Multi-model collaborative network security threat intelligent monitoring tool under Stacking integrated framework

Abstract

The invention discloses a multi-model collaborative network security threat intelligent monitoring tool under a Stacking integrated framework. The multi-model collaborative network security threat intelligent monitoring tool comprises S1, a data acquisition and preprocessing module which is responsible for preprocessing original network security attack data; s2, a feature selection and engineering module: extracting key features from the preprocessed data based on business logic, expert experience and domain knowledge of the data; s3, a feature representation module: converting the selected features into feature vectors by adopting different types of models; s4, a Stacking framework fusion module: performing intelligent fusion on prediction results of a plurality of base learners by using a Stacking framework; s5, a threat monitoring and response module which monitors network security threats in real time based on the prediction result of the fusion module; and S6, a user interaction and configuration module. According to the invention, through integration of a plurality of modules, intelligent monitoring and identification of network security threats are realized, the monitoring accuracy and efficiency are improved, and reliable technical support is provided for network security.

Description

Technical Field

[0001] The present invention relates to the technical field of network security threat intelligent monitoring, and in particular to a network security threat intelligent monitoring tool with multi-model collaboration under a Stacking integration framework. Background Art

[0002] With the rapid development of the Internet and information technology, the types and number of network security threats are also increasing. From the early simple virus and worm attacks to today's complex advanced persistent threats (APT) and ransomware, network attack methods are becoming increasingly complex and diverse, posing severe challenges to the security of network systems. Traditional network security monitoring methods mainly rely on static rules and feature matching technology. These methods detect known threats through predefined rules. Although they can protect against known attacks to a certain extent, they are often powerless in the face of evolving attack patterns and unknown threats, and are prone to missed reports and false alarms, making it difficult to provide effective protection.

[0003] In this context, intelligent network security threat monitoring using machine learning and deep learning technologies has gradually become a research hotspot. Machine learning models can automatically identify abnormal behaviors and potential threats in network traffic by learning from a large amount of historical attack data. However, the performance of a single model is often affected by multiple factors such as data distribution, feature selection, and model complexity, making it difficult to maintain efficient and accurate detection performance in various complex environments.

[0004] In order to improve the effect of network security monitoring, multi-model fusion technology has been introduced into the field of network security. Multi-model fusion can combine the advantages of each model and make up for the shortcomings of a single model by combining the prediction results of multiple models, thereby significantly improving the accuracy and robustness of detection. Among them, Stacking is a commonly used and effective multi-model fusion technology. It trains multiple basic models in layers, uses the prediction results of each basic model as new feature input, and further trains high-level models for final prediction. The Stacking method makes full use of the complementarity between different models and shows superior performance in practical applications.

[0005] In addition, the Transformer encoder in deep learning performs well in processing sequence data and natural language processing tasks. The Transformer's self-attention mechanism can effectively capture global dependencies and is suitable for processing complex network traffic features. In network security monitoring, combining the Transformer encoder for feature representation can further improve the model's expressiveness and detection accuracy.

[0006] However, although the existing multi-model fusion and deep learning methods have improved the performance of network threat detection to a certain extent, facing the increasingly complex and changing network environment, the existing technologies still have many shortcomings and challenges. How to further improve the accuracy, real-time and adaptability of network security threat detection has become an urgent problem to be solved. Summary of the invention

[0007] In order to overcome the above problems, the purpose of the present invention is to provide a multi-model collaborative network security threat intelligent monitoring tool under the Stacking integration framework, aiming to improve the accuracy and real-time performance of network security threat detection through multi-model fusion and deep feature characterization.

[0008] The technical solution adopted by the present invention is: comprising the following modules:

[0009] S1. Data collection and preprocessing module: This module is the data entry of the tool. It is responsible for collecting raw network data and performing preliminary processing. It removes noise and redundant information through data cleaning, outlier processing, missing value filling, and feature conversion to ensure that the data set for subsequent model training is of high quality and consistency.

[0010] S2, Feature Selection and Engineering Module: Based on domain knowledge and data characteristics, key features are extracted from the preprocessed data, and the feature set is further optimized through feature selection and engineering techniques, by reducing irrelevant features, eliminating redundant features, and creating new synthetic features;

[0011] S3, feature representation module: Use different types of models to represent the selected features, convert the original data into high-dimensional feature vectors, encode and convert the features with obvious category properties, and use machine learning models for efficient representation. For text features, use Transformer encoder for deep representation;

[0012] S4, Stacking framework fusion module: Use the Stacking framework to fuse the feature vectors output by the feature representation module. In Level 1, the prediction results of the same data set are spliced ​​by different models to form a new feature vector. In Level 2, the XGBoost ensemble learning model is used to take the prediction results of Level 1 as feature input for final prediction and classification.

[0013] S5. Threat monitoring and response module: Based on the prediction results of the Stacking framework fusion module, the tool monitors and identifies network security threats in real time. Once a potential security threat is detected, the tool will immediately issue an alarm and respond through preset security measures;

[0014] S6. User interaction and configuration module: allows users to view real-time monitoring results, configure and adjust monitoring parameters, and receive and process alarm information. Users can interact with the tool through this module to achieve real-time monitoring and management of network security threats.

[0015] Furthermore, the S1 specifically includes:

[0016] S11. Deleting duplicate data: Checking and deleting duplicate records based on unique identifiers;

[0017] S12. Missing value processing: Count the number of missing values ​​in each feature column. If the missing ratio exceeds 15%, delete the feature column directly. Otherwise, for numerical features, such as "confidence" or "threat level", if there are missing values, use the mean value to fill in; for categorical features, such as "threat category" and "attack chain stage", if there are missing values, fill in according to business rules or the most frequently occurring category;

[0018] S13. Outlier processing: First, use the Z-score method to identify data points that deviate too much from the average value:

[0019]

[0020] Among them, Z i is the Z-score of the ith data point, x i represents the value of the i-th data point, μ is the mean of the data set, and σ is the standard deviation of the data set; secondly, using the IQR rule, the range of outliers is defined by Q3+1.5×IQR and Q1-1.5×IQR, where Q1 refers to the first quartile and Q3 refers to the third quartile;

[0021] S14, Feature conversion: Convert data into a format suitable for model use. Different models accept different types of data. For features with obvious meanings such as IP addresses or ports, convert them into original binary form to facilitate the model to perform underlying network analysis and processing; for text data with category features, map each category into an ID value; for text features, tokenization based on the BPE word segmentation algorithm will be used:

[0022]

[0023] Where (x, y) is a pair of adjacent characters, and freq(x, y) is the frequency of occurrence of the character pair in the text, until the preset vocabulary size is reached or it can no longer be merged.

