessment.

[0833] Develop multi-model integration techniques such as Bagging to improve the stability and reliability of risk assessment.

[0834] The embodiment of the present invention is operating a security monitoring system for a large enterprise network. This system uses PriPLTree to store historical risk assessment data and needs to quickly evaluate the current risk level based on real-time anomaly detection results.

[0835] Example:

[0836] The embodiment of the present invention will focus on the indicator of network traffic anomaly.

[0837] Step 1: Input of anomaly detection results

[0838] Suppose the anomaly detection system of the embodiment of the present invention reports that the current network traffic anomaly degree is 0.78.

[0839] Step 2: Retrieve using PriPLTree

[0840] a) PriPLTree structure:

[0841] Suppose the PriPLTree of the embodiment of the present invention stores data for the past 30 days, and each node contains:

[0842] Timestamp

[0843] Anomaly degree value

[0844] Corresponding risk level

[0845] Risk score

[0846] b) Retrieval process:

[0847] Starting from the root node, compare 0.78 with the anomaly degree values of each node.

[0848] Recursively traverse the tree to find the node closest to 0.78.

[0849] Suppose the three closest nodes are found:

[0850] Node 1: {Anomaly degree: 0.75, Risk level: "High", Risk score: 7.5}

[0851] Node 2: {Anomaly degree: 0.80, Risk level: "High", Risk score: 8.0}

[0852] Node 3: {Anomaly degree: 0.77, Risk level: "High", Risk score: 7.7}

[0853] Step 3: Determine the closest query result

[0854] a) Calculate the distance:

[0855] Use the Euclidean distance to calculate the distance between the current value (0.78) and each node.

[0856] b) Select the nearest neighbor:

[0857] Assume that Node 3 (anomaly degree 0.77) is the closest.

[0858] c) Preliminary result:

[0859] Based on the nearest neighbor, the embodiment of the present invention obtains a preliminary risk assessment:

[0860] Risk level: "High"

[0861] Risk score: 7.7

[0862] Step 4: Evaluate the confidence interval of the query result

[0863] a) Construct a sample set:

[0864] Use the closest k nodes (in this example, k = 3) to construct a sample set.

[0865] b) Calculate the confidence interval:

[0866] 1. Calculate the mean and standard deviation of the risk scores:

[0867] Mean μ = (7.5 + 8.0 + 7.7) / 3 = 7.73

[0868] Standard deviation σ ≈ 0.25

[0869] 2. Assume that the embodiment of the present invention wants to calculate the 95% confidence interval and use the t-distribution (degrees of freedom = 2):

[0870] Confidence interval = μ ± (t * σ / √n), where t ≈ 4.303 (95% confidence level, degrees of freedom = 2)

[0871] Confidence interval = 7.73 ± (4.303 * 0.25 / √3) ≈ (7.07, 8.39)

[0872] c) Interpret the confidence interval:

[0873] The embodiment of the present invention can be 95% confident that the true risk score falls between 7.07 and 8.39.

[0874] Step 5: Final risk assessment report

[0875] Based on the above analysis, the embodiments of the present invention generate the following risk assessment report:

[0876] 1. Current network traffic anomaly degree: 0.78

[0877] 2. Assessment result:

[0878] Risk level: High

[0879] Risk score: 7.7 (95% confidence interval: 7.07 - 8.39)

[0880] 3. Explanation: The current network traffic anomaly degree is at a high - risk level, and there is a 97.5% probability that the risk score is higher than 7.07.

[0881] Step 6: Additional considerations

[0882] a) Time decay:

[0883] If the timestamp of the nearest neighbor node is old, a time - decay factor can be applied to adjust the risk score.

[0884] b) Multi - dimensional analysis:

[0885] If PriPLTree stores multiple metrics, the nearest - neighbor results of all relevant metrics can be comprehensively considered.

[0886] c) Anomaly pattern matching:

[0887] Compare the similarity of the current anomaly pattern with the patterns of historical high - risk events to further adjust the risk assessment.

[0888] Step 7: Continuous optimization

[0889] a) Dynamic update:

[0890] Insert the current assessment result into PriPLTree for future risk assessment.

