Defense system security assessment method and system based on time sequence attention mechanism

Abstract

The invention relates to the technical field of network security, and provides a defense system security assessment method and system based on a time sequence attention mechanism, and the method comprises the steps: obtaining multi-dimensional time sequence data of network operation for a to-be-assessed network; for the multi-dimensional time sequence data, extracting short-term mode features of the network system in the defense process to obtain extracted features; carrying out weighting processing on the extracted features by adopting a time sequence self-attention mechanism; acquiring attack situation information, and performing embedding processing to obtain context information; and fusing the time sequence features processed by the time sequence self-attention mechanism with the context information to generate uniform feature representation, and further generating a defense effect score as an evaluation result. Based on a time sequence self-attention mechanism, in combination with deep learning technologies such as context embedding and convolution feature extraction, the real-time effect of a defense system can be accurately evaluated on the basis of different attack situations and time sequence features, and quantifiable scores are generated.

Description

Technical Field

[0001] The present disclosure relates to the technical field related to network security, and in particular, to a defense system security assessment method and system based on a temporal attention mechanism. Background Art

[0002] The statements in this section merely provide background information related to the present disclosure and do not necessarily constitute prior art.

[0003] With the development of information technology and the increasing sophistication of cyber attack methods, network defense systems are facing great challenges. Traditional network security defense systems usually rely on fixed rules and predefined detection methods, which are difficult to quickly adapt to changes in attack patterns and the dynamic characteristics of the network environment. Therefore, how to quantitatively evaluate the actual effect of the defense system under different attack scenarios has become a key issue in the field of network security.

[0004] In recent years, defense effectiveness analysis methods based on deep learning have gradually become a research hotspot. Through time series analysis technology, it is possible to dynamically capture the performance of defense systems in fighting various attacks. However, existing technologies mostly focus on detecting specific attacks or abnormal events, but lack a comprehensive score for the overall anti-attack effect of the defense system, making it difficult to provide security managers with real-time, quantitative defense effect feedback. Summary of the invention

[0005] In order to solve the above problems, this paper proposes a defense system security assessment method and system based on the temporal attention mechanism. Based on the temporal self-attention mechanism, combined with deep learning technologies such as context embedding and convolution feature extraction, a defense effect dynamic scoring method is proposed. This method can accurately evaluate the real-time effect of the defense system based on different attack scenarios and time series characteristics, generate quantifiable scores, and help security managers to grasp the effectiveness and current status of the defense system in a timely manner.

[0006] In order to achieve the above objectives, the present disclosure adopts the following technical solutions:

[0007] One or more embodiments provide a defense system security assessment method based on a temporal attention mechanism, comprising the following steps:

[0008] For the network to be evaluated, obtain multi-dimensional time series data of network operation;

[0009] For multi-dimensional time series data, extract the short-term pattern characteristics of the network system in the defense process and obtain the extracted features;

[0010] The temporal self-attention mechanism is used to weight the extracted features;

[0011] Obtain attack scenario information and perform embedding processing to obtain context information;

[0012] The temporal features processed by the temporal self-attention mechanism are fused with the contextual information to generate a unified feature representation, and then a defense effectiveness score is generated as the evaluation result.

[0013] One or more embodiments provide a defense system security assessment system based on a temporal attention mechanism, including:

[0014] A data acquisition module is configured to acquire multi-dimensional time series data of network operation for the network to be evaluated;

[0015] The convolution layer is configured to extract short-term pattern features of the network system during the defense process for multi-dimensional time series data to obtain extracted features;

[0016] The attention layer is configured to weight the extracted features using a temporal self-attention mechanism;

[0017] The embedding layer is configured to obtain attack situation information and perform embedding processing to obtain context information;

[0018] The fully connected layer is configured to fuse the temporal features and contextual information processed by the temporal self-attention mechanism to generate a unified feature representation, and then generate a defense effectiveness score as the evaluation result.

