Dynamic perception method and device for cyberspace security situation and electronic equipment

Abstract

The invention relates to the field of security monitoring, and particularly discloses a cyberspace security situation dynamic perception method, a cyberspace security situation dynamic perception device and electronic equipment.The method comprises the steps of firstly obtaining terminal log data collected by user terminal equipment and network security threat data collected by a server; the method comprises the following steps of: performing feature extraction and correlation analysis on the two data, and finally generating a network security situation risk report through a generator, thereby monitoring the network security condition in real time, detecting potential security threats and attack behaviors, and further making corresponding security decisions and countermeasures.

Description

Technical Field

[0001] The present application relates to the field of security monitoring, and more specifically, to a method, device and electronic device for dynamically sensing the security situation in cyberspace. Background Art

[0002] The network situation is the network status and change trend jointly shaped by multiple factors (such as the operation status of network equipment, network user behavior, etc.). Security situation awareness uses information fusion to comprehensively grasp the overall network security situation from a macro perspective, monitor and warn of threatening network nodes, dynamically defend against network security incidents, and provide decision support for the formulation of network security countermeasures.

[0003] With the popularization and development of the Internet, the security of cyberspace has become increasingly urgent. Although network firewalls and intrusion detection systems can enhance network security, there may be problems such as missed reports and false reports, resulting in security risks in cyberspace.

[0004] Therefore, a method, device and electronic device for dynamically perceiving the security situation in cyberspace are desired. Summary of the invention

[0005] In order to solve the above technical problems, this application is proposed. The embodiments of this application provide a method, device and electronic device for dynamic perception of cyberspace security situation, which first obtains terminal log data collected by user terminal devices and network security threat data collected by servers, then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally generates a network security situation risk report through a generator, so as to monitor the network security status in real time, detect potential security threats and attack behaviors, and then make corresponding security decisions and countermeasures.

[0006] According to one aspect of the present application, a method for dynamically perceiving cyberspace security situation is provided, which includes:

[0007] Obtain terminal log data collected by user terminal devices and network security threat data collected by servers;

[0008] Extracting a user terminal log semantic feature vector and a network security threat association feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server;

[0009] A network security situation risk report is generated based on the user terminal log semantic feature vector and the network security threat association feature vector.

[0010] According to another aspect of the present application, a network space security situation dynamic perception device is provided, which includes:

[0011] A security data acquisition module is used to acquire terminal log data collected by user terminal devices and network security threat data collected by the server;

[0012] A security data extraction module, used to extract a user terminal log semantic feature vector and a network security threat association feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server;

[0013] The security risk report generation module is used to generate a network security situation risk report based on the user terminal log semantic feature vector and the network security threat association feature vector.

[0014] According to another aspect of the present application, an electronic device is provided, comprising: a processor; and a memory, in which computer program instructions are stored, and when the computer program instructions are executed by the processor, the processor executes the method for dynamic perception of cyberspace security situation as described above.

[0015] Compared with the prior art, the present application provides a method, device and electronic device for dynamic perception of cyberspace security situation, which first obtains terminal log data collected by user terminal devices and network security threat data collected by servers, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally generates a network security situation risk report through a generator, thereby monitoring the network security status in real time, detecting potential security threats and attack behaviors, and then making corresponding security decisions and countermeasures. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] By describing the embodiments of the present application in more detail in conjunction with the accompanying drawings, the above and other purposes, features and advantages of the present application will become more apparent. The accompanying drawings are used to provide a further understanding of the embodiments of the present application and constitute a part of the specification. Together with the embodiments of the present application, they are used to explain the present application and do not constitute a limitation of the present application. In the accompanying drawings, the same reference numerals generally represent the same components or steps.

[0017] Figure 1 It is a flowchart of a method for dynamically perceiving cyberspace security situation according to an embodiment of the present application.

[0018] Figure 2 The present invention is a flowchart of extracting user terminal log semantic feature vectors and network security threat association feature vectors from the terminal log data collected by the user terminal device and the network security threat data collected by the server in the method for dynamic perception of cyberspace security situation according to an embodiment of the present application.

[0019] Figure 3The present invention is a flowchart of performing semantic encoding on the terminal log data collected by the user terminal device to obtain multiple user terminal log feature vectors in the method for dynamic perception of cyberspace security situation according to an embodiment of the present application.

