Distributed anomaly detection method for large AI models of security situation awareness

Abstract

The present invention relates to the technical field of distributed detection, and discloses a distributed anomaly detection method for a security situation awareness AI big model. The present invention collects model architecture network information of the distributed security situation awareness AI big model, obtains a correlation characteristic map of a specified extension level, constructs an anomaly detection framework of a stream processing framework, specifies anomaly detection levels to construct an anomaly detection framework for real-time security situation verification, generates anomaly detection feature distribution, utilizes the anomaly detection feature distribution, evaluates the anomaly of each node, and thus discovers potential security threats. Customized anomaly detection based on level and node characteristics improves detection accuracy and pertinence. The stream processing framework can realize real-time data stream processing, quickly respond to security situation changes, and solves the problem in the prior art that the reliability of the distributed AI big model decreases with operation.

Description

Technical Field

[0001] The present invention relates to the technical field of distributed detection, and in particular to a distributed anomaly detection method for a security situation awareness AI large model. Background Art

[0002] With the advancement of AI technology, a large AI model composed of multiple terminal network nodes can be used to conduct security situation awareness in a certain area and achieve comprehensive security detection of all locations in the area.

[0003] In a distributed network system, network nodes are spread across different physical or virtual environments. The communication and data interaction between nodes are extremely complex, and the behavior of nodes may exhibit different characteristics at different levels. Traditional security situation awareness methods based on a single model are often unable to perform effective fine-grained monitoring and anomaly detection on each node and level. The reliability of the security situation awareness AI large model with a distributed network structure requires continuous anomaly detection and update optimization to support it. Summary of the invention

[0004] The purpose of the present invention is to provide a distributed anomaly detection method for a security situation awareness AI large model, aiming to solve the problem in the prior art that the reliability of the distributed AI large model decreases with operation.

[0005] The present invention is implemented in this way. In a first aspect, the present invention provides a distributed anomaly detection method for a large AI model of security situation awareness, comprising:

[0006] Collect information about the model architecture of the security situation awareness AI big model participating in the distributed construction to obtain the model architecture network information of the security situation awareness AI big model; wherein the model architecture network information is used to describe the node information of each network node of the security situation awareness AI big model;

[0007] Acquire the associated characteristic map of the specified extension level of the security situation awareness AI big model based on the model architecture network information to obtain the associated characteristic map of the security situation awareness AI big model at the specified extension level; wherein the associated characteristic map of the specified extension level is used to describe the associated characteristics of each network node of the security situation awareness AI big model in the description method corresponding to the specified extension level;

[0008] Constructing an anomaly detection framework in the form of a stream processing framework for the security situation awareness AI big model according to the associated characteristic map of the specified extended level and the model architecture network information, so as to obtain an anomaly detection framework of the specified level of the security situation awareness AI big model;

[0009] Based on the specified-level anomaly detection framework, the security situation awareness AI big model is verified in real time for security situation, so as to obtain the anomaly detection feature distribution of the security situation awareness AI big model corresponding to the specified-level anomaly detection framework; wherein the anomaly detection feature distribution is used to evaluate the node abnormality of each network node of the security situation awareness AI big model.

[0010] The present invention provides a distributed anomaly detection method for a large AI model of security situation awareness, which has the following beneficial effects:

[0011] The present invention collects model architecture network information of a distributed security situation awareness AI large model, obtains a correlation characteristic map of a specified expansion level, constructs an anomaly detection framework of a stream processing framework, specifies anomaly detection levels to construct an anomaly detection framework for real-time security situation verification, generates anomaly detection feature distributions, and uses anomaly detection feature distributions to evaluate the anomalies of each node, thereby discovering potential security threats. By performing customized anomaly detection based on level and node characteristics, the accuracy and pertinence of detection are improved. The stream processing framework can realize real-time data stream processing and quickly respond to changes in security situation, thereby solving the problem in the prior art that the reliability of distributed AI large models decreases with operation. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1 It is a schematic diagram of the steps of a distributed anomaly detection method for a security situation awareness AI large model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0013] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0014] The implementation of the present invention is described in detail below in conjunction with specific embodiments.

[0015] Reference Figure 1 As shown, a preferred embodiment of the present invention is provided.

[0016] In a first aspect, the present invention provides a distributed anomaly detection method for a large security situation awareness AI model, comprising:

[0017] S1: Collecting information about the model architecture of the security situation awareness AI big model participating in the distributed construction to obtain the model architecture network information of the security situation awareness AI big model; wherein the model architecture network information is used to describe the node information of each network node of the security situation awareness AI big model;

[0018] S2: Acquire the correlation characteristic map of the specified extension level of the security situation awareness AI big model based on the model architecture network information to obtain the correlation characteristic map of the security situation awareness AI big model at the specified extension level; wherein the correlation characteristic map of the specified extension level is used to describe the correlation characteristics of each network node of the security situation awareness AI big model in the description method corresponding to the specified extension level;

[0019] S3: constructing an anomaly detection framework in the form of a stream processing framework for the security situation awareness AI big model according to the associated characteristic map of the specified extension level and the model architecture network information, so as to obtain an anomaly detection framework of the specified level of the security situation awareness AI big model;

[0020] S4: Based on the specified-level anomaly detection framework, the security situation awareness AI big model is subjected to real-time security situation verification to obtain the anomaly detection feature distribution of the security situation awareness AI big model corresponding to the specified-level anomaly detection framework; wherein the anomaly detection feature distribution is used to evaluate the node abnormality of each network node of the security situation awareness AI big model.

[0021] Specifically, in step S1 of the embodiment provided by the present invention, it is necessary to clarify the overall structure of the security situation awareness AI model, including each level (such as input layer, hidden layer, output layer, etc.), each node (such as neurons, computing units, data processing units, etc.) and the connection relationship between nodes, perform static structural analysis on the model, and identify and annotate the function of each node, data flow path, information processing method, etc.

[0022] More specifically, the network topology information related to the large model is collected. For distributed AI models, they usually contain multiple nodes, which are distributed on different computing units or servers. Network detection tools or log analysis tools (such as network protocol analyzers, distributed monitoring systems, etc.) are used to obtain the connection mode, data flow path, delay and bandwidth information between each node.

[0023] It should be noted that the security situation awareness AI big model is an AI big model deployed in a specified range area to perform security situation awareness at multiple locations within the specified range at the same time. This functional requirement enables the model to have the ability to collect and analyze data at multiple locations. The data collection and analysis functions at each location are in a state of interactive verification, that is, the training results of the data collected at one place can be applied to another location, thereby improving the reliability of the distributed model's synchronous data processing at multiple locations.

[0024] On the other hand, there are specific differences in the situations in each subdivided area within the specified range where the security situation awareness AI model is deployed. Therefore, it is necessary to correct the regional characteristics of the AI ​​model corresponding to each subdivided area to increase the reliability of the AI ​​model.

[0025] More specifically, in the model architecture information, each node is described in detail, including the node type, processing capability, input and output type and format, and the interaction method with other nodes. Automated tools or manual labeling are used to record the role, function, weight, processing flow, data transmission and other information of each node in detail.

[0026] More specifically, if the model is already running, dynamic data during model runtime can be collected, including the node's computing load, processing latency, and node health status (such as resource occupancy, fault logs, etc.). Operation data can be collected through a real-time monitoring system and combined with historical data for in-depth analysis to obtain the node's operating characteristics.

[0027] More specifically, the collected model architecture information is collated and standardized to ensure the structuring of the information and facilitate subsequent processing and analysis. Database storage or graph construction tools are used to store the description information of each node in a structured manner, which can be saved using a node-edge graph model or a tabular data structure.

[0028] It is understandable that through the comprehensive architecture information collection of the security situation awareness AI large model, we can fully understand the model's network topology, node functions, dependencies between nodes, etc. After obtaining a clear architecture view, we can deeply analyze how each node works together, as well as potential performance bottlenecks and node failure points. Through detailed node information descriptions, we can clearly understand each node's computing function, communication method and its role in security situation awareness. The collected model architecture information is helpful for the expansion and optimization of the model. By analyzing the resource requirements and performance bottlenecks of each node, we can guide how to effectively expand the model, optimize the allocation of computing resources, and avoid the impact of performance degradation or node failure.