[0024] Furthermore, the S2 specifically includes:

[0025] S21. Feature filtering based on domain knowledge: Use domain knowledge to preliminarily screen the original features. Time records or unique identification features are useless for model training and are directly eliminated.

[0026] S22. Based on feature selection algorithm: Five machine learning models: random forest, AdaBoost, ExtraTree, GradientBoosting and decision tree are used for feature selection to reduce irrelevant features and eliminate redundant features. One of the measurement criteria for feature importance is mean impurity reduction (MDI).

[0027] For the random forest algorithm, the average impurity reduction of each feature in all trees after filtering by domain knowledge is calculated, and then the importance of each feature is evaluated based on this average value, specifically:

[0028]

[0029] Where T is the set of decision trees, v(t) is the feature corresponding to node t, p(t) is the sample ratio of node t, Δi(t) represents the reduction in impurity, and N(f) is the number of times feature f appears.

[0030] For the AdaBoost algorithm, the feature importance is evaluated based on the weight of each weak classifier and the frequency of use of the feature in the classifier. Specifically:

[0031]

[0032] Among them, α t represents the weight of the weak classifier in the tth iteration, ε t is the classification error rate;

[0033] For the ExtraTree algorithm, randomness is added when selecting features and dividing thresholds to discover effective features under highly randomized conditions;

[0034] For the GradientBoosting algorithm, features that can improve model performance are discovered through combination;

[0035] For the observation tree algorithm, by observing the splitting rules and feature importance scores of the decision tree, features that have little impact on the classification results can be quickly eliminated.

[0036] Furthermore, the S3 specifically includes:

[0037] S31, characterization of category property features: After feature screening in S22, a set C containing all relevant category feature columns is obtained, where C = c 1 ,c 2 ,…,c n , each ci represents a set of discrete category values. For c i The categorical features in are converted into numerical data through the label encoding mapping function:

[0038] L(c j )=j (j=1,2,…,m)

[0039] Among them, each category c j is mapped to a unique integer j. Considering the limitations of a single machine learning model in feature representation and learning, five machine learning models, including random forest (RF), AdaBoost (AB), ExtraTree (ET), GradientBoosting (GB) and decision tree (DT), are used for ensemble learning to make full use of the characteristics of each model and improve the overall prediction performance. Specifically:

[0040]

[0041] Where x represents a sample of network security attack behavior characteristics, RF(x) is the model's judgment on whether the sample is a threat, and h t (x) is the prediction of the tth tree, T is the number of trees;

[0042]

[0043] Among them, AB(x) represents the final prediction result of the AdaBoost model for the input sample x, G m (x) represents the prediction result of the mth weak classifier for the input sample x, α m Represents the weight of the mth weak classifier;

[0044] GB(x)=F 0 (x)+η*Σ(γ m *h m (x)

[0045] Among them, GB(x) represents the prediction result of the GradientBoosting model for the input sample x, and F 0 (x) represents a basic, non-threatening network behavior pattern, η is the learning rate, and h m (x) represents a weak learner;

[0046]

[0047] Among them, ET(x) represents the prediction result of the ExtraTree model for the input sample x, and the other parameters are the same as RF(x).

[0048] Each base learner will be trained independently using the converted numerical data. After training, each model will predict the validation set and generate its own prediction results.

[0049] S32, representation of text-like features: The set of subword units obtained after BPE segmentation in S14 is represented as T = {t 1 ,t 2 ,…,t n}, each subword unit t i Mapped to a unique ID representation:

[0050]

[0051] Next, the mapped subword ID sequence is truncated or padded to make its length uniform to L:

[0052]

[0053] Next, each subword sequence is embedded in the Converted into a fixed-dimensional embedding vector e i :

[0054] E={e 1 ,e 2 ,…,e n}

[0055] Among them, the embedding vector e i is a d-dimensional vector, that is These embedding vectors capture the semantic information in network security attack data and can reflect the security characteristics and relevance of subwords. In order to introduce sequence information, position encoding p is used. i Add to the embedding vector:

[0056] z i =e i +p i

[0057] The positional encoding is calculated using the following formula:

[0058]

[0059] Among them, j is the dimension index, d refers to the dimension of the model, and then the position-encoded vector Z = {z 1 ,z 2 ,…,z n} Input to the Transformer encoder:

[0060] H=Encoder(z)

[0061] The Transformer encoder uses a multi-head self-attention mechanism and a feedforward neural network to encode the input to extract key features from the text. The multi-head self-attention mechanism models the context by weighted combinations of words at different positions in a sequence, helping the model understand the relevance and importance of different attack behaviors. Specifically:

[0062]

[0063] MultiHead(Q,K,V)=Concat(head 1 ,…,head h )W O

[0064] Among them, Q, K, V are query, key, and value matrices obtained through linear transformation, d k is the dimension of the attention head. These queries, keys, and values ​​contain key information such as the attack type, attacker IP address, and victim IP address. Then, the output of the self-attention mechanism is transformed through a feedforward neural network to extract higher-level feature representations. The feedforward neural network can dig deeper into the semantic information in the text and better understand the patterns and characteristics of the attack behavior. The calculation process is as follows:

[0065] FFN(x)=ReLU(xW 1 +b 1 )W 2 +b 2

[0066] Where x represents the input vector, W 1 and W 2 is the learnable weight matrix, b 1 and b 2 is the bias vector. Through training, these parameters can effectively extract the key features of attack data, such as attack payload content and attack traffic characteristics.

