A security monitoring system based on knowledge graph and multimodal information

Abstract

The present invention discloses a security monitoring system based on knowledge graph and multimodal information, which specifically relates to the technical field of network node management, including building a deep learning model based on a convolutional neural network, using the trained deep learning model to predict the set of state values ​​of all network nodes at the next moment, and outputting a node state risk index by analyzing a fused fault state category matrix of the network nodes at the next moment; building a fault handling knowledge graph, inputting fault information into the fault handling knowledge graph, and outputting a fault theoretical handling operation; outputting a fault handling performance index by analyzing the fault theoretical handling operation and actual fault handling information; jointly analyzing the node state risk index, the fault handling performance index and the prediction accuracy, outputting a node risk control coefficient, taking measures based on the relationship between the node risk control coefficient and a threshold, and solving the problem that the prior art lacks node fault prediction in computer networks.

Description

Technical Field

[0001] The present invention relates to the field of network node management technology, and more specifically, to a security monitoring system based on knowledge graph and multimodal information. Background Art

[0002] In the current network environment, the security and stability of network nodes are crucial to the operation of the entire network system. As a structured knowledge base, the knowledge graph can efficiently integrate and analyze relevant information of network nodes, including fault information, actual fault handling information, etc. By constructing a knowledge graph of network nodes, the system can have a more comprehensive understanding of the status and operation of network nodes, so as to promptly discover potential safety hazards and fault points. At the same time, the multimodal information security monitoring system can collect and analyze the log information, traffic data, etc. of network nodes in real time, further improving the monitoring accuracy and real-time performance of network nodes.

[0003] However, it still has many shortcomings in actual use, such as the lack of efficient and intelligent monitoring solutions for network security monitoring, which are specifically reflected in:

[0004] With the continuous development of network technology, the number and types of network nodes are increasing, and the log information and data generated are becoming increasingly large and complex. Traditional monitoring methods are unable to cope with these multimodal information; existing security monitoring systems lack efficient information extraction and analysis methods when processing multimodal information. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a security monitoring system based on knowledge graph and multimodal information to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above object, the present invention provides the following technical solution: a security monitoring system based on knowledge graph and multimodal information, comprising:

[0007] A network node data collection module is used to collect log information of network nodes, wherein the log information includes at least: fault information and actual fault handling information, wherein the fault information includes a timestamp of the fault occurrence, an IP address of the corresponding network node, and a description of the network node status;

[0008] The node status prediction module builds a deep learning model based on a convolutional neural network, records the prediction accuracy YPR of the deep learning model, and uses the trained deep learning model to predict the state value set of all network nodes at the next moment to obtain the fused fault state category matrix of the network nodes at the next moment;

[0009] The node fault risk analysis module outputs the node status risk index by analyzing the fusion fault status category matrix of the network node at the next moment;

[0010] The fault handling knowledge graph building module establishes a mapping between fault information and fault handling operations, builds a fault handling knowledge graph, inputs fault information into the fault handling knowledge graph, and outputs fault theoretical handling operations;

[0011] The fault handling performance analysis module outputs the fault handling performance index by analyzing the theoretical fault handling operations and actual fault handling information;

[0012] The risk control performance evaluation module jointly analyzes the node status risk index, fault handling performance index and prediction accuracy YPR, and outputs the node risk control coefficient Fk; it is calculated by the formula Node risk control coefficient Fk, where exp represents a natural exponential function, which is used to control the nonlinear degree of the impact of prediction accuracy on the node risk control coefficient; is an adjustment factor used to adjust the impact of prediction accuracy on the node risk control coefficient;

[0013] The risk control performance judgment module determines whether the threshold of the node risk control coefficient is within the normal range. If the node risk control coefficient is higher than the threshold, it indicates that the current risk control measures are effective and no measures are taken; otherwise, an early warning is issued to indicate that the risk is abnormal, indicating that the risk status of the network node is uncontrollable, and it is suggested to increase the supervision resources and maintenance resources of the network node to improve the fault handling performance.

[0014] Preferably, the network node that needs to collect log information is connected through the configured IP address and port number parameters, and the log information is obtained from the network node in real time or periodically using the log collector. The collected log information is cleaned, deduplicated, and formatted for preprocessing to ensure the accuracy and consistency of the data; the preprocessed log information is stored in the database, and the log information is obtained by calling the API interface. Once an abnormality is found in the collection task, it should be processed and restored in a timely manner.