[0019] An electronic device includes a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the above-mentioned defense system security assessment method based on the temporal attention mechanism are completed.

[0020] A computer-readable storage medium is used to store computer instructions. When the computer instructions are executed by a processor, the steps in the above-mentioned defense system security assessment method based on the temporal attention mechanism are completed.

[0021] Compared with the prior art, the present invention has the following beneficial effects:

[0022] The present disclosure significantly improves the comprehensive performance of the dynamic scoring model for defense effectiveness by integrating the temporal self-attention mechanism, convolutional feature extraction, and context embedding. The temporal self-attention mechanism can adaptively allocate attention in the time series, highlight the relative importance of different time steps to the defense effect, and enhance the accuracy and timeliness of the scoring; the convolution layer extracts short-term pattern features to capture local dynamic changes in the defense system; the context embedding mechanism introduces attack context information to achieve contextual awareness and personalized adjustment of the scoring. This embodiment can demonstrate higher adaptability, stability, and reliability in complex attack scenarios by synergistically integrating the temporal self-attention mechanism, convolutional feature extraction, and context embedding, providing more accurate and detailed support for real-time and security management.

[0023] The advantages of the present disclosure and the advantages of additional aspects will be described in detail in the following specific embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] The accompanying drawings constituting a part of the present disclosure are used to provide a further understanding of the present disclosure. The exemplary embodiments of the present disclosure and the description thereof are used to explain the present disclosure but do not constitute a limitation of the present disclosure.

[0025] Figure 1 is a flow chart of a defense system security assessment method based on a temporal attention mechanism according to Embodiment 1 of the present disclosure;

[0026] Figure 2 is a flowchart of step 1 of embodiment 1 of the present disclosure;

[0027] Figure 3 is a flowchart of step 2 of embodiment 1 of the present disclosure;

[0028] Figure 4 is a flowchart of step 3 of embodiment 1 of the present disclosure;

[0029] Figure 5 is a block diagram of a defense system security assessment model of Embodiment 1 of the present disclosure;

[0030] Figure 6 is an example diagram of the processing flow of the attention mechanism of Embodiment 1 of the present disclosure; DETAILED DESCRIPTION

[0031] The present disclosure is further described below in conjunction with the accompanying drawings and embodiments.

[0032] It should be noted that the following detailed descriptions are exemplary and are intended to provide further explanation of the present disclosure. Unless otherwise specified, all technical and scientific terms used herein have the same meanings as those commonly understood by those skilled in the art to which the present disclosure belongs.

[0033] It should be noted that the terms used herein are only for describing specific embodiments and are not intended to limit exemplary embodiments according to the present disclosure. As used herein, unless the context clearly indicates otherwise, the singular form is also intended to include the plural form. In addition, it should be understood that when the terms "comprising" and / or "including" are used in this specification, it indicates the presence of features, steps, operations, devices, components and / or combinations thereof. It should be noted that, in the absence of conflict, the various embodiments in the present disclosure and the features in the embodiments can be combined with each other. The embodiments will be described in detail below in conjunction with the accompanying drawings.

[0034] Example 1

[0035] In the technical solutions disclosed in one or more embodiments, Figures 1 to 6 As shown in FIG. 1 , a defense system security assessment method based on a temporal attention mechanism includes the following steps:

[0036] Step 1: For the network to be evaluated, obtain the multi-dimensional time series data of the network operation;

[0037] Step 2: For the multidimensional time series data, extract the short-term pattern features of the network system during the defense process to obtain the extracted features;

[0038] Step 3: Use the temporal self-attention mechanism to weight the extracted features to increase the attention of important features;

[0039] Step 4: Obtain attack scenario information and perform embedding processing to obtain context information;

[0040] Step 5: Fuse the temporal features processed by the temporal self-attention mechanism with the contextual information to generate a unified feature representation, and then generate a defense effectiveness score as the evaluation result;

