Network security monitoring method and system based on block chain technology, and medium

Abstract

The invention discloses a network security monitoring method and system based on a block chain technology, and a medium. Relates to the technical field of network intelligent monitoring. Time queue data of a security situation and a security event are extracted from a block chain network, and the security event data and the security situation data are subjected to embedded coding and time sequence analysis by adopting an artificial intelligence technology based on deep learning, so that time sequence dynamic change characteristics of the security event and the security situation are respectively captured, and further, time sequence dynamic change characteristics of the security event and the security situation are obtained. The deep association between the security event and the security situation is mined by performing interactive fusion coding on the security event and the security situation, so that the intelligent classification and identification of the network state risk are realized. Through the mode, the accuracy and comprehensiveness of network security monitoring can be effectively improved, the dynamic change of a network environment can be better adapted, and the timely response capability to potential threats is improved, so that a powerful guarantee is provided for stable operation of a network system.

Description

Technical Field

[0001] The present invention relates to the field of network intelligent monitoring technology, and in particular to a network security monitoring method, system and medium based on blockchain technology. Background Art

[0002] With the rapid development of network technology, network security issues have become increasingly prominent and have become an important factor restricting the healthy development of an information society. As an important means of ensuring network security, network security monitoring is of great significance for timely discovering potential threats and ensuring the stable operation of information systems. Traditional network security monitoring methods usually rely on a single data source and are usually difficult to fully reflect the security status of network systems.

[0003] Existing technologies collect security situation data and security event data, and aggregate and analyze the two to obtain the security situation characteristics of the network, thereby achieving a more comprehensive network security assessment.

[0004] However, since network attacks often have temporal characteristics, that is, the attack behavior will gradually unfold over a period of time, the above-mentioned network security monitoring method based on situation awareness fails to fully consider the temporal dynamic correlation between security situation and security events, ignores the dynamic changes in the network environment, and is easily affected by instantaneous noise, which may lead to inaccurate analysis results. Summary of the invention

[0005] The technical problem to be solved by the present invention is: since network attacks often have time series characteristics, that is, the attack behavior will gradually unfold over a period of time, and the above-mentioned network security monitoring method based on situational awareness fails to fully consider the time series dynamic association between security situation and security events, ignores the dynamic changes in the network environment, and is easily affected by instantaneous noise, which may lead to inaccurate analysis results; the purpose of the present invention is to provide a network security monitoring method, system and medium based on blockchain technology, by extracting the time queue data of security situation and security events from the blockchain network, and using artificial intelligence technology based on deep learning to embed coding and time series analysis of security event data and security situation data, respectively capturing the time series dynamic change characteristics of security events and security situation, and then, by interactively fusion coding the two, in order to dig out the deep-level association between security events and security situation, so as to realize intelligent classification and identification of network status risks. In this way, the accuracy and comprehensiveness of network security monitoring can be effectively improved, the dynamic changes of the network environment can be better adapted, and the ability to respond to potential threats in a timely manner can be improved, thereby providing a strong guarantee for the stable operation of the network system.

[0006] The present invention is achieved through the following technical solutions:

[0007] This solution provides a network security monitoring method based on blockchain technology, including:

[0008] Extracting the time queue of security situation data and the time queue of security event data from the blockchain network;

[0009] In combination with the time queue of the security event data, performing aggregation analysis on the time queue of the security situation data to obtain a security event-security situation significant aggregation representation vector;

[0010] Determining network security features based on the security event-security situation significant aggregation representation vector;

[0011] The network security features are input into a preset random forest model to train corresponding target classifications to obtain network security monitoring results; the target classifications include normal network status, low-risk network status, medium-risk network status, or high-risk network status.

[0012] A further optimization scheme is that the time queue of the security event data is combined with the time queue of the security situation data to perform aggregation analysis to obtain a security event-security situation significant aggregation representation vector; including the method:

[0013] Embedding and encoding the time queue of the security situation data and the time queue of the security event data to obtain a time queue of the security situation data embedded coding vector and a time queue of the security event data embedded coding vector;

[0014] Performing time series dynamic propagation aggregation on the time queue of the security situation data embedded coding vector and the time queue of the security event data embedded coding vector respectively, so as to obtain a time series aggregation representation vector of the principal component of the security situation and a time series aggregation representation vector of the principal component of the security event;

[0015] The security situation principal component temporal aggregation representation vector and the security incident principal component temporal aggregation representation vector are interactively aggregated to obtain a security incident-security situation significant aggregation representation vector; including: extracting implicit correlation features between the security situation principal component temporal aggregation representation vector and the security incident principal component temporal aggregation representation vector as a conditional feature vector; based on the conditional feature vector, guiding the security situation principal component temporal aggregation representation vector and the security incident principal component temporal aggregation representation vector to perform cross-domain interactive fusion based on an attention mechanism to obtain the security incident-security situation significant aggregation representation vector.

[0016] A further optimization scheme is that the method of temporal dynamic propagation aggregation includes:

[0017] Extracting a current security situation / event data embedding coding vector from the time queue of the security situation / event data embedding coding vector, and performing principal component extraction based on eigenvalues ​​on the current security situation / event data embedding coding vector to obtain a principal component representation vector of the current security situation / event data;

[0018] Defining other security situation / event data embedding coding vectors in the sequence of security situation / event data embedding coding vectors as historical security situation / event data embedding coding vectors to obtain a sequence of historical security situation / event data embedding coding vectors, and performing eigenvalue-based principal component extraction on each historical security situation / event data embedding coding vector in the sequence of historical security situation / event data embedding coding vectors to obtain a sequence of historical security situation / event data principal component representation vectors;

[0019] Based on the time span of each historical security situation / event data principal component representation vector in the sequence of the historical security situation / event data principal component representation vector relative to the current security situation / event data principal component representation vector, the temporal gradient attenuation weight of each historical security situation / event data principal component representation vector is calculated to obtain a sequence of the temporal gradient attenuation weights of the historical security situation / event data;

[0020] Based on the sequence of temporal gradient attenuation weights of the historical security situation / event data, a weighted sum of the sequence of principal component representation vectors of the historical security situation / event data is calculated to obtain a principal component significant transfer aggregation representation vector of the historical security situation / event data;

[0021] The position-based sum of the historical security situation / event data principal component significant transfer aggregation representation vector and the current security situation / event data principal component representation vector is calculated to obtain a security situation / event principal component time series aggregation representation vector.

