A method and system for sharing and coordinating vulnerability databases across regions

Abstract

The present application provides a method and system for sharing and collaboratively handling cross-regional vulnerability libraries. Among them, vulnerability library information of different management areas is received, a multi-level information flow framework is introduced to convert information formats, and a standardized cross-regional vulnerability information map is generated; a dynamic Bayesian network algorithm is used to extract spatiotemporal sequence data, causal relationship analysis is performed through a temporal causal reasoning module, an event-driven architecture is used for immediate response, and a cross-regional trust model is generated; a multi-agent system algorithm is used to extract multi-party collaboration needs, and collaborative intelligent optimization is performed, and a real-time data monitoring platform is constructed using real-time streaming data analysis technology to perform real-time monitoring and generate a cross-regional collaborative optimization report; risk heat map technology is used for visual analysis, and a predictive analysis model is used to estimate future vulnerability development trends, and a cross-regional vulnerability sharing and collaborative handling plan is generated. The technical solution provided by this application significantly improves the sharing and collaboration efficiency between cross-regional vulnerability libraries.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security technology, and in particular to a method and system for sharing and collaboratively handling a cross-region vulnerability library. Background Art

[0002] As cybersecurity threats become increasingly complex and diverse, the sharing and collaborative handling of cross-regional vulnerability libraries has become a key link in ensuring information security. Different management areas maintain independent vulnerability libraries, but due to the lack of an effective information sharing mechanism, vulnerability data between regions is difficult to integrate and utilize. Therefore, there is an urgent need for a method that can efficiently process vulnerability library information from multiple different management areas to achieve standardized, real-time cross-regional vulnerability information sharing and collaborative handling.

[0003] At present, most cross-regional vulnerability database sharing and collaborative disposal rely on traditional information exchange platforms and manual operation processes. These platforms usually use fixed formats and protocols for information transmission, but lack flexibility and automated processing capabilities. In response to this problem, some institutions have introduced preliminary data standardization tools and simple automation scripts to try to improve the efficiency of information exchange. In addition, some advanced solutions have attempted to apply machine learning algorithms for data analysis, but they are still limited to a single management area and have failed to effectively solve the problem of cross-regional collaboration. Although these methods have improved the efficiency of vulnerability management to a certain extent, there are still obvious deficiencies in cross-regional information sharing and real-time response.

[0004] The main drawback of the existing scheme is that due to the different formats of vulnerability library information used in each management area, direct information exchange often requires a lot of manual adjustment and conversion work, resulting in slow and error-prone information transmission, and low efficiency of sharing and collaboration between cross-regional vulnerability libraries. In addition, traditional methods lack in-depth analysis of causal relationships in spatiotemporal series data, and cannot accurately capture the pattern of vulnerability information evolution over time, thus affecting the speed and accuracy of emergency response. More importantly, the existing scheme fails to fully utilize multi-agent system algorithms and real-time streaming data analysis technology, making it difficult to optimize and monitor multi-party collaboration needs in real time, limiting the construction of cross-regional trust models and the effectiveness of decision-making coordination. These problems not only reduce overall security, but also increase management and maintenance costs. Summary of the invention

[0005] The embodiment of the present application provides a method and system for sharing and coordinating cross-region vulnerability libraries, so as to solve the problem of low efficiency of sharing and coordinating between cross-region vulnerability libraries in the prior art.

[0006] In a first aspect, an embodiment of the present application provides a method for sharing and coordinating a cross-region vulnerability library, including:

[0007] Receive vulnerability database information from multiple different management areas, introduce a multi-level information circulation framework, convert the information format of the vulnerability database information through multi-level information exchange rules in the multi-level information circulation framework, and generate a standardized cross-region vulnerability information map;

[0008] A dynamic Bayesian network algorithm is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and a causal relationship analysis is performed on the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm to focus on the causal pattern of the spatiotemporal sequence data evolving over time. An event-driven architecture is used to respond to the causal pattern evolving over time through the instant response mechanism in the event-driven architecture, and the standardized cross-region vulnerability information map is dynamically updated according to the instant response results to generate a cross-region trust model.

[0009] Using a multi-agent system algorithm, extract the multi-party collaboration needs in the cross-region trust model, and perform collaborative intelligent optimization on the multi-party collaboration needs through the negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. Using real-time streaming data analysis technology, build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, and monitor the multi-party collaboration needs in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model and generate a cross-region collaborative optimization report.

[0010] The historical vulnerability data in the standardized cross-regional vulnerability information map is obtained, and the risk heat map technology is used to perform a visual analysis of the cross-regional collaborative optimization results in the cross-regional collaborative optimization report and the vulnerabilities of each region in the historical vulnerability data. Information is shared according to the high-risk concentrated areas in the visualization analysis results, and a predictive analysis model is used to estimate the future vulnerability development trend of the high-risk concentrated areas, and a cross-regional vulnerability sharing and collaborative disposal plan is generated.

[0011] Optionally, the dynamic Bayesian network algorithm is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and the temporal causal reasoning module in the dynamic Bayesian network algorithm is used to perform causal relationship analysis on the spatiotemporal sequence data to focus on the causal pattern of the spatiotemporal sequence data evolving over time. An event-driven architecture is used to respond to the causal pattern evolving over time through the instant response mechanism in the event-driven architecture, and the standardized cross-region vulnerability information map is dynamically updated according to the instant response result to generate a cross-region trust model, including:

[0012] Performing time labeling processing on the cross-region vulnerability data in the standardized cross-region vulnerability information map, attaching detailed time labels by parsing the time field in the time labeling processing result, executing anomaly detection algorithms, identifying and correcting potential outliers in the detailed time labels, and generating corrected time labels;

[0013] Using a dynamic Bayesian network algorithm, extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and perform causal relationship analysis on the modified time label combined with the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm, so as to focus on the causal pattern of the spatiotemporal sequence data evolving over time and generate a causal relationship model;

[0014] Adopting an event-driven architecture, by introducing an instant response mechanism in the event-driven architecture into the causal relationship model, responding immediately to the causal pattern evolving over time, dynamically updating the standardized cross-region vulnerability information map according to the instant response result, and generating an instant response log;

[0015] According to the instant response results, the response speed and response effectiveness are introduced as response performance, and the emergency response performance of each management area in the instant response log is quantitatively evaluated through response performance evaluation analysis. The causal relationship model is optimized through the emergency response performance to generate a cross-region trust model;

[0016] Optionally, the dynamic Bayesian network algorithm is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and the time series causal reasoning module in the dynamic Bayesian network algorithm is used to perform causal relationship analysis on the modified time label in combination with the spatiotemporal sequence data, so as to focus on the causal pattern of the spatiotemporal sequence data evolving over time, and generate a causal relationship model, including:

[0017] Performing time series analysis on the correction time tag, accurately mapping each record in the correction time tag to a corresponding time point and geographic location, performing association rule mining analysis, identifying the spatiotemporal correlation between the corresponding time point and geographic location, and generating a spatiotemporal correlation map;

[0018] Using a dynamic Bayesian network algorithm, extract the spatiotemporal feature vectors in the spatiotemporal association graph, perform causal relationship analysis on the spatiotemporal feature vectors in combination with the spatiotemporal sequence data through a temporal causal reasoning module in the dynamic Bayesian network algorithm, and construct a conditional probability distribution table to quantify the causal relationship strength in the causal relationship analysis results, parse the causal pattern of the spatiotemporal sequence data evolving over time according to the causal relationship strength, and generate a causal relationship matrix;

[0019] Introducing multi-scale feature extraction technology, extracting key feature vectors at different time scales from the causal relationship matrix, applying hierarchical clustering analysis, performing hierarchical clustering processing on similar feature vectors in the key feature vectors, and generating a multi-scale feature vector set;

[0020] A causal network construction process is introduced to connect the different time scale features in the multi-scale feature vector set into a complete causal network to systematically reflect the feature interactions between the different time scale features and generate a causal relationship model.

[0021] Optionally, the event-driven architecture is adopted, and an immediate response mechanism in the event-driven architecture is introduced into the causal relationship model to respond immediately to the causal pattern evolving over time, and the standardized cross-region vulnerability information map is dynamically updated according to the immediate response result to generate an immediate response log, including:

[0022] Performing pattern recognition processing on the causal patterns in the causal relationship model, identifying key patterns in the causal relationship model that reflect the causal relationship between different events, performing impact path analysis, parsing the impact paths and impact intensities involved in the key patterns, and generating a key pattern library;

[0023] Adopting an event-driven architecture, by introducing an instant response mechanism in the event-driven architecture into the causal relationship model, an instant response is made to the key pattern library combined with the causal pattern evolving over time, the standardized cross-region vulnerability information map is dynamically updated according to the instant response result, and an initial response instruction set is generated;

[0024] Monitor the actual effect of the initial response instruction set after implementation in real time, apply a deviation correction algorithm, compare the deviation value between the expected effect of the initial response instruction set and the actual effect, identify potential deviation inducing factors, optimize the initial response instruction set according to the potential deviation inducing factors, and generate an optimized response instruction set;

[0025] Collect all response results after the implementation of the optimized response instruction set, integrate all the response results through log generation processing, introduce a log synchronization mechanism, synchronize the log generation processing results to the optimized response instruction set in real time, and generate an immediate response log.

[0026] Optionally, the multi-agent system algorithm is used to extract the multi-party collaboration requirements in the cross-region trust model, and the multi-party collaboration requirements are collaboratively and intelligently optimized through the negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. The real-time streaming data analysis technology is used to build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, and the multi-party collaboration requirements are monitored in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model, and a cross-region collaborative optimization report is generated, including:

[0027] Utilizing natural language processing technology, parsing the collaboration records and historical communication content between management areas in the cross-region trust model, extracting multi-party collaboration requirements in the collaboration records and historical communication content, and generating a collaboration requirement list;

[0028] Using a multi-agent system algorithm, taking each management area in the cross-region trust model as an independent agent, simulating the behavior pattern of the independent agent, and performing collaborative intelligent optimization on the behavior pattern and the collaboration requirement list through a negotiation mechanism in the multi-agent system algorithm, thereby improving the decision-making coordination among the multiple different management areas and generating an optimized collaboration solution set;

[0029] Adopting real-time streaming data analysis technology, building a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, monitoring the optimized collaboration solution set in real time through the data monitoring platform, improving the multi-party collaboration efficiency in the cross-region trust model, and generating a real-time monitoring report;

[0030] By introducing a feedback loop mechanism, the collaborative results of the real-time monitoring report are fed back to the execution center of each management area in the cross-region trust model. The execution center improves the optimized collaboration solution set and then loops the real-time monitoring process, integrating the feedback loop results after the introduction of the feedback loop mechanism to generate a cross-region collaborative optimization report.

[0031] Optionally, the multi-agent system algorithm is used to take each management area in the cross-region trust model as an independent agent, simulate the behavior pattern of the independent agent, and perform collaborative intelligent optimization on the behavior pattern and the collaboration requirement list through the negotiation mechanism in the multi-agent system algorithm, thereby improving the decision-making coordination among the multiple different management areas and generating an optimized collaboration solution set, including:

[0032] Using the analytic hierarchy process, the requirements in the collaboration requirements list are prioritized, and through resource matching analysis, the resource matching degree of each management area in the cross-region trust model is evaluated according to the requirements priority ranking results to generate a resource matching matrix;

[0033] Using a multi-agent system algorithm, taking each management area in the cross-region trust model as an independent agent, simulating the behavior pattern of the independent agent under the resource matching matrix, and performing collaborative intelligent optimization on the behavior pattern and the collaboration requirement list through a negotiation mechanism in the multi-agent system algorithm, thereby improving the decision-making coordination among the multiple different management areas and generating a preliminary collaboration solution set;

[0034] Conducting synergy analysis on the preliminary collaboration solution set, identifying the best collaboration mode and potential mode improvement points in the preliminary collaboration solution set by constructing a cooperative game model, and generating a synergy evaluation matrix;

[0035] A risk mitigation strategy is constructed based on the risk point assessment results in the synergy effect assessment matrix to improve the collaboration efficiency of the preliminary collaboration solution set for uncertain scenarios and generate an optimized collaboration solution set.

[0036] Optionally, the obtaining of historical vulnerability data in the standardized cross-region vulnerability information map, using risk heat map technology, visually analyzing the cross-region collaborative optimization results in the cross-region collaborative optimization report and the regional vulnerabilities in the historical vulnerability data, sharing information based on the high-risk concentrated areas in the visual analysis results, and using a predictive analysis model to estimate the future vulnerability development trend of the high-risk concentrated areas, generating a cross-region vulnerability sharing and collaborative disposal plan, including:

[0037] Extracting historical vulnerability data from the standardized cross-region vulnerability information map, aggregating the historical vulnerability data according to time nodes through time series aggregation analysis to identify periodic patterns of the historical vulnerability data, and generating aggregated historical vulnerability data;

[0038] Introducing risk heat map technology, constructing a dynamic heat map for the cross-region collaborative optimization results in the cross-region collaborative optimization report and the regional vulnerabilities in the aggregated historical vulnerability data, performing risk visualization analysis, identifying high-risk concentrated areas in the dynamic heat map, and generating a list of high-risk concentrated areas;

[0039] Introducing an information sharing mechanism, establishing an efficient information sharing channel between the multiple different management areas for the high-risk concentrated area list, building a secure communication platform to instantly transmit the risk probability information in the high-risk concentrated area list, and generating an information sharing log;

[0040] Combining the information sharing log with the dynamic heat map, using the time series prediction algorithm, the future vulnerability development trend of the high-risk concentration area is estimated, a collaborative disposal plan based on the future vulnerability development trend is formulated, and a cross-region vulnerability sharing and collaborative disposal plan is generated.