[0041] In this embodiment, the comprehensive performance of the dynamic scoring model for defense effectiveness is significantly improved by integrating the temporal self-attention mechanism, convolutional feature extraction, and context embedding. The temporal self-attention mechanism can adaptively allocate attention in the time series, highlight the relative importance of different time steps to the defense effect, and enhance the accuracy and timeliness of the scoring; the convolution layer extracts short-term pattern features to capture local dynamic changes in the defense system; the context embedding mechanism introduces attack context information to achieve contextual awareness and personalized adjustment of the scoring. By synergistically integrating the temporal self-attention mechanism, convolutional feature extraction, and context embedding, this embodiment can demonstrate higher adaptability, stability, and reliability in complex attack scenarios, providing more accurate and detailed support for real-time and security management.

[0042] The implementation method of step 1 includes the following steps:

[0043] Step 1.1: Obtain multi-dimensional time series data from the defense system and attack simulation platform. These data reflect the various behaviors and performances of the system during the defense process. The collected data include defense event data, attack event logs, and system operation status:

[0044] 1) Defense event data: including alarm and blocking events triggered by firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), etc.

[0045] Specifically, the alarm and blocking events triggered every minute are obtained from the firewall, intrusion detection system (IDS) and intrusion prevention system (IPS). The data format can be [event type, event timestamp, whether blocked], such as ["IDS", "2023-11-05 10:01:00", 1], which means that at 10:01 on November 5, 2023, the system triggered an IDS alarm and blocked it;

[0046] 2) Attack event log: including the type, intensity, time and duration of the recorded attack events. These attack events can be generated by the attack simulation tool during the simulation stage;

[0047] The type of attack event (such as DDoS, SQL injection), intensity (high, medium, low), attack start time and duration are recorded from the logs generated by the attack simulation tool. The data format is [attack type, intensity, start time, duration]. For example, ["DDoS", "High", "2023-11-05 10:01:00", "5"] indicates a high-intensity DDoS attack that occurred at 10:01 and lasted for 5 minutes.

[0048] 3) System operation status: including CPU, memory usage, network bandwidth, disk IO and other resource usage.

[0049] The system operation status is the system resource data recorded every minute, including CPU usage, memory usage, network bandwidth and disk IO. The data format is [CPU%, memory%, bandwidth (Mbps), disk IO (read / write MBps)]. For example, [45.6,78.9,150,5 / 3] means that the CPU usage is 45.6%, the memory usage is 78.9%, the network bandwidth is 150Mbps, and the disk read and write rates are 5 and 3MBps respectively.

[0050] Step 1.2: Perform data standardization:

[0051] Normalize different feature data and map the feature values ​​to the interval [0,1] to ensure that the input feature value range is consistent. Normalization uses the following formula:

[0052]

[0053] Among them, x is the original data, x ’ The data is normalized; the attack strength value is mapped to high = 1, medium = 0.5, low = 0;

[0054] Step 1.3: Perform sliding window feature expansion, extract the mean and standard deviation in each window according to the set sliding window processing, and obtain the time series after sliding window processing;

[0055] Specifically, a sliding window is used to expand the features of time series data in order to capture short-term trends in the model. The sliding window size is set to 10 minutes, and the mean and standard deviation within the 10-minute window are extracted each time. The specific calculation formula is as follows:

[0056]

[0057] Among them, μ is the mean and σ is the standard deviation. The data format is [mean within the window, standard deviation within the window]. For example, within a 10-minute window, the mean of CPU usage is 50% and the standard deviation is 5%;

[0058] In step 2, the convolutional layer is used to extract the short-term pattern features of the data to capture the response behavior of the network system in different attack time periods, including the following steps:

[0059] Step 2.1: Construct a one-dimensional convolutional layer:

[0060] Specifically, a one-dimensional convolutional layer (1D-CNN) is constructed, and the constructed one-dimensional convolutional layer is used to extract features from the time series data after normalization and sliding window processing to capture local temporal patterns.