[0029] Specifically, in step S2 of the embodiment provided by the present invention, the designated extension level is an analysis level for performing extended analysis on the designated detection items of the security situation awareness AI big model. The designated extension level can have multiple forms, that is, the security situation awareness AI big model can be subjected to anomaly detection analysis in multiple directions, including: an extension level of communication status, an extension level of data security, and an extension level of whether the model is adapted to the regional characteristics of the area where each node is located.

[0030] More specifically, after determining the expansion level, the network information of the model architecture is analyzed to extract the correlation characteristics between the nodes of this level. These characteristics usually include the input-output relationship, dependency, data flow path, information transmission between nodes, etc., and graph analysis tools (such as network diagrams, association matrices, etc.) are used to calculate the correlation, dependency or collaborative working relationship between nodes to form the correlation characteristic data at this expansion level.

[0031] More specifically, the extracted correlation characteristic data is visualized to construct a correlation characteristic map, which presents the connections and characteristics between nodes at the expansion level, usually in the form of a graph or matrix structure. Appropriate visualization tools (such as graph databases, visualization chart tools, etc.) are selected to visualize the nodes and their correlation characteristics at a specified level. The correlation characteristic map should be able to display the functional relationships between nodes, data flow, and the roles of each node.

[0032] More specifically, the constructed association feature map is further analyzed to describe the role of each node in the expansion level, the interaction characteristics with other nodes, the coordination mode, etc. These descriptions help to understand the behavior pattern of the node and its impact on the overall system. Based on the association data in the map, a detailed description of each node is given, including its role in security situation awareness, its dependency with other nodes, and its possible weaknesses or attack surfaces.

[0033] It is understandable that by defining and analyzing the association characteristic map of a specific expansion level, we can deeply understand the functions and behaviors of nodes at each level in the model. Analysis at different levels helps to distinguish between global and local perspectives and enhance the hierarchical understanding of the entire model architecture. This hierarchical analysis helps to discover potential performance bottlenecks or security risks, especially when certain nodes play a more critical role in a specific level, so that security protection can be optimized or strengthened in a targeted manner. By constructing an association characteristic map, we can accurately describe the collaboration mode and dependency relationship between nodes, which is crucial for understanding the overall behavior of the model and predicting its response under specific inputs. This association analysis can reveal the key paths and interaction patterns between nodes, thereby providing data support for optimizing models, improving operating efficiency, and ensuring system stability.

[0034] Specifically, in step S3 of the embodiment provided by the present invention, based on the association characteristic map of the specified extended level and the network information of the model architecture, the key features such as node interaction, data flow, and processing flow at the level are deeply analyzed, with the focus on determining the input and output data flows, dependencies, and potential risk points during data transmission of each node in the level. Combined with the model architecture and the association characteristic map, the normal behavior pattern of each node is analyzed, and possible abnormal associations between nodes are identified (for example, too high data transmission delay, abnormal computing resource usage, inconsistent information transmission between nodes, etc.).

[0035] More specifically, a stream processing framework is used to build a data processing pipeline to monitor the data flowing in and out of the specified expansion layer in real time. When the data flow is transmitted between different nodes, it will pass through the stream processing engine for real-time data analysis. A suitable stream processing framework (such as Apache Kafka, Apache Flink, Apache Storm, etc.) is selected to integrate the network data flow and node interaction information flow of the large security situation awareness AI model into the stream processing system, design a data pipeline, and realize real-time data collection, preprocessing, conversion, analysis and anomaly detection.

[0036] More specifically, based on the association feature map of the extended level, anomaly detection rules are defined. These rules include threshold rules, pattern matching rules, abnormal distribution detection rules, etc., to detect abnormal behaviors of specific nodes in real time, embed anomaly detection algorithms in the stream processing framework, and select appropriate monitoring methods. Common anomaly detection techniques include: Threshold-based detection: such as data flow, delay time, load occupancy exceeding a certain threshold, pattern recognition: based on machine learning models (such as K-means clustering, Isolation Forest, etc.), behaviors that are different from normal patterns are detected, and associated anomaly detection: through the correlation analysis between nodes, data flows or node behaviors that do not meet the expected dependencies are identified.

[0037] More specifically, we implement real-time monitoring and anomaly detection based on the stream processing framework. When the data flow passes through the specified expansion level of the model architecture, possible anomalies are captured and processed in real time. By using the real-time computing power of the stream processing framework, an anomaly detection mechanism is embedded in each link of the data flow. When the data flows through a node, we detect in real time whether the interaction between the node and other nodes meets the expected correlation characteristics, and identify potential abnormal data flows or communication errors.

[0038] More specifically, when the anomaly detection system finds an anomaly, it needs to start the corresponding response mechanism, including alarm, logging, failover, etc., and configure the alarm and response mechanism in the stream processing framework, such as issuing alarms through email, SMS, dashboard, etc., or automatically starting the failover mechanism to transfer traffic to normal nodes. In addition, the exception log can be recorded for subsequent analysis and optimization.

[0039] More specifically, based on the anomaly detection results, the model architecture and anomaly detection rules are continuously optimized to form a closed-loop feedback system to analyze the causes and summarize the patterns of detected anomalies, update the anomaly detection rules and optimize the processing flow of the stream processing framework to detect future abnormal behaviors more efficiently and accurately.

[0040] It is understandable that the stream processing framework can realize real-time monitoring and anomaly detection of large AI models of security situation awareness. By continuously streaming data streams, it can detect and respond to problems as soon as they occur, avoiding the delay problem of traditional batch processing. Stream processing can efficiently process large amounts of real-time data, adapt to the complexity and dynamics of distributed models, and ensure that the detection system does not impose a large burden on the operation of the model. By defining precise anomaly detection rules and combining the associated feature map of the expansion level, it can effectively identify abnormal behaviors of model nodes, such as inconsistent data streams, abnormal dependencies between nodes, and excessive computing loads. Refined detection rules make anomaly detection more accurate, avoid missed reports and false alarms, and can classify and process different types of anomalies. The stream processing framework usually has good scalability and can adapt to the needs of large-scale AI models of security situation awareness. As the model scale increases or the expansion level increases, the stream processing framework can easily cope with it and ensure the continued effectiveness of detection. This scalability enables the framework to support more model expansion levels and more nodes in the future without rebuilding the entire detection system.

[0041] Specifically, in step S4 of the embodiment provided by the present invention, the network data flow, status information and interactive behavior of each node in the security situation awareness AI big model are collected and analyzed in real time through the stream processing framework, and real-time data streams are collected from each node of the AI ​​big model (such as input nodes, processing nodes, output nodes, etc.). These data include network traffic, delay, computing resource occupancy, interactive information between nodes, etc. The real-time behavior of each node is modeled to ensure that the model can monitor the dynamic changes of the node in real time.

[0042] More specifically, the collected real-time data is preprocessed to extract features related to anomaly detection, the raw data is cleaned and denoised to ensure data quality, and features such as network traffic, node load, latency, data transmission rate, and processing time are extracted. The correlation features that reflect the interaction relationships within each node and between nodes are extracted, and based on the correlation characteristics of the expanded hierarchy, the behavioral characteristics of each node at a specific level are extracted for anomaly detection.

[0043] More specifically, based on the extracted features, anomaly detection feature distribution is established to identify abnormal behavior of nodes. The distribution pattern of features is analyzed through anomaly detection algorithms (such as clustering, classification, regression and other methods based on machine learning), and it is identified which features show abnormal trends. The distribution of historical data and real-time data is compared to identify possible abnormal patterns. For example, the discrimination model of "normal" and "abnormal" categories can be used to determine whether the behavior of each node falls into the abnormal category, and the anomaly score of each node is calculated to indicate the degree of abnormality of the node.

[0044] More specifically, real-time anomaly detection and security situation verification are performed based on real-time data and pre-defined anomaly detection rules. In real-time streaming data, the aforementioned constructed anomaly detection feature distribution is applied to detect whether each node exhibits abnormal behavior through machine learning algorithms (such as support vector machines, random forests, neural networks, etc.). By continuously comparing the deviation between the current behavior of the node and the historical pattern, the abnormality of each node is evaluated, the abnormality of each node is quantified, and the abnormality score of each node (such as an interval value of 0-1, 1 indicates severe abnormality and 0 indicates normal) is obtained.

[0045] More specifically, based on the detection results, the abnormality of each node is evaluated, and corresponding feedback and disposal are carried out according to the results. For nodes that exhibit abnormal behavior, combined with the distribution of abnormal detection characteristics, a detailed node abnormality report is provided, indicating the nature and possible causes of the abnormality. According to the degree of abnormality of the node, the system can choose to start the self-healing mechanism, isolate the faulty node, adjust the network configuration, and other operations, and feed back the abnormal detection results to the security monitoring system for continuous updating and verification of the security situation.