[0067] Furthermore, the S4 specifically includes:

[0068] S41, Level 1 prediction result splicing: The prediction results Y of the five machine learning models for the category features are combined c1 ,Y c2 ,…,Y c5 And Transformer's prediction result Y for text class features t To splice:

[0069] Y level1 =concat(Y c1 ,Y c2 ,…,Y c5 ,Yt )

[0070] S42. For each basic model M i Use K-fold cross validation to divide the training data into K folds. Assume that on the kth fold, the base model M i The prediction results for the validation set are Concatenate these K sets of prediction results to get a K×n matrix, where n is the number of samples in the validation set:

[0071]

[0072] For each base model M i Execute each of them once to obtain K K×n matrices, and then concatenate these matrices together again as the input of the next layer of learners:

[0073] Y level1_valid =concat(Y valid_concat_1 ,Y valid_concat_2 ,…,Y valid_concat_K )

[0074] Among them, Y level1_valid Represents the overall situation of the prediction results of all basic models on the validation set;

[0075] S43, Level 2 ensemble learning model: Y obtained in S42 level1_valid The matrix is ​​used as the input feature of the Level 2 model, and the original target label y will be used as the target of the Level 2 model. level2 =Y level1_valid , then:

[0076]

[0077] Select XGBoost as the Level 2 learner and use the concatenated prediction result matrix X level2 And the corresponding target label y for model training. The specific training process can be expressed as:

[0078]

[0079] Where L is the loss function, Ω(f) is the regularization term, and N is the number of training samples.

[0080] S44. In the actual prediction process, the trained basic model is first used to predict the new data set to generate the Level 1 prediction result matrix Y level1_test , assuming that the new data set has n′ samples, the prediction result of each basic model is:

[0081]

[0082] These prediction results are concatenated to form the input feature matrix X of Level 2 level2_test :

[0083] X level2_test =concat(Y test_1 ,Y test_2 ,…,Y test_m )

[0084] The final prediction result is:

[0085]

[0086] Furthermore, the S5 specifically includes:

[0087] S51. Real-time data monitoring: The tool continuously monitors network traffic and related data, and generates data samples to be tested X real-time , these data samples are converted into feature vectors suitable for model prediction through the preprocessing module:

[0088] X real-time =Preprocess(Raw Data)

[0089] S52, Threat Prediction: Use the trained Stacking framework fusion model to predict real-time data and determine whether there are potential network security threats:

[0090] Y real-time,level1 =concat(M 1 (X real-time ),M 2 (X real-time ),…,M m (X real-time ))

[0091]

[0092] Among them, Y real-time,level1 The prediction result matrix of Level 1 is obtained by predicting real-time data using multiple basic models. i (X real-time ) represents the prediction result of the i-th basic model on the real-time data; Represents the final threat prediction result, Represents the Level 2 integrated learning model;

[0093] S53, Threat identification and alert: Based on threat prediction results The tool determines whether there is a potential security threat. If a threat is detected (for example, the predicted result is an attack), the tool immediately issues an alarm and records the threat information:

[0094]

[0095] S54, Response measures: The tool responds to the detected threat according to the preset security measures, which specifically include the following steps:

[0096] S541, block network connections from threat sources to prevent the spread of threats, and execute rule judgment procedures;

[0097] S542. Record threat monitoring and corresponding details for subsequent analysis and audit;

[0098] S543. If the automatic operation and maintenance rules are met, the preset automatic defense measures are executed, such as updating the firewall rules and enabling the intrusion prevention system;

[0099] S544. If the automatic operation and maintenance rules are not met, a work order is generated to notify the operation and maintenance administrator and relevant security personnel to ensure that manual intervention measures are taken in a timely manner;

[0100] S55, Feedback and Learning: Feedback the detected threat information and response results to the model.

[0101] Furthermore, the S6 specifically includes:

[0102] S61. Real-time monitoring results viewing: Users can view real-time monitoring results through a visual interface, including current network traffic, potential threats, and detection logs;

[0103]

[0104] S62. Monitoring parameter configuration: Users can configure and adjust the tool’s monitoring parameters to suit different network environments and security requirements:

[0105] P config ={p 1 ,p 2 ,…,p n where p i is the i-th monitoring parameter

[0106] P new =Adjust(P config ,ΔP)

[0107] Among them, P config Represents a configuration set of monitoring parameters, which includes all monitoring parameters used in the tool and is used to control and adjust the behavior of the network security threat monitoring tool; newrepresents the set of monitoring parameter configurations after adjustment; ΔP represents the adjustment amount of the monitoring parameter, that is, the change amount of each parameter before and after the adjustment;

[0108] S63. Alarm reception and processing: Users can receive security alarms issued by the tool and process the alarms. The alarm information includes threat type, threat level, and recommended measures.

[0109] A alert ={a 1 ,a 2 ,…,a m where a i is the i-th alarm information

[0110]

[0111] S64, Interaction and Feedback: Users interact with the tool through this module and submit feedback to help the tool optimize detection strategies and response measures:

[0112] F feedback ={f 1 ,f 2 ,…,f k} where f i is the i-th feedback

[0113]

[0114] Beneficial effects of the present invention:

[0115] 1. This invention innovatively combines the Stacking framework to significantly improve the accuracy of network security threat monitoring. By integrating multiple models, the tool can synthesize the prediction results of each model and use the Transformer encoder to extract deep-level features of network traffic, thereby more accurately identifying threats.

[0116] 2. The present invention significantly enhances the real-time monitoring capability by introducing deep learning models, especially the Transformer encoder. The deep learning model can quickly process and analyze network traffic data, identify potential security threats in real time, and ensure that the tool can respond quickly and protect network security.

[0117] 3. The user interaction and configuration module design of the present invention makes the tool more flexible and easy to use. Users can adjust monitoring parameters and response measures in real time according to actual needs and changes in the network environment to meet personalized security needs. This flexibility not only improves the reliability and usability of the tool, but also provides users with a more intelligent and convenient network security threat monitoring experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0118] Figure 1 This is the overall flow chart of the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework proposed in the present invention. DETAILED DESCRIPTION

[0119] The specific implementation of the present invention is described below in conjunction with the accompanying drawings and embodiments:

[0120] It should be noted that the structures, proportions, sizes, etc. illustrated in the drawings of this specification are only used to match the contents disclosed in the specification for people familiar with this technology to understand and read, and are not used to limit the conditions under which the present invention can be implemented. Any structural modification, change in proportional relationship or adjustment of size should still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0121] At the same time, the terms such as "upper", "lower", "left", "right", "middle" and "one" cited in this specification are only for the convenience of description and are not used to limit the scope of implementation of the present invention. Changes or adjustments to their relative relationships should be regarded as the scope of implementation of the present invention without substantially changing the technical content.

[0122] like Figure 1 As shown, it shows a specific implementation of the present invention: the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework disclosed by the present invention includes the following modules:

[0123] S1. Data collection and preprocessing module: This module is the data entry of the tool. It is responsible for collecting raw network data and performing preliminary processing. It removes noise and redundant information through data cleaning, outlier processing, missing value filling, and feature conversion to ensure that the data set for subsequent model training is of high quality and consistency.