[0020] Figure 4 The present invention is a flowchart of performing feature encoding on the multiple user terminal log feature vectors to obtain the user terminal log semantic feature vector in the method for dynamic perception of cyberspace security situation according to an embodiment of the present application.

[0021] Figure 5 It is a block diagram of a device for dynamically perceiving cyberspace security situation according to an embodiment of the present application.

[0022] Figure 6 is a block diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0023] Below, the exemplary embodiments according to the present application will be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application, and it should be understood that the present application is not limited to the exemplary embodiments described here.

[0024] Exemplary Methods

[0025] Figure 1 Flowchart of a method for dynamically perceiving cyberspace security situation according to an embodiment of the present application. Figure 1 As shown, according to the method for dynamic perception of cyberspace security situation in an embodiment of the present application, it includes: S110, acquiring terminal log data collected by a user terminal device and network security threat data collected by a server; S120, extracting a user terminal log semantic feature vector and a network security threat association feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server; S130, generating a network security situation risk report based on the user terminal log semantic feature vector and the network security threat association feature vector.

[0026] In the above-mentioned method for dynamically perceiving the security situation of cyberspace, the step S110 obtains the terminal log data collected by the user terminal device and the network security threat data collected by the server, wherein the terminal log data collected by the user terminal device includes flow data, security log and audit log, and the network security threat data collected by the server includes monitoring data, virus data and asset data. It should be understood that the security situation of cyberspace is a comprehensive manifestation and dynamic change trend of security events, threats and risks in the network environment. In order to ensure the safe and stable operation of network systems and data, it is necessary to comprehensively assess security risks and take corresponding measures. Although tools such as network firewalls and intrusion detection systems have been used to strengthen network security, these measures are not absolutely perfect and may have problems such as underreporting and false positives. Therefore, the technical solution of the present application combines the log data collected by the user terminal device and the network security threat data collected by the server, and uses deep learning technology to generate a network security situation risk report to more effectively identify and respond to the challenges of network security risks. Among them, the terminal log data collected by the user terminal device covers flow data, security logs and audit logs, which record the activities of the user device, network traffic and the occurrence of security events. Traffic data can reveal the communication mode and frequency of the device, security logs record the security status of the device and possible security threats, and audit logs track detailed information on system and user operations, which helps track potential security issues and abnormal behaviors. The network security threat data collected by the server includes monitoring data, virus data, and asset data. Monitoring data provides information on network traffic analysis and anomaly detection, which can help identify potential attack behaviors and security vulnerabilities. Virus data contains the latest virus sample information and malware features, which helps to update protection measures and identify malicious activities in a timely manner. Asset data records various asset information in the network, including equipment, software, and services, providing basic data for security situation analysis. In this way, it is possible to achieve comprehensive perception and analysis of the network security situation, timely discover potential security threats and risks, take targeted protection measures and response strategies, and improve the effectiveness and timeliness of network security protection.

[0027] In the above-mentioned method for dynamically perceiving the security situation in cyberspace, the step S120 extracts the user terminal log semantic feature vector and the network security threat associated feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server. It should be understood that the extraction of the user terminal log semantic feature vector involves processing the terminal log data to capture the semantic information contained therein. Extracting the user terminal log semantic feature vector and the network security threat associated feature vector can more comprehensively understand the network security situation, identify potential security threats, and provide a reliable basis for security decision-making.

[0028] Figure 2 The present invention is a flowchart of extracting user terminal log semantic feature vectors and network security threat associated feature vectors from the terminal log data collected by the user terminal device and the network security threat data collected by the server in the method for dynamic perception of network space security situation according to an embodiment of the present application. Figure 2 As shown, in a specific embodiment of the present application, the step S120 includes: S121, semantically encoding the terminal log data collected by the user terminal device to obtain multiple user terminal log feature vectors; S122, feature encoding the multiple user terminal log feature vectors to obtain the user terminal log semantic feature vector; S123, semantically encoding the network security threat data collected by the server to obtain the network security threat associated feature vector. It should be understood that the original terminal log data can be converted into a representation with semantic information through semantic encoding. This includes parsing, standardizing and structuring the log data to extract meaningful features from it. Semantic encoding can involve natural language processing technology, text mining algorithms and other methods to convert text information in the log into a form that can be understood and processed by a computer. By generating multiple user terminal log feature vectors, the behavior and activity characteristics of the user terminal device can be more comprehensively characterized. These feature vectors can include information on multiple aspects such as the network communication mode of the device, the usage of the application, and the user operation behavior. By combining these feature vectors, a more comprehensive and accurate user behavior model can be constructed, which helps to detect abnormal behavior and security threats.