[0041] In a second aspect, the embodiment of the present application provides a cross-region vulnerability library sharing and collaborative handling system, including:

[0042] A receiving module is used to receive vulnerability database information from multiple different management areas, introduce a multi-level information circulation framework, convert the information format of the vulnerability database information through multi-level information exchange rules in the multi-level information circulation framework, and generate a standardized cross-region vulnerability information map;

[0043] An analysis module is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map by using a dynamic Bayesian network algorithm, perform causal relationship analysis on the spatiotemporal sequence data by using a temporal causal reasoning module in the dynamic Bayesian network algorithm, so as to focus on the causal pattern of the spatiotemporal sequence data evolving over time, adopt an event-driven architecture, and respond to the causal pattern evolving over time by using an instant response mechanism in the event-driven architecture, dynamically update the standardized cross-region vulnerability information map according to the instant response result, and generate a cross-region trust model;

[0044] An optimization module is used to use a multi-agent system algorithm to extract the multi-party collaboration needs in the cross-region trust model, and to perform collaborative intelligent optimization on the multi-party collaboration needs through a negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. A real-time streaming data analysis technology is used to build a real-time data monitoring platform through a continuous query engine in the real-time streaming data analysis technology, and the multi-party collaboration needs are monitored in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model and generate a cross-region collaborative optimization report.

[0045] The sharing module is used to obtain the historical vulnerability data in the standardized cross-regional vulnerability information map, use the risk heat map technology to visualize the cross-regional collaborative optimization results in the cross-regional collaborative optimization report and the regional vulnerabilities in the historical vulnerability data, share information based on the high-risk concentrated areas in the visualization analysis results, and use a predictive analysis model to estimate the future vulnerability development trend of the high-risk concentrated areas, and generate a cross-regional vulnerability sharing and collaborative disposal plan.

[0046] In a third aspect, an embodiment of the present application provides a computing device, comprising a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a cross-region vulnerability library sharing and collaborative disposal method as described in the first aspect.

[0047] In a fourth aspect, an embodiment of the present application provides a computer storage medium storing a computer program. When the computer program is executed by a computer, it implements a method for sharing and collaboratively handling a cross-region vulnerability library as described in the first aspect.

[0048] In an embodiment of the present application, vulnerability library information from multiple different management areas is received, a multi-level information flow framework is introduced, and the information format of the vulnerability library information is converted through the multi-level information exchange rules in the multi-level information flow framework to generate a standardized cross-region vulnerability information map; the dynamic Bayesian network algorithm is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and the spatiotemporal sequence data is analyzed for causal relationships through the temporal causal reasoning module in the dynamic Bayesian network algorithm to focus on the causal pattern of the spatiotemporal sequence data evolving over time, an event-driven architecture is used, and the instant response mechanism in the event-driven architecture is used to respond to the causal pattern evolving over time, and the standardized cross-region vulnerability information map is dynamically updated according to the instant response results to generate a cross-region trust model; the multi-agent system algorithm is used to extract the multi-party collaboration requirements in the cross-region trust model, Through the negotiation mechanism in the multi-agent system algorithm, the multi-party collaboration needs are collaboratively optimized intelligently to improve the decision-making coordination between the multiple different management areas. The real-time streaming data analysis technology is used to build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology. The multi-party collaboration needs are monitored in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model and generate a cross-region collaborative optimization report. The historical vulnerability data in the standardized cross-region vulnerability information map is obtained, and the risk heat map technology is used to visualize the cross-region collaborative optimization results in the cross-region collaborative optimization report and the regional vulnerabilities in the historical vulnerability data. Information is shared according to the high-risk concentrated areas in the visualization analysis results, and the future vulnerability development trend of the high-risk concentrated areas is estimated by using a predictive analysis model to generate a cross-region vulnerability sharing and collaborative disposal plan. By introducing a multi-level information flow framework, the effective integration and standardized processing of vulnerability library information in different management areas is achieved, ensuring the uniformity and accuracy of the cross-region vulnerability information map. Through the combined application of dynamic Bayesian network algorithms and event-driven architectures, we can not only accurately capture causal patterns in spatiotemporal sequence data, but also respond to and dynamically update these patterns in real time, thereby generating a cross-region trust model. This approach improves the speed and accuracy of emergency response, while enhancing the efficiency of collaboration between management areas. In addition, the application of real-time streaming data analysis technology and continuous query engines enables real-time monitoring of multi-party collaboration needs, further improving the effectiveness of decision-making coordination.

[0049] Furthermore, by time-labeling the cross-region vulnerability data and executing the anomaly detection algorithm, the accuracy and completeness of the time label are ensured. The application of the dynamic Bayesian network algorithm makes the causal analysis more in-depth and accurate, and the generated causal model can better reflect the causal pattern of the spatiotemporal series data evolving over time. Through the instant response mechanism of the event-driven architecture, rapid response and dynamic update of the causal pattern are achieved, and an instant response log is generated. Finally, through the response performance evaluation analysis, the emergency response performance of each management area is quantitatively evaluated, the causal model is optimized, and a more scientific and reasonable cross-region trust model is generated. This method not only improves the quality of emergency response, but also provides data support for future improvements.

[0050] Furthermore, natural language processing technology is used to parse collaboration records and historical communication content, extract multi-party collaboration needs, and generate a list of collaboration needs, ensuring the comprehensiveness and accuracy of demand extraction. The behavior patterns of independent agents are simulated through multi-agent system algorithms, and collaborative intelligent optimization is performed using negotiation mechanisms to generate optimized collaboration plan sets, which significantly improves the decision-making and coordination capabilities among multiple different management areas. The application of real-time streaming data analysis technology and continuous query engines has built a real-time data monitoring platform, realized real-time monitoring of the optimized collaboration plan set, and further improved the efficiency of multi-party collaboration in the cross-region trust model. The introduction of the feedback loop mechanism enables the collaboration results to be fed back to the execution center of each management area in a timely manner, continuously improves the optimized collaboration plan set, and finally generates a detailed cross-region collaborative optimization report. This method not only improves the optimization degree of the collaboration plan, but also promotes continuous improvement and efficient collaboration among various management areas.

[0051] These and other aspects of the present application will become more clearly understood in the description of the following embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0053] Figure 1 A flow chart of a method for sharing and coordinating a cross-region vulnerability library provided in an embodiment of the present application;

[0054] Figure 2 A schematic diagram of the structure of a cross-region vulnerability library sharing and collaborative handling system provided in an embodiment of the present application;

[0055] Figure 3A schematic diagram of the structure of a computing device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0056] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application.