[0124] In an implementation manner, the S1 specifically includes:

[0125] S11. Network data collection: Select appropriate data sources based on specific application requirements. These data sources include but are not limited to S6000, defense monitoring system, network management system, etc.

[0126] S12. Deleting duplicate data: Checking and deleting duplicate records based on unique identifiers such as "event ID" or "session ID".

[0127] S13. Missing value processing: Count the number of missing values ​​in each feature column. If the missing ratio exceeds 15%, delete the feature column directly. Otherwise, for numerical features, such as "confidence" or "threat level", if there are missing values, use the mean to fill them. For categorical features, such as "threat category", "attack chain stage", etc., if there are missing values, fill them according to business rules or the most frequently occurring category.

[0128] S14. Outlier processing: First, use the Z-score method to identify data points that deviate too much from the average value:

[0129]

[0130] Among them, Z i is the Z-score of the ith data point, x i represents the value of the ith data point, μ is the mean of the data set, and σ is the standard deviation of the data set; secondly, using the IQR rule, the outlier range is defined by Q3+1.5×IQR and Q1-1.5×IQR, where Q1 refers to the first quartile and Q3 refers to the third quartile; in other embodiments, outliers can also use statistical methods or machine learning-based anomaly detection algorithms to identify abnormal data points.

[0131] S15, Feature conversion: Convert data into a format suitable for model use. Different models accept different types of data. For features with obvious meanings such as IP addresses or ports, convert them into original binary form to facilitate the model to perform underlying network analysis and processing; for text data with category features, map each category into an ID value; for text features, tokenization based on the BPE word segmentation algorithm will be used:

[0132]

[0133] Where (x, y) is an adjacent character pair, and freq(x, y) is the frequency of occurrence of the character pair in the text, until the preset vocabulary size is reached or it can no longer be merged. The BPE algorithm builds a vocabulary by merging frequently occurring subword pairs. This method can effectively process words that do not appear in the original vocabulary. In other embodiments, if the corpus of text-like features is small, word segmentation and tokenization can also be performed based on characters, words, or other subwords.

[0134] S2, Feature Selection and Engineering Module: Based on domain knowledge and data characteristics, key features are extracted from the preprocessed data, and the feature set is further optimized through feature selection and engineering techniques, by reducing irrelevant features, eliminating redundant features, and creating new synthetic features;

[0135] In an implementation manner, the S2 specifically includes:

[0136] S21. Feature filtering based on domain knowledge: After data preprocessing, the key issue is how to extract the most critical features for threat monitoring from a large number of features. Using domain knowledge for initial screening can significantly improve the efficiency and effectiveness of feature selection.

[0137] S211. Timestamp features in time series data or event records (such as "detection time") are usually converted into other forms (such as time intervals, time periods, etc.) before modeling, or directly removed because they have no direct effect on model training in their original form.

[0138] S212. Unique identifiers such as "event rule ID" and "session ID" are only used to distinguish different events or session records and are meaningless for model training, so they should be eliminated.

[0139] S22. Based on feature selection algorithm: Due to the certain correlation between features, a large number of features will affect the training speed and may also cause model overfitting. Five machine learning models: random forest, AdaBoost, ExtraTree, GradientBoosting and decision tree are used for feature selection to reduce irrelevant features and eliminate redundant features. One of the measurement criteria for feature importance is the mean impurity reduction (MDI).

[0140] S221. For the random forest algorithm, the average impurity reduction of each feature in all trees after filtering by domain knowledge is calculated, and then the importance of each feature is evaluated based on this average value. Specifically:

[0141]

[0142] Where T is the set of decision trees, v(t) is the feature corresponding to node t, p(t) is the sample ratio of node t, Δi(t) represents the reduction in impurity, and N(f) is the number of times feature f appears.

[0143] S222. For the AdaBoost algorithm, the feature importance is evaluated according to the weight of each weak classifier and the frequency of use of the feature in the classifier. Specifically:

[0144]

[0145] Among them, α t represents the weight of the weak classifier in the tth iteration, ε t is the classification error rate;

[0146] S223: For the ExtraTree algorithm, randomness is added when selecting features and dividing thresholds to discover effective features under highly randomized conditions. Through multiple random selections, features that still perform well under different random conditions can be identified. Specifically:

[0147]

[0148] Among them, Imp(f) is the importance of feature f, T is the set of trees, and v(t) is the feature corresponding to node t.

[0149] S224. For the GradientBoosting algorithm, the features that can improve the model performance are found by combining existing features. In each iteration, GradientBoosting optimizes the feature combination according to the gradient direction, thereby improving the overall performance of the model. Specifically:

[0150]

[0151] Where M is the total number of iterations, T m is the tree set of the mth weak learner, ΔL m (t) is the loss reduction brought by tree t in the mth iteration.

[0152] S225. For the decision tree algorithm, by observing the splitting rules and feature importance scores of the decision tree, features that have little impact on the classification results can be quickly eliminated.

[0153]

[0154] Among them, N t is the number of samples at node t, N is the total number of samples, and ΔGini(t) is the reduction in the Gini index brought by node t.

[0155] S3, feature representation module: Use different types of models to represent the selected features, convert the original data into high-dimensional feature vectors, encode and convert the features with obvious category properties, and use machine learning models for efficient representation. For text features, use Transformer encoder for deep representation.

[0156] In an implementation manner, the S3 specifically includes:

[0157] S31, characterization of category property features: After feature screening in S22, a set C containing all relevant category feature columns is obtained, where C = c 1 ,c 2 ,…,c n , each c i represents a set of discrete category values. For c iThe categorical features in are converted into numerical data through the label encoding mapping function:

[0158] L(c j )=j (j=1,2,…,m)

[0159] Among them, each category c j is mapped to a unique integer j. Considering the limitations of a single machine learning model in feature representation and learning, five machine learning models, including random forest (RF), AdaBoost (AB), ExtraTree (ET), GradientBoosting (GB) and decision tree (DT), are used for ensemble learning to make full use of the characteristics of each model and improve the overall prediction performance. Specifically:

[0160]

[0161] Where x represents a sample of network security attack behavior characteristics, RF(x) is the model's judgment on whether the sample is a threat, and h t (x) is the prediction of the tth tree, T is the number of trees;

[0162]

[0163] Among them, AB(x) represents the final prediction result of the AdaBoost model for the input sample x, G m (x) represents the prediction result of the mth weak classifier for the input sample x, α m Represents the weight of the mth weak classifier;

[0164] GB(x)=F 0 (x)+η*∑(γ m *h m (x)

[0165] Among them, GB(x) represents the prediction result of the GradientBoosting model for the input sample x, and F 0 (x) represents a basic, non-threatening network behavior pattern, η is the learning rate, and h m (x) represents a weak learner;

[0166]

[0167] Among them, ET(x) represents the prediction result of the ExtraTree model for the input sample x, and the other parameters are the same as RF(x).