[0022] A further optimization scheme is that the method for obtaining the principal component representation vector of the current security situation / event data includes:

[0023] Calculate the covariance matrix of the current security situation / event data embedded in the coding vector to obtain the covariance matrix of the current security situation / event data;

[0024] Performing eigenvalue decomposition on the covariance matrix of the current security situation / event data to obtain a set of principal component eigenvalues ​​of the current security situation / event data and a set of corresponding principal component eigenvectors of the current security situation / event data;

[0025] Determine the maximum eigenvalue set A in the principal component eigenvalue set of the current security situation / event data, and obtain the principal component eigenvector of the current security situation / event data corresponding to the maximum eigenvalue set A as the principal component representation vector of the current security situation / event data.

[0026] A further optimization scheme is that the method for obtaining the sequence of the temporal gradient attenuation weight of the historical security situation / event data includes:

[0027] Calculating the time series propagation absolute attenuation factor of each historical security situation / event data principal component representation vector in the sequence of historical security situation / event data principal component representation vectors relative to the current security situation / event data principal component representation vector to obtain a sequence of time series propagation absolute attenuation factors;

[0028] Based on the time span between each historical security situation / event data principal component representation vector in the sequence of the historical security situation / event data principal component representation vector and the current security situation / event data principal component representation vector, each time series propagation absolute attenuation factor in the sequence of the time series propagation absolute attenuation factor is modulated in the time dimension to obtain a sequence of time span modulated propagation attenuation factors; including: calculating the timestamp difference between the historical security situation / event data principal component representation vector and the current security situation / event data principal component representation vector, rounding down the timestamp difference to obtain a time span factor; dividing the time series propagation absolute attenuation factor of the historical security situation / event data principal component representation vector by the natural exponential function value of the time span factor to obtain the time span modulated propagation attenuation factor;

[0029] The sequence of the time span modulated propagation attenuation factors is input into the information transmission screening module based on the gating function to obtain the sequence of the historical security situation / event data time series gradient attenuation weights.

[0030] A further optimization scheme is that the method for obtaining the conditional feature vector includes:

[0031] Inputting the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector into an implicit correlation feature capture network to obtain a security event-security situation implicit correlation feature vector;

[0032] The security event-security situation implicit association feature vector is activated based on a Sigmoid function to obtain the conditional feature vector.

[0033] A further optimization scheme is that the method for obtaining the security event-security situation implicit correlation feature vector includes:

[0034] The security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector are fused according to the position points and then passed through a neural network layer based on the tanh function to obtain the security event-security situation implicit association feature vector.

[0035] A further optimization scheme is that the method for obtaining the security event-security situation significant aggregation representation vector includes:

[0036] Calculate a first content contribution factor of the security situation principal component time series aggregation representation vector relative to the conditional feature vector;

[0037] Calculate a second content contribution factor of the security event principal component time series aggregation representation vector to the conditional feature vector;

[0038] Normalizing the first content contribution factor and the second content contribution factor, and using the normalized first content contribution factor and the second content contribution factor to weighted modulate the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector, to obtain a modulated security situation principal component time series aggregation representation vector and a modulated security event principal component time series aggregation representation vector;

[0039] The modulated security situation principal component temporal aggregation representation vector, the modulated security event principal component temporal aggregation representation vector and the conditional feature vector are cross-domain interactively encoded based on a converter structure to obtain the security event-security situation significant aggregation representation vector; including: using the modulated security situation principal component temporal aggregation representation vector as a query vector, the modulated security event principal component temporal aggregation representation vector as a key vector and the conditional feature vector as a value vector, inputting the modulated security situation principal component temporal aggregation representation vector, the modulated security event principal component temporal aggregation representation vector and the conditional feature vector into a feature-to-feature significant guided interaction module based on a converter structure to obtain the security event-security situation significant aggregation representation vector.

[0040] This solution also provides a network security monitoring system based on blockchain technology, which is used to implement the above-mentioned network security monitoring method based on blockchain technology; the system includes:

[0041] A data extraction module, used to extract the time queue of security situation data and the time queue of security event data from the blockchain network;

[0042] An aggregation analysis module, configured to perform aggregation analysis on the time queue of the security situation data in combination with the time queue of the security event data to obtain a security event-security situation significant aggregation representation vector;

[0043] A network security feature determination module, used to determine network security features based on the security event-security situation significant aggregation representation vector;

[0044] The target classification generation module is used to input the network security features into a preset random forest model to train the corresponding target classification and obtain the network security monitoring results; the target classification includes normal network status, low risk network status, medium risk network status or high risk network status.

[0045] The present solution also provides a computer-readable medium having a computer program stored thereon, and the computer program is executed by a processor to implement the network security monitoring method based on blockchain technology as described above.

[0046] Compared with the prior art, the present invention has the following advantages and beneficial effects:

[0047] The network security monitoring method, system and medium based on blockchain technology provided by the present invention; by extracting the time queue data of security situation and security events from the blockchain network, and using artificial intelligence technology based on deep learning to embed coding and time series analysis of security event data and security situation data, the time series dynamic change characteristics of security events and security situation are captured respectively, and then, by interactively fusion coding the two, the deep-level correlation between security events and security situation is excavated, thereby realizing intelligent classification and identification of network status risks. In this way, the accuracy and comprehensiveness of network security monitoring can be effectively improved, the dynamic changes of the network environment can be better adapted, and the ability to respond to potential threats in a timely manner can be enhanced, thereby providing a strong guarantee for the stable operation of the network system. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the exemplary embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. It should be understood that the following drawings only illustrate certain embodiments of the present invention and should not be regarded as limiting the scope. For those of ordinary skill in the art, other relevant drawings can be obtained based on these drawings without creative work. In the drawings:

[0049] Figure 1 This is a flowchart of a network security monitoring method based on blockchain technology;

[0050] Figure 2 A schematic diagram of data flow for a network security monitoring method based on blockchain technology;

[0051] Figure 3 A schematic diagram of the process of obtaining a security event-security situation significant aggregation representation vector;

[0052] Figure 4This is a schematic diagram of the network security monitoring system based on blockchain technology. DETAILED DESCRIPTION

[0053] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with embodiments and drawings. The exemplary embodiments of the present invention and their description are only used to explain the present invention and are not intended to limit the present invention.

[0054] Since network attacks often have a time-series characteristic, that is, the attack behavior will gradually unfold over a period of time, and the above-mentioned network security monitoring method based on situational awareness fails to fully consider the time-series dynamic correlation between security situation and security events, ignores the dynamic changes in the network environment, and is easily affected by instantaneous noise, which may lead to inaccurate analysis results. In view of this, the present invention provides the following embodiments to solve the above-mentioned technical problems:

[0055] Example 1

[0056] This embodiment provides a network security monitoring method based on blockchain technology, such as Figure 1 and Figure 2 As shown, including:

[0057] Step 1: Extract the time queue of security situation data and the time queue of security event data from the blockchain network; it should be understood that security situation and security events usually change over time and have the characteristics of time series change. In the technical solution of the present application, by extracting the time queue data of security situation and security events, the dynamic behavior of security events and security situation can be analyzed more accurately, and the security status of the network environment can be understood more comprehensively. In addition, blockchain technology, with its characteristics of decentralization, distributed storage and encryption security, ensures the integrity and immutability of data. By extracting data from the blockchain network, it helps to improve the security and credibility of data.