[0891] Regularly clean up old data to keep the tree structure efficient.

[0892] b) Model verification:

[0893] Track actual security events to verify the accuracy of the risk assessment.

[0894] According to the verification results, adjust the structure of PriPLTree or the risk calculation model.

[0895] Through this process, the embodiments of the present invention efficiently retrieve historical data using PriPLTree, quickly evaluate the current risk level, and provide a confidence interval to quantify uncertainty. This method not only considers the current anomaly detection results but also utilizes the context of historical data to provide a more reliable and insightful risk assessment. The use of PriPLTree ensures query efficiency and data privacy, while the calculation of the confidence interval provides credibility information for risk assessment to decision-makers, helping to formulate more informed security policies.

[0896] S5.4: Automatically generate a security situation awareness report based on the risk score

[0897] Through this series of steps, the system can transform complex anomaly detection results into intuitive and actionable risk assessments and security situation reports. The use of the PriPLTree data structure not only improves the efficiency of data processing and querying but also enhances the protection of sensitive information. The multi-level risk scoring strategy ensures the comprehensiveness of the assessment, while the automated report generation greatly improves the efficiency and effectiveness of information transmission.

[0898] S6: Define threat levels and response levels based on the security situation awareness report and execute automated defenses

[0899] This is the last step and the most critical execution phase of the entire self-defense process. Based on the security situation awareness report generated in the previous steps, the system will automatically determine the threat level, formulate corresponding response strategies, and execute automated defense measures.

[0900] 1. Threat level definition:

[0901] Implement a multi-dimensional threat assessment model that comprehensively considers factors such as attack type, impact scope, and duration.

[0902] Design a dynamic threshold mechanism to adaptively adjust the threat level standard according to historical data and the current network environment.

[0903] Develop a threat level visualization tool to intuitively display different levels and types of threats.

[0904] 2. Response level determination:

[0905] Establish a threat response mapping matrix to associate different threat levels with corresponding defense measures.

[0906] Implement a context-aware response strategy generator that considers factors such as network topology and business importance.

[0907] Design a response conflict detection and resolution mechanism to ensure the coordination of multiple simultaneously executed response measures.

[0908] 3. Automated response execution:

[0909] Develop a response orchestration engine to automatically execute a series of predefined defense actions.

[0910] Implement a real-time feedback loop to continuously monitor the effectiveness of response measures and dynamically adjust them.

[0911] Design a rollback mechanism to quickly restore the system state when response measures produce unexpected results.

[0912] S6.1: Deploy a honeypot network

[0913] A honeypot is a proactive defense technique that attracts attackers by mimicking real systems, thereby diverting attacks and collecting threat intelligence.

[0914] Implement a dynamic honeypot generator to automatically create and configure honeypots based on the current network environment. Design a distributed honeypot network to deploy multiple honeypots in different network regions to form a collaborative defense system.

[0915] S6.2: Execute automated repair

[0916] Automated repair is one of the core functions of a self-defending system, which can quickly take action after detecting a threat to minimize potential damage.

[0917] 1. Vulnerability repair:

[0918] Implement an automated patch management system to automatically download and apply security updates based on threat intelligence.

[0919] Design virtual patching technology to provide temporary protection before official patches are released.

[0920] Develop a rollback mechanism to quickly restore the system when patches cause instability.

[0921] 2. Configuration correction:

[0922] Implement a security baseline checking tool to automatically identify and correct system configurations that deviate from security standards.

[0923] Design an intelligent firewall rule generator to dynamically adjust access control policies based on detected threats.

[0924] Develop a configuration version control system to track all configuration changes and support quick rollback.

[0925] 3. Malware removal:

[0926] Implement a behavior analysis-based malware detection engine to identify unknown or variant malicious programs.

[0927] Design a sandbox isolation environment to safely analyze and remove suspicious files.

[0928] Develop a system integrity repair tool to restore system files and the registry that have been tampered with by malware.

[0929] 4. Network isolation and recovery:

[0930] Implement an automated network segmentation technology to quickly isolate infected devices when a threat is detected.

[0931] Design a traffic redirection mechanism to direct suspicious traffic to a deep packet inspection system for analysis.