[0046] More specifically, based on the real-time detection results, the anomaly detection feature distribution is continuously updated to adapt to new security situations and network environment changes. According to the changes in the node abnormality score, the anomaly detection feature distribution model is adjusted to make it more accurately reflect the real-time status of each node. The model is optimized and new normal behavior patterns are dynamically learned to improve the detection capability of future unknown anomalies.

[0047] It is understandable that through the real-time stream processing framework and feature extraction mechanism, the abnormality of each node can be monitored and detected in real time during the operation of the security situation awareness AI large model. The model can promptly respond to any abnormal behavior in the network node, ensuring that the problem is identified and responded to in the shortest time, avoiding the delay in the traditional batch processing model, and can instantly verify the security situation while the data is flowing, quickly identify potential threats, and accurately evaluate the abnormality of each network node through the distribution of anomaly detection features. The anomaly score of the node can reflect the real-time health status of the node, helping administrators identify possible system failures or security threats. The feature distribution model can comprehensively consider the interactive relationship between multiple data sources, effectively capture the subtle changes of each node, and provide more accurate anomaly detection results.

[0048] Furthermore, through real-time verification and anomaly assessment, the system can dynamically perceive the security situation of the model and respond intelligently to abnormal nodes. The adaptive feedback mechanism enables the security situation awareness AI large model to quickly adjust and respond when facing dynamic security threats, reducing the risk of system attacks or failures. Through real-time anomaly detection and security situation verification, the AI ​​large model can better cope with various security challenges in the network environment, and promptly discover and respond to various abnormal behaviors, such as network attacks, data leakage, and abuse of computing resources. Through continuous feature distribution updates and anomaly pattern optimization, the anomaly detection framework can adapt to new network environments, data flows, and security threats, and maintain efficient detection capabilities. The anomaly detection feature distribution not only considers the behavior of a single node, but also combines the correlation and interactivity between nodes, realizing multi-dimensional security situation awareness capabilities, and can comprehensively evaluate the entire security situation, rather than being limited to the anomalies of a single node, providing a more complete and three-dimensional security situation view to ensure that the system can operate effectively in a complex environment.

[0049] The present invention provides a distributed anomaly detection method for a large AI model of security situation awareness, which has the following beneficial effects:

[0050] The present invention collects model architecture network information of a distributed security situation awareness AI large model, obtains a correlation characteristic map of a specified expansion level, constructs an anomaly detection framework of a stream processing framework, specifies anomaly detection levels to construct an anomaly detection framework for real-time security situation verification, generates anomaly detection feature distributions, and uses anomaly detection feature distributions to evaluate the anomalies of each node, thereby discovering potential security threats. By performing customized anomaly detection based on level and node characteristics, the accuracy and pertinence of detection are improved. The stream processing framework can realize real-time data stream processing and quickly respond to changes in security situation, thereby solving the problem in the prior art that the reliability of distributed AI large models decreases with operation.

[0051] Preferably, the step of collecting information of the model architecture of the security situation awareness AI big model participating in the distributed construction to obtain the model architecture network information of the security situation awareness AI big model includes:

[0052] S11: Performing node traversal query on the security situation awareness AI big model to receive response information corresponding to the query from each network node participating in the security situation awareness AI big model;

[0053] S12: parsing the reply information of each network node of the security situation awareness AI large model to obtain the node identification mark, node performance specification, and node network positioning of each network node;

[0054] S13: Digitally simulate the network nodes according to the node performance specifications, and combine the results of the digital simulation with the node identification mark to obtain a node feedback unit corresponding to the network node. Then, according to the node network positioning, the network topology relationship of each node feedback unit is comprehensively combined to obtain the model architecture network information of the security situation awareness AI large model.

[0055] Specifically, each participating node of the security situation awareness AI model is traversed and queried, and the response information of each node is collected. Through web crawler technology, API calls or custom communication protocols, each network node in the AI ​​model (such as input nodes, processing nodes, output nodes, storage nodes, etc.) is accessed, and a predefined query request is sent to each node, requiring the node to return key information about itself, including node identification tags, node performance specifications, network positioning, etc., to ensure that the communication dependencies between nodes are taken into account during the query process to avoid affecting the accuracy of information collection due to network delays or packet loss.

[0056] More specifically, after receiving the reply information from each node, the information is parsed to extract key network node information, and each node's unique identifier (such as IP address, node ID, MAC address, etc.) is extracted from the reply information for subsequent node identification and tracking. The node performance specification parses the performance data in the reply, including the node's computing power, storage capacity, memory size, bandwidth, processing speed, etc. The node network positioning extracts the node's network topology location information, such as the node's physical location (server room location), network topology level (core layer, access layer, etc.) and connection relationship with other nodes.

[0057] More specifically, digital simulation is performed according to the performance specifications of each node, and its performance is analyzed and combined with the node identification tag to obtain the feedback unit of each node. Based on the performance specifications of the node (such as computing power, storage and bandwidth), digital simulation is performed, for example, the resource usage, response time, throughput, etc. of the node are modeled through simulators or simulation tools (such as NS-3, OMNeT++, etc.).

[0058] More specifically, the simulation results are combined with node identification tags to obtain feedback units corresponding to each node. These feedback units represent the role and performance of the node in the system and are used for further performance evaluation and security situation analysis to ensure that the digital simulation can accurately reflect the behavior of the node in the real network environment, thereby ensuring the accuracy of subsequent analysis.

[0059] More specifically, based on the network positioning and feedback unit information of the nodes, the network topology relationship is overall combined to obtain the complete model architecture network information. Based on the network positioning information of each node, the topological relationship between the nodes is constructed, such as the connection structure of the core layer nodes, the switching layer nodes and the edge layer nodes. The connection relationship of each node and its feedback unit is graphically displayed using graph theory algorithms or network analysis tools (such as Graphviz, Gephi, etc.), and the network topology diagram of the entire model is constructed. Combined with factors such as communication delays and bandwidth limitations between nodes, an accurate network architecture diagram is generated, which reflects how each node interacts in the security situation awareness AI large model. For each node's feedback unit, its influence in the network can be further evaluated, and key parameters such as the data transmission path, delay, and bottleneck can be calculated.

[0060] More specifically, the results of the previous steps are integrated to eventually generate the complete model architecture network information of the entire security situation awareness AI model. Based on the feedback unit information and network topology of all nodes, a complete model architecture network information document or report is generated, including the identification mark, performance specifications, feedback unit information and network positioning of each node. In addition, it should also include information such as the communication relationship, bandwidth allocation, and data transmission path between nodes. The various elements of the network architecture can be displayed through visualization tools (such as charts, 3D modeling, etc.), providing a more intuitive network structure view, ensuring a clear report information structure, and facilitating subsequent review, optimization, and security audits.

[0061] It is understandable that by collecting and analyzing detailed information on each node, we can fully grasp the architecture of the security situation awareness AI model, understand the performance, location, role of each node and the relationship between them, and through digital simulation of node performance specifications, we can accurately predict the performance of each node in the actual operation process. This simulation helps evaluate the performance bottlenecks, resource allocation problems and potential expansion needs of the entire distributed system, and provide data support for subsequent system optimization and expansion. Through the analysis of the network positioning and topology of each node, we can have an in-depth understanding of the communication methods, data flows and potential security vulnerabilities of the entire model.

[0062] Preferably, the step of acquiring the correlation characteristic map of the specified extension level of the security situation awareness AI big model based on the model architecture network information to obtain the correlation characteristic map of the security situation awareness AI big model at the specified extension level includes:

[0063] S21: Determine detection items to be used for distributed anomaly detection of the security situation awareness AI large model; wherein the detection items include network communication items, data security items, and situation awareness mode items;

[0064] S22: Determine the corresponding designated extension level for the security situation awareness AI big model according to the detection project to obtain the designated extension level corresponding to the detection project; wherein the designated extension level includes the communication extension level corresponding to the network communication project, the data extension level corresponding to the data security project, and the mode extension level corresponding to the situation awareness mode project;

[0065] S23: Based on the network data platform, identify and search for data types that match the specified extension level to obtain a reference database that matches the specified extension level, and specifically locate and call the available data in the reference database according to the model architecture network information of the security situation awareness AI big model to obtain a correlation feature map of the security situation awareness AI big model at the specified extension level;

[0066] Wherein, when the designated extension level is a communication extension level, the associated characteristic in the associated characteristic map is a network communication status of a location of a network node;

[0067] When the designated extension level is a data extension level, the associated characteristic in the associated characteristic map is an information security mechanism used by the network node;

[0068] When the designated extension level is a mode extension level, the associated characteristic in the associated characteristic map is a security situation of an area where the network node is located.