[0057] In some of the processes described in the specification and claims of this application and the above-mentioned figures, multiple operations that appear in a specific order are included, but it should be clearly understood that these operations may not be executed in the order in which they appear in this article or executed in parallel. The serial numbers of the operations, such as 101, 102, etc., are only used to distinguish between different operations, and the serial numbers themselves do not represent any execution order. In addition, these processes may include more or fewer operations, and these operations may be executed in sequence or in parallel. It should be noted that the descriptions of "first", "second", etc. in this article are used to distinguish different messages, devices, modules, etc., do not represent the order of precedence, and do not limit the "first" and "second" to be different types.

[0058] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of this application.

[0059] Figure 1 A flowchart of a cross-region vulnerability library sharing and collaborative handling method is provided for an embodiment of the present application, such as Figure 1 As shown, the method includes:

[0060] 101. Receive vulnerability database information from multiple different management areas, introduce a multi-level information circulation framework, convert the information format of the vulnerability database information through multi-level information exchange rules in the multi-level information circulation framework, and generate a standardized cross-region vulnerability information map;

[0061] In this step, the multi-level information flow framework is an architecture for sharing cross-regional vulnerability database information. It ensures the effective transmission and standardized processing of information between different management areas through multi-level information exchange rules.

[0062] Multi-level information exchange rules define the specific methods of how to exchange information between different management areas, including data format, transmission method, and verification mechanism. They ensure that even if the original data formats are different, they can be correctly parsed and used at the receiving end.

[0063] Vulnerability database information refers to the security vulnerability records maintained by each management area, including vulnerability description, discovery time, impact scope, and repair suggestions. This information is the basis for generating a standardized cross-region vulnerability information map.

[0064] The standardized cross-regional vulnerability information map is a unified data set generated by formatting vulnerability library information from multiple management areas. It not only contains vulnerability information from all management areas, but also reflects the correlation between this information, facilitating subsequent analysis and application.

[0065] In an embodiment of the present application, first, vulnerability library information is collected centrally from each management area; second, the collected information is formatted according to the multi-level information exchange rules in the multi-level information flow framework; third, standardized processing tools are used to unify all information into a standard format; finally, a standardized cross-region vulnerability information map is generated for subsequent analysis and application.

[0066] Suppose a national cybersecurity center needs to integrate vulnerability database information from multiple local government departments. First, local security teams regularly upload their local vulnerability database information to the central server; second, the central server automatically adjusts and converts data in different formats according to the predefined multi-level information flow framework; third, the standardized data is integrated into a unified cross-regional vulnerability information map; finally, security analysts use the map to identify potential cross-regional security threats.

[0067] 102. Use a dynamic Bayesian network algorithm to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, perform causal relationship analysis on the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm, so as to focus on the causal pattern of the spatiotemporal sequence data evolving over time, adopt an event-driven architecture, and respond to the causal pattern evolving over time through the instant response mechanism in the event-driven architecture, dynamically update the standardized cross-region vulnerability information map according to the instant response results, and generate a cross-region trust model;

[0068] In this step, the dynamic Bayesian network algorithm is a probabilistic graphical model that is suitable for processing complex systems with time dependence. It captures the causal relationship between variables by constructing a probability distribution that changes over time. It is particularly suitable for analyzing spatiotemporal series data.

[0069] Spatiotemporal series data refers to a collection of spatially related data points that change over time, including vulnerability information reported by different management areas at different times.

[0070] The temporal causal inference module is part of the dynamic Bayesian network algorithm, which is specifically designed to analyze causal patterns that evolve over time in spatiotemporal series data. It can identify which factors cause changes in other factors and quantify these causal relationships.

[0071] Event-driven architecture is a programming and design pattern that emphasizes the system's ability to respond to events. In this architecture, when specific conditions are met, the system will trigger the corresponding processing logic to achieve immediate response.

[0072] Immediate response mechanisms allow the system to react quickly when new events or changes are detected, update relevant information, and take necessary actions.

[0073] The cross-regional trust model is a model generated based on the immediate response results, reflecting the trust relationship and its changes between management areas. The model helps evaluate the degree of cooperation and reliability between different management areas.

[0074] In the embodiment of the present application, first, spatiotemporal series data are extracted from the standardized cross-region vulnerability information map; second, a dynamic Bayesian network algorithm is applied to perform causal analysis; third, the analysis results are quickly fed back and updated through the instant response mechanism in the event-driven architecture; finally, the cross-region vulnerability information map is dynamically adjusted according to the results of the instant response to generate a cross-region trust model.

[0075] For example, continuing with the above example, assume that the central server has generated a standardized cross-region vulnerability information map. First, the system automatically extracts spatiotemporal sequence data from the map; second, it uses the dynamic Bayesian network algorithm to analyze this data and identify causal patterns that evolve over time; third, once a new causal relationship is detected, the event-driven architecture immediately triggers an immediate response mechanism to update relevant records; finally, based on the updated information, the system generates the latest cross-region trust model to guide subsequent security policy formulation.

[0076] 103. Use a multi-agent system algorithm to extract the multi-party collaboration needs in the cross-region trust model, perform collaborative intelligent optimization on the multi-party collaboration needs through the negotiation mechanism in the multi-agent system algorithm, improve the decision-making coordination among the multiple different management areas, use real-time streaming data analysis technology, build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, monitor the multi-party collaboration needs in real time through the data monitoring platform, improve the multi-party collaboration efficiency in the cross-region trust model, and generate a cross-region collaborative optimization report;

[0077] In this step, the multi-agent system algorithm is a method that simulates the interaction and collaboration between multiple independent entities. Each agent has its own goals and behavior patterns, and optimizes common goals through a negotiation mechanism.

[0078] Multi-party collaboration requirements refer to the coordination and support required by different management areas when processing vulnerability information.

[0079] The negotiation mechanism is a part of the multi-agent system algorithm, which is used to coordinate conflicts and cooperation among multiple agents.

[0080] Real-time streaming data analysis technology is a technology used to process large amounts of real-time data. It can quickly analyze and respond to changing data streams. It includes data collection, storage, processing, and visualization functions.

[0081] The continuous query engine is one of the core components of real-time streaming data analysis technology. It is responsible for continuously monitoring and processing data streams to ensure timely response to new data inputs.

[0082] The real-time data monitoring platform is a platform built based on real-time streaming data analysis technology and continuous query engine, providing real-time tracking and monitoring of multi-party collaboration needs to ensure that all parties can understand the latest collaboration status in a timely manner.

[0083] The cross-regional collaborative optimization report is a report generated based on the real-time monitoring results of multi-party collaboration needs. It summarizes the collaboration between various management areas and provides improvement plans and suggestions.