[0932] Develop a tool for automatic reconstruction of network topology to re-optimize the network structure after an attack to enhance security.

[0933] Through these automated defense and repair measures, the system can respond quickly after detecting a threat, greatly reducing the need for manual intervention and improving the defense efficiency. At the same time, the deployment of the honeypot network can not only disperse attacks but also provide valuable threat intelligence, further enhancing the defense capabilities of the entire system. This approach of combining active defense and passive defense can provide comprehensive and in-depth protection for network security.

[0934] As Figure 2 shown, an embodiment of the present invention also provides an information network security self-defense system 30 based on trusted computing, including:

[0935] A construction module 31 for constructing a trusted computing platform, where constructing the trusted computing platform includes deploying a trusted platform module TPM, establishing a trusted software stack TSS, and implementing a trusted network connection TNC;

[0936] A design module 32 for designing a self-defense architecture, where the self-defense architecture includes deploying defense systems for the network layer, application layer, and data layer, integrating an intelligent perception system, and establishing a central control and decision-making center;

[0937] A monitoring and preprocessing module 33 for monitoring network traffic and user access behavior and preprocessing embedded attack behaviors;

[0938] An anomaly detection module 34 for applying machine learning algorithms to perform anomaly detection on the network traffic and user access behavior;

[0939] A calculation module 35 for calculating a real-time risk score based on the anomaly detection results and generating a security situation awareness report;

[0940] A defense module 36 for defining threat levels and response levels based on the security situation awareness report and performing automated defense.

[0941] The above are only specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of various equivalent modifications or substitutions, and these modifications or substitutions should be covered within the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. An information network security self-defense method based on trusted computing, characterized in that: The method comprises: Constructing a trusted computing platform, wherein the trusted computing platform construction includes deploying a trusted platform module TPM, establishing a trusted software stack TSS, and implementing a trusted network connection TNC; Design a self-defense architecture, which includes deploying network layer, application layer and data layer defense systems, integrating intelligent perception systems and establishing a central control and decision-making center; Monitor network traffic and user access behavior, and pre-process embedded attack behaviors; Applying machine learning algorithms to perform anomaly detection on the network traffic and user access behavior; Based on the anomaly detection results, calculate a real-time risk score and generate a security situation awareness report; Based on the security situation awareness report, define the threat level and response level, and perform automated defense; Among them, monitoring network traffic and user access behavior, and pre-processing embedded attack behaviors, including: Get real-time data on network traffic and user access behavior; Use word frequency-based and semantic similarity-based pruning algorithms to preprocess and standardize real-time data on network traffic and user access behavior; Performing embedding vector analysis on the real-time data of the network traffic and user access behavior, and using an embedding clustering algorithm to identify abnormal embedding groups, and tracking the embedding trajectory of the abnormal embedding groups; Using an autoencoder model to learn the distribution of normal and abnormal embeddings, and using the learned autoencoder model to analyze the abnormal level of the abnormal embedding group; If the abnormal level exceeds a preset threshold, an embedding space cleaning algorithm is used to remove potential malicious disturbances, and an embedding projection technique is used to map the abnormal embedding group to a safe area.

2. The method according to claim 1, characterized in that The method further comprises: Use sensitive information detectors to identify potential information leaks; Use the attention mechanism to implement cross-layer attention consistency checks and identify potential attack traces; A gradient fluidity analysis tool is used to implement hidden state analysis of the abnormal embedding group and detect parameter updates of the abnormal embedding group.

3. The method according to claim 1, characterized in that Apply machine learning algorithms to perform anomaly detection on the network traffic and user access behavior, including: Extracting the control flow graph CFG of the network traffic and user access behavior; Extracting assembly instruction sequences and graph-level statistical features from the CFG, the statistical features including the number of nodes, the number of edges, and the average degree; Build a graph neural network (GNN) with adversarial domain adaptation; Training the GNN model and evaluating the domain adaptability of the GNN model; The assembly instruction sequence and statistical features in the CFG are input into the GNN model to perform anomaly detection on the drifted variants in the network traffic and user access behavior.