[0069] Specifically, determine the detection items involved in distributed anomaly detection. The detection items cover the following categories: Network communication items: including monitoring of the communication status between network nodes, such as bandwidth usage, latency, packet loss rate, connection quality, etc. Data security items: involving the security of data transmission between nodes, especially encryption, authentication, anti-tampering measures, etc. Situational awareness mode items: refers to the perception of the security situation in the environment where the node is located, and the analysis of potential threats, attack modes and the status of defense mechanisms.

[0070] More specifically, according to the specific needs of the model and the characteristics of the nodes in the network architecture, specific items to be detected are selected. These items are usually used to identify abnormal behaviors or security threats that may exist in the network, and the detection indicators of these items are dynamic and closely related to the security situation. According to the selected detection items, the designated expansion level associated with them is determined. The expansion level helps to subdivide the specific detection content and node location.

[0071] More specifically, the expansion level corresponding to the network communication project is the "communication expansion level", which includes the network communication status between nodes (such as bandwidth, delay, packet loss, etc.); the expansion level corresponding to the data security project is the "data expansion level", which includes the encryption algorithm, identity authentication mechanism, data integrity protection and other information security mechanisms used by the nodes; the expansion level corresponding to the situation awareness mode project is the "mode expansion level", which includes the security situation of the area where the network node is located (such as risk assessment, security vulnerability analysis, real-time attack detection, etc.).

[0072] More specifically, the extension level of each detection project is determined, and the extension level of each node is marked. The extension level is hierarchically divided and specified according to the network information of the detection project and the model architecture.

[0073] More specifically, through the network data platform, the relevant data types are matched for the specified extension level. The network data platform can be a database system that stores a large amount of network status, node performance, communication logs and other data. For each extension level, the platform will identify and classify according to the data type, and search for the reference database related to the specified extension level. Based on the extension level (such as communication extension level, data extension level, and pattern extension level), the platform searches for relevant data categories in the database. For the communication extension level, the platform can search for data related to network communication performance, such as bandwidth, latency, and packet loss rate between nodes. For the data extension level, the platform searches for information security technologies such as encryption algorithms and authentication mechanisms used by nodes. For the pattern extension level, the platform searches for data related to security situation awareness, such as attack events, vulnerability scanning results, etc.

[0074] More specifically, based on the obtained reference database, by combining it with the network information of the model architecture, the data platform will locate and call relevant data for further processing. The data platform will determine the type of data that needs to be obtained for a specific node or network area by matching it with the network information of the model architecture, and further perform queries and positioning to locate and obtain data under the specified extension level, such as communication status, information security mechanism or security situation, etc., call the database content related to the extension level, and perform specific data extraction and integration.

[0075] More specifically, based on the positioning data, an associated characteristic map corresponding to the specified extension level is generated: communication extension level: the characteristics in the associated characteristic map are the network communication conditions of the network node's location (such as bandwidth, latency, connection quality, etc.); data extension level: the characteristics in the associated characteristic map are the information security mechanisms used by the network nodes (such as encryption, identity authentication, data integrity protection, etc.); mode extension level: the characteristics in the associated characteristic map are the security situation of the area where the network node is located (such as risk assessment, attack mode, vulnerability analysis, etc.).

[0076] More specifically, the collected characteristic data will be used to generate a graphical correlation characteristic map through data visualization tools (such as heat maps, topology maps, etc.), and each node or area will be marked and displayed on the map according to its communication status, security mechanism and situational awareness.

[0077] It is understandable that by expanding security situation awareness from multiple angles (communication, data, security situation), potential threats in the network environment can be fully perceived, and the multi-level perception capability of network security can be improved, which helps to timely discover potential security vulnerabilities, abnormal behaviors or attack patterns in the system. By detecting the correlation characteristics of different levels such as network communication, data security, and situation awareness patterns, abnormal behaviors in distributed systems can be more accurately identified, providing more accurate indicators for anomaly detection, and corresponding defense measures can be taken according to security requirements at different levels to improve response speed and accuracy. By acquiring network communication, information security and situation awareness data related to node locations and regions in real time, real-time monitoring of network and security status can be achieved. Real-time security monitoring can help timely discover and repair security issues, prevent the spread of attacks, and reduce potential losses.

[0078] Preferably, the step of constructing an anomaly detection framework in the form of a stream processing framework for the security situation awareness AI big model according to the associated characteristic map of the specified extended level and the model architecture network information to obtain the specified level anomaly detection framework of the security situation awareness AI big model includes:

[0079] S31: Build a basic version of a specified-level anomaly detection framework consisting of a data collection layer, a data stream processing layer, anomaly detection layer, and a feedback response layer;

[0080] S32: Deploy parameters of the data collection layer corresponding to each network node according to the model architecture network information, so that the data collection layer has a data collection channel corresponding to the network node distribution status of the security situation awareness AI big model; wherein the data collection channel is used to perform unique data collection on each network node of the security situation awareness AI big model;

[0081] S33: Analyze the detection method of each network node of the model architecture network information according to the associated characteristic map of the specified extension level, so as to obtain the node detection method of each network node of the security situation awareness AI big model corresponding to the specified extension level;

[0082] S34: Substitute the node detection method corresponding to the specified extension level of each network node of the security situation awareness AI big model into the data flow processing layer to perform program deployment of the node detection method, so that the data flow processing layer is adapted to the network node distribution status of the security situation awareness AI big model;

[0083] S35: Based on the data collection channel of the data collection layer, the data stream processing layer is preparatory for assigning data tags and triggering detection tasks, so that the data stream processing layer has the function of detecting the data collected by the data collection layer after receiving the data;

[0084] S36: Deploy a model of a deep learning algorithm model to the anomaly detection layer according to the node detection method deployed by the data stream processing layer, so that the anomaly detection layer has the function of performing anomaly analysis on the detection work of the data stream processing layer;

[0085] S37: Perform a probability calculation on the abnormal analysis results of the abnormal detection layer, and configure the conventional result abnormality elimination mechanism and the abnormal detection result display mechanism of the feedback response layer according to the conventional results of the possibility calculation, so as to obtain the designated level abnormality detection framework of the security situation awareness AI big model.

[0086] Specifically, an anomaly detection framework consisting of four main layers is constructed: data collection layer, data stream processing layer, anomaly detection layer, and feedback response layer. Each layer has specific functions and roles, ensuring that the framework can stream data from network nodes and perform real-time detection and feedback of anomalies.

[0087] More specifically, the data acquisition layer is responsible for collecting data from each node in the network and establishing the entry of the data flow; the data flow processing layer processes, filters, labels, and prepares the data for further analysis; the anomaly detection layer applies deep learning algorithms to perform anomaly analysis on the data and identify potential threats; the feedback response layer responds according to the detection results, including anomaly elimination, display mechanisms, and other automated responses.

[0088] More specifically, according to the network information of the model architecture, the corresponding network node parameter deployment is allocated to the data collection layer to ensure that each network node has an independent data collection channel. A unique collection channel is established for each node, and the data related to it is accessed through the channel. The collection channel of each node should be customized according to its role, topology, load and other characteristics in the network to ensure the accuracy and timeliness of the data. The collection channels can be deployed for different expansion levels (such as communication expansion level, data expansion level, mode expansion level) to obtain the required network status, data security information and security situation.

[0089] More specifically, based on the associated characteristic map of the specified expansion level, the detection method of each network node is analyzed, and a decision is made on how to perform targeted anomaly detection on each node. For different expansion levels, the characteristics of the network nodes and the content that needs to be monitored are analyzed. For example, for the communication expansion level, the focus is on monitoring communication indicators such as bandwidth and latency; for the data expansion level, attention is paid to security mechanisms such as data encryption and identity authentication; for the pattern expansion level, the security situation of the network nodes is monitored, such as attack behaviors or abnormal patterns. Based on these characteristics, the specific detection method of each node is analyzed, for example, using technologies such as traffic monitoring, behavior analysis, and data security checks.