[0061] In this embodiment, the parameters of the convolution layer are configured as follows: the convolution kernel size is 3; the number of convolution kernels is 64; the stride is 1; the activation function is ReLU;

[0062] Padding method, specifically: when using the convolution operation, by adding an appropriate amount of zero padding at both ends of the input data, the size of the output data of the convolution operation is made the same as the size of the input data.

[0063] Step 2.2: Perform a convolution operation, slide the convolution kernel on the input time series, and calculate the weighted sum of each position. The formula is as follows:

[0064]

[0065] Among them, x i represents the input sequence, w i represents the convolution kernel weight, and b is the bias term. The convolution layer outputs a 64-dimensional feature vector, which contains short-term pattern features;

[0066] When the CPU usage and memory utilization surge synchronously in a short period of time, the convolution layer can extract this abnormal pattern. In this embodiment, the convolution layer can identify the abnormal pattern, thereby providing rich initial features for the next step of processing.

[0067] In step 3, if Figure 4 and Figure 6 As shown in the figure, the time series self-attention feature weighting is adopted, and the defense effect of different time steps is dynamically evaluated through the multi-head self-attention mechanism; the time series features are weighted by the multi-head self-attention mechanism to highlight the defense performance of the key time step, including the following steps:

[0068] Step 3.1: Initialize the multi-head self-attention mechanism: Use the output feature vector of the convolutional layer as input, build a multi-head self-attention mechanism, configure the attention heads and the dimensions of each head;

[0069] Optionally, this embodiment configures 8 attention heads, each with a dimension of 16;

[0070] Step 3.2: Generation of query, key, and value matrices (Q, K, V): The output features of the convolutional layer are converted into query matrix Q, key matrix K, and value matrix V through weight matrix calculation. The dimension of each head is 16. The specific formula is as follows:

[0071] Q=XW Q ,K=XW K ,V=XW V

[0072] Among them, W Q , W K , W V are the weight matrices for query, key, and value respectively, and X is the output of the convolutional layer;

[0073] Figure 6 In the above code, query is the feature vector in the time series of the output of the convolutional layer, key1, key2, key3, key4 are a set of key vectors of the attention mechanism; each key is a key vector extracted from the time series, representing the features of different positions (time points) in the sequence;

[0074] The similarity scores s1, s2, s3 and s4 are calculated by the function F(Q, K) to represent the correlation between the current time step and the remaining time steps. The calculation formula is:

[0075]

[0076] Step 3.3: Attention weight calculation: According to the query matrix Q, key matrix K and value matrix V, the correlation between time steps is calculated to obtain the attention weight. The importance of each time step is calculated adaptively, and a higher weight is assigned to obtain the output of each attention head.

[0077] Specifically, the attention weight is calculated by the following formula:

[0078]

[0079] Among them, d k =16 is the dimension of the attention head, Q, K, and V are query, key, and value matrices respectively, and the softmax function normalizes the weights to highlight the influence of important time points;

[0080] The multi-head self-attention mechanism calculates the similarity between query and key, generates a weight matrix and then weights the value. By splicing the outputs of multiple attention heads, a complete temporal feature representation is finally generated. This mechanism can identify key time points (such as high-risk time periods) and give them higher attention weights, thereby improving the model's adaptability to complex attack scenarios and the accuracy of scoring.

[0081] This embodiment adaptively calculates the importance of each time step and assigns a higher weight. For example, when the data in a certain time period is abnormal and the utilization of system resources surges, the model regards it as a high-risk time point and assigns it a higher weight. Taking CPU utilization as an example, under normal circumstances, the CPU utilization is 30-40%. If its value surges to 90% in a certain time period, a higher weight will be assigned to this time point through the attention mechanism. When users log in frequently and their permissions are modified, the model will identify the importance of this time period and increase its attention weight to above 0.8, while the weight of ordinary time periods is 0.1-0.3.