[0058] Step two, combining the time queue of the security incident data, performing aggregation analysis on the time queue of the security situation data to obtain a security incident-security situation significant aggregation representation vector; taking into account that security situation data and security incident data are often closely related in time and content. For example, when a security incident occurs in a network, the incident may have an immediate or delayed impact on the security situation of the network. Therefore, in order to accurately capture the temporal dynamic correlation between the two and to form a comprehensive perception of the network status, the present application further performs aggregation analysis on the time queue of the security incident data and the time queue of the security situation data to obtain a security incident-security situation significant aggregation representation vector. Figure 3 As shown, step 2 specifically includes the following method:

[0059] S21, embedding and encoding the time queue of the security situation data and the time queue of the security event data to obtain the time queue of the security situation data embedded coding vector and the time queue of the security event data embedded coding vector; considering that the original security situation data and security event data usually contain a large number of features and dimensions, and have different magnitudes and distribution characteristics. Therefore, in order to convert the security situation data and the security event data into feature representations with unified dimensions and magnitudes, so as to facilitate further in-depth analysis of both using artificial intelligence algorithms, this application uses embedded coding technology to process the time queue of the security situation data and the time queue of the security event data to map the data to a low-dimensional vector space, while retaining the key features and information in the data, and generating a time queue of the security situation data embedded coding vector and a time queue of the security event data embedded coding vector. In an embodiment of the present application, the Word2Vec model is used to generate a security situation embedded coding matrix and a security event embedded coding matrix after training, so as to embed and code the security situation data and the security event data, thereby converting the two into a unified vector format that can be processed by a deep learning model.

[0060] S22, respectively, the time queue of the security situation data embedded coding vector and the time queue of the security event data embedded coding vector are subjected to time series dynamic propagation aggregation to obtain the time series aggregation representation vector of the main component of the security situation and the time series aggregation representation vector of the main component of the security event; considering that the original security situation data and security event data usually contain a large number of features and dimensions, and have different magnitudes and distribution characteristics. Therefore, in order to convert the security situation data and the security event data into feature representations with unified dimensions and magnitudes, so as to facilitate further in-depth analysis of both using artificial intelligence algorithms, the present application uses embedded coding technology to process the time queue of the security situation data and the time queue of the security event data, so as to map the data to a low-dimensional vector space, while retaining the key features and information in the data, and generating the time queue of the security situation data embedded coding vector and the time queue of the security event data embedded coding vector. In an embodiment of the present application, the Word2Vec model is used to generate a security situation embedded coding matrix and a security event embedded coding matrix after training, so as to embed the security situation data and the security event data for coding, thereby converting the two into a unified vector format for deep learning model processing.

[0061] The method for dynamic time series propagation aggregation in this step includes:

[0062] S221, extracting the current security situation / event data embedded coding vector from the time queue of the security situation / event data embedded coding vector, and performing principal component extraction based on the eigenvalue on the current security situation / event data embedded coding vector to obtain the current security situation / event data principal component representation vector;

[0063] S222, define other security situation / event data embedding coding vectors in the sequence of security situation / event data embedding coding vectors as historical security situation / event data embedding coding vectors, obtain a sequence of historical security situation / event data embedding coding vectors, and perform eigenvalue-based principal component extraction on each historical security situation / event data embedding coding vector in the sequence of historical security situation / event data embedding coding vectors to obtain a sequence of historical security situation / event data principal component representation vectors; that is, regard the last time node in the time queue data as the current time node, and other time nodes as historical nodes, perform PCA on the data embedding coding vectors at each time node to remove noise interference in the data, highlight key information, and extract the most representative principal components, thereby obtaining the data principal component representation vector of the current time node and the data principal component representation vector of the historical time node.

[0064] This step specifically includes the following methods:

[0065] S2221, calculating the covariance matrix of the current security situation / event data embedded coding vector to obtain the covariance matrix of the current security situation / event data;

[0066] S2222, performing eigenvalue decomposition on the covariance matrix of the current security situation / event data to obtain a set of principal component eigenvalues ​​of the current security situation / event data and a set of principal component eigenvectors of the corresponding current security situation / event data;

[0067] S2223, determine the maximum eigenvalue set A in the principal component eigenvalue set of the current security situation / event data, and obtain the principal component eigenvector of the current security situation / event data corresponding to the maximum eigenvalue set A as the principal component representation vector of the current security situation / event data.

[0068] More specifically, based on the time span of each historical security situation data principal component representation vector in the sequence of historical security situation data principal component representation vectors relative to the current security situation data principal component representation vector, the process of calculating the time gradient attenuation weights of each historical security situation data principal component representation vector to obtain a sequence of historical security situation data time gradient attenuation weights includes: calculating the time propagation absolute attenuation factor of each historical security situation data principal component representation vector in the sequence of historical security situation data principal component representation vectors relative to the current security situation data principal component representation vector to obtain a sequence of time propagation absolute attenuation factors; based on the time span between each historical security situation data principal component representation vector in the sequence of historical security situation data principal component representation vectors and the current security situation data principal component representation vector, performing time dimension modulation on each time propagation absolute attenuation factor in the sequence of time propagation absolute attenuation factors to obtain a sequence of time span modulated propagation attenuation factors; inputting the sequence of time span modulated propagation attenuation factors into an information transmission and screening module based on a gating function to obtain a sequence of historical security situation data time gradient attenuation weights. Among them, calculating the time series propagation absolute attenuation factor of each historical security situation data principal component representation vector in the sequence of the historical security situation data principal component representation vector relative to the current security situation data principal component representation vector includes: calculating the dot division vector between the historical security situation data principal component representation vector and the current security situation data principal component representation vector, and calculating the base-two logarithmic value of the absolute value of each eigenvalue in the dot division vector to obtain the time series propagation attenuation absolute standard representation vector; calculating the dot product vector between the time series propagation attenuation absolute standard representation vector and the historical security situation data principal component representation vector, and calculating the exponential function value with base e and the sum of the eigenvalues ​​of the dot product vector as the exponent to obtain the time series propagation absolute attenuation factor. More specifically, based on the time span between each historical security situation data principal component representation vector in the sequence of historical security situation data principal component representation vectors and the current security situation data principal component representation vector, each time series propagation absolute attenuation factor in the sequence of time series propagation absolute attenuation factors is modulated in the time dimension to obtain a sequence of time span modulated propagation attenuation factors, including: calculating the timestamp difference between the historical security situation data principal component representation vector and the current security situation data principal component representation vector, rounding down the timestamp difference to obtain a time span factor; dividing the time series propagation absolute attenuation factor of the historical security situation data principal component representation vector by the natural exponential function value of the time span factor to obtain the time span modulated propagation attenuation factor.More specifically, the sequence of time span modulated propagation attenuation factors is input into an information transmission screening module based on a gating function, including: based on a preset threshold, masking the sequence of time span modulated propagation attenuation factors to obtain a sequence of masked time span modulated propagation attenuation factors; inputting the sequence of masked time span modulated propagation attenuation factors into a Sigmoid function for normalization processing to obtain a sequence of temporal gradient attenuation weights of the historical security situation data.