[0029] Furthermore, in the field of network security, user terminal log data contains rich information, such as device activities, network traffic, and security events. By extracting and encoding features from these data, we can better understand the behavior patterns and security status of user terminal devices. The feature encoding process involves converting the original multiple user terminal log feature vectors into more representative and interpretable user terminal log semantic feature vectors. The process of generating such feature vectors usually includes steps such as feature selection, dimensionality reduction, and feature conversion, aiming to extract the most informative features and eliminate redundant information between features, so as to better capture the essential characteristics of the data. Through feature encoding, the original multi-dimensional feature vector can be mapped to a lower-dimensional feature space while retaining the key information of the data. This helps to simplify the complexity of data analysis and model training, and improve the efficiency and performance of the algorithm.

[0030] Furthermore, by generating cybersecurity threat correlation feature vectors, the correlation and connection between different threat data can be more comprehensively characterized. These feature vectors can include information on threat type, attack source, affected system, and other aspects. By integrating these feature vectors, a more comprehensive and accurate cybersecurity threat correlation model can be constructed, which will help identify and respond to complex threat events, thereby improving the security team's perception of threat events, strengthening the correlation analysis of security events and the integration of threat intelligence, so as to more timely discover and respond to potential security threats and ensure the safe and stable operation of network systems.

[0031] Figure 3 The present invention is a flowchart of semantically encoding the terminal log data collected by the user terminal device to obtain multiple user terminal log feature vectors in the method for dynamic perception of cyberspace security situation according to an embodiment of the present application. Figure 3 As shown, in a specific embodiment of the present application, the step S121 includes: S1211, segmenting the terminal log data collected by the user terminal device to obtain a user terminal log word sequence; S1212, passing the user terminal log word sequence through a user terminal log context encoder containing an embedding layer to obtain the multiple user terminal log feature vectors. It should be understood that in the field of information security and data analysis, the terminal log data contains a large amount of text information, and these text data can be converted into a form that is easier to process and understand through word segmentation. Among them, word segmentation is the process of dividing continuous text data into meaningful words or phrases according to certain rules. Segmenting the user terminal log data can split the original text information into a sequence of words or phrases, so as to better capture the semantic information and features in the text data. This helps to identify key words, phrases and entities, and helps to understand the operating behavior, event occurrence and security status of the user terminal device. Through word segmentation, text data can be effectively cleaned and standardized, irrelevant information and noise can be removed, and key content in the text data can be extracted. The final user terminal log word sequence can be used as the basic representation of text data to better understand and utilize text information, providing more accurate and comprehensive support for security event detection, behavior analysis, and security decision-making.

[0032] Furthermore, the embedding layer in the user terminal log context encoder including the embedding layer is used to map discrete vocabulary representations into a continuous high-dimensional vector space. Through the embedding layer, each word will be represented as a dense word embedding vector, which can capture the semantic and grammatical relationship between words, so as to map each word into a real number vector, thereby forming a continuous representation form. The function of the user terminal log context encoder is to convert the word embedding sequence output by the embedding layer into a higher-level semantic representation. Through the processing of the encoder, the user terminal log word sequence is converted into a plurality of user terminal log feature vectors, each of which contains semantic information and context associations within a certain window range. Specifically, the embedding layer of the user terminal log context encoder including the embedding layer is used to map each word in the user terminal log word sequence to a word embedding vector to obtain a sequence of terminal log word embedding vectors; the converter-based Bert model of the user terminal log context encoder including the embedding layer is used to perform global context semantic encoding on the sequence of terminal log word embedding vectors to obtain a plurality of user terminal log feature vectors.