[0015] Preferably, the deep learning model includes a first prediction model, a second prediction model and a fusion unit;

[0016] The first prediction model uses the short-term fault state category matrix to predict the state value set of all network nodes at the next moment;

[0017] Based on the output of the first prediction model, the input data of the second prediction model is interpolated to predict the state value set of all network nodes at the next moment;

[0018] The fusion unit is used to fuse the prediction results of the first prediction model and the second prediction model, and output the fusion fault state category matrix of the network node at the next moment; through the formula The fused fault state category matrix of the next moment is calculated, where Q1 represents the weight coefficient of the first prediction model and Q2 represents the weight coefficient of the second prediction model.

[0019] Preferably, the short-term fault status category matrix is ​​a fault status category matrix composed of fault status information of all network nodes in the previous moment or previous moments; the first prediction model satisfies the following formula, Among them, m is the time step number, that is, the first m moments, z k represents the row vector at the kth moment in the state matrix z, p k+1 represents the set of state values ​​of all network nodes at the next moment predicted by the first prediction model, and θ represents the correction constant.

[0020] Preferably, the input of the second prediction model is the combined concatenation of the input and output of the first prediction model, and m prediction state matrices are inserted into the state matrix of the previous m moments, which are respectively recorded as , the second prediction model satisfies the formula, .

[0021] Preferably, the deep learning model is obtained in the following manner:

[0022] Step S11, log information extraction: extracting the log information of the computer network node from the database;

[0023] Step S12, key feature extraction: using regular expressions to extract key features from log information, including timestamp, network node IP address, and network node status description information; performing semantic analysis on the network node status description information, making a status evaluation, and obtaining a corresponding status category;

[0024] Step S13, constructing a fault state category matrix: combining the fault state categories of all network nodes into a state vector, representing the fault state categories of all network nodes at a certain moment; combining the state vectors at all moments into a fault state category matrix for subsequent time series prediction;

[0025] Step S14, data preprocessing: performing forward state filling on the fault state category matrix to deal with the problem of time sparseness of log information, and dividing the data into training set and test set;

[0026] Step S15, model training: building a deep learning model based on the structure of the recurrent neural network and the fully connected layer, and sending the training set to the deep learning model for training;

[0027] Step S16, model evaluation and optimization: Use the cross entropy loss function as the loss function of the deep learning model, update the parameters of the deep learning model through the gradient descent algorithm to minimize the loss function, use the prediction accuracy YPR indicator to evaluate the performance of the deep learning model, and optimize it to output the trained deep learning model.

[0028] Preferably, the node status risk index is obtained in the following manner:

[0029] Analyze the fault status category matrix of the network nodes at the next moment to obtain the number of faulty network nodes and the corresponding fault status categories;

[0030] Suppose there are n faulty network nodes, and i represents the sequential number of the faulty network nodes;

[0031] The weight coefficient of the ith network node is recorded as q_i, and the fault status category score corresponding to the ith faulty network node is recorded as gp_i; through the formula The node status risk index Gz is calculated.

[0032] Preferably, the fault handling performance index is obtained in the following manner:

[0033] Obtain fault information and actual fault handling information from the log information, where the actual fault handling information includes the actual fault handling operation and the actual response time;

[0034] By comparing the differences between actual fault handling information and theoretical fault handling operations, the fault handling performance index Gx is output.

[0035] Preferably, assuming that there are s faults in the log information, j is used to represent the sequence number of the faults;

[0036] The theoretical fault handling operation, theoretical response time, actual fault handling operation and actual response time of the jth fault are recorded as Ca_j, Cb_j, Ta_j, Tb_j respectively;

[0037] The fault handling performance index Gx is calculated by the following formula: in, The function is used to get the minimum value of the values ​​in brackets. is a piecewise function. When the theoretical fault processing operation of the j-th fault category is the same as the actual fault processing operation of the j-th fault, the value is 1, otherwise the value is 0. gp_j represents the fault status category score corresponding to the j-th fault.

[0038] Preferably, measures are taken based on the node status risk index Gz. If the node status risk index Gz exceeds the threshold, it indicates that the risk status of the network node is uncontrollable. The operating status of the network node is monitored in real time, and potential faults are discovered and warned in time. According to the load conditions of the network nodes and fault handling requirements, resource allocation is dynamically adjusted to ensure sufficient resource support during the fault handling process. Through automated tools and process optimization, the manual operations of operation and maintenance personnel during the fault handling process are reduced to shorten the response time.