[0069] In summary, taking the time queue of the security situation data embedded in the coding vector as an example, the time queue of the security situation data embedded in the coding vector is subjected to time series dynamic propagation aggregation to obtain a security situation principal component time series aggregation representation vector, including: processing the time queue of the security situation data embedded in the coding vector with the following information time series dynamic propagation formula to obtain a security situation principal component time series aggregation representation vector, wherein the information time series dynamic propagation formula is:

[0070] X={x 1 ,x 2 ,...,x i ,...,x p}

[0071] h i = PCA(x i )

[0072]

[0073]

[0074] Wherein, X represents the time queue of the security situation data embedded in the coding vector, p is the number of vectors in the time queue of the security situation data embedded in the coding vector, and x p Represents the current security situation data embedding encoding vector, x 1 、x 2 and x i denote the first, second and i-th historical security situation data embedding coding vectors in the sequence of the historical security situation data embedding coding vectors, PCA(·) denotes the principal component analysis function, h i represents the principal component representation vector of the i-th historical security situation data, h p Represents the principal component representation vector of the current security situation data, (·) T represents the transpose of the vector, n represents the length of the embedding encoding vector of the historical security situation data, C i represents the sample covariance matrix of the i-th historical security situation data embedded coding vector, that is, the historical security situation data covariance matrix, U irepresents the matrix composed of the set of principal component eigenvectors of historical security situation data obtained by performing eigenvalue decomposition on the covariance matrix of the i-th historical security situation data, Λ i represents a diagonal matrix consisting of a set of principal component eigenvalues ​​of the historical security situation data obtained by performing eigenvalue decomposition on the i-th historical security situation data covariance matrix, diag is a diag function used to construct a diagonal matrix, λ i1 , i2 , ik and λ im represents the first, second, kth and mth historical security situation data principal component eigenvalues ​​in the set of the i-th historical security situation data principal component eigenvalues, respectively, m is the number of eigenvalues ​​in the set of the historical security situation data principal component eigenvalues, u i1 、u i2 、u iz and u im denote the first, second, zth and mth principal component eigenvectors of the historical security situation data in the set of the i-th principal component eigenvectors of the historical security situation data, respectively; argmax(·) denotes the index corresponding to the maximum value; z denotes the index of the maximum value in the set of principal component eigenvalues ​​of the historical security situation data; represents the jth eigenvalue of the principal component representation vector of the i-th historical security situation data, represents the j-th eigenvalue of the principal component representation vector of the current security situation data, |·| represents the absolute value, log represents the logarithmic function with base 2, l represents the length of the principal component representation vector of the current security situation data, exp(·) represents the exponential function with base e, d i represents the absolute attenuation factor of the time series propagation of the principal component representation vector of the i-th historical security situation data, t p and t i respectively represent the timestamps of the current security situation data embedded coding vector and the i-th historical security situation data embedded coding vector, Indicates rounding down, e i represents the modulation propagation attenuation factor of the i-th time span, mask(·) represents mask processing, sigmoid represents the sigmoid function, θ represents the preset threshold, and w i represents the time series gradient attenuation weight of the i-th historical security situation data, x p+1 A time series aggregation representation vector representing the principal components of the security situation.

[0075] S223, based on the time span of each historical security situation / event data principal component representation vector in the sequence of the historical security situation / event data principal component representation vector relative to the current security situation / event data principal component representation vector, calculate the temporal gradient attenuation weight of each historical security situation / event data principal component representation vector to obtain a sequence of temporal gradient attenuation weights of the historical security situation / event data;

[0076] In order to capture the trend of feature evolution over time and the information loss, the change rate of the feature principal component of each historical time node relative to the current time node and its corresponding time series propagation absolute attenuation factor are further calculated to enhance the model's ability to understand information transmission over long time intervals. Then, the time span factor is introduced to adjust the above time series propagation absolute attenuation factor to simulate the gradual forgetting process of data over time, so that recent data features receive greater attention, while early data features gradually fade. This step specifically includes the following methods:

[0077] S2231, calculating the time series propagation absolute attenuation factor of each historical security situation / event data principal component representation vector in the sequence of historical security situation / event data principal component representation vectors relative to the current security situation / event data principal component representation vector, to obtain a sequence of time series propagation absolute attenuation factors;

[0078] S2232, based on the time span between each historical security situation / event data principal component representation vector in the sequence of the historical security situation / event data principal component representation vector and the current security situation / event data principal component representation vector, modulate each time series propagation absolute attenuation factor in the sequence of the time series propagation absolute attenuation factor to obtain a sequence of time span modulated propagation attenuation factors; including: calculating the timestamp difference between the historical security situation / event data principal component representation vector and the current security situation / event data principal component representation vector, rounding down the timestamp difference to obtain a time span factor; dividing the time series propagation absolute attenuation factor of the historical security situation / event data principal component representation vector by the natural exponential function value of the time span factor to obtain the time span modulated propagation attenuation factor;

[0079] S2233, input the sequence of time span modulated propagation attenuation factors into the information transmission screening module based on the gating function to obtain the sequence of time series gradient attenuation weights of the historical security situation / event data.

[0080] The absolute attenuation factor of the time-series propagation modulated by the time dimension is gated and screened to identify the most influential propagation path and assign corresponding weights accordingly.

[0081] S224, based on the sequence of temporal gradient attenuation weights of the historical security situation / event data, calculating the weighted sum of the sequence of principal component representation vectors of the historical security situation / event data to obtain a principal component significant transfer aggregation representation vector of the historical security situation / event data;

[0082] S225, calculating the positional sum of the historical security situation / event data principal component significant transfer aggregation representation vector and the current security situation / event data principal component representation vector, to obtain the security situation / event principal component time series aggregation representation vector.