[0082] Step 3.4: Multi-head attention output concatenation: concatenate the outputs of each attention head to obtain the temporal weighted feature representation, i.e., the temporal features after processing by the self-attention mechanism;

[0083] Specifically, in this embodiment, the outputs of the eight heads are concatenated to form a 128-dimensional temporal weighted feature representation to capture multiple temporal dependencies;

[0084] In the above scheme of this embodiment, by introducing the temporal self-attention mechanism, it is possible to adaptively allocate attention in the time series, highlighting the relative importance of different time steps to the defense effect. This weighted mechanism improves the adaptability of the model in dealing with complex attack environments, enabling it to capture the defense performance at critical moments, thereby enhancing the accuracy and timeliness of the scoring. The convolution layer is used to extract short-term pattern features in the response process of the defense system, and can identify local changes in the system in a short period of time, providing rich initial features for the self-attention mechanism. This structure that combines a one-dimensional convolutional layer and a self-attention mechanism improves the comprehensive analysis capability of time series data by capturing the short-term and long-term performance characteristics of the defense system, and can effectively identify potential defense weaknesses and outstanding defense behaviors.

[0085] Step 4 uses the context embedding layer to obtain attack situation information, which includes attack type, attack intensity and defense configuration; including the following steps:

[0086] Step 4.1: Obtain context information of the network system including attack type, attack intensity, and defense resource configuration;

[0087] Among them, the attack type, such as distributed denial of service attack (DDoS), SQL injection, etc.; the data format is [attack type, code], such as DDoS is coded as ["DDoS", 1], SQL injection is ["SQL injection", 2];

[0088] Attack Strength, including:

[0089] High intensity: a large number of high-frequency requests or complex attack methods, such as sending millions of requests per second or combining multiple attack methods, medium or low;

[0090] Medium intensity: The attack is significant but within the tolerance of the target system, such as a medium-volume DDoS attack or a single SQL injection.

[0091] Low intensity: fewer requests or less complexity, likely a reconnaissance attack.

[0092] The data format of attack strength is [attack strength, value mapping], such as "high" is 1, "medium" is 0.5, and "low" is 0;

[0093] Step 4.2, perform context embedding conversion, convert the acquired context information into a vector representation through the embedding layer, and obtain the embedded representation of the context information, as follows:

[0094] Embedding(x)=W e *x

[0095] Among them, W e is the embedding layer weight matrix;

[0096] In the above solution of this embodiment, the context embedding mechanism provides situational information such as attack type, attack intensity and defense configuration, so that the score is not only based on the system's time series data, but also can be adjusted according to different attack scenarios. This mechanism significantly improves the model's situational awareness, enabling it to more accurately evaluate the defense effect under different attack conditions, thereby obtaining a more detailed and personalized defense score.

[0097] In step 5, feature fusion is performed, and features are fused through a fully connected layer to generate a unified defense effect feature representation; score generation is performed, and a defense effect score is generated through a fully connected network to quantify the system's defense capability;

[0098] In step 5, the temporal features processed by the temporal self-attention mechanism are fused with the context information, including the following steps:

[0099] Step 5.1: Concatenate the context information with the temporal features processed by the self-attention mechanism:

[0100] In this embodiment, the context feature vector is concatenated with the time series feature to form a 144-dimensional comprehensive feature representation; a set of comprehensive feature representations containing context information is generated to further improve the context perception capability of the model;

[0101] Step 5.2: Feature fusion layer construction: Use the fully connected layer to fuse the concatenated features using an activation function to obtain a unified feature representation that includes temporal features and context information;

[0102] Specifically, in this embodiment, a fully connected layer is used to fuse 144-dimensional features and output 128-dimensional features. The activation function is ReLU, and the feature fusion layer is calculated by the following formula:

[0103] FC(x)=ReLU(W f *x+b f )

[0104] Among them, W f is the weight matrix of the fully connected layer, b f is a bias term; taking the features of a specific context and time step as an example, it can learn important user operation behaviors in a specific time period.