[0033] Figure 4 This is a flowchart of performing feature encoding on the plurality of user terminal log feature vectors to obtain the user terminal log semantic feature vector in the method for dynamic perception of cyberspace security situation according to an embodiment of the present application. Figure 4 As shown, in a specific embodiment of the present application, the step S122 includes: S1221, arranging the multiple user terminal log feature vectors in one dimension to obtain a user terminal log associated feature vector; S1222, passing the user terminal log associated feature vector through a user terminal log word granularity feature encoder to obtain the user terminal log semantic feature vector. It should be understood that through one-dimensional arrangement, multiple feature vectors are connected together in a certain order to form a longer vector. Doing so helps to retain the order information in the original feature vector, while integrating the correlation between different features into a higher dimensional vector. This merging operation can help the model better understand and utilize the correlation between different features in the user terminal log data, and improve the richness and characterization ability of the data representation. The generation process of the user terminal log associated feature vector can integrate and encode the original multiple feature vectors, so as to better capture the global information and contextual associations in the user terminal log data.

[0034] Furthermore, considering that the user terminal log associated feature vector is a one-dimensional vector composed of feature vectors of multiple words, these feature vectors will be further processed and integrated through the user terminal log word granularity feature encoder to obtain the semantic information of the entire user terminal log data. The word granularity feature encoder usually considers the contextual relationship and context information between words, so as to better capture the semantic connection between words and the meaning of the text as a whole. Specifically, each layer of the user terminal log word granularity feature encoder is used to perform convolution processing, pooling processing and non-linear activation processing on the input data in the forward pass of the layer to output the user terminal log semantic feature vector by the last layer of the user terminal log word granularity feature encoder, wherein the input of the user terminal log word granularity feature encoder is the user terminal log associated feature vector.

[0035] In a specific embodiment of the present application, the step S123 includes: encoding the network security threat data collected by the server through word embedding to obtain a network security threat embedding vector; and passing the network security threat embedding vector through a network security threat text context semantic encoding model to obtain the network security threat associated feature vector. It should be understood that word embedding encoding is a technology that maps vocabulary to a continuous vector space, which is used to convert text data into a form that can be understood and processed by a computer. Through word embedding encoding, each word is represented as a dense vector, so that words with similar semantics are closer to each other in the vector space. This representation method allows the computer to better understand the relationship between words, for example, by calculating the distance between vectors to find semantically similar words. Common word embedding models include Word2Vec, GloVe, and FastText. Among them, the role of word embedding encoding is to convert the vocabulary in the network security threat data into dense vector representations, which can capture the semantic and grammatical relationships between words. Through word embedding encoding, each word is mapped to a real number vector, so that the vocabulary in the network security threat data can be represented in a continuous vector space, thereby better reflecting the similarity and correlation between words.

[0036] Furthermore, the network security threat embedding vector is a numerical vector representation obtained after word embedding encoding of the network security threat data. Through the network security threat text context semantic encoding model, these embedding vectors will be further processed and transformed to capture the semantic information of the entire network security threat data. The model usually considers the contextual relationship, context information and sentence structure of the vocabulary in the network security text data, so as to more comprehensively understand the semantic content of the text. This helps the system to more comprehensively understand and analyze the network security threat data, thereby improving the accuracy and efficiency of security threat detection and response. Specifically, the network security threat embedding vector is subjected to temporal global context semantic encoding based on the converter-based Bert model of the network security threat text context semantic encoding model to obtain multiple threat feature vectors; and, the multiple threat feature vectors are cascaded to obtain the network security threat association feature vector.

[0037] In the above-mentioned method for dynamic perception of cyberspace security situation, the step S130 generates a network security situation risk report based on the user terminal log semantic feature vector and the network security threat association feature vector. It should be understood that the user terminal log semantic feature vector contains the semantic information of the user terminal activity, reflecting the user's operation behavior, access records and application usage on the terminal device. These feature vectors can help the system understand the user's activity pattern and behavior habits by semantically encoding and representing the user behavior data, thereby detecting abnormal activities and potential security risks. The network security threat association feature vector contains the semantic representation and association characteristics of the network security threat data, reflecting the correlation and importance between different threat events. Through these feature vectors, the system can better understand the characteristics and trends of network security threats, identify possible threat sources and attack methods, and provide timely threat intelligence and risk assessment for the security team. Comprehensive user terminal log semantic feature vectors and network security threat association feature vectors, generating a network security situation risk report can comprehensively analyze user activities and security threat information, help the system identify potential security risks and threat events, so as to help organizations take effective security measures in a timely manner, strengthen the security protection of information systems and data, and ensure the normal operation of business and the integrity of data. Through such risk reports, organizations can better respond to complex and changing cybersecurity threats and improve their overall security protection and response capabilities.