[0168] Each base learner will be trained independently using the converted numerical data. After training, each model will predict the validation set and generate its own prediction results.

[0169] S32, representation of text-like features: The set of subword units obtained after BPE segmentation in S14 is represented as T = {t 1 ,t 2 ,…,t n}, each subword unit t i Mapped to a unique ID representation:

[0170]

[0171] Next, the mapped subword ID sequence is truncated or padded to make its length uniform to L:

[0172]

[0173] Next, each subword sequence is embedded in the Converted into a fixed-dimensional embedding vector e i :

[0174] E={e 1 ,e 2 ,…,e n}

[0175] Among them, the embedding vector e i is a d-dimensional vector, that is These embedding vectors capture the semantic information in network security attack data and can reflect the security characteristics and relevance of subwords. In order to introduce sequence information, position encoding p is used. i Add to the embedding vector:

[0176] z i =e i +p i

[0177] The positional encoding is calculated using the following formula:

[0178]

[0179] Among them, j is the dimension index, d refers to the dimension of the model, and then the position-encoded vector Z = {z 1 ,z 2 ,…,z n} Input to the Transformer encoder:

[0180] H=Encoder(z)

[0181] The Transformer encoder uses a multi-head self-attention mechanism and a feedforward neural network to encode the input to extract key features from the text. The multi-head self-attention mechanism models the context by weighted combinations of words at different positions in a sequence, helping the model understand the relevance and importance of different attack behaviors. Specifically:

[0182]

[0183] MultiHead(Q,K,V)=Concat(head 1 ,…,head h )W O

[0184] Among them, Q, K, V are query, key, and value matrices obtained through linear transformation, d k is the dimension of the attention head. These queries, keys, and values ​​contain key information such as attack type, attacker IP address, and victim IP address. Then, the output of the self-attention mechanism is transformed through a feedforward neural network to extract higher-level feature representations. The feedforward neural network can dig deeper into the semantic information in the text and better understand the patterns and characteristics of the attack behavior. The calculation process is as follows:

[0185] FFN(x)=ReLU(xW 1 +b 1 )W 2 +b 2

[0186] Where x represents the input vector, W 1 and W 2 is the learnable weight matrix, b 1 and b 2 is the bias vector. Through training, these parameters can effectively extract the key features of attack data, such as attack payload content, attack traffic characteristics, etc.

[0187] S4, Stacking framework fusion module: Use the Stacking framework to fuse the feature vectors output by the feature representation module. In Level 1, the prediction results of the same data set are spliced ​​by different models to form a new feature vector. In Level 2, the XGBoost ensemble learning model is used to take the prediction results of Level 1 as feature input for final prediction and classification.

[0188] In an implementation manner, the S4 specifically includes:

[0189] S41, Level 1 prediction result splicing: In this step, we need to consider how to effectively splice the prediction results of different models for features. c1 ,Y c2 ,…,Y c5 And Transformer's prediction result Y for text class features t To splice:

[0190] Y level1 =concat(Y c1 ,Y c2 ,…,Y c5 ,Y t )

[0191] The specific steps are as follows:

[0192] S411, prediction results for category features: First, for each category feature prediction result Y c1 ,Y c2 ,…,Y c5 , you can consider using one-hot encoding or category label encoding to represent it; then concatenate the prediction results of each model for the same data set by column.

[0193] S412. Prediction results for text features: Prediction results Y for text models such as Transformer t , which is usually a continuous vector. Before concatenation, the prediction results of the text features may need to be normalized or dimensionally reduced to ensure that they have the same dimension as the prediction results of other features.

[0194] S42, K-fold cross validation splicing validation set prediction results: In this step, we need to i Perform K-fold cross validation and concatenate the prediction results of different folds. The specific steps are as follows:

[0195] S421. Divide the training data into K mutually exclusive subsets. For each basic model, use K-1 of the K subsets for training, and then make predictions on the remaining subset.

[0196] S422. Assume that on the kth fold, the base model M i The prediction results for the validation set are Concatenate these K sets of prediction results to get a K×n matrix, where n is the number of samples in the validation set:

[0197]

[0198] For each base model M i Execute each of them once to obtain K K×n matrices, and then concatenate these matrices together again as the input of the next layer of learners:

[0199] Y level1_valid =concat(Y valid_concat_1 ,Y valid_concat_2 ,…,Y valid_concat_K )

[0200] Among them, Y level1_valid Represents the overall situation of the prediction results of all basic models on the validation set.

[0201] S43, Level 2 ensemble learning model: Y obtained in S42 level1_valid The matrix is ​​used as the input feature of the Level 2 model, and the original target label y will be used as the target of the Level 2 model. level2 =Y level1_valid , then:

[0202]

[0203] Select XGBoost as the Level 2 learner and use the concatenated prediction result matrix X level2 And the corresponding target label y for model training. The specific training process can be expressed as:

[0204]

[0205] Where L is the loss function, Ω(f) is the regularization term, and N is the number of training samples.

[0206] In other embodiments, the type or prediction method of the basic model can be appropriately adjusted to adapt to different task requirements. For hyperparameter tuning, methods such as cross-validation, grid search, or Bayesian optimization can be used to obtain the best model performance.