4. The method according to claim 3, characterized in that The GNN model is trained and the domain adaptability of the GNN model is evaluated, including: Design a domain classifier to distinguish between a source domain and a target domain, wherein the source domain is a known malicious attack and the target domain is a malicious attack after potential drift; Design a domain-invariant feature extractor to capture common features across domains; Obtain a historical data set, and divide the historical data set into a training set, a validation set, and a test set; Using the domain classifier, labeling source domain and target domain data in the historical data set; Construct the cross entropy loss function and the adversarial loss function of the domain classifier respectively, and perform weighted combination; Optimize model parameters using gradient descent; Implement early stopping strategy to prevent overfitting; Use the validation set to monitor the performance of the GNN model and adjust hyperparameters; Evaluate the GNN model performance on the test set; Evaluate the performance of the GNN model on the target domain, and optimize the GNN model based on the evaluation result.

5. The method according to claim 1, characterized in that: Calculates real-time risk scores and generates security situation awareness reports, including: Construct PriPLTree data structure; Define the security indicator PriPLTree; Define a risk calculation model based on the PriPLTree data structure, input the anomaly detection result into the risk calculation model, and obtain a risk score; Based on the risk score, a security situation awareness report is automatically generated.

6. The method according to claim 5, characterized in that The construction of the PriPLTree data structure includes: Design a one-dimensional PriPLTree data structure, including: Define a tree structure where each node contains piecewise linear function parameters; Using adaptive segmentation algorithm, nodes are dynamically adjusted according to data distribution; Use local differential privacy mechanism to protect sensitive information of each node; Design a multidimensional PriPLTree data structure, each dimension of the multidimensional PriPLTree uses a one-dimensional PriPLTree data structure; Define the security indicator PriPLTree, including: Define safety metrics; Construct a one-dimensional PriPLTree for each safety indicator; Integrate all safety indicators and construct a multidimensional PriPLTree.

7. The method according to claim 5, characterized in that Defining a risk calculation model based on the PriPLTree data structure, inputting the anomaly detection result into the risk calculation model, and obtaining a risk score, including: Identify trends and patterns in security indicators using the time series analysis module; Build a multi-level risk scoring strategy, including system-level, module-level and single indicator risk scoring strategies; After the anomaly detection result is input into the risk calculation model, PriPLTree data is used for retrieval to determine the closest query result, and the confidence interval of the query result is evaluated. The query result is the risk level and corresponding score that are closest to the anomaly detection result.

8. The method according to claim 1, characterized in that The automated defense includes deploying a honeypot network and automated repair.

9. An information network security self-defense system based on trusted computing, characterized in that: include: A construction module is used to construct a trusted computing platform, wherein the construction of the trusted computing platform includes deploying a trusted platform module TPM, establishing a trusted software stack TSS, and implementing a trusted network connection TNC; A design module for designing a self-defense architecture, which includes deploying network layer, application layer and data layer defense systems, integrating intelligent perception systems and establishing a central control and decision center; Monitoring and preprocessing module, used to monitor network traffic and user access behavior, and preprocess embedded attack behaviors; An anomaly detection module, used to apply a machine learning algorithm to perform anomaly detection on the network traffic and user access behavior; A calculation module, used to calculate a real-time risk score based on the anomaly detection result and generate a security situation awareness report; A defense module, used to define threat levels and response levels based on the security situation awareness report, and perform automated defense; The monitoring and preprocessing module is used to monitor network traffic and user access behavior and preprocess embedded attack behavior, including: Get real-time data on network traffic and user access behavior; Use word frequency-based and semantic similarity-based pruning algorithms to preprocess and standardize real-time data on network traffic and user access behavior; Performing embedding vector analysis on the real-time data of the network traffic and user access behavior, and using an embedding clustering algorithm to identify abnormal embedding groups, and tracking the embedding trajectory of the abnormal embedding groups; Using an autoencoder model to learn the distribution of normal and abnormal embeddings, and using the learned autoencoder model to analyze the abnormal level of the abnormal embedding group; If the abnormal level exceeds a preset threshold, an embedding space cleaning algorithm is used to remove potential malicious disturbances, and an embedding projection technique is used to map the abnormal embedding group to a safe area.

Images