[0090] More specifically, the node detection method obtained through analysis is deployed to the data stream processing layer to ensure that the data stream processing layer can adapt according to the distribution status of network nodes, and convert different node detection methods into program codes or models suitable for data stream processing (for example, traffic analysis programs, anomaly detection algorithms, etc.), to ensure that the programs of the data stream processing layer can process data streams at different expansion levels and support the input and processing of heterogeneous data sources.

[0091] More specifically, based on the data channel of the data acquisition layer, the data stream processing layer is prepared to assign data labels and trigger detection tasks. When the data acquisition layer obtains data, the required label information is prepared for the data stream processing layer for subsequent processing. In the data stream processing layer, it is marked which data belongs to normal traffic and which data may belong to abnormal behavior, providing a basis for subsequent anomaly detection. The detection task trigger mechanism is configured to ensure that the data stream processing layer can perform data analysis immediately after receiving the data.

[0092] More specifically, according to the node detection method of the data flow processing layer, the deep learning algorithm model is deployed to the anomaly detection layer for anomaly analysis of the data flow. Appropriate deep learning algorithms, such as convolutional neural networks (CNN), recurrent neural networks (RNN), graph neural networks (GNN), etc., are selected for abnormal pattern recognition. The data output by the data flow processing layer is passed to the anomaly detection model for training and prediction. The model needs to classify anomalies of different nodes and identify potential threats such as network attacks, performance bottlenecks, data leakage, etc. Detection models for different levels are deployed to ensure that various dimensions such as communication, data security and situational awareness are covered.

[0093] More specifically, according to the analysis results of the anomaly detection layer, the anomaly elimination mechanism and the anomaly detection result display mechanism of the feedback response layer are configured. Based on the analysis results of the anomaly detection layer, the anomaly elimination mechanism is set to identify and eliminate "false alarms" that are not real anomalies. The real anomaly detection results are displayed through visualization tools and provided to network administrators or security personnel to support rapid response and decision-making, and configure automated response mechanisms, such as network traffic switching, alarm generation, and blocking of abnormal nodes.

[0094] More specifically, we integrate all levels to complete the construction of the anomaly detection framework at the specified level, effectively integrate the four-level modules of data collection, data stream processing, anomaly detection, and feedback response to form a complete stream processing framework, conduct overall system testing, ensure that all parts work together, ensure the real-time, accuracy, and efficiency of the system, dynamically adjust and optimize according to the network environment and actual needs, and enhance the flexibility and scalability of the framework.

[0095] More specifically, by building a multi-level anomaly detection framework, network nodes can be monitored in real time in multiple dimensions (such as communication, data security, and situational awareness), ensuring a wide coverage of anomaly detection and being able to effectively respond to different types of attacks and abnormal behaviors. The data stream processing layer can receive and process massive amounts of data from each node in real time, while assigning data labels and triggering tasks, supporting real-time anomaly detection, and providing efficient streaming data processing capabilities, ensuring that the system can continuously and in real time perform security monitoring and threat detection in a large-scale dynamic network environment.

[0096] More specifically, the anomaly detection layer performs abnormal pattern analysis based on deep learning algorithms, which can automatically identify complex attack patterns or abnormal behaviors. The deep learning model can improve detection accuracy through continuous learning, reduce false alarms and missed alarms, and enhance the intelligence level of the system.

[0097] More specifically, the automated response mechanism of the feedback response layer can take quick action when an anomaly is detected, such as automatically blocking malicious traffic and adjusting network topology, etc., which reduces the complexity of manual intervention, improves the system's response speed and processing capabilities, and helps to quickly respond to sudden security incidents.

[0098] More specifically, due to the hierarchical design of the framework, the system can be flexibly expanded and optimized according to different network topologies, detection tasks and security requirements. The system can adapt to the ever-changing network environment and security requirements, has strong scalability and flexibility, and is suitable for networks of different sizes and complexities.

[0099] More specifically, by displaying anomaly detection results through visualization tools, administrators can quickly understand the security status of the system and make decisions, which improves the comprehensibility of the security situation and helps security personnel identify threats and develop response strategies more effectively.

[0100] More specifically, through real-time anomaly detection, precise model analysis and automated response mechanisms, the security and stability of the entire network system are enhanced, providing enterprises or organizations with an efficient, safe and reliable network security management system, effectively preventing network attacks and abnormal events and ensuring the normal operation of the system.

[0101] Preferably, when the designated extension level is a communication extension level, the associated characteristics in the associated characteristic map are network communication conditions at the location of the network node, and the model architecture network information is analyzed according to the associated characteristic map of the designated extension level to detect each network node, so as to obtain the node detection method of each network node of the security situation awareness AI large model corresponding to the designated extension level. The steps include:

[0102] S3311: performing theoretical deduction of communication detection performance conditions under various detection forms for each network node of the security situation awareness AI big model according to the correlation characteristic map, so as to obtain theoretical performance conditions of each network node of the security situation awareness AI big model corresponding to various detection forms;

[0103] S3312: Evaluate and select the detection form for each network node of the security situation awareness AI big model according to the theoretical performance of various detection forms, so as to determine the best detection form for each network node of the security situation awareness AI big model;

[0104] S3313: Based on the optimal detection form of each network node of the security situation awareness AI big model, a mapping relationship between the detection form and the network node is constructed for the designated extended level, so that each network node of the security situation awareness AI big model and various preset detection forms have a directional selective mapping relationship;

[0105] S3314: The mapping relationship between each network node of the security situation awareness AI big model and various preset detection forms is combined in an overall form to obtain the node detection method of each network node of the security situation awareness AI big model corresponding to the specified expansion level.

[0106] Specifically, according to the communication status of network nodes in the associated characteristic map, the performance of each network node under multiple detection forms is theoretically deduced, and the communication characteristics of each network node, such as bandwidth, delay, packet loss rate, traffic pattern, etc., are determined. Multiple possible communication detection forms are designed for each network node, such as traffic monitoring, delay analysis, bandwidth assessment, connection stability analysis, etc. Based on the network topology and communication protocol model, the possible communication performance of the node under each detection form is deduced. The deduction process should consider the performance of the node under different loads, network status, attack scenarios and other conditions, and provide a detailed communication behavior theoretical model for each network node, which provides theoretical support for subsequent actual detection and can predict the communication performance and potential anomalies of each node under different detection forms, so as to conduct subsequent analysis more accurately.

[0107] More specifically, based on the theoretical performance of each network node under different detection forms, the detection forms are evaluated and the most suitable detection method is selected. A series of evaluation indicators are set for each detection form, such as detection accuracy, response time, computing overhead, real-time performance, etc. The various detection forms are compared according to the evaluation indicators, and the most suitable detection method is selected. For example, for high-bandwidth nodes, more emphasis may be placed on traffic analysis, while for nodes that are sensitive to low latency, more emphasis may be placed on latency analysis. The best performing detection form is selected for each network node to ensure a balance between detection accuracy and system resources. Through evaluation and selection, the most appropriate detection method for each network node is ensured, detection efficiency and accuracy are improved, resource usage is optimized, and excessive calculation or false alarms are avoided.

[0108] More specifically, based on the best detection form, a mapping relationship between each network node and the corresponding detection form is constructed, and according to the best detection form of each node, a mapping relationship between the node and the detection form is designed. This ensures that each network node can select the most appropriate detection form according to the network communication status when performing anomaly detection, optimizes the mapping relationship, and ensures that the system can flexibly adjust the corresponding relationship between the node and the detection form in a dynamically changing network environment. It provides a flexible and scalable mapping relationship based on the communication status of the network nodes, realizes the intelligent mapping between the network nodes and the detection form, and enables the detection process to be dynamically adjusted according to the actual situation.

[0109] More specifically, the mapping relationship of each network node is combined in an overall form to obtain an anomaly detection framework at the communication expansion level in the complete security situation awareness AI model. The detection forms and mapping relationships of all network nodes are merged to form an overall mapping table of network nodes and detection methods. This ensures that the mapping table can cover all network nodes in the entire security situation awareness AI model and provide an accurate and real-time anomaly detection solution for each node. This completes the comprehensive construction of the node detection method in the entire AI model under the communication expansion level, achieves global coordination and dynamic adaptation, provides personalized detection strategies for each node in the network, and improves the overall security situation awareness capability.