[0083] Here, the principal component features of each time node are aggregated by calculating the position weighted sum, so as to effectively integrate the long-term trends and short-term fluctuations of security events and security situations, generate the principal component time series aggregation representation vector of the security situation and the principal component time series aggregation representation vector of the security event, thereby achieving accurate perception of the dynamic changes in the security situation and security event time series information.

[0084] S23, interactively aggregate the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector to obtain a security event-security situation significant aggregation representation vector; in order to fully explore the deep correlation between security events and security situations, the present application proposes a feature-guided fusion method based on cross-modal implicit correlation features, which is guided by the implicit correlation features between security events and security situations to promote the explicit fusion of features between the two, thereby achieving a deeper level of feature interaction.

[0085] This step includes: extracting implicit correlation features between the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector as a conditional feature vector; based on the conditional feature vector, guiding the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector to perform cross-domain interactive fusion based on the attention mechanism to obtain the security event-security situation significant aggregation representation vector.

[0086] In this step, the method for obtaining the conditional feature vector includes:

[0087] S231, input the principal component time series aggregation representation vector of the security situation and the principal component time series aggregation representation vector of the security event into an implicit correlation feature capture network to obtain a security event-security situation implicit correlation feature vector; specifically, the principal component time series aggregation representation vector of the security situation and the principal component time series aggregation representation vector of the security event are fused according to the position points and then passed through a neural network layer based on the tanh function to obtain the security event-security situation implicit correlation feature vector.

[0088] S232, performing feature activation based on a Sigmoid function on the security event-security situation implicit association feature vector to obtain the conditional feature vector.

[0089] In step 2, the method for obtaining the security event-security situation significant aggregation representation vector includes:

[0090] S201, calculating a first content contribution factor of the security situation principal component time series aggregation representation vector relative to the conditional feature vector;

[0091] S202, calculating a second content contribution factor of the security event principal component time series aggregation representation vector to the conditional feature vector;

[0092] S203, normalizing the first content contribution factor and the second content contribution factor, and using the normalized first content contribution factor and the second content contribution factor to weighted modulate the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector, to obtain a modulated security situation principal component time series aggregation representation vector and a modulated security event principal component time series aggregation representation vector;

[0093] S204, performing cross-domain interactive encoding based on a converter structure on the modulated security situation principal component time series aggregation representation vector, the modulated security event principal component time series aggregation representation vector and the conditional feature vector to obtain the security event-security situation significant aggregation representation vector; including: using the modulated security situation principal component time series aggregation representation vector as a query vector, the modulated security event principal component time series aggregation representation vector as a key vector and the conditional feature vector as a value vector, inputting the modulated security situation principal component time series aggregation representation vector, the modulated security event principal component time series aggregation representation vector and the conditional feature vector into a feature-significant guided interaction module based on a converter structure to obtain the security event-security situation significant aggregation representation vector.

[0094] In a specific example of the present application, first, the implicit correlation features between the time series aggregation representation vector of the principal component of the security situation and the time series aggregation representation vector of the principal component of the security incident are extracted as conditional feature vectors; specifically, the time series aggregation representation vector of the principal component of the security situation and the time series aggregation representation vector of the principal component of the security incident are input into the implicit correlation feature capture network to obtain the security incident-security situation implicit correlation feature vector; then, the security incident-security situation implicit correlation feature vector is subjected to feature activation based on the Sigmoid function to obtain the conditional feature vector. That is, the implicit correlation features shared between the time series aggregation representation vector of the principal component of the security situation and the time series aggregation representation vector of the principal component of the security incident are extracted through the implicit correlation feature capture network, and the extracted implicit correlation features are nonlinearly transformed using the Sigmoid function to emphasize key information and suppress irrelevant noise, so as to serve as the conditional feature vector. Among them, the specific process of inputting the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector into the implicit correlation feature capture network to obtain the security event-security situation implicit correlation feature vector is: the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector are fused according to the position points and then passed through the neural network layer based on the tanh function to obtain the security event-security situation implicit correlation feature vector. Furthermore, based on the conditional feature vector, the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector are guided to perform cross-domain interactive fusion based on the attention mechanism to obtain the security event-security situation significant aggregation representation vector; specifically, based on the conditional feature vector, the specific process of guiding the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector to perform cross-domain interactive fusion based on the attention mechanism includes: calculating the first content contribution factor of the security situation principal component time series aggregation representation vector relative to the conditional feature vector; calculating the security event principal component time series aggregation representation vector to the conditional feature vector. a second content contribution factor; normalizing the first content contribution factor and the second content contribution factor, and using the normalized first content contribution factor and the second content contribution factor to weighted modulate the security situation principal component temporal aggregation representation vector and the security event principal component temporal aggregation representation vector to obtain a modulated security situation principal component temporal aggregation representation vector and a modulated security event principal component temporal aggregation representation vector; performing cross-domain interactive encoding based on a converter structure on the modulated security situation principal component temporal aggregation representation vector, the modulated security event principal component temporal aggregation representation vector and the conditional feature vector to obtain the security event-security situation significant aggregation representation vector.That is, the principal component temporal aggregation representation vector of the security situation and the principal component temporal aggregation representation vector of the security incident are respectively evaluated for correlation with the conditional feature vector to determine the importance of the two for the joint representation, and thereby weighted modulate the original principal component temporal aggregation representation vector of the security situation and the principal component temporal aggregation representation vector of the security incident, thereby effectively emphasizing the key information in the two and suppressing irrelevant information. Finally, the modulated principal component temporal aggregation representation vector of the security situation is used as the query vector, the modulated principal component temporal aggregation representation vector of the security incident is used as the key vector, and the conditional feature vector is used as the value vector, and the Transformer architecture is used to guide the interaction between features, thereby realizing the deep interactive fusion of cross-modal features, so as to generate a security incident-security situation significant aggregation representation vector containing deep correlation information of security incidents and security situation.

[0095] Among them, calculating the first content contribution factor of the security situation principal component time series aggregation representation vector relative to the conditional feature vector includes: calculating the dot division vector between the security situation principal component time series aggregation representation vector and the conditional feature vector, and calculating the base-two logarithmic value of the absolute value of each eigenvalue in the dot division vector to obtain a semantic correlation representation vector; calculating the dot product vector between the semantic correlation representation vector and the security situation principal component time series aggregation representation vector, and calculating an exponential function value with base e and the sum of the eigenvalues ​​of the dot product vector as an exponent to obtain the first content contribution factor.