[0084] In the embodiment of the present application, first, the collaboration records and historical communication content in the cross-region trust model are analyzed to extract the collaboration needs of multiple parties; second, the multi-agent system algorithm is used to simulate the behavior patterns of each management area, and these needs are optimized through a negotiation mechanism; third, real-time streaming data analysis technology is used to build a real-time data monitoring platform to continuously track the execution of the optimization plan; finally, the optimization plan is continuously improved through a feedback loop mechanism to generate a detailed cross-region collaborative optimization report.

[0085] For example, continuing with the above example, assume that the central server has generated a cross-region trust model. First, the system uses natural language processing technology to analyze the collaboration records and historical communication content of each management area and generate a list of collaboration requirements; second, the multi-agent system algorithm simulates the behavior patterns of each management area and optimizes the collaboration requirements through a negotiation mechanism; third, the real-time data monitoring platform monitors the optimization plan set in real time to ensure the effective implementation of the plan; finally, the feedback loop mechanism feeds back the monitoring results to each management area to further optimize the collaboration plan and generate a detailed cross-region collaborative optimization report.

[0086] 104. Obtain historical vulnerability data in the standardized cross-regional vulnerability information map, use risk heat map technology to visualize the cross-regional collaborative optimization results in the cross-regional collaborative optimization report and the regional vulnerabilities in the historical vulnerability data, share information based on the high-risk concentrated areas in the visualization analysis results, and use a predictive analysis model to estimate the future vulnerability development trend of the high-risk concentrated areas, and generate a cross-regional vulnerability sharing and collaborative disposal plan.

[0087] In this step, risk heat map technology is a visual analysis method that uses color depth to indicate the degree of risk and intuitively displays the distribution of vulnerabilities in each management area.

[0088] Visual analysis refers to the use of graphical tools and techniques to transform complex data into easy-to-understand charts or images to help decision makers better understand and analyze data.

[0089] High-risk concentration areas refer to color areas that appear as high-risk areas in the risk heat map, which usually mean that there are more unresolved vulnerabilities or higher security threats.

[0090] Information sharing is a way to ensure that critical information is quickly passed between relevant parties, which can speed up response, especially in the face of emergency situations.

[0091] Predictive analysis models are models based on historical data and statistical principles to predict possible events or trends in the future.

[0092] The cross-regional vulnerability sharing and collaborative disposal plan is based on the results of the predictive analysis model, and specific response measures and action plans are formulated for high-risk concentration areas to ensure timely and effective vulnerability management and disposal.

[0093] In the embodiments of the present application, first, historical vulnerability data is extracted from the standardized cross-region vulnerability information map; second, risk heat map technology is used for visual analysis to identify high-risk concentration areas; third, through the information sharing mechanism, relevant information of high-risk areas is transmitted in a timely manner; finally, a predictive analysis model is used to estimate future vulnerability development trends and generate cross-region vulnerability sharing and collaborative disposal plans.

[0094] For example, continuing with the above example, assume that the real-time data monitoring platform has generated a cross-region collaborative optimization report. First, the system extracts historical vulnerability data from the standardized cross-region vulnerability information map; second, the risk heat map technology is used to visualize the cross-region collaborative optimization results and historical vulnerability data to identify high-risk concentration areas; third, through the information sharing mechanism, the information of high-risk areas is quickly conveyed to relevant management areas; finally, the predictive analysis model estimates the future vulnerability development trend of high-risk concentration areas, generates cross-region vulnerability sharing and collaborative disposal plans, and guides each management area to prepare for response in advance.

[0095] In summary, steps 101 to 104 cover the complete process from information collection, standardized processing, causal analysis, multi-party collaborative optimization to risk assessment and prediction, aiming to provide a comprehensive and efficient cross-regional vulnerability library sharing and collaborative disposal solution to meet the strict requirements of real-time, accuracy and collaborative efficiency in the field of network security.

[0096] In order to solve the problems of time labeling and outlier processing, in some embodiments, the use of a dynamic Bayesian network algorithm for causal analysis in step 102 includes: performing time labeling processing on the cross-region vulnerability data in the standardized cross-region vulnerability information map, attaching detailed time tags by parsing the time field in the time labeling processing result, executing an anomaly detection algorithm, identifying and correcting potential outliers in the detailed time tags, and generating corrected time tags; using a dynamic Bayesian network algorithm to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and combining the corrected time tags with the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm. Conduct causal analysis to focus on the causal pattern of the spatiotemporal series data evolving over time and generate a causal model; adopt an event-driven architecture, introduce the instant response mechanism in the event-driven architecture into the causal model, respond to the causal pattern evolving over time in real time, dynamically update the standardized cross-region vulnerability information map according to the instant response results, and generate an instant response log; based on the instant response results, introduce response speed and response effectiveness as response performance, quantitatively evaluate the emergency response performance of each management area in the instant response log through response performance evaluation analysis, optimize the causal model through the emergency response performance, and generate a cross-region trust model;

[0097] In this embodiment, time labeling processing is the process of attaching accurate time information to each record in the cross-region vulnerability data. This step is achieved by parsing the original time field and attaching a detailed time label to ensure that the subsequent timing analysis has a reliable time reference.

[0098] Detailed time tags refer to more specific and accurate time identifiers added based on the original time field. These tags not only contain date and time stamps, but also include the specific time, duration, and frequency of the event, thus enhancing the time dimension of the data.

[0099] Corrected time labels are the final time labels generated after being processed by anomaly detection algorithms. They eliminate errors and inconsistencies in the original data and provide a reliable basis for subsequent spatiotemporal series data analysis.

[0100] The causal relationship model is a model built based on the dynamic Bayesian network algorithm, which is used to capture the causal patterns of spatiotemporal series data evolving over time.

[0101] Immediate response mechanisms allow the system to react quickly when new events or changes are detected, update relevant information, and take necessary actions.

[0102] The immediate response log is a log file that records the results of each immediate response, including the time, content and effect of the response. These logs provide data support for evaluating the emergency response performance of each management area. The immediate response log is used for subsequent performance evaluation and optimization.

[0103] Response performance evaluation analysis evaluates the emergency response performance of each management area by quantitatively analyzing the data in the immediate response log. This method can help identify areas with excellent performance and provide a basis for improving deficiencies.

[0104] The cross-regional trust model is a model that adjusts and optimizes the initial causal relationship model based on the results of the response performance evaluation analysis. The cross-regional trust model reflects the trust relationship and its changes between management areas, and helps evaluate the degree of cooperation and reliability between different management areas.

[0105] In an embodiment of the present application, first, the cross-region vulnerability data in the standardized cross-region vulnerability information map is time-annotated, and detailed time tags are attached by parsing the time field; secondly, an anomaly detection algorithm is executed to identify and correct potential outliers in the detailed time tags, and a corrected time tag is generated; thirdly, a dynamic Bayesian network algorithm is used to extract the spatiotemporal series data in the standardized cross-region vulnerability information map, and a causal relationship analysis is performed in combination with the corrected time tags to generate a causal relationship model; finally, an event-driven architecture is used to introduce an immediate response mechanism, and the standardized cross-region vulnerability information map is dynamically updated according to the immediate response results, an immediate response log is generated, and the causal relationship model is optimized through response performance evaluation analysis to generate a cross-region trust model.