[0038] In a specific embodiment of the present application, the step S130 includes: fusing the user terminal log semantic feature vector and the network security threat associated feature vector to obtain a network security situation feature vector; performing spatial sparsity-restricted implicit group optimization on the network security situation feature vector to obtain an optimized network security situation feature vector; passing the optimized network security situation feature vector through a generator to generate a network security situation risk report. It should be understood that fusing the user terminal log semantic feature vector and the network security threat associated feature vector can comprehensively consider the association between user behavior and potential threats, thereby more comprehensively evaluating the network security situation and taking corresponding defense measures. This fusion process combines user activity data and network security threat information, allowing the system to more accurately identify potential risks and respond in a timely manner. By fusing the user terminal log semantic feature vector and the network security threat associated feature vector, the system can comprehensively consider the correlation between user behavior and security threats. The fused network security situation feature vector combines user activity data and security threat information, and can more comprehensively describe the security status of the network environment. This comprehensive feature vector can help the system more accurately identify potential security risks, respond quickly and take corresponding security protection measures, thereby improving the efficiency and accuracy of network security defense. By integrating the semantic feature vectors of user terminal logs and the network security threat association feature vectors, the system can better cope with complex and changing network security threats and ensure the security of network security and user data.

[0039] In particular, in the technical solution of the present application, it is considered that the terminal log data collected by the user terminal device and the network security threat data collected by the server may have problems such as low data quality and lack of diversity, resulting in insufficient information contained in the network security situation feature vector. In this case, the information aggregation degree is not high, and it is impossible to fully reflect the activity or network security situation. In addition, during the data processing process, information may be lost or deformed, especially in the process of data segmentation, embedding and encoding. If these steps are not handled properly, it may lead to the loss or distortion of important information, thereby affecting the information aggregation degree of the network security situation feature vector. Further, it is considered that there may be incomplete information integration between the user terminal log data and the network security threat data. If there is a lack of effective integration and association between the data sources, the information aggregation degree of the network security situation feature vector will be affected, and it is impossible to fully reflect the comprehensive situation of the activity and network security situation. In order to solve the problem of low information aggregation degree of the network security situation feature vector, in the technical solution of the present application, the network security situation feature vector is subjected to implicit group optimization with spatial sparsity restrictions.

[0040] Specifically, performing implicit group optimization with spatial sparsity restriction on the network security situation feature vector to obtain an optimized network security situation feature vector includes:

[0041] The implicit group optimization factor of the spatial sparsity restriction of the network security situation feature vector is calculated by the following optimization formula, wherein the optimization formula is:

[0042]

[0043] Among them, v c represents the network security situation feature vector, σ(v c ) represents the variance of the eigenvalue set of the network security situation feature vector, v i is the eigenvalue of each position in the network security situation feature vector, and L is the length of the network security situation feature vector, and ||v c || 1 represents a norm of the network security situation feature vector, w is an implicit group optimization factor constrained by the spatial sparsity of the network security situation feature vector; and

[0044] The network security situation feature vector is weighted by using the implicit group optimization factor of the spatial sparsity restriction as a weight to obtain the optimized network security situation feature vector.

[0045] Here, the network security situation feature vector is subjected to implicit group optimization with spatial sparsity restrictions, which evaluates the fitness of each particle in the network security situation feature vector in a high-dimensional feature space, and updates the network security situation feature vector according to the optimal solution of each particle in the network security situation feature vector and the group optimal solution to satisfy the updated network security situation feature vector to satisfy the spatial sparsity restriction, thereby enhancing the aggregation degree of the feature manifold of the network security situation feature vector by restoring the basic information in the full-precision information representation space, thereby improving the expression effect of the network security situation feature vector.

[0046] Furthermore, the generator can quickly and accurately analyze large amounts of data, discover security threats hidden in massive amounts of information, and help security teams formulate effective security response strategies in a timely manner. The network security situation risk report generated by the generator can automatically analyze and summarize large amounts of data, reduce the workload of the security team, improve work efficiency, and update based on real-time data to promptly reflect changes in the network security situation, helping organizations to adjust security strategies in a timely manner, so as to provide smarter and more comprehensive security risk assessments, help organizations to respond to various network security threats in a timely manner, and ensure the security of information systems and data.

[0047] In summary, the embodiment of the present application first obtains the terminal log data collected by the user terminal device and the network security threat data collected by the server, and then uses deep learning technology to perform feature extraction and correlation analysis on the two, and finally generates a network security situation risk report through a generator, so as to monitor the network security status in real time, detect potential security threats and attack behaviors, and then make corresponding security decisions and countermeasures.