[0110] It is understandable that through theoretical deduction and selection of detection forms, it is possible to ensure that each network node selects the most suitable detection method, thereby improving detection accuracy and efficiency, avoiding unnecessary repeated detection and false alarms, and improving the response speed and accuracy of the entire system. The optimal detection form of each network node is dynamically adjusted based on its actual communication conditions, so that the detection scheme can adapt to different network environments and communication loads, and can flexibly adjust the detection method according to changes in network status, ensuring that efficient and accurate anomaly detection capabilities are always maintained under different network conditions.

[0111] Preferably, when the designated extension level is a data extension level, the associated characteristics in the associated characteristic map are information security mechanisms used by network nodes, and the steps of analyzing the detection methods of various network nodes of the model architecture network information according to the associated characteristic map of the designated extension level to obtain the node detection methods of the designated extension level corresponding to each network node of the security situation awareness AI large model include:

[0112] S3321: performing theoretical deduction of information security mechanism defense status under multiple detection forms for each network node of the security situation awareness AI big model according to the association characteristic map, so as to obtain theoretical defense status of each network node of the security situation awareness AI big model corresponding to various detection forms;

[0113] S3322: Evaluate and select the detection form for each network node of the security situation awareness AI big model corresponding to the theoretical defense conditions of various detection forms, so as to determine the best detection form for each network node of the security situation awareness AI big model;

[0114] S3323: Based on the optimal detection form of each network node of the security situation awareness AI big model, a mapping relationship between the detection form and the network node is constructed for the designated extended level, so that each network node of the security situation awareness AI big model and various preset detection forms have a directional selective mapping relationship;

[0115] S3324: The mapping relationship between each network node of the security situation awareness AI big model and various preset detection forms is combined in an overall form to obtain the node detection method of each network node of the security situation awareness AI big model corresponding to the specified expansion level.

[0116] Specifically, according to the network node security mechanism in the associated characteristic map, the information security defense status of each network node under different detection forms is theoretically deduced. First, the security defense mechanism used by each network node is determined, such as firewall, intrusion detection system (IDS), encryption protocol, access control, etc., and multiple detection forms are designed for each network node, such as intrusion detection, data integrity detection, identity authentication validity verification, etc. According to the characteristics of the security mechanism, the defense status under different protection measures is deduced. For example, some nodes may use strong encryption mechanisms, which may affect the performance of data leakage detection, or some nodes may be configured with fine-grained access control, which affects the identification of access attempts. A detailed theoretical model of the security defense mechanism is provided for each network node to help understand the detection performance under different protection mechanisms. Through theoretical deduction, the effects of different detection forms under specific defense mechanisms are predicted, thereby providing accurate detection solutions.

[0117] More specifically, based on the theoretical defense status of each network node under different detection forms, the detection forms are evaluated and the best detection method is selected. According to factors such as the strength of the security mechanism, the load of the network node, and the potential attack path, evaluation criteria are set, such as protection effectiveness, response time, computing overhead, real-time performance, etc. The effects of each detection form under different node defense mechanisms are evaluated and compared. For example, some firewalls may be able to effectively block known attacks, but have poor detection capabilities for new attacks; and some encryption algorithms may have poor data leakage detection effects. Based on the evaluation results, the best detection form corresponding to each network node is selected to ensure the best detection effect under different security protection mechanisms. Through precise evaluation and selection, it is ensured that the detection method of each network node matches its information security mechanism, thereby improving detection accuracy and response speed, optimizing the use of computing resources, avoiding excessive computing, and ensuring efficient operation under different loads.

[0118] More specifically, based on the best detection form for each network node, a mapping relationship between nodes and detection forms is constructed, and according to the security mechanism of each network node and the best detection form selected, a mapping relationship between nodes and detection methods is designed. This mapping relationship ensures that under different security mechanisms, nodes can automatically select the most suitable detection method, optimize the mapping relationship, and enable nodes to quickly and accurately switch to the appropriate detection method. Especially in the face of dynamically changing networks and attack modes, a personalized and flexible mapping relationship is achieved, so that each network node can dynamically select the appropriate detection method according to its security protection mechanism. The optimization of the mapping relationship makes the detection process more efficient and avoids unnecessary complex calculations.

[0119] More specifically, the detection mapping relationships of each network node are combined as a whole to construct a global node detection method, and the detection methods of all network nodes and their corresponding security mechanism mapping relationships are integrated to form a comprehensive and unified detection system, ensuring that the system can always effectively perform detection tasks under different topologies, network conditions and security requirements. By merging the mapping relationships as a whole, a security situation awareness model with high consistency and coordination is formed. The global detection framework can flexibly switch detection schemes according to the security mechanisms of network nodes, providing real-time and comprehensive security situation awareness capabilities.

[0120] It is understandable that by theoretically deducing the defense status under different detection forms, the effect of each security protection mechanism can be accurately evaluated, thereby ensuring that network nodes can select the most suitable detection method under the existing protection mechanism. The intelligence and accuracy of protection are improved, and the protection capability of network nodes is effectively enhanced. According to the security mechanism and defense status of the network node, the detection method is flexibly adjusted to ensure that the system can adapt to dynamically changing attack modes and security requirements. It ensures that the system can quickly adjust and maintain a high detection capability when facing new attack modes or security challenges.

[0121] Preferably, when the designated extension level is a mode extension level, the associated characteristics in the associated characteristic map are security situation situations in the area where the network node is located, and the detection method of each network node of the model architecture network information is analyzed according to the associated characteristic map of the designated extension level to obtain the node detection method of each network node of the security situation awareness AI large model corresponding to the designated extension level. The steps include:

[0122] S3331: performing an adaptability analysis of the security situation awareness mode of each network node of the security situation awareness AI big model to the security situation of the area where the network node is located according to the association characteristic map, and obtaining node area adaptability tendency characteristics of the security situation awareness mode corresponding to each network node of the security situation awareness AI big model;

[0123] S3332: Obtaining node area adaptability tendency characteristics of each network node corresponding to the security situation awareness mode based on the security situation awareness AI big model, and calculating non-adaptive detection data for each network node to obtain a non-adaptive test set for each network node;

[0124] S3333: converting the detection form of each network node according to the non-adaptive test set of each network node to obtain the detection program of each network node, so as to obtain the optimal detection form of each network node of the security situation awareness AI large model;

[0125] S3334: Based on the optimal detection form of each network node of the security situation awareness AI big model, a mapping relationship between the detection form and the network node is constructed for the designated extended level, so that each network node of the security situation awareness AI big model and various preset detection forms have a directional selective mapping relationship;

[0126] S3335: The mapping relationship between each network node of the security situation awareness AI big model and various preset detection forms is combined in an overall form to obtain the node detection method of each network node of the security situation awareness AI big model corresponding to the specified expansion level.

[0127] Specifically, based on the association characteristic map, analyze the security situation of the area where each network node is located, evaluate the adaptability of the existing security situation awareness model to the area, identify the network area where each network node is located and its security situation, such as the network topology, threat sources, and security protection measures deployed in the area, and evaluate whether the existing security situation awareness model is suitable for the security needs of specific areas. For example, some areas may have highly concentrated data traffic and require stronger traffic monitoring and protection mechanisms; while some areas may belong to external access areas with higher threats and require strengthened monitoring and protection of external connections.

[0128] More specifically, based on the analysis results, adaptive tendency features are generated for each network node, that is, which security situation awareness modes are suitable for the region and which may not be applicable. Detailed security situation analysis is provided for the region where each network node is located, ensuring that the model can understand the unique security needs of different regions, achieve dynamic security situation awareness, and flexibly adjust the security mode according to the different needs of the region, thereby improving the system's responsiveness to the regional security situation.

[0129] More specifically, based on the adaptive tendency characteristics of the security situation awareness mode of each network node, its possible non-adaptive detection data is inferred, and according to the adaptive tendency characteristics of the node area, it is identified which areas may have mismatched detection modes. For example, some detection methods may not be able to cope with the network traffic pattern of a specific area, or some security policies may not match the threat situation in the area where the node is located. For these mismatches, possible non-adaptive detection data is inferred, and through simulation or historical data analysis, the attack type, attack path or vulnerability exposure that the node may face in a non-adaptive situation is inferred. By inferring non-adaptive data, potential detection blind spots are identified and warned in advance, and combined with the regional security situation and node characteristics, it is ensured that the detection method can cover all possible attack scenarios, even in an inadaptable environment.