[0096] More specifically, the modulated security situation principal component time series aggregation representation vector, the modulated security event principal component time series aggregation representation vector and the conditional feature vector are cross-domain interactively encoded based on a converter structure to obtain the security event-security situation significant aggregation representation vector, including: using the modulated security situation principal component time series aggregation representation vector as a query vector, using the modulated security event principal component time series aggregation representation vector as a key vector and using the conditional feature vector as a value vector, inputting the modulated security situation principal component time series aggregation representation vector, the modulated security event principal component time series aggregation representation vector and the conditional feature vector into a feature-to-feature significant guidance interaction module based on a converter structure to obtain the security event-security situation significant aggregation representation vector. In a specific example, the process of inputting the modulated security situation principal component time series aggregation representation vector, the modulated security event principal component time series aggregation representation vector and the conditional feature vector into a feature-to-feature significant guidance interaction module based on a converter structure includes: multiplying the modulated security situation principal component time series aggregation representation vector by the transposed vector of the modulated security event principal component time series aggregation representation vector and then dividing it by the square root of the length of the security event principal component time series aggregation representation vector to obtain a security event-security situation feature query attention score matrix; passing the security event-security situation feature query attention score matrix through a softmax function and then multiplying it by the conditional feature vector to obtain the security event-security situation significant aggregation representation vector.

[0097] In summary, the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector are interactively aggregated to obtain the security event-security situation significant aggregation representation vector, including: processing the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector with the following feature interactive fusion formula to obtain the security event-security situation significant aggregation representation vector, wherein the feature interactive fusion formula is:

[0098]

[0099] X c =sigmoid(X J

[0100]

[0101]

[0102] X 1 '=X 1 w 1

[0103] X 2 '=X2 w 2

[0104]

[0105] Among them, X 1 represents the time series aggregation representation vector of the principal component of the security situation, X 2 represents the principal component time series aggregation representation vector of the security event, Indicates adding by position point, X J represents the implicit correlation feature vector between security incident and security situation, W VT and b VT Represent the weight matrix and bias parameter of the neural network layer, tanh represents the hyperbolic tangent function, sigmoid represents the sigmoid activation function, and X c represents the conditional eigenvector, and represents the i-th eigenvalue in the principal component time series aggregation representation vector of the security situation, the i-th eigenvalue in the principal component time series aggregation representation vector of the security incident, and the i-th eigenvalue in the conditional feature vector, respectively; |·| is the absolute value symbol; log represents the logarithmic function with base 2; exp(·) represents the exponential function with base e; n represents the length of the principal component time series aggregation representation vector of the security situation, and the principal component time series aggregation representation vector of the security incident and the conditional feature vector have the same length; CI 1 and CI 2 denote the first content contribution factor and the second content contribution factor respectively, w 1 and w 2 Respectively represent the normalized first content contribution factor and the second content contribution factor, X 1 ' and X 2 'represent the principal component time series aggregation representation vector of security situation after modulation and the principal component time series aggregation representation vector of security events after modulation, (·) T represents the transpose of a vector, represents matrix multiplication operation, softmax is the normalized exponential function, X r The security incident-security situation significant aggregation representation vector is represented.

[0106] Step 3: determining network security features based on the security event-security situation significant aggregation representation vector;

[0107] It should be understandable that after the above processing, the security incident-security situation significant aggregation representation vector has fully integrated the temporal dynamic correlation information of security incidents and security situation, effectively mined the deep implicit correlation between the two, and provided strong data support for subsequent network status risk assessment tasks. Therefore, in the technical solution of the present application, the security incident-security situation significant aggregation representation vector is used as a network security feature, and is further classified and identified to achieve accurate judgment of the network security status.

[0108] Preferably, in an example of the present application, determining the network security feature based on the security event-security situation significant aggregation representation vector includes:

[0109] Performing feature optimization on the security incident-security situation significant aggregation representation vector to obtain an optimized security incident-security situation significant aggregation representation vector;

[0110] Using the optimized security event-security situation significant aggregation representation vector as the network security feature;

[0111] The step of performing feature optimization on the security incident-security situation significant aggregation representation vector to obtain an optimized security incident-security situation significant aggregation representation vector includes:

[0112] Calculate the sum of the absolute values ​​of each eigenvalue of the security incident-security situation significant aggregation representation vector to obtain a first security incident-security situation significant aggregation spatial structure value, and calculate the square root of the sum of the squares of each eigenvalue of the security incident-security situation significant aggregation representation vector to obtain a second security incident-security situation significant aggregation spatial structure value;

[0113] Multiply each eigenvalue of the security incident-security situation significant aggregation representation vector by the first security incident-security situation significant aggregation spatial structure value and the second security incident-security situation significant aggregation spatial structure value to obtain a first security incident-security situation significant aggregation structure reference value and a second security incident-security situation significant aggregation structure reference value corresponding to each eigenvalue;

[0114] Multiply each eigenvalue of the security incident-security situation significant aggregation representation vector by the length of the security incident-security situation significant aggregation representation vector and the square root of the length to obtain a first security incident-security situation significant aggregation scale transformation value and a second security incident-security situation significant aggregation scale transformation value corresponding to each eigenvalue;

[0115] Dividing the first security event-security situation significant aggregation structure reference value by the difference between the first security event-security situation significant aggregation spatial structure value and the first security event-security situation significant aggregation scale transformation value to obtain a first security event-security situation significant aggregation transformation adjustment value;

[0116] Dividing the second security event-security situation significant aggregation structure reference value by the difference between the second security event-security situation significant aggregation spatial structure value and the second security event-security situation significant aggregation scale transformation value to obtain a second security event-security situation significant aggregation transformation adjustment value;

[0117] Calculate the weighted sum of the first security event-security situation significant aggregation transformation adjustment value and the second security event-security situation significant aggregation transformation adjustment value to obtain each eigenvalue of the optimized security event-security situation significant aggregation representation vector.

[0118] Here, the security incident-security situation significant aggregation representation vector, denoted as V, is optimized as follows:

[0119]

[0120] v 1i =(α×v i ) / (α-L×v i )

[0121]

[0122]

[0123] Where V is the security incident-security situation significant aggregation representation vector, v i are the eigenvalues ​​of the security incident-security situation significant aggregation representation vector, α is the first security incident-security situation significant aggregation spatial structure value, β is the second security incident-security situation significant aggregation spatial structure value, v 1i is the first security event-security situation significant aggregation transformation adjustment value, v 2i is the second security event-security situation significant aggregation transformation adjustment value, V 1 is the first security event-security situation significant aggregation transformation adjustment vector composed of the first security event-security situation significant aggregation transformation adjustment value, V 2 is the second security event-security situation significant aggregation transformation adjustment vector composed of the second security event-security situation significant aggregation transformation adjustment values, ω is a weighted hyperparameter, is the point addition, ⊙ is the point product, and V′ is the optimized security event-security situation significant aggregation representation vector.