[0048] Exemplary Systems

[0049] Figure 5 FIG. 1 is a block diagram of a network space security situation dynamic perception device according to an embodiment of the present application. Figure 5 As shown, according to the embodiment of the present application, the network space security situation dynamic perception device 100 includes: a security data acquisition module 110, which is used to obtain terminal log data collected by the user terminal device and network security threat data collected by the server; a security data extraction module 120, which is used to extract the user terminal log semantic feature vector and the network security threat association feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server; a security risk report generation module 130, which is used to generate a network security situation risk report based on the user terminal log semantic feature vector and the network security threat association feature vector.

[0050] As described above, the cyberspace security situation dynamic perception device 100 according to the embodiment of the present application can be implemented in various terminal devices, such as a server deployed with a cyberspace security situation dynamic perception algorithm. In one example, the cyberspace security situation dynamic perception device 100 can be integrated into the terminal device as a software module and / or a hardware module. For example, the cyberspace security situation dynamic perception device 100 can be a software module in the operating system of the terminal device, or it can be an application developed for the terminal device; of course, the cyberspace security situation dynamic perception device 100 can also be one of the many hardware modules of the terminal device.

[0051] Alternatively, in another example, the cyberspace security situation dynamic perception device 100 and the terminal device may also be separate devices, and the cyberspace security situation dynamic perception device 100 may be connected to the terminal device via a wired and / or wireless network, and transmit interactive information in accordance with an agreed data format.

[0052] Here, those skilled in the art can understand that the specific operations of each step in the above-mentioned network space security situation dynamic perception device have been referred to above. Figures 1 to 4The method for dynamic perception of cyberspace security situation has been introduced in detail in the description of the method, and therefore, its repeated description will be omitted.

[0053] Exemplary Electronic Devices

[0054] Below, reference Figure 6 To describe an electronic device according to an embodiment of the present application.

[0055] like Figure 6 As shown, the electronic device 10 includes an input device 11, an input interface 12, a central processing unit 13, a memory 14, an output interface 15, an output device 16, and a bus 17. The input interface 12, the central processing unit 13, the memory 14, and the output interface 15 are connected to each other through the bus 17, and the input device 11 and the output device 16 are connected to the bus 17 through the input interface 14 and the output interface 15, respectively, and then connected to other components of the electronic device 10.

[0056] Specifically, the input device 11 receives input information from the outside and transmits the input information to the central processing unit 13 through the input interface 12; the central processing unit 13 processes the input information based on the computer executable instructions stored in the memory 14 to generate output information, temporarily or permanently stores the output information in the memory 14, and then transmits the output information to the output device 16 through the output interface 15; the output device 16 outputs the output information to the outside of the electronic device 10 for user use.

[0057] In one embodiment, Figure 6 The electronic device 10 shown can be implemented as a network device, which may include: a memory configured to store programs; a processor configured to run the programs stored in the memory to execute any one of the methods for dynamic perception of cyberspace security situation described in the above embodiments.

[0058] According to an embodiment of the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, an embodiment of the present application includes a computer program product, which includes a computer program tangibly contained on a machine-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network, and / or installed from a removable storage medium.

[0059] It will be appreciated by those skilled in the art that all or some of the steps, systems, and functional modules / units in the methods disclosed above may be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementations, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, a physical component may have multiple functions, or a function or step may be performed by several physical components in cooperation. Some or all physical components may be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or implemented as hardware, or implemented as an integrated circuit, such as an application-specific integrated circuit. Such software may be distributed on a computer-readable medium, which may include a computer storage medium (or non-transitory medium) and a communication medium (or temporary medium). As known to those skilled in the art, the term computer storage medium includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storing information (such as computer-readable instructions, data structures, program modules, or other data). Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and can be accessed by a computer. In addition, it is well known to those skilled in the art that communication media typically contain computer-readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and may include any information delivery media.

[0060] It is to be understood that the above embodiments are merely exemplary embodiments used to illustrate the principles of the present application, but the present application is not limited thereto. For those skilled in the art, various modifications and improvements can be made without departing from the spirit and substance of the present application, and these modifications and improvements are also considered to be within the scope of protection of the present application.