[0130] More specifically, based on the non-adaptive detection data, a non-adaptive test set is constructed for each network node. Based on the inferred non-adaptive detection data, a test set containing various non-adaptive situations is constructed. The test set should include various possible attack types, vulnerabilities, false positives and missed negatives. Whether the detection method of the test node can identify and respond to these non-adaptive situations, ensure the comprehensiveness of the test set, cover various attack modes and complex situations. By constructing a non-adaptive test set, it is possible to more accurately verify the performance of the detection method in various non-ideal environments, enhance the comprehensiveness and robustness of the security situation awareness AI large model, and improve its ability to respond to unknown attacks.

[0131] More specifically, according to the non-adaptive test set of each network node, the detection form is converted and the detection program of the node is optimized. According to the results of the test set, the detection method of each network node is optimized and adjusted. For example, some nodes may need to work under more fine-grained traffic monitoring, while other nodes may need to use more active intrusion detection systems (IDS) or data leakage protection (DLP) mechanisms. The detection form is adjusted so that the node can adapt to the security situation of a specific area, which may include enhancing the sensitivity of certain detection mechanisms, adding specific types of protection measures, or changing the way logs are collected. Dynamic detection form conversion is achieved, so that network nodes can flexibly adjust their detection methods according to different regional security situations, improve the accuracy and response speed of the detection program, and ensure that the system can cope with complex regional attacks.

[0132] More specifically, based on the optimal detection form of each network node, a mapping relationship between the detection form and the node is constructed. According to the optimal detection form of each network node, a mapping relationship between the node and various preset detection forms is designed to ensure that each node can automatically select the optimal detection method it is suitable for, ensure the efficiency and accuracy of the mapping relationship, avoid unnecessary detection redundancy or false detection, provide accurate mapping relationships, ensure automatic matching between each network node and its most suitable detection form, optimize the detection process, improve the processing efficiency of the system, and reduce unnecessary computing overhead.

[0133] More specifically, the detection forms of all network nodes and the mapping relationships between various preset detection forms are combined as a whole to form a global node detection method, and the detection mapping relationship of each node is integrated into a global framework to ensure that the system can coordinate work between various nodes and can uniformly perform security situation awareness tasks across regions. According to the network topology, traffic distribution and security situation, the combination method is further optimized to improve the system's response time and security protection efficiency, and build a global detection system. Each node in the entire network can choose the most appropriate detection method according to the security situation of its area, thereby improving the overall performance of the system, ensuring efficient collaboration in large and complex networks, and enhancing the overall security perception capability.

[0134] It is understandable that through adaptive analysis and non-adaptive data inference, it is possible to accurately understand the regional security situation of each network node, ensure that the system can adjust the detection method according to different security environments, and enhance the overall security perception capability. It can provide personalized, region-specific security protection solutions for the security needs of different network areas, thereby improving the accuracy and coverage of detection. Through non-adaptive test sets and detection form conversion, the system can dynamically adjust the detection method in a complex security environment to ensure its robustness and adaptability under different security situations, improve the flexibility of the detection system and its ability to cope with complex threats, and can quickly respond to new attack modes and complex network security scenarios.

[0135] Preferably, the step of performing real-time security situation verification on the security situation awareness AI big model based on the specified level anomaly detection framework to obtain the anomaly detection feature distribution of the security situation awareness AI big model corresponding to the specified level anomaly detection framework includes:

[0136] S41: performing data collection on each network node of the security situation awareness AI big model based on the data collection layer in the specified-level anomaly detection framework, so that the specified-level anomaly detection framework and each network node of the security situation awareness AI big model are in a data connected state;

[0137] S42: Based on the data flow processing layer in the specified level anomaly detection framework, each network node of the security situation awareness AI big model in a data connected state is subjected to a node detection method corresponding to the network node, so as to obtain detection data of the node detection method corresponding to each network node of the security situation awareness AI big model;

[0138] S43: performing anomaly evaluation on the detection data based on the anomaly detection layer in the specified-level anomaly detection framework to obtain anomaly detection features corresponding to the detection data;

[0139] S44: Based on the feedback response layer in the specified level anomaly detection framework, the anomaly detection features of each of the network nodes are distributedly combined to obtain the anomaly detection feature distribution of the security situation awareness AI large model.

[0140] Specifically, analyze the security situation of the area where the network node is located, evaluate whether the existing security situation awareness mode is adapted to the specific needs of the area, generate adaptive tendency characteristics for each network node, ensure that the security mode can be adjusted according to the security needs of different areas, understand and analyze the security needs of different network areas, and automatically adjust the perception mode according to the security environment of each node to improve the system's responsiveness.

[0141] More specifically, it can identify and infer possible non-adaptive detection data, identify and warn detection blind spots in advance, simulate mismatched area detection patterns, predict attack types, paths and potential vulnerability exposures, identify potential blind spots or inadaptability in advance, and ensure that security protection plans cover all possible attack scenarios.

[0142] More specifically, a test set containing various non-adaptive situations is constructed to cover different attack modes, false positives and false negatives, to verify the comprehensiveness of the detection method, and to improve the robustness of the model in unknown environments by verifying the reliability of the detection method through a comprehensive test set.

[0143] More specifically, the node detection method is optimized according to the results of the non-adaptive test set, the sensitivity, strategy and log collection method of the detection program are adjusted, and the detection form is dynamically adjusted to ensure that each network node updates the detection method in a timely manner according to its security situation.

[0144] More specifically, the mapping relationship between network nodes and detection forms is designed and optimized to ensure that each node can automatically select the most suitable detection method, improve detection efficiency and accuracy, avoid redundant detection or false alarms, and ensure effective use of system resources.

[0145] More specifically, the detection forms of all network nodes are combined with the preset detection forms into a global framework to ensure cross-regional collaboration, build an efficient and consistent global detection system, and ensure the coordinated work of security situation awareness and protection systems across network areas.

[0146] It is understandable that through adaptive analysis and non-adaptive data inference, it is possible to accurately understand the security situation of the area where each network node is located, automatically adjust the detection mode according to the security needs of different areas, improve detection accuracy, ensure that the specific security needs of different areas are met, and effectively prevent the emergence of security blind spots between regions. By continuously adjusting and optimizing the node detection procedures, it is ensured that the system can dynamically adapt to different security scenarios, improve the flexibility of the detection system, and be able to quickly respond to complex and changing attack patterns, enhance the adaptability of the system, and by building a global mapping relationship, ensure that the nodes in the system can work together efficiently, realize cross-regional security situation awareness, optimize the system's resource allocation, improve detection efficiency and accuracy, reduce resource waste, and enhance overall performance.

[0147] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A distributed anomaly detection method for a large AI model of security situation awareness, characterized in that: include: Collect information about the model architecture of the security situation awareness AI big model participating in the distributed construction to obtain the model architecture network information of the security situation awareness AI big model; wherein the model architecture network information is used to describe the node information of each network node of the security situation awareness AI big model; Acquire the associated characteristic map of the specified extension level of the security situation awareness AI big model based on the model architecture network information to obtain the associated characteristic map of the security situation awareness AI big model at the specified extension level; wherein the associated characteristic map of the specified extension level is used to describe the associated characteristics of each network node of the security situation awareness AI big model in the description method corresponding to the specified extension level; Constructing an anomaly detection framework in the form of a stream processing framework for the security situation awareness AI big model according to the associated characteristic map of the specified extended level and the model architecture network information, so as to obtain an anomaly detection framework of the specified level of the security situation awareness AI big model; Based on the specified-level anomaly detection framework, the security situation awareness AI big model is verified in real time for security situation, so as to obtain the anomaly detection feature distribution of the security situation awareness AI big model corresponding to the specified-level anomaly detection framework; wherein the anomaly detection feature distribution is used to evaluate the node abnormality of each network node of the security situation awareness AI big model.

2. The distributed anomaly detection method of the security situation awareness AI large model according to claim 1 is characterized in that: The steps of collecting information of the model architecture of the security situation awareness AI big model participating in the distributed construction to obtain the model architecture network information of the security situation awareness AI big model include: Performing node traversal query on the security situation awareness AI big model to receive response information corresponding to the query from each network node participating in the security situation awareness AI big model; Parsing the response information of each network node of the security situation awareness AI large model to obtain the node identification mark, node performance specification, and node network positioning of each network node; The network nodes are digitally simulated according to the node performance specifications, and the results of the digital simulation are combined with the node identification tags to obtain node feedback units corresponding to the network nodes. Then, the network topology relationships of the node feedback units are overall combined according to the node network positioning to obtain the model architecture network information of the security situation awareness AI large model.