[0039] Preferably, the security monitoring system further includes:

[0040] Real-time monitoring and alarm module, used to monitor the status of network nodes in real time. Once an abnormality or potential risk is found, the alarm mechanism is immediately triggered to notify relevant personnel to handle it;

[0041] Visual display module: Displays the status of network nodes, node status risk index, and fault handling performance index information through a graphical interface, allowing operation and maintenance personnel to intuitively understand the network status;

[0042] Knowledge graph management module: used to manage the knowledge graph, including the knowledge graph opinion generation unit and the knowledge graph update unit;

[0043] The knowledge graph opinion generation unit provides intelligent suggestions based on the risk analysis results, such as optimizing network configuration, adding redundant equipment, etc., to improve the stability and security of the network.

[0044] The knowledge graph updating unit continuously updates the node association relationship and fault propagation model information in the knowledge graph as the operation and data are accumulated, so as to improve the accuracy and reliability of the knowledge graph.

[0045] Technical effects and advantages of the present invention:

[0046] (1) The security monitoring system based on knowledge graph and multimodal information provided by the present invention builds a deep learning model based on a convolutional neural network, records the prediction accuracy YPR of the deep learning model, uses the trained deep learning model to predict the set of state values ​​of all network nodes at the next moment, and obtains the fused fault state category matrix of the network nodes at the next moment; through the comprehensive use of knowledge graph, multimodal information and deep learning technology, it realizes the effective prediction of network node failures, risk assessment, fault handling under knowledge guidance, performance evaluation and risk control, providing a comprehensive, efficient and intelligent solution for network security monitoring.

[0047] (2) The security monitoring system based on knowledge graph and multimodal information provided by the present invention has a second prediction model in the node state prediction module, which introduces the prediction result of the first prediction model as additional input information, and inserts the state matrix predicted by the first prediction model into the state matrix of the previous m moments to realize data interpolation processing, thereby increasing the density and completeness of the data, and helping to improve the accuracy of subsequent predictions; enhancing model robustness: inserting the predicted state matrix increases the generalization ability of the deep learning model, enabling it to better adapt to different data distributions and changes, thereby improving the robustness and stability of the deep learning model. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 This is a structural block diagram of the network node security monitoring system of the present invention.

[0049] Figure 2 This is a structural block diagram of the deep learning model of the present invention.

[0050] Figure 3 A flow chart is obtained for the deep learning model of the present invention. DETAILED DESCRIPTION

[0051] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0052] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0053] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0054] Example 1, see Figure 1 The present invention provides a network node security monitoring system structure block diagram. Figure 1 A security monitoring system based on knowledge graph and multimodal information is shown, comprising:

[0055] A network node data collection module is used to collect log information of network nodes, wherein the log information includes at least: fault information and actual fault handling information, wherein the fault information includes a timestamp of the fault occurrence, an IP address of the corresponding network node, and a description of the network node status;

[0056] Explanation: Connect to the network node where log information needs to be collected through the configured IP address and port number parameters, use the log collector to obtain log information from the network node in real time or periodically, and perform pre-processing operations such as cleaning, deduplication, and formatting on the collected log information to ensure data accuracy and consistency; store the pre-processed log information in the database, and obtain log information by calling the API interface. Once an abnormality is found in the collection task (such as connection failure, data format error, etc.), it should be processed and restored in a timely manner;

[0057] The node status prediction module builds a deep learning model based on a convolutional neural network, records the prediction accuracy YPR of the deep learning model, and uses the trained deep learning model to predict the state value set of all network nodes at the next moment to obtain the fused fault state category matrix of the network nodes at the next moment;

[0058] Explanation: By collecting the log information of network nodes and using the deep learning model built by convolutional neural network to predict the state of network nodes, it is possible to predict the failures that may occur in the future of network nodes, which helps to identify potential risks in advance, take preventive measures, and reduce the possibility of failures. The fusion fault state category matrix of the network nodes at the next moment output by the node state prediction module is used by the node fault risk analysis module to calculate the node state risk index. This index provides a quantitative way to evaluate the risk level of network node failure, allowing managers to understand the network status more intuitively.