[0106] Here is a specific example:

[0107] For example, suppose that the information security team of a multinational enterprise needs to improve the efficiency of vulnerability information sharing between its branches around the world. First, the central server performs time-stamping processing on the collected cross-region vulnerability data to ensure that each record has detailed timestamp information; second, the anomaly detection algorithm is used to check and correct any potential time anomalies to ensure the reliability of the data; third, the dynamic Bayesian network algorithm is used to analyze the corrected spatiotemporal series data to generate a model that reflects the causal relationship between each management area; finally, through the instant response mechanism of the event-driven architecture, the central server can respond immediately when a new security threat is detected, update relevant records and generate an instant response log. At the same time, through the response performance evaluation analysis, the emergency response performance of each management area is quantitatively evaluated, and the causal relationship model is optimized, so as to generate a more scientific and reasonable cross-region trust model to guide the subsequent security policy formulation. In this process, the enterprise information security team can more effectively coordinate the security response between branches in various regions and improve overall security.

[0108] In order to solve the problems of accuracy of causal relationship analysis and multi-scale feature extraction in spatiotemporal series data, in some embodiments, the use of a dynamic Bayesian network algorithm for causal relationship analysis in step 102 includes: performing time series parsing processing on the corrected time label, accurately mapping each record in the corrected time label to the corresponding time point and geographical location, performing association rule mining analysis, identifying the spatiotemporal correlation between the corresponding time point and geographical location, and generating a spatiotemporal correlation map; using a dynamic Bayesian network algorithm to extract the spatiotemporal feature vectors in the spatiotemporal correlation map, and combining the spatiotemporal feature vectors with the spatiotemporal series data through the temporal causal reasoning module in the dynamic Bayesian network algorithm. Causal relationship analysis is performed, and a conditional probability distribution table is constructed to quantify the causal relationship strength in the causal relationship analysis results. The causal pattern of the spatiotemporal series data evolving over time is parsed according to the causal relationship strength to generate a causal relationship matrix; multi-scale feature extraction technology is introduced to extract key feature vectors at different time scales from the causal relationship matrix, and hierarchical clustering analysis is applied to perform hierarchical clustering processing on similar feature vectors in the key feature vectors to generate a multi-scale feature vector set; causal network construction processing is introduced to connect the different time scale features in the multi-scale feature vector set into a complete causal network to systematically reflect the feature interactions between the different time scale features and generate a causal relationship model.

[0109] In this embodiment, the time series analysis process is a process of accurately mapping each record in the correction time tag to a corresponding time point and geographical location.

[0110] The spatiotemporal correlation map is a chart generated through association rule mining and analysis, which is used to identify the spatiotemporal correlation between corresponding time points and geographical locations. The spatiotemporal correlation map shows how security incidents at specific times and places between different management areas affect each other, helping to reveal hidden spatiotemporal patterns.

[0111] The spatiotemporal feature vector is a feature vector extracted from the spatiotemporal correlation map, which represents the security status of each management area at a specific time and place.

[0112] The conditional probability distribution table is a table used to quantify the strength of causal relationships in the results of causal relationship analysis. It reflects the degree of dependence between different factors by constructing a conditional probability model.

[0113] The strength of causal relationship refers to the importance or influence of the causal relationship between different factors analyzed through the conditional probability distribution table.

[0114] The causal relationship matrix is ​​a matrix generated based on the strength of causal relationships, which systematically reflects the causal pattern of spatiotemporal series data evolving over time.

[0115] Hierarchical cluster analysis is a method of hierarchically clustering similar feature vectors. Through this analysis, management areas with similar characteristics can be identified.

[0116] The multi-scale feature vector set is a set of feature vectors generated after hierarchical clustering analysis. Each feature vector represents a key feature at a specific time scale. The multi-scale feature vector set provides a basis for the subsequent causal network construction.

[0117] The causal network construction process is the process of connecting the different time scale features in the multi-scale feature vector set into a complete causal network, which systematically reflects the interactions between the different time scale features.

[0118] The causal relationship model is a model generated through the above series of processing steps, which aims to systematically reflect the interaction between features at different time scales. The model helps identify complex causal relationships in the cross-regional vulnerability database and provide a scientific basis for decision-making.

[0119] In the embodiment of the present application, first, the correction time label is subjected to time series parsing processing, and each record is accurately mapped to the corresponding time point and geographical location; secondly, association rule mining analysis is performed to identify the spatiotemporal correlation between the corresponding time point and the geographical location, and a spatiotemporal correlation map is generated; thirdly, the dynamic Bayesian network algorithm is used to extract the spatiotemporal feature vectors in the spatiotemporal correlation map, and the spatiotemporal sequence data is combined to perform causal relationship analysis, and a conditional probability distribution table is constructed to quantify the causal relationship strength, and a causal relationship matrix is ​​generated; finally, multi-scale feature extraction technology and hierarchical clustering analysis are introduced to extract key feature vectors at different time scales from the causal relationship matrix, generate a multi-scale feature vector set, and connect the different time scale features into a complete causal relationship model through causal network construction processing.

[0120] For example, suppose a national educational institution needs to improve the information security level of its schools across the country and wants to deeply analyze the temporal and spatial correlation of campus network security incidents. First, the central server performs time series analysis on the correction time tags in the cross-regional vulnerability data collected from schools across the country to ensure that each record can be accurately mapped to the corresponding time point and geographical location; secondly, through association rule mining and analysis, the temporal and spatial correlation between each time point and geographical location is identified to generate a temporal and spatial correlation map; thirdly, the dynamic Bayesian network algorithm is used to extract the temporal and spatial feature vectors in the temporal and spatial correlation map, and the causal relationship analysis is performed in combination with the temporal and spatial sequence data, and a conditional probability distribution table is constructed to quantify the causal relationship strength and generate a causal relationship matrix; finally, multi-scale feature extraction technology and hierarchical clustering analysis are introduced to extract key feature vectors at different time scales from the causal relationship matrix, generate a multi-scale feature vector set, and connect the features of different time scales into a complete causal relationship model through causal network construction and processing. In this process, educational institutions not only improve the sharing efficiency of campus information security, but also better understand the propagation path and potential risks of campus network security incidents through in-depth analysis of temporal and spatial correlation, providing a scientific basis for future security strategy formulation.