3. The distributed anomaly detection method of the security situation awareness AI large model according to claim 1 is characterized in that: The steps of acquiring the correlation characteristic map of the security situation awareness AI big model at a specified extension level based on the model architecture network information to obtain the correlation characteristic map of the security situation awareness AI big model at the specified extension level include: Determine the detection items to be used for distributed anomaly detection of the security situation awareness AI big model; wherein the detection items include network communication items, data security items, and situation awareness mode items; Determine the corresponding designated expansion level of the security situation awareness AI big model according to the detection project to obtain the designated expansion level corresponding to the detection project; wherein the designated expansion level includes the communication expansion level corresponding to the network communication project, the data expansion level corresponding to the data security project, and the mode expansion level corresponding to the situation awareness mode project; Based on the network data platform, the specified extension level is identified and searched for matching data types to obtain a reference database that matches the specified extension level, and the reference database is specifically located and called for usable data according to the model architecture network information of the security situation awareness AI big model to obtain a correlation characteristic map of the security situation awareness AI big model at the specified extension level; Wherein, when the designated extension level is a communication extension level, the associated characteristic in the associated characteristic map is a network communication status of a location of a network node; When the designated extension level is a data extension level, the associated characteristic in the associated characteristic map is an information security mechanism used by the network node; When the designated extension level is a mode extension level, the associated characteristic in the associated characteristic map is a security situation of an area where the network node is located.

4. The distributed anomaly detection method of the security situation awareness AI large model as described in claim 3 is characterized in that: The steps of constructing an anomaly detection framework in the form of a stream processing framework for the security situation awareness AI big model according to the associated characteristic map of the specified extension level and the model architecture network information to obtain the specified level anomaly detection framework of the security situation awareness AI big model include: Build a basic version of a specified-level anomaly detection framework consisting of a data collection layer, a data stream processing layer, anomaly detection layer, and a feedback response layer; The data collection layer is configured with parameters corresponding to each network node according to the model architecture network information, so that the data collection layer has a data collection channel corresponding to the network node distribution status of the security situation awareness AI large model; wherein the data collection channel is used to perform unique data collection on each network node of the security situation awareness AI large model; Analyze the detection method of each network node of the model architecture network information according to the associated characteristic map of the specified extension level to obtain the node detection method of each network node of the security situation awareness AI large model corresponding to the specified extension level; Substitute the node detection method of the specified expansion level corresponding to each network node of the security situation awareness AI big model into the data flow processing layer to perform program deployment of the node detection method, so that the data flow processing layer is adapted to the network node distribution status of the security situation awareness AI big model; Based on the data collection channel of the data collection layer, the data stream processing layer is preparatory for assigning data tags and triggering detection tasks, so that the data stream processing layer has the function of detecting the data collected by the data collection layer after receiving it; Deploy a model of a deep learning algorithm model to the anomaly detection layer according to the node detection method deployed by the data stream processing layer, so that the anomaly detection layer has the function of performing anomaly analysis on the detection work of the data stream processing layer; The anomaly detection layer is subjected to a probability inference of the anomaly analysis results, and the feedback response layer is subjected to a routine result anomaly exclusion mechanism and anomaly detection result display mechanism configuration according to the routine results of the probability inference, thereby obtaining a designated-level anomaly detection framework of the security situation awareness AI large model.

5. The distributed anomaly detection method of the security situation awareness AI large model as described in claim 4 is characterized in that: When the designated extension level is a communication extension level, the associated characteristics in the associated characteristic map are network communication conditions at the location of the network node, and the steps of analyzing the detection method of each network node of the model architecture network information according to the associated characteristic map of the designated extension level to obtain the node detection method of each network node of the security situation awareness AI large model corresponding to the designated extension level include: According to the correlation characteristic map, theoretical deductions are performed on the communication detection performance status of each network node of the security situation awareness AI big model under multiple detection forms, so as to obtain the theoretical performance status of each network node of the security situation awareness AI big model corresponding to various detection forms; Evaluate and select the detection form for each network node of the security situation awareness AI big model according to the theoretical performance of various detection forms, so as to determine the best detection form for each network node of the security situation awareness AI big model; Based on the optimal detection form of each network node of the security situation awareness AI big model, the mapping relationship between the detection form and the network node of the designated extension level is constructed, so that each network node of the security situation awareness AI big model and various preset detection forms have a directional selective mapping relationship; The mapping relationship between each network node of the security situation awareness AI big model and various preset detection forms is combined in an overall form to obtain the node detection method of each network node of the security situation awareness AI big model corresponding to the specified expansion level.

6. The distributed anomaly detection method of the security situation awareness AI large model as described in claim 4 is characterized in that: When the designated extension level is a data extension level, the associated characteristics in the associated characteristic map are information security mechanisms used by network nodes, and the steps of analyzing the detection methods of various network nodes of the model architecture network information according to the associated characteristic map of the designated extension level to obtain the node detection methods of the designated extension level corresponding to various network nodes of the security situation awareness AI large model include: According to the correlation characteristic map, theoretical deduction of the information security mechanism defense status under various detection forms is performed on each network node of the security situation awareness AI big model, so as to obtain the theoretical defense status of each network node of the security situation awareness AI big model corresponding to various detection forms; Evaluate and select the detection form for each network node of the security situation awareness AI big model corresponding to the theoretical defense status of various detection forms, so as to determine the best detection form for each network node of the security situation awareness AI big model; Based on the optimal detection form of each network node of the security situation awareness AI big model, the mapping relationship between the detection form and the network node of the designated extension level is constructed, so that each network node of the security situation awareness AI big model and various preset detection forms have a directional selective mapping relationship; The mapping relationship between each network node of the security situation awareness AI big model and various preset detection forms is combined in an overall form to obtain the node detection method of each network node of the security situation awareness AI big model corresponding to the specified expansion level.

7. The distributed anomaly detection method of the security situation awareness AI large model as described in claim 4 is characterized in that: When the designated extension level is a mode extension level, the associated characteristics in the associated characteristic map are security situation situations of the area where the network node is located, and the steps of analyzing the detection methods of each network node of the model architecture network information according to the associated characteristic map of the designated extension level to obtain the node detection methods of each network node of the security situation awareness AI large model corresponding to the designated extension level include: According to the association characteristic map, the adaptability analysis of the security situation awareness mode of each network node of the security situation awareness AI big model to the security situation of the area where the network node is located is performed to obtain the node area adaptability tendency characteristics of the security situation awareness mode corresponding to each network node of the security situation awareness AI big model; Based on the security situation awareness AI big model, the node area adaptability tendency characteristics of each network node corresponding to the security situation awareness mode are obtained, and the non-adaptive detection data of each network node is calculated to obtain the non-adaptive test set of each network node; Convert the detection form of each network node according to the non-adaptive test set of each network node to obtain the detection program of each network node, so as to obtain the optimal detection form of each network node of the security situation awareness AI large model; Based on the optimal detection form of each network node of the security situation awareness AI big model, the mapping relationship between the detection form and the network node of the designated extension level is constructed, so that each network node of the security situation awareness AI big model and various preset detection forms have a directional selective mapping relationship; The mapping relationship between each network node of the security situation awareness AI big model and various preset detection forms is combined in an overall form to obtain the node detection method of each network node of the security situation awareness AI big model corresponding to the specified expansion level.

8. The distributed anomaly detection method of the security situation awareness AI large model as described in claim 4 is characterized in that: The steps of performing real-time security situation verification on the security situation awareness AI big model based on the specified level anomaly detection framework to obtain the anomaly detection feature distribution of the security situation awareness AI big model corresponding to the specified level anomaly detection framework include: Based on the data collection layer in the specified-level anomaly detection framework, data is collected from each network node of the security situation awareness AI big model, so that the specified-level anomaly detection framework and each network node of the security situation awareness AI big model are in a data connected state; Based on the data flow processing layer in the specified level anomaly detection framework, each network node of the security situation awareness AI big model in a data connected state is subjected to a node detection method corresponding to the network node, so as to obtain detection data of the node detection method corresponding to each network node of the security situation awareness AI big model; Performing anomaly evaluation on the detection data based on the anomaly detection layer in the specified-level anomaly detection framework to obtain anomaly detection features corresponding to the detection data; Based on the feedback response layer in the specified level anomaly detection framework, the anomaly detection features of each of the network nodes are distributedly combined to obtain the anomaly detection feature distribution of the security situation awareness AI large model.

Images