[0124] That is, the present application takes into account the principal component temporal significant aggregation features of the low-dimensional embedded coding features of the time queue of the security situation data and the time queue of the security event data, respectively, which are represented by the security situation principal component temporal aggregation representation vector and the security event principal component temporal aggregation representation vector. When they are subjected to feature-guided interaction based on implicit correlation features, the feature modal difference, principal component extraction difference and superimposed gradient attenuation temporal aggregation difference between the security situation principal component temporal aggregation representation vector and the security event principal component temporal aggregation representation vector will make the semantic fusion feature representation of the security event-security situation significant aggregation representation vector have a complex semantic spatial structure, thereby expecting to improve its classification convergence and generalization effects under complex spatial structures.

[0125] Therefore, in the preferred example, with respect to the spatial structure information of the feature set of the security incident-security situation significant aggregation representation vector in the high-dimensional space, a scale-based box transformation of each eigenvalue of the security incident-security situation significant aggregation representation vector is performed by taking the class-norm spatial structured representation of the security incident-security situation significant aggregation representation vector as a reference window, and a spatial structure-based box attention weight adjustment of each eigenvalue of the security incident-security situation significant aggregation representation vector is implemented to ensure the invariance of spatial transformation (translation, scaling and rotation) of the security incident-security situation significant aggregation representation vector under the interaction of feature space, thereby improving the convergence and generalization effect of decoding regression of the feature set of the security incident-security situation significant aggregation representation vector under the complex spatial structure representation, and improving the accuracy of passing it.

[0126] Step 4, input the network security features into the preset random forest model to train the corresponding target classification and obtain the network security monitoring results; the target classification includes normal network status, low-risk network status, medium-risk network status or high-risk network status. Specifically, the preset random forest model is composed of multiple decision trees, and each decision tree makes classification decisions independently. In a specific embodiment of the present application, the preset random forest model uses the principles disclosed in Chinese patent CN111786950A to make target classification decisions. Since the decision-making process is not the focus of this application, it will not be repeated in this application.

[0127] In summary, according to the network security monitoring method based on blockchain technology in the embodiment of the present application, by extracting the time queue data of security situation and security events from the blockchain network, and embedding the security event data and security situation data based on deep learning artificial intelligence technology and performing time series analysis, the time series dynamic change characteristics of security events and security situation are captured respectively, and then, by interactively fusion coding the two, the deep-level correlation between security events and security situation is excavated, thereby realizing intelligent classification and identification of network status risks. In this way, the accuracy and comprehensiveness of network security monitoring can be effectively improved, the dynamic changes of the network environment can be better adapted, and the ability to respond to potential threats in a timely manner can be improved, thereby providing a strong guarantee for the stable operation of the network system.

[0128] Example 2

[0129] This embodiment provides a network security monitoring system based on blockchain technology, which is used to implement the network security monitoring method based on blockchain technology in Example 1; Figure 4 As shown, the system comprises:

[0130] A data extraction module 310 is used to extract a time queue of security situation data and a time queue of security event data from a blockchain network; an aggregation analysis module 320 is used to perform aggregation analysis on the time queue of security situation data in combination with the time queue of security event data to obtain a security event-security situation significant aggregation representation vector; a network security feature determination module 330 is used to determine a network security feature based on the security event-security situation significant aggregation representation vector; a target classification generation module 340 is used to input the network security feature into a preset random forest model, train the network security feature through the preset random forest model, and obtain a target classification corresponding to the network security feature, wherein the target classification includes a normal network status, a low risk network status, a medium risk network status, or a high risk network status.

[0131] As described above, the network security monitoring system 300 based on blockchain technology according to the embodiment of the present application can be implemented in various wireless terminals, such as a server with a network security monitoring algorithm based on blockchain technology. In one possible implementation, the network security monitoring system 300 based on blockchain technology according to the embodiment of the present application can be integrated into the wireless terminal as a software module and / or hardware module. For example, the network security monitoring system 300 based on blockchain technology can be a software module in the operating system of the wireless terminal, or it can be an application developed for the wireless terminal; of course, the network security monitoring system 300 based on blockchain technology can also be one of the many hardware modules of the wireless terminal.

[0132] Alternatively, in another example, the network security monitoring system 300 based on blockchain technology and the wireless terminal may also be separate devices, and the network security monitoring system 300 based on blockchain technology may be connected to the wireless terminal via a wired and / or wireless network, and transmit interactive information in accordance with an agreed data format.

[0133] Example 3

[0134] This embodiment provides a computer-readable medium having a computer program stored thereon, and the computer program is executed by a processor to implement the network security monitoring method based on blockchain technology as described in Embodiment 1; specifically, the following steps are performed:

[0135] Step 1: extracting the time queue of security situation data and the time queue of security event data from the blockchain network;

[0136] Step 2: combining the time queue of the security event data, performing aggregation analysis on the time queue of the security situation data to obtain a security event-security situation significant aggregation representation vector;

[0137] Step 3: determining network security features based on the security event-security situation significant aggregation representation vector;

[0138] Step 4: Input the network security features into a preset random forest model to train the corresponding target classification to obtain the network security monitoring results; the target classification includes normal network status, low risk network status, medium risk network status or high risk network status.

[0139] The specific implementation methods described above further illustrate the objectives, technical solutions and beneficial effects of the present invention in detail. It should be understood that the above description is only a specific implementation method of the present invention and is not intended to limit the scope of protection of the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the scope of protection of the present invention.

Claims

1. A network security monitoring method based on blockchain technology, characterized in that: include: Extracting the time queue of security situation data and the time queue of security event data from the blockchain network; In combination with the time queue of the security event data, performing aggregation analysis on the time queue of the security situation data to obtain a security event-security situation significant aggregation representation vector; Determining network security features based on the security event-security situation significant aggregation representation vector; The network security features are input into a preset random forest model to train corresponding target classifications to obtain network security monitoring results; the target classifications include normal network status, low-risk network status, medium-risk network status, or high-risk network status.

2. The network security monitoring method based on blockchain technology according to claim 1 is characterized in that: The method of combining the time queue of the security event data and performing aggregation analysis on the time queue of the security situation data to obtain a security event-security situation significant aggregation representation vector comprises: Embedding and encoding the time queue of the security situation data and the time queue of the security event data to obtain a time queue of the security situation data embedded coding vector and a time queue of the security event data embedded coding vector; Performing time series dynamic propagation aggregation on the time queue of the security situation data embedded coding vector and the time queue of the security event data embedded coding vector respectively, so as to obtain a time series aggregation representation vector of the principal component of the security situation and a time series aggregation representation vector of the principal component of the security event; Interactively aggregating the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector to obtain a security event-security situation significant aggregation representation vector; including: extracting implicit correlation features between the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector as a conditional feature vector; Based on the conditional feature vector, the security situation principal component temporal aggregation representation vector and the security event principal component temporal aggregation representation vector are guided to perform cross-domain interactive fusion based on the attention mechanism to obtain the security event-security situation significant aggregation representation vector.