[0121] In order to solve the problem of instant response and optimization of causal patterns, in some embodiments, the instant response using an event-driven architecture in step 102 includes: performing pattern recognition processing on the causal patterns in the causal relationship model, identifying key patterns in the causal relationship model that reflect the causal relationship between different events, performing impact path analysis, parsing the impact paths and impact intensities involved in the key patterns, and generating a key pattern library; using an event-driven architecture, by introducing an instant response mechanism in the event-driven architecture into the causal relationship model, instantly responding to the key pattern library in combination with the causal pattern that evolves over time, and dynamically responding to the key pattern library based on the instant response results. Dynamically update the standardized cross-region vulnerability information map to generate an initial response instruction set; monitor the actual effect of the initial response instruction set after implementation in real time, apply a deviation correction algorithm, compare the deviation value between the expected effect of the initial response instruction set and the actual effect, identify potential deviation-inducing factors, optimize the initial response instruction set according to the potential deviation-inducing factors, and generate an optimized response instruction set; collect all response results after the implementation of the optimized response instruction set, integrate all response results through log generation processing, introduce a log synchronization mechanism, synchronize the log generation processing results to the optimized response instruction set in real time, and generate an immediate response log.

[0122] In this embodiment, the pattern recognition process is a technique for identifying key patterns in the causal relationship model that reflect the causal relationship between different events.

[0123] The key pattern library is a database that stores key patterns generated after pattern recognition processing. Each key pattern represents a set of events with important causal relationships and their impact paths and intensities, providing basic data for subsequent immediate responses.

[0124] Impact path analysis is the process of analyzing the impact paths and impact intensities involved in key patterns. This step reveals the transmission mechanism between different events and helps evaluate the specific impact of a certain event on other events.

[0125] Immediate response mechanisms are part of event-driven architecture, allowing the system to react quickly when new events or changes are detected, update relevant information, and take necessary actions.

[0126] The initial response instruction set is a set of preliminary instructions generated based on the immediate response results to guide each management area on how to respond to emerging security threats. These instructions are based on the information in the current causal pattern library to ensure a rapid response.

[0127] The deviation correction algorithm is a technology used to compare the deviation value between the actual effect and the expected effect. By identifying potential deviation-causing factors, the deviation correction algorithm can adjust the response instructions and improve the effectiveness of the response.

[0128] The optimized response instruction set is a set of response instructions that has been optimized by the deviation correction algorithm. The optimized response instruction set takes into account various deviations in the actual response process to ensure that the final response measures are more accurate and effective.

[0129] Log generation processing is the process of integrating all response results into log files. These logs record the time, content and effect of each response, providing detailed data support for subsequent evaluation.

[0130] The log synchronization mechanism ensures that the results of log generation and processing can be synchronized to the optimized response instruction set in real time. This mechanism ensures that all relevant parties can obtain the latest response information in a timely manner, thereby improving the efficiency of information sharing.

[0131] The immediate response log is the final log file generated, which contains the response results after the implementation of all optimized response instruction sets. The immediate response log not only records the response process, but also reflects the state changes of the system at different time points, providing a basis for subsequent analysis and improvement.

[0132] In an embodiment of the present application, first, pattern recognition processing is performed on the causal pattern in the causal relationship model to identify the key pattern that reflects the causal relationship between different events, and an impact path analysis is performed to parse the impact path and impact intensity involved in the key pattern to generate a key pattern library; secondly, an event-driven architecture is used to introduce an immediate response mechanism, and an immediate response is performed in combination with the key pattern library and the causal pattern that evolves over time. The standardized cross-region vulnerability information map is dynamically updated according to the immediate response results to generate an initial response instruction set; thirdly, the actual effect after the implementation of the initial response instruction set is monitored in real time, and a deviation correction algorithm is used to compare the deviation value between the expected effect and the actual effect, identify potential deviation-inducing factors, optimize the initial response instruction set, and generate an optimized response instruction set; finally, all response results after the implementation of the optimized response instruction set are collected, and these results are integrated through log generation processing, and a log synchronization mechanism is introduced to synchronize the log generation processing results to the optimized response instruction set in real time to generate an immediate response log.

[0133] Here is a specific example:

[0134] For example, suppose a multinational financial institution needs to improve the information security response speed of its branches around the world and hopes to optimize the ability to respond immediately to new security threats. First, the central server performs pattern recognition processing on the causal patterns in the causal relationship model, identifies the key patterns that reflect the causal relationship between different security events, and performs impact path analysis to parse the impact paths and impact strengths involved in these key patterns, and generates a key pattern library; secondly, an event-driven architecture is used to introduce an immediate response mechanism, which combines the key pattern library and the causal patterns that evolve over time to perform immediate responses, dynamically updates the standardized cross-region vulnerability information map based on the immediate response results, and generates an initial response instruction set; thirdly, the actual effect of the initial response instruction set after implementation is monitored in real time, and the deviation correction algorithm is used to compare the deviation value between the expected effect and the actual effect, identify potential deviation-causing factors, optimize the initial response instruction set, and generate an optimized response instruction set; finally, all response results after the implementation of the optimized response instruction set are collected, and these results are integrated through log generation processing, and a log synchronization mechanism is introduced to synchronize the log generation processing results to the optimized response instruction set in real time to generate an immediate response log. During this process, financial institutions not only improved their information security response speed, but also ensured the effectiveness and scientific nature of response measures by optimizing immediate response mechanisms, further enhancing the security protection capabilities of their global branches.

[0135] In order to solve the problem of extracting and optimizing multi-party collaboration needs, in some embodiments, the use of a multi-agent system algorithm for collaborative intelligent optimization in step 103 includes: using natural language processing technology to parse the collaboration records and historical communication content between the management areas in the cross-region trust model, extracting the multi-party collaboration needs in the collaboration records and historical communication content, and generating a collaboration needs list; using a multi-agent system algorithm to take each management area in the cross-region trust model as an independent agent, simulating the behavior pattern of the independent agent, and performing collaborative intelligent optimization on the behavior pattern and the collaboration needs list through the negotiation mechanism in the multi-agent system algorithm to improve the multiple independent agents. Coordinate decisions between management areas to generate an optimized collaboration solution set; adopt real-time streaming data analysis technology, build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, monitor the optimized collaboration solution set in real time through the data monitoring platform, improve the efficiency of multi-party collaboration in the cross-region trust model, and generate a real-time monitoring report; by introducing a feedback loop mechanism, feed back the collaboration results of the real-time monitoring report to the execution center of each management area in the cross-region trust model, and the execution center improves the optimized collaboration solution set and then loops the real-time monitoring process, integrates the feedback loop results after the introduction of the feedback loop mechanism, and generates a cross-region collaborative optimization report.

[0136] In this embodiment, natural language processing technology is a technology for parsing text content, which can extract useful information from unstructured data through semantic analysis and context understanding.

[0137] The collaboration needs list is a list generated through natural language processing technology, which lists in detail the collaboration needs between various management areas.