[0059] The node fault risk analysis module outputs the node status risk index by analyzing the fusion fault status category matrix of the network node at the next moment;

[0060] The fault handling knowledge graph building module establishes a mapping between fault information and fault handling operations, builds a fault handling knowledge graph, inputs fault information into the fault handling knowledge graph, and outputs fault theoretical handling operations;

[0061] Explanation: The establishment of the fault handling knowledge graph enables the system to quickly output theoretical fault handling operations based on the input fault information, which helps to improve the efficiency and accuracy of fault handling and reduce human errors;

[0062] The fault handling performance analysis module outputs the fault handling performance index by analyzing the theoretical fault handling operations and actual fault handling information;

[0063] The risk control performance evaluation module jointly analyzes the node status risk index, fault handling performance index and prediction accuracy YPR, and outputs the node risk control coefficient Fk; it is calculated by the formula Node risk control coefficient Fk, where exp represents a natural exponential function, which is used to control the nonlinear degree of the impact of prediction accuracy on the node risk control coefficient; is an adjustment factor used to adjust the impact of prediction accuracy on the node risk control coefficient;

[0064] The risk control performance judgment module determines whether the threshold of the node risk control coefficient is within the normal range. If the node risk control coefficient is higher than the threshold, it indicates that the current risk control measures are effective and no measures are taken; otherwise, an early warning is issued to indicate that the risk is abnormal, indicating that the risk status of the network node is uncontrollable, and it is suggested to increase the supervision resources and maintenance resources of the network node to improve the fault handling performance.

[0065] See also Figure 2 A structural block diagram of a deep learning model, wherein the deep learning model includes a first prediction model, a second prediction model and a fusion unit; the first prediction model uses a short-term fault state category matrix to predict a set of state values ​​of all network nodes at the next moment; based on the output of the first prediction model, the input data of the second prediction model is interpolated to predict a set of state values ​​of all network nodes at the next moment; the fusion unit is used to fuse the prediction results of the first prediction model and the second prediction model, and output a fused fault state category matrix of the network nodes at the next moment; and obtain a more accurate prediction result.

[0066] It needs to be further explained in the embodiment of the present invention that the short-term fault state category matrix is ​​a fault state category matrix composed of the fault state information of all network nodes in the previous one or several moments; the first prediction model satisfies the following formula, Among them, m is the time step number, that is, the first m moments, z k represents the row vector at the kth moment in the state matrix z, p k+1 represents the set of state values ​​of all network nodes at the next moment predicted by the first prediction model, and θ represents the correction constant.

[0067] It is necessary to further explain in the embodiment of the present invention that the input of the second prediction model is the combined splicing of the input and output of the first prediction model, and m prediction state matrices are inserted into the state matrix of the previous m moments, which are respectively recorded as , the second prediction model satisfies the following formula, By formula The fused fault state category matrix of the next moment is calculated, where Q1 represents the weight coefficient of the first prediction model and Q2 represents the weight coefficient of the second prediction model.

[0068] See also Figure 3 The deep learning model acquisition flow chart is as follows:

[0069] Step S11, log information extraction: extracting the log information of the computer network node from the database;

[0070] Step S12, key feature extraction: using regular expressions to extract key features from log information, including timestamp, network node IP address, and network node status description information; performing semantic analysis on the network node status description information, making a status evaluation, and obtaining a corresponding status category;

[0071] Step S13, constructing a fault state category matrix: combining the fault state categories of all network nodes into a state vector, representing the fault state categories of all network nodes at a certain moment; combining the state vectors at all moments into a fault state category matrix for subsequent time series prediction;

[0072] Step S14, data preprocessing: performing forward state filling on the fault state category matrix to deal with the problem of time sparseness of log information, and dividing the data into training set and test set;

[0073] Step S15, model training: building a deep learning model based on the structure of the recurrent neural network and the fully connected layer, and sending the training set to the deep learning model for training;

[0074] Step S16, model evaluation and optimization: Use the cross entropy loss function as the loss function of the deep learning model, update the parameters of the deep learning model through the gradient descent algorithm to minimize the loss function, use the prediction accuracy YPR indicator to evaluate the performance of the deep learning model, and optimize it to output the trained deep learning model.

[0075] It needs to be further explained in the embodiment of the present invention that the node status risk index is obtained in the following manner:

[0076] Analyze the fault status category matrix of the network nodes at the next moment to obtain the number of faulty network nodes and the corresponding fault status categories;

[0077] Suppose there are n faulty network nodes, and i represents the sequential number of the faulty network nodes;

[0078] The weight coefficient of the ith network node is recorded as q_i, and the fault status category score corresponding to the ith faulty network node is recorded as gp_i; through the formula The node status risk index Gz is calculated.