[0207] S44. In the actual prediction process, the trained basic model is first used to predict the new data set to generate the Level 1 prediction result matrix Y level1_test , assuming that the new data set has n′ samples, the prediction result of each basic model is:

[0208]

[0209] These prediction results are concatenated to form the input feature matrix X of Level 2 level2_test :

[0210] X level2_test =concat(Y test_1 ,Ytest_2 ,…,Y test_m )

[0211] The final prediction result is:

[0212]

[0213] S5. Threat monitoring and response module: Based on the prediction results of the Stacking framework fusion module, the tool monitors and identifies network security threats in real time. Once a potential security threat is detected, the tool will immediately issue an alarm and respond through preset security measures;

[0214] In an implementation manner, the S5 specifically includes:

[0215] S51. Real-time data monitoring: The tool continuously monitors network traffic and related data, and generates data samples to be tested X real-time , these data samples are converted into feature vectors suitable for model prediction through the preprocessing module:

[0216] X real-time =Preprocess(Raw Data)

[0217] S52, Threat Prediction: Use the trained Stacking framework fusion model to predict real-time data and determine whether there are potential network security threats:

[0218] Y real-time,level1 =concat(M 1 (X real-time ),M 2 (X real-time ),…,Mm(X real-time ))

[0219]

[0220] Among them, Y real-time,level1 The prediction result matrix of Level 1 is obtained by predicting real-time data using multiple basic models. i (X real-time ) represents the prediction result of the i-th basic model on the real-time data; Represents the final threat prediction result, Represents the Level 2 integrated learning model;

[0221] S521, multiple pre-trained basic models (such as decision tree, random forest, support vector machine, etc.) respectively train the feature vector X real-time Make predictions and generate preliminary prediction results.

[0222] S522, concatenate the prediction results of all basic models to form the prediction result matrix Y of Level 1 real-time,level1 .

[0223] S523, through the integrated learning model Y real-time,level1 Further processing is performed to obtain the final threat prediction results

[0224] S53, Threat identification and alert: Based on threat prediction results The tool determines whether there is a potential security threat. If a threat is detected (for example, the predicted result is an attack), the tool immediately issues an alarm and records the threat information:

[0225]

[0226] The specific implementation steps are as follows:

[0227] S531, tool real-time evaluation prediction results Determine if there is a potential threat.

[0228] S532. If it is determined that a threat exists, the tool generates an alert message including detailed information such as the threat type, source, and time.

[0229] S533. Record the threat information in the security event log for subsequent analysis and auditing.

[0230] S54, Response measures: The tool responds to the detected threat according to the preset security measures, which specifically include the following steps:

[0231] S541, block network connections from threat sources to prevent the spread of threats, and execute rule judgment procedures;

[0232] S542. Record threat monitoring and corresponding details for subsequent analysis and audit;

[0233] S543. If the automatic operation and maintenance rules are met, the preset automatic defense measures are executed, such as updating the firewall rules and enabling the intrusion prevention system;

[0234] S544. If the automatic operation and maintenance rules are not met, a work order is generated to notify the operation and maintenance administrator and relevant security personnel to ensure that manual intervention measures are taken in a timely manner;

[0235] S55, Feedback and Learning: Feedback the detected threat information and response results to the model.

[0236] The specific implementation steps are as follows:

[0237] S551. Collect all data generated during threat detection and response, including prediction results, actual threat information, response measures and their effects, etc.

[0238] S552, Model update: Retrain and optimize threat detection models based on newly collected data to ensure that the models can adapt to new threat scenarios.

[0239] S553. Tool evaluation: Regularly evaluate the threat detection and response effectiveness of the tools to identify and improve weak links in the tools.

[0240] S6. User interaction and configuration module: allows users to view real-time monitoring results, configure and adjust monitoring parameters, and receive and process alarm information. Users can interact with the tool through this module to achieve real-time monitoring and management of network security threats.

[0241] In an implementation manner, the S6 specifically includes:

[0242] S61. Real-time monitoring results viewing: Users can view real-time monitoring results through a visual interface, including current network traffic, potential threats, detection logs, etc.

[0243]

[0244] S62. Monitoring parameter configuration: Users can configure and adjust the tool’s monitoring parameters to suit different network environments and security requirements:

[0245] P config ={p 1 ,p 2 ,…,p n where p i is the i-th monitoring parameter

[0246] P new =Adjust(P config ,ΔP)

[0247] Among them, P config Represents a configuration set of monitoring parameters, which includes all monitoring parameters used in the tool and is used to control and adjust the behavior of the network security threat monitoring tool; new represents the set of monitoring parameter configurations after adjustment; ΔP represents the adjustment amount of the monitoring parameter, that is, the change amount of each parameter before and after the adjustment;

[0248] S63. Alarm reception and processing: Users can receive security alarms issued by the tool and process the alarms. The alarm information includes threat type, threat level, and recommended measures.

[0249] A alert ={a 1,a 2 ,…,a m where a i is the i-th alarm information

[0250]

[0251] S64, Interaction and Feedback: Users interact with the tool through this module and submit feedback to help the tool optimize detection strategies and response measures:

[0252] F feedback ={f 1 ,f 2 ,…,f k}where f i is the i-th feedback

[0253]

[0254] Example:

[0255] In a regional power company A, with the continuous increase in business and network services, the network security challenges it faces are becoming increasingly severe. In order to improve the accuracy and efficiency of network security monitoring, Company A deployed a multi-model collaborative network security threat intelligent monitoring tool under the Stacking integration framework proposed in this invention.

[0256] During the implementation process, we first used the network security monitoring system in operation of Company A to collect a large amount of key data, such as source IP address, destination IP address, attack time, attack category, etc. After pre-processing such as data cleaning and outlier processing, these data were converted into standardized data sets. Next, we further optimized the standardized data sets through feature selection and engineering technology, and used these data to train a usable network security threat model, and finally deployed the trained model in the network security monitoring tool.

[0257] During the application process, the tool accesses the key data of the network security monitoring system in real time. These data are automatically uploaded to the network security database and preprocessed for subsequent analysis. The tool uses different types of models to characterize the preprocessed data, such as Random Forest, Transformer, etc. These methods can effectively characterize and process different types of data, thereby providing accurate network threat predictions. In this process, the tool adaptively adjusts the model parameters to make the prediction model more suitable for the actual network security monitoring scenario.

[0258] In a quarter (about three months), Company A evaluated the effectiveness of the tool. The specific data is shown in Table 1 below:

[0259] Table 1A Company Cybersecurity Threat Forecast Report

[0260] Data Category Before deploying the tool After deploying the tool Network security threat prediction accuracy 65.3％ 99.6％ Response time 60s 10s

[0261] As can be seen from Table 1 above, in the embodiment, after the deployment of the tool, the accuracy of network security threat prediction of Company A was significantly improved from 65.3% to 99.6%. At the same time, the network security threat response time was greatly reduced, which greatly improved the timeliness and flexibility of the prediction. The present invention provides Company A with a comprehensive, efficient and intelligent solution, which effectively ensures the company's network security by introducing a variety of advanced technologies.