[0105] The features output by the feature fusion layer are unified feature representations: the generated 128-dimensional feature vector integrates the semantic information of temporal features and contextual features;

[0106] In step 5, based on the unified feature representation, a defense effectiveness score is generated. As the evaluation result, multiple activation functions are activated in sequence to reduce the dimension and generate a security score value, including the following steps:

[0107] Step 5-1: The first layer of fully connected network for score generation: receives 128-dimensional fusion features, outputs 64-dimensional features, and the activation function is ReLU:

[0108] Layer1(x) = ReLU(W1*x+b1)

[0109] Step 5-2: The second layer of fully connected network for score generation: receives 64-dimensional input, outputs 32-dimensional features, and uses ReLU as the activation function:

[0110] Layer2(x)=ReLU(W2*x+b2)

[0111] Step 5-3: Generate the final score: Use the sigmoid activation function to generate the final safety score and normalize the score value to the range of [0,100]:

[0112] Score = σ(W3*Layer2(x)+b3)

[0113] Among them, σ is the sigmoid function; it can be set, 0-60 means poor, 60-85 means good, and 85 or above means excellent defense effect;

[0114] In the process of generating scores, a multi-layer fully connected network is used for feature fusion and dimensionality reduction to effectively extract key score information. At the same time, an activation function is used to normalize the scores to the range of [0,100], making the generated scores highly interpretable, which is convenient for security managers to understand the status and effect of the current defense system in real time.

[0115] As a further technical solution, the above steps can be implemented by building a defense system security assessment model, such as Figure 5 As shown, it includes convolutional layers, embedding layers, attention layers, and multiple fully connected layers connected in sequence;

[0116] The convolution layer is used to extract the short-term pattern features of the network system during the defense process from multi-dimensional time series data to obtain the extracted features;

[0117] The attention layer is used to weight the extracted features using a temporal self-attention mechanism to increase the attention paid to important features.

[0118] Embedding layer, used to obtain attack scenario information and embed it to obtain context information;

[0119] Multiple fully connected layers fuse the temporal features and contextual information processed by the temporal self-attention mechanism to generate a unified feature representation, and then generate a defense effectiveness score as the evaluation result.

[0120] The above-mentioned model can be trained by using simulation data of the simulation system, simulating intrusion, and obtaining defense data during simulated intrusion to construct a data set for training.

[0121] Example 2

[0122] Based on Example 1, this embodiment provides a defense system security assessment system based on a temporal attention mechanism, including:

[0123] A data acquisition module is configured to acquire multi-dimensional time series data of network operation for the network to be evaluated;

[0124] The convolution layer is configured to extract short-term pattern features of the network system during the defense process for multi-dimensional time series data to obtain extracted features;

[0125] The attention layer is configured to weight the extracted features using a temporal self-attention mechanism;

[0126] The embedding layer is configured to obtain attack situation information and perform embedding processing to obtain context information;

[0127] The fully connected layer is configured to fuse the temporal features and contextual information processed by the temporal self-attention mechanism to generate a unified feature representation, and then generate a defense effectiveness score as the evaluation result.

[0128] It should be noted here that the various modules in this embodiment correspond one-to-one to the various steps in Example 1, and the specific implementation process is the same, which will not be repeated here.

[0129] Example 3

[0130] This embodiment provides an electronic device, including a memory and a processor, and computer instructions stored in the memory and running on the processor. When the computer instructions are executed by the processor, the steps in the defense system security assessment method based on the temporal attention mechanism of Example 1 are completed.

[0131] Example 4

[0132] This embodiment provides a computer-readable storage medium for storing computer instructions. When the computer instructions are executed by a processor, the steps in the defense system security assessment method based on the temporal attention mechanism of Example 1 are completed.

[0133] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the present disclosure. For those skilled in the art, the present disclosure may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

[0134] Although the above describes the specific implementation methods of the present disclosure in conjunction with the accompanying drawings, it is not intended to limit the scope of protection of the present disclosure. Technical personnel in the relevant field should understand that on the basis of the technical solution of the present disclosure, various modifications or variations that can be made by those skilled in the art without creative work are still within the scope of protection of the present disclosure.