[0079] It needs to be further explained in the embodiment of the present invention that the fault handling performance index is obtained in the following manner:

[0080] Obtain fault information and actual fault handling information from the log information, where the actual fault handling information includes the actual fault handling operation and the actual response time;

[0081] By comparing the differences between actual fault handling information and theoretical fault handling operations, the fault handling performance index Gx is output.

[0082] In a possible embodiment, it is assumed that there are s faults in the log information, and j represents the sequence number of the faults;

[0083] The theoretical fault handling operation, theoretical response time, actual fault handling operation and actual response time of the jth fault are recorded as Ca_j, Cb_j, Ta_j, Tb_j respectively;

[0084] The fault handling performance index Gx is calculated by the following formula: in, The function is used to get the minimum value of the values ​​in brackets. is a piecewise function. When the theoretical fault processing operation of the j-th fault category is the same as the actual fault processing operation of the j-th fault, the value is 1, otherwise the value is 0. gp_j represents the fault status category score corresponding to the j-th fault.

[0085] What needs to be further explained in the embodiments of the present invention is that measures are taken based on the node status risk index Gz. If the node status risk index Gz exceeds the threshold, it indicates that the risk status of the network node is uncontrollable. The operating status of the network node is monitored in real time, and potential faults are discovered and warned in time. According to the load conditions of the network nodes and fault handling requirements, resource allocation is dynamically adjusted to ensure sufficient resource support during the fault handling process. Through automated tools and process optimization, the manual operations of operation and maintenance personnel in the fault handling process are reduced to shorten the response time.

[0086] Embodiment 2, in this embodiment of the present invention, the security monitoring system further includes any one or more of the following modules:

[0087] Real-time monitoring and alarm module, used to monitor the status of network nodes in real time. Once an abnormality or potential risk is found, the alarm mechanism is immediately triggered to notify relevant personnel to handle it;

[0088] Visual display module: Displays the status of network nodes, node status risk index, and fault handling performance index information through a graphical interface, allowing operation and maintenance personnel to intuitively understand the network status;

[0089] Knowledge graph management module: used to manage the knowledge graph, including the knowledge graph opinion generation unit and the knowledge graph update unit;

[0090] The knowledge graph opinion generation unit provides intelligent suggestions based on the risk analysis results, such as optimizing network configuration and adding redundant equipment to improve the stability and security of the network.

[0091] The knowledge graph updating unit continuously updates the node association relationship and fault propagation model information in the knowledge graph as the operation and data are accumulated, so as to improve the accuracy and reliability of the knowledge graph.

[0092] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A security monitoring system based on knowledge graph and multimodal information, characterized in that: include: A network node data collection module collects log information of network nodes, wherein the log information includes at least: fault information and actual fault handling information, wherein the fault information includes a timestamp of the fault occurrence, an IP address of the corresponding network node, and a description of the network node status; The node status prediction module builds a deep learning model based on a recurrent neural network, records the prediction accuracy YPR of the deep learning model, and uses the trained deep learning model to predict the set of state values ​​of all network nodes at the next moment, and obtains the fused fault state category matrix of the network nodes at the next moment; The node fault risk analysis module outputs the node status risk index Gz by analyzing the fusion fault status category matrix of the network node at the next moment; takes measures based on the node status risk index Gz; if the node status risk index Gz exceeds the threshold, it indicates that the risk status of the network node is uncontrollable; monitors the operating status of the network node in real time, discovers and warns potential faults in time, and dynamically adjusts resource allocation according to the load of the network node and fault handling requirements; the node status risk index is obtained as follows: Analyze the fault status category matrix of the network nodes at the next moment to obtain the number of faulty network nodes and the corresponding fault status category; suppose there are n faulty network nodes, i represents the order number of the faulty network nodes; record the weight coefficient of the i-th network node as q_i, and record the fault status category score corresponding to the i-th faulty network node as gp_i; through the formula The node status risk index Gz is calculated; The fault handling knowledge graph building module establishes a mapping between fault information and fault handling operations, builds a fault handling knowledge graph, inputs fault information into the fault handling knowledge graph, and outputs fault theoretical handling operations; The fault handling performance analysis module outputs the fault handling performance index Gx by analyzing the theoretical fault handling operation and the actual fault handling information. Assume that there are s faults in the log information, and j represents the order of the faults. The theoretical fault handling operation, theoretical response time, actual fault handling operation and actual response time of the jth fault are recorded as Ca_j, Ta_j, Cb_j, and Tb_j respectively. The fault handling performance index Gx is calculated by the following formula: in, The function is used to get the minimum value of the values ​​in brackets. is a piecewise function. When the theoretical fault handling operation of the j-th fault category is the same as the actual fault handling operation of the j-th fault, the value is 1, otherwise the value is 0. gp_j represents the fault status category score corresponding to the j-th fault. The risk control performance evaluation module jointly analyzes the node status risk index, fault handling performance index and prediction accuracy YPR, and outputs the node risk control coefficient Fk; through the formula The node risk control coefficient Fk is calculated, where exp represents the natural exponential function, which is used to control the nonlinear degree of the impact of the prediction accuracy on the node risk control coefficient; is an adjustment factor used to adjust the impact of prediction accuracy on the node risk control coefficient; The risk control performance judgment module determines whether the threshold of the node risk control coefficient is within the normal range. If the node risk control coefficient is higher than the threshold, it indicates that the current risk control measures are effective and no measures are taken; otherwise, an early warning is issued to indicate that the risk is abnormal, indicating that the risk status of the network node is uncontrollable, and it is suggested to increase the supervision resources and maintenance resources of the network node to improve the fault handling performance.