[0262] The preferred embodiments of the present invention are described in detail above in conjunction with the accompanying drawings, but the present invention is not limited to the above embodiments, and various changes can be made within the knowledge scope of ordinary technicians in this field without departing from the purpose of the present invention.

[0263] Many other changes and modifications may be made without departing from the concept and scope of the present invention.It should be understood that the present invention is not limited to the specific embodiments, and the scope of the present invention is defined by the appended claims.

Claims

1. A multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework, characterized by: Includes the following modules: S1. Data collection and preprocessing module: This module is the data entry of the tool. It is responsible for collecting raw network data and performing preliminary processing. It removes noise and redundant information through data cleaning, outlier processing, missing value filling, and feature conversion to ensure that the data set for subsequent model training is of high quality and consistency. S2, Feature Selection and Engineering Module: Based on domain knowledge and data characteristics, key features are extracted from the preprocessed data, and the feature set is further optimized through feature selection and engineering techniques, by reducing irrelevant features, eliminating redundant features, and creating new synthetic features; S3, feature representation module: Use different types of models to represent the selected features, convert the original data into high-dimensional feature vectors, encode and convert the features with obvious category properties, and use machine learning models for efficient representation. For text features, use Transformer encoder for deep representation; S4, Stacking framework fusion module: Use the Stacking framework to fuse the feature vectors output by the feature representation module. In Level 1, the prediction results of the same data set are spliced ​​by different models to form a new feature vector. In Level 2, the XGBoost ensemble learning model is used to take the prediction results of Level 1 as feature input for final prediction and classification. S5. Threat monitoring and response module: Based on the prediction results of the Stacking framework fusion module, the tool monitors and identifies network security threats in real time. Once a potential security threat is detected, the tool will immediately issue an alarm and respond through preset security measures; S6. User interaction and configuration module: allows users to view real-time monitoring results, configure and adjust monitoring parameters, and receive and process alarm information. Users can interact with the tool through this module to achieve real-time monitoring and management of network security threats.

2. According to claim 1, the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework is characterized in that: The S1 specifically includes: S11. Deleting duplicate data: Checking and deleting duplicate records based on unique identifiers; S12. Missing value processing: Count the number of missing values ​​in each feature column. If the missing ratio exceeds 15%, delete the feature column directly. Otherwise, for numerical features, such as "Confidence" or "Threat Level", if there are missing values, use the mean value to fill them. For categorical features, such as "Threat Category" and "Attack Chain Stage", if there are missing values, fill them according to business rules or the most frequently occurring category. S13. Outlier processing: First, use the Z-score method to identify data points that deviate too much from the average value: Among them, Z i is the Z-score of the ith data point, x i represents the value of the i-th data point, μ is the mean of the data set, and σ is the standard deviation of the data set; secondly, using the IQR rule, the range of outliers is defined by Q3+1.5×IQR and Q1-1.5×IQR, where Q1 refers to the first quartile and Q3 refers to the third quartile; S14, Feature conversion: Convert data into a format suitable for model use. Different models accept different types of data. For features with obvious meanings such as IP addresses or ports, convert them into original binary form to facilitate the model to perform underlying network analysis and processing; for text data with category features, map each category into an ID value; for text features, tokenization based on the BPE word segmentation algorithm will be used: Where (x, y) is a pair of adjacent characters, and freq(x, y) is the frequency of occurrence of the character pair in the text, until the preset vocabulary size is reached or it can no longer be merged.

3. According to claim 1, the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework is characterized in that: The S2 specifically includes: S21. Feature filtering based on domain knowledge: Use domain knowledge to preliminarily screen the original features. Time records or unique identification features are useless for model training and are directly eliminated. S22. Based on feature selection algorithm: Five machine learning models: random forest, AdaBoost, ExtraTree, GradientBoosting and decision tree are used for feature selection to reduce irrelevant features and eliminate redundant features. One of the measurement criteria for feature importance is mean impurity reduction (MDI). For the random forest algorithm, the average impurity reduction of each feature in all trees after filtering by domain knowledge is calculated, and then the importance of each feature is evaluated based on this average value, specifically: Where T is the set of decision trees, v(t) is the feature corresponding to node t, p(t) is the sample ratio of node t, Δi(t) represents the reduction in impurity, and N(f) is the number of times feature f appears. For the AdaBoost algorithm, the feature importance is evaluated based on the weight of each weak classifier and the frequency of use of the feature in the classifier. Specifically: Among them, α t represents the weight of the weak classifier in the tth iteration, ε t is the classification error rate; For the ExtraTree algorithm, randomness is added when selecting features and dividing thresholds to discover effective features under highly randomized conditions; For the GradientBoosting algorithm, features that can improve model performance are discovered through combination; For the observation tree algorithm, by observing the splitting rules and feature importance scores of the decision tree, features that have little impact on the classification results can be quickly eliminated.