Claims

1. A defense system security assessment method based on temporal attention mechanism, characterized in that: The steps include: For the network to be evaluated, obtain multi-dimensional time series data of network operation; For multi-dimensional time series data, extract the short-term pattern characteristics of the network system in the defense process and obtain the extracted features; The temporal self-attention mechanism is used to weight the extracted features; Obtain attack scenario information and perform embedding processing to obtain context information; The temporal features processed by the temporal self-attention mechanism are fused with the contextual information to generate a unified feature representation, and then a defense effectiveness score is generated as the evaluation result.

2. The defense system security assessment method based on the temporal attention mechanism according to claim 1, characterized in that: The convolutional layer is used to extract the short-term pattern features of the data to capture the response behavior of the network system in different attack time periods, including the following steps: Construct a one-dimensional convolutional layer; Perform a convolution operation, slide the convolution kernel on the input time series, and calculate the weighted sum of each position.

3. The defense system security assessment method based on the temporal attention mechanism according to claim 1, characterized in that: The temporal self-attention mechanism is used to weight the extracted features, including the following steps: Initialize the multi-head self-attention mechanism, configure the attention heads and the dimensions of each head; The output features of the convolutional layer are converted into query matrix Q, key matrix K and value matrix V through weight matrix calculation; According to the obtained query matrix Q, key matrix K and value matrix V, the correlation between time steps is calculated to obtain the attention weight and the output of each attention head; The output of each attention head is concatenated to obtain the temporal weighted feature representation, that is, the temporal features processed by the self-attention mechanism.

4. The method for security assessment of a defense system based on a temporal attention mechanism according to claim 1, characterized in that: Obtain contextual information of the network system including attack type, attack intensity, and defense resource configuration; Perform context embedding transformation, convert the acquired context information into a vector representation through the embedding layer, and obtain the embedded representation of the context information.

5. The method for security assessment of a defense system based on a temporal attention mechanism according to claim 1, characterized in that: The fusion of temporal features and context information processed by the temporal self-attention mechanism includes the following steps: Directly concatenate the context information with the temporal features processed by the self-attention mechanism; The concatenated features are fused using an activation function to obtain a unified feature representation that includes temporal features and contextual information.

6. The method for security assessment of a defense system based on a temporal attention mechanism according to claim 1, characterized in that: Based on the unified feature representation, multiple activation functions are activated in sequence to reduce the dimension and generate a safety score value as the evaluation result.

7. The method for security assessment of a defense system based on a temporal attention mechanism according to claim 6, characterized in that: The safety score is realized through a multi-layer fully connected network. The first and second layers of the fully connected network use the ReLU activation function respectively, and the third layer of the fully connected network uses the sigmoid activation function to generate the final safety score.

8. A defense system security assessment system based on temporal attention mechanism, characterized in that: include: A data acquisition module is configured to acquire multi-dimensional time series data of network operation for the network to be evaluated; The convolution layer is configured to extract short-term pattern features of the network system during the defense process for multi-dimensional time series data to obtain extracted features; The attention layer is configured to weight the extracted features using a temporal self-attention mechanism; The embedding layer is configured to obtain attack situation information and perform embedding processing to obtain context information; The fully connected layer is configured to fuse the temporal features and contextual information processed by the temporal self-attention mechanism to generate a unified feature representation, and then generate a defense effectiveness score as the evaluation result.

9. An electronic device, characterized in that: It includes a memory and a processor, and computer instructions stored in the memory and executed on the processor. When the computer instructions are executed by the processor, the steps in the defense system security assessment method based on the temporal attention mechanism described in any one of claims 1 to 7 are completed.

10. A computer-readable storage medium, characterized in that: Used to store computer instructions, which, when executed by a processor, complete the steps of the defense system security assessment method based on the temporal attention mechanism described in any one of claims 1 to 7.

Images