3. The network security monitoring method based on blockchain technology according to claim 2 is characterized in that: The method for dynamic time series propagation aggregation includes: Extracting a current security situation / event data embedding coding vector from the time queue of the security situation / event data embedding coding vector, and performing principal component extraction based on eigenvalues ​​on the current security situation / event data embedding coding vector to obtain a principal component representation vector of the current security situation / event data; Defining other security situation / event data embedding coding vectors in the sequence of security situation / event data embedding coding vectors as historical security situation / event data embedding coding vectors to obtain a sequence of historical security situation / event data embedding coding vectors, and performing eigenvalue-based principal component extraction on each historical security situation / event data embedding coding vector in the sequence of historical security situation / event data embedding coding vectors to obtain a sequence of historical security situation / event data principal component representation vectors; Based on the time span of each historical security situation / event data principal component representation vector in the sequence of the historical security situation / event data principal component representation vector relative to the current security situation / event data principal component representation vector, the temporal gradient attenuation weight of each historical security situation / event data principal component representation vector is calculated to obtain a sequence of the temporal gradient attenuation weights of the historical security situation / event data; Based on the sequence of temporal gradient attenuation weights of the historical security situation / event data, a weighted sum of the sequence of principal component representation vectors of the historical security situation / event data is calculated to obtain a principal component significant transfer aggregation representation vector of the historical security situation / event data; The position-based sum of the historical security situation / event data principal component significant transfer aggregation representation vector and the current security situation / event data principal component representation vector is calculated to obtain a security situation / event principal component time series aggregation representation vector.

4. The network security monitoring method based on blockchain technology according to claim 3 is characterized in that: The method for obtaining the principal component representation vector of the current security situation / event data includes: Calculate the covariance matrix of the current security situation / event data embedded in the coding vector to obtain the covariance matrix of the current security situation / event data; Performing eigenvalue decomposition on the covariance matrix of the current security situation / event data to obtain a set of principal component eigenvalues ​​of the current security situation / event data and a set of corresponding principal component eigenvectors of the current security situation / event data; Determine the maximum eigenvalue set A in the principal component eigenvalue set of the current security situation / event data, and obtain the principal component eigenvector of the current security situation / event data corresponding to the maximum eigenvalue set A as the principal component representation vector of the current security situation / event data.

5. The network security monitoring method based on blockchain technology according to claim 4 is characterized in that: The method for obtaining the sequence of the temporal gradient attenuation weight of the historical security situation / event data includes: Calculating the time series propagation absolute attenuation factor of each historical security situation / event data principal component representation vector in the sequence of historical security situation / event data principal component representation vectors relative to the current security situation / event data principal component representation vector to obtain a sequence of time series propagation absolute attenuation factors; Based on the time span between each historical security situation / event data principal component representation vector in the sequence of the historical security situation / event data principal component representation vector and the current security situation / event data principal component representation vector, each time series propagation absolute attenuation factor in the sequence of the time series propagation absolute attenuation factor is modulated in the time dimension to obtain a sequence of time span modulated propagation attenuation factors; including: calculating the timestamp difference between the historical security situation / event data principal component representation vector and the current security situation / event data principal component representation vector, rounding down the timestamp difference to obtain a time span factor; dividing the time series propagation absolute attenuation factor of the historical security situation / event data principal component representation vector by the natural exponential function value of the time span factor to obtain the time span modulated propagation attenuation factor; The sequence of the time span modulated propagation attenuation factors is input into the information transmission screening module based on the gating function to obtain the sequence of the historical security situation / event data time series gradient attenuation weights.

6. The network security monitoring method based on blockchain technology according to claim 2 is characterized in that: The method for obtaining the conditional feature vector includes: Inputting the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector into an implicit correlation feature capture network to obtain a security event-security situation implicit correlation feature vector; The security event-security situation implicit association feature vector is activated based on a Sigmoid function to obtain the conditional feature vector.

7. The network security monitoring method based on blockchain technology according to claim 6 is characterized in that: The method for obtaining the security event-security situation implicit correlation feature vector includes: The security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector are fused according to the position points and then passed through a neural network layer based on the tanh function to obtain the security event-security situation implicit association feature vector.

8. The network security monitoring method based on blockchain technology according to claim 6 is characterized in that: The method for obtaining the security event-security situation significant aggregation representation vector includes: Calculate a first content contribution factor of the security situation principal component time series aggregation representation vector relative to the conditional feature vector; Calculate a second content contribution factor of the security event principal component time series aggregation representation vector to the conditional feature vector; Normalizing the first content contribution factor and the second content contribution factor, and using the normalized first content contribution factor and the second content contribution factor to weighted modulate the security situation principal component time series aggregation representation vector and the security event principal component time series aggregation representation vector, to obtain a modulated security situation principal component time series aggregation representation vector and a modulated security event principal component time series aggregation representation vector; The modulated security situation principal component temporal aggregation representation vector, the modulated security event principal component temporal aggregation representation vector and the conditional feature vector are cross-domain interactively encoded based on a converter structure to obtain the security event-security situation significant aggregation representation vector; including: using the modulated security situation principal component temporal aggregation representation vector as a query vector, the modulated security event principal component temporal aggregation representation vector as a key vector and the conditional feature vector as a value vector, inputting the modulated security situation principal component temporal aggregation representation vector, the modulated security event principal component temporal aggregation representation vector and the conditional feature vector into a feature-to-feature significant guided interaction module based on a converter structure to obtain the security event-security situation significant aggregation representation vector.

9. A network security monitoring system based on blockchain technology, characterized in that: Used to implement the network security monitoring method based on blockchain technology according to any one of claims 1 to 8; the system comprises: A data extraction module, used to extract the time queue of security situation data and the time queue of security event data from the blockchain network; An aggregation analysis module, configured to perform aggregation analysis on the time queue of the security situation data in combination with the time queue of the security event data to obtain a security event-security situation significant aggregation representation vector; A network security feature determination module, used to determine network security features based on the security event-security situation significant aggregation representation vector; The target classification generation module is used to input the network security features into a preset random forest model to train the corresponding target classification and obtain the network security monitoring results; the target classification includes normal network status, low risk network status, medium risk network status or high risk network status.

10. A computer readable medium having a computer program stored thereon, characterized in that: The computer program is executed by a processor to implement the network security monitoring method based on blockchain technology as described in any one of claims 1 to 8.

Images