4. According to claim 1, the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework is characterized in that: The S3 specifically includes: S31, Characterization of category property characteristics: After feature screening in S22, a set C containing all relevant category feature columns is obtained, where C = c1, c2, ..., c n , each c i represents a set of discrete category values. For c i The categorical features in are converted into numerical data through the label encoding mapping function: L(c j )=j(j=1,2,…,m) Among them, each category c j is mapped to a unique integer j. Considering the limitations of a single machine learning model in feature representation and learning, five machine learning models, including random forest (RF), AdaBoost (AB), ExtraTree (ET), GradientBoosting (GB) and decision tree (DT), are used for ensemble learning to make full use of the characteristics of each model and improve the overall prediction performance. Specifically: Where x represents a sample of network security attack behavior characteristics, RF(x) is the model's judgment on whether the sample is a threat, and h t (x) is the prediction of the tth tree, T is the number of trees; Among them, AB(x) represents the final prediction result of the AdaBoost model for the input sample x, G m (x) represents the prediction result of the mth weak classifier for the input sample x, α m Represents the weight of the mth weak classifier; GB(x)=F0(x)+η*∑(γ m *h m (x)) Among them, GB(x) represents the prediction result of the GradientBoosting model for the input sample x, F0(x) represents a basic, non-threatening network behavior pattern, η is the learning rate, h m (x) represents a weak learner; Among them, ET(x) represents the prediction result of the ExtraTree model for the input sample x, and the other parameters are the same as RF(x). Each base learner will be trained independently using the converted numerical data. After training, each model will predict the validation set and generate its own prediction results. S32, representation of text-like features: The set of subword units obtained after BPE segmentation in S14 is represented as T = {t1, t2, ..., t n }, each subword unit t i Mapped to a unique ID representation: Next, the mapped subword ID sequence is truncated or padded to make its length uniform to L: Next, each subword sequence is embedded in the Converted into a fixed-dimensional embedding vector e i : E={e1,e2,…,e n } Among them, the embedding vector e i is a d-dimensional vector, that is These embedding vectors capture the semantic information in network security attack data and can reflect the security characteristics and relevance of subwords. In order to introduce sequence information, position encoding p is used. i Add to the embedding vector: with i =e i +p i The positional encoding is calculated using the following formula: Among them, j is the dimension index, d refers to the dimension of the model, and then the position-encoded vector Z = {z1,z2,…,z n } Input to the Transformer encoder: H=Encoder(z) The Transformer encoder uses a multi-head self-attention mechanism and a feedforward neural network to encode the input to extract key features from the text. The multi-head self-attention mechanism models the context by weighted combinations of words at different positions in a sequence, helping the model understand the relevance and importance of different attack behaviors. Specifically: MultiHead(Q,K,V)=Concat(head1,…,head h )W O Among them, Q, K, V are query, key, and value matrices obtained through linear transformation, d k is the dimension of the attention head. These queries, keys, and values ​​contain key information such as the attack type, attacker IP address, and victim IP address. Then, the output of the self-attention mechanism is transformed through a feedforward neural network to extract higher-level feature representations. The feedforward neural network can dig deeper into the semantic information in the text and better understand the patterns and characteristics of the attack behavior. The calculation process is as follows: FFN(x)=ReLU(xW1+b1)W2+b2 Among them, x represents the input vector, W1 and W2 are learnable weight matrices, b1 and b2 are bias vectors. These parameters can be trained to effectively extract the key features of attack data, such as attack payload content and attack traffic characteristics.

5. According to claim 1, the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework is characterized in that: The S4 specifically includes: S41, Level 1 prediction result splicing: The prediction results Y of the five machine learning models for the category features are combined c1 ,Y c2 ,…,Y c5 And Transformer's prediction result Y for text class features t To splice: AND level1 =concat(AND c1 ,AND c2 ,…,AND c5 ,AND t ) S42. For each basic model M i Use K-fold cross validation to divide the training data into K folds. Assume that on the kth fold, the base model M i The prediction results for the validation set are Concatenate these K sets of prediction results to get a K×n matrix, where n is the number of samples in the validation set: For each base model M i Execute each of them once to obtain K K×n matrices, and then concatenate these matrices together again as the input of the next layer of learners: AND level1_valid =concat(AND valid_concat_1 ,AND valid_concat_2 ,…,AND valid_concat_K ) Among them, Y level1_valid Represents the overall situation of the prediction results of all basic models on the validation set; S43, Level 2 ensemble learning model: Y obtained in S42 level1_valid The matrix is ​​used as the input feature of the Level 2 model, and the original target label y will be used as the target of the Level 2 model. level2 =Y level1_valid , then: Select XGBoost as the Level 2 learner and use the concatenated prediction result matrix X level2 And the corresponding target label y for model training. The specific training process can be expressed as: Where L is the loss function, Ω(f) is the regularization term, and N is the number of training samples. S44. In the actual prediction process, the trained basic model is first used to predict the new data set to generate the Level 1 prediction result matrix Y level1_test , assuming that the new data set has n′ samples, the prediction result of each basic model is: These prediction results are concatenated to form the input feature matrix X of Level 2 level2_test : X level2_test =concat(AND test_1 ,AND test_2 ,…,AND test_m ) The final prediction result is: 。 6. According to claim 1, the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework is characterized in that: The S5 specifically includes: S51. Real-time data monitoring: The tool continuously monitors network traffic and related data, and generates data samples to be tested X real-time , these data samples are converted into feature vectors suitable for model prediction through the preprocessing module: X real-time =Preprocess(Raw Data) S52, Threat Prediction: Use the trained Stacking framework fusion model to predict real-time data and determine whether there are potential network security threats: Y real-time,level1 =concat(M1(X real-time ),M2(X real-time ),…,M m (X real-time )) Among them, Y real-time,level1 The prediction result matrix of Level 1 is obtained by predicting real-time data using multiple basic models. i (X real-time ) represents the prediction result of the i-th basic model on the real-time data; Represents the final threat prediction result, Represents the Level 2 integrated learning model; S53, Threat identification and alert: Based on threat prediction results The tool determines whether there is a potential security threat. If a threat is detected (for example, the predicted result is an attack), the tool immediately issues an alarm and records the threat information: S54, Response measures: The tool responds to the detected threat according to the preset security measures, which specifically include the following steps: S541, block network connections from threat sources to prevent the spread of threats, and execute rule judgment procedures; S542. Record threat monitoring and corresponding details for subsequent analysis and audit; S543. If the automatic operation and maintenance rules are met, the preset automatic defense measures are executed, such as updating the firewall rules and enabling the intrusion prevention system; S544. If the automatic operation and maintenance rules are not met, a work order is generated to notify the operation and maintenance administrator and relevant security personnel to ensure that manual intervention measures are taken in a timely manner; S55, Feedback and Learning: Feedback the detected threat information and response results to the model.

7. According to claim 1, the multi-model collaborative network security threat intelligent monitoring tool under the Stacking integrated framework is characterized in that: The S6 specifically includes: S61. Real-time monitoring results viewing: Users can view real-time monitoring results through a visual interface, including current network traffic, potential threats, and detection logs; S62. Monitoring parameter configuration: Users can configure and adjust the tool’s monitoring parameters to suit different network environments and security requirements: P config ={p1,p2,…,p n where p i is the i-th monitoring parameter P new =Adjust(P config ,ΔP) Among them, P config Represents a configuration set of monitoring parameters, which includes all monitoring parameters used in the tool and is used to control and adjust the behavior of the network security threat monitoring tool; new represents the set of monitoring parameter configurations after adjustment; ΔP represents the adjustment amount of the monitoring parameter, that is, the change amount of each parameter before and after the adjustment; S63. Alarm reception and processing: Users can receive security alarms issued by the tool and process the alarms. The alarm information includes threat type, threat level, and recommended measures. A alert ={a1,a2,…,a m where a i is the i-th alarm information S64, Interaction and Feedback: Users interact with the tool through this module and submit feedback to help the tool optimize detection strategies and response measures: F feedback ={f1,f2,…,f k }where f i is the i-th feedback 。

Images