Claims

1. A method for dynamically perceiving cyberspace security situation, characterized in that: include: Obtain terminal log data collected by user terminal devices and network security threat data collected by servers; Extracting a user terminal log semantic feature vector and a network security threat association feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server; A network security situation risk report is generated based on the user terminal log semantic feature vector and the network security threat association feature vector.

2. The method for dynamic perception of cyberspace security situation according to claim 1 is characterized in that: Extracting a user terminal log semantic feature vector and a network security threat associated feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server, including: Performing semantic coding on the terminal log data collected by the user terminal device to obtain a plurality of user terminal log feature vectors; Performing feature encoding on the plurality of user terminal log feature vectors to obtain the user terminal log semantic feature vector; The network security threat data collected by the server is semantically encoded to obtain the network security threat associated feature vector.

3. The method for dynamic perception of cyberspace security situation according to claim 2 is characterized in that: The terminal log data collected by the user terminal device is semantically encoded to obtain a plurality of user terminal log feature vectors, including: Segmenting the terminal log data collected by the user terminal device to obtain a user terminal log word sequence; The user terminal log word sequence is passed through a user terminal log context encoder including an embedding layer to obtain the multiple user terminal log feature vectors.

4. The method for dynamic perception of cyberspace security situation according to claim 3 is characterized in that: Performing feature encoding on the plurality of user terminal log feature vectors to obtain the user terminal log semantic feature vector includes: Arranging the plurality of user terminal log feature vectors in one dimension to obtain a user terminal log associated feature vector; The user terminal log associated feature vector is passed through a user terminal log word granularity feature encoder to obtain the user terminal log semantic feature vector.

5. The method for dynamic perception of cyberspace security situation according to claim 4 is characterized in that: Semantically encoding the network security threat data collected by the server to obtain the network security threat associated feature vector includes: The network security threat data collected by the server is encoded by word embedding to obtain a network security threat embedding vector; The network security threat embedding vector is passed through a network security threat text context semantic encoding model to obtain the network security threat associated feature vector.

6. The method for dynamic perception of cyberspace security situation according to claim 5 is characterized in that: Generate a network security situation risk report based on the user terminal log semantic feature vector and the network security threat association feature vector, including: The user terminal log semantic feature vector and the network security threat association feature vector are merged to obtain a network security situation feature vector; Performing spatial sparsity-restricted implicit group optimization on the network security situation feature vector to obtain an optimized network security situation feature vector; The optimized network security situation feature vector is passed through a generator to generate a network security situation risk report.

7. The method for dynamic perception of cyberspace security situation according to claim 6 is characterized in that: Performing implicit group optimization with spatial sparsity restriction on the network security situation feature vector to obtain an optimized network security situation feature vector, including: The implicit group optimization factor of the spatial sparsity restriction of the network security situation feature vector is calculated by the following optimization formula, wherein the optimization formula is: Among them, v c represents the network security situation feature vector, σ(v c ) represents the variance of the eigenvalue set of the network security situation feature vector, v i is the eigenvalue of each position in the network security situation feature vector, and L is the length of the network security situation feature vector, and ||v c ||1 represents a norm of the network security situation feature vector, w is an implicit group optimization factor constrained by the spatial sparsity of the network security situation feature vector; and The network security situation feature vector is weighted by using the implicit group optimization factor of the spatial sparsity restriction as a weight to obtain the optimized network security situation feature vector.

8. A network space security situation dynamic perception device, characterized in that: include: A security data acquisition module is used to acquire terminal log data collected by user terminal devices and network security threat data collected by the server; A security data extraction module, used to extract a user terminal log semantic feature vector and a network security threat association feature vector from the terminal log data collected by the user terminal device and the network security threat data collected by the server; The security risk report generation module is used to generate a network security situation risk report based on the user terminal log semantic feature vector and the network security threat association feature vector.

9. The method for dynamic perception of cyberspace security situation according to claim 8, characterized in that: The security data extraction module comprises: Performing semantic coding on the terminal log data collected by the user terminal device to obtain a plurality of user terminal log feature vectors; Performing feature encoding on the plurality of user terminal log feature vectors to obtain the user terminal log semantic feature vector; The network security threat data collected by the server is semantically encoded to obtain the network security threat associated feature vector.

10. An electronic device, characterized in that: include: at least one processor; And, a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the method for dynamic perception of cyberspace security situation as described in any one of claims 1 to 7.

Images