2. The security monitoring system based on knowledge graph and multimodal information according to claim 1 is characterized in that: The deep learning model includes a first prediction model, a second prediction model and a fusion unit; The first prediction model uses the short-term fault state category matrix to predict the state value set of all network nodes at the next moment; Based on the output of the first prediction model, the input data of the second prediction model is interpolated to predict the state value set of all network nodes at the next moment; The fusion unit is used to fuse the prediction results of the first prediction model and the second prediction model, and output a fusion fault state category matrix of the network node at the next moment.

3. The security monitoring system based on knowledge graph and multimodal information according to claim 2 is characterized in that: The short-term fault status category matrix is ​​a fault status category matrix composed of the fault status information of all network nodes in the previous m moments; the first prediction model satisfies the following formula: Where m is the time step number, z k represents the row vector at the kth moment in the state matrix z, p k+1 represents the set of state values ​​of all network nodes at the next moment predicted by the first prediction model, and θ represents the correction constant; The input of the second prediction model is the combined concatenation of the input and output of the first prediction model. m prediction state matrices are inserted into the state matrix of the previous m moments, which are respectively denoted as , the second prediction model satisfies the following formula, By formula The fused fault state category matrix of the next moment is calculated, where Q1 represents the weight coefficient of the first prediction model and Q2 represents the weight coefficient of the second prediction model.

4. The security monitoring system based on knowledge graph and multimodal information according to claim 3 is characterized in that: The deep learning model is obtained as follows: Step S11, log information extraction: extracting the log information of the computer network node from the database; Step S12, key feature extraction: using regular expressions to extract key features from log information, including timestamp, network node IP address, and network node status description information; performing semantic analysis on the network node status description information, making a status evaluation, and obtaining a corresponding status category; Step S13, constructing a fault state category matrix: combining the fault state categories of all network nodes into a state vector, representing the fault state categories of all network nodes at a certain moment; combining the state vectors at all moments into a fault state category matrix for subsequent time series prediction; Step S14, data preprocessing: performing forward state filling on the fault state category matrix to deal with the problem of time sparseness of log information, and dividing the data into training set and test set; Step S15, model training: building a deep learning model based on the structure of the recurrent neural network and the fully connected layer, and sending the training set to the deep learning model for training; Step S16, model evaluation and optimization: Use the cross entropy loss function as the loss function of the deep learning model, update the parameters of the deep learning model through the gradient descent algorithm to minimize the loss function, use the prediction accuracy YPR indicator to evaluate the performance of the deep learning model, and optimize it to output the trained deep learning model.

5. The security monitoring system based on knowledge graph and multimodal information according to claim 4 is characterized in that: Also includes: Real-time monitoring and alarm module, used to monitor the status of network nodes in real time. Once an abnormality or potential risk is found, the alarm mechanism is immediately triggered to notify relevant personnel to handle it; Visual display module: Displays the status of network nodes, node status risk index, and fault handling performance index information through a graphical interface, allowing operation and maintenance personnel to intuitively understand the network status.

Images