[0138] The optimized collaboration scheme set is a set of collaboration schemes generated after optimization by the negotiation mechanism in the multi-agent system algorithm. These schemes comprehensively consider the needs and limitations of each management area to ensure that the efficiency of multi-party collaboration can be effectively improved in actual implementation.

[0139] The continuous query engine is one of the core components of real-time streaming data analysis technology. It is responsible for continuously monitoring and processing data streams to ensure timely response to new data inputs.

[0140] The real-time data monitoring platform is a platform built based on real-time streaming data analysis technology and continuous query engine. It provides real-time tracking and monitoring of multi-party collaboration needs to ensure that all parties can understand the latest collaboration status in a timely manner.

[0141] The real-time monitoring report is a report generated based on the real-time data monitoring platform. It summarizes the collaboration between various management areas and provides improvement plans and suggestions.

[0142] The feedback loop mechanism is a process of feeding back the collaborative results of real-time monitoring reports to the execution centers of each management area, ensuring that the results of each collaboration can be evaluated and improved in a timely manner. By introducing the feedback loop mechanism, the collaboration plan can be continuously optimized to form a virtuous circle.

[0143] The cross-regional collaborative optimization report is the final report after integrating the feedback loop mechanism. It reflects the collaboration effects and improvement suggestions among the various management areas, and provides a scientific basis for future decision-making.

[0144] In the embodiments of the present application, first, natural language processing technology is used to parse the collaboration records and historical communication content between each management area in the cross-region trust model, extract collaboration needs and generate a collaboration need list; secondly, a multi-agent system algorithm is used to simulate the behavior pattern of each management area as an independent intelligent agent, and the behavior pattern and the collaboration need list are collaboratively intelligently optimized through a negotiation mechanism to generate an optimized collaboration plan set; thirdly, real-time streaming data analysis technology is used to build a real-time data monitoring platform, and the optimized collaboration plan set is monitored in real time through a continuous query engine to generate a real-time monitoring report; finally, by introducing a feedback loop mechanism, the collaboration results of the real-time monitoring report are fed back to the execution center of each management area, and the execution center improves and optimizes the collaboration plan set, and the real-time monitoring process is cyclical to generate a cross-region collaborative optimization report.

[0145] Here is a specific example:

[0146] For example, suppose a large multinational manufacturing company needs to optimize the efficiency of multi-party collaboration in its global supply chain management to cope with frequent security threats and emergencies. First, the central server uses natural language processing technology to analyze the collaboration records and historical communication content between factories and warehouses, extracts specific multi-party collaboration needs, and generates a list of collaboration needs; secondly, the multi-agent system algorithm simulates the behavior patterns of each factory and warehouse as an independent agent, and combines the negotiation mechanism to perform collaborative intelligent optimization of these behavior patterns and the list of collaboration needs to generate an optimized collaboration solution set; thirdly, the real-time streaming data analysis technology is used to build a real-time data monitoring platform, and the continuous query engine is used to monitor the optimized collaboration solution set in real time to ensure the effective implementation of the solution and generate a real-time monitoring report; finally, by introducing a feedback loop mechanism, the collaboration results of the real-time monitoring report are fed back to the execution center of each factory and warehouse, and the execution center improves the optimized collaboration solution set according to the actual situation, and the real-time monitoring process is circulated to finally generate a cross-regional collaborative optimization report. In this process, the enterprise not only improves the collaborative efficiency of supply chain management, but also ensures the continuous improvement of the optimization solution through a scientific feedback mechanism, and enhances the overall ability to respond to security threats.

[0147] In order to solve the problem of priority sorting and resource matching of multi-party collaboration needs, in some embodiments, the collaborative intelligent optimization using a multi-agent system algorithm in step 103 includes: using the analytic hierarchy process to prioritize the needs in the collaboration need list, and through resource matching analysis, evaluating the resource matching degree of each management area in the cross-region trust model according to the result of the priority sorting process, and generating a resource matching matrix; using the multi-agent system algorithm, taking each management area in the cross-region trust model as an independent agent, simulating the behavior mode of the independent agent under the resource matching matrix, and performing collaborative intelligent optimization on the behavior mode and the collaboration need list through the negotiation mechanism in the multi-agent system algorithm, improving the decision-making coordination between the multiple different management areas, and generating a preliminary collaboration plan set; performing a synergy effect analysis on the preliminary collaboration plan set, identifying the best collaboration mode and potential mode improvement points in the preliminary collaboration plan set by constructing a cooperative game model, and generating a synergy effect evaluation matrix; constructing a risk mitigation strategy based on the risk point evaluation results in the synergy effect evaluation matrix to improve the collaboration efficiency of the preliminary collaboration plan set for uncertain scenarios, and generating an optimized collaboration plan set.

[0148] In this embodiment, the analytic hierarchy process is a method for decision analysis, which decomposes a complex problem into multiple sub-problems by constructing a hierarchical model, and determines the relative importance of each factor through a pairwise comparison matrix.

[0149] Resource matching is to evaluate the degree of adaptation between the resources and needs of each management area in the cross-region trust model.

[0150] The resource matching matrix is ​​a table generated based on the results of demand priority sorting and resource matching evaluation, reflecting the resource matching situation of each management area under different demands.

[0151] The preliminary collaboration plan set is a set of preliminary collaboration plans generated after optimization of the negotiation mechanism in the multi-agent system algorithm. These plans comprehensively consider the needs and resource constraints of each management area to ensure that the efficiency of multi-party collaboration can be effectively improved in actual implementation.

[0152] Synergy analysis is the process of evaluating the effectiveness of a set of preliminary collaborative solutions. By building a cooperative game model, the best collaborative model and potential model improvement points can be identified.

[0153] The synergy effect evaluation matrix is ​​a table generated based on the results of the synergy effect analysis, which reflects the effects and room for improvement of each collaboration plan. The synergy effect evaluation matrix provides a basis for the final optimization of the collaboration plan set.

[0154] Risk point assessment results refer to the results obtained by evaluating the risk points in the synergy assessment matrix. These results help identify potential risks and uncertainties and provide support for building risk mitigation strategies.

[0155] Risk mitigation strategies are specific measures developed for identified risk points, aiming to improve the collaboration efficiency of the initial collaboration plan set under uncertain scenarios. By introducing risk mitigation strategies, it can be ensured that the collaboration plan can be effectively implemented in various situations.

[0156] The optimized collaboration plan set is the final collaboration plan generated based on the preliminary collaboration plan set and combined with the risk mitigation strategy. The optimized collaboration plan set not only takes into account current needs and resources, but also responds to possible risks in the future to ensure long-term and effective collaboration.

[0157] In the embodiment of the present application, firstly, the analytic hierarchy process is used to prioritize the various requirements in the collaborative requirements list, and the resource matching degree of each management area in the cross-regional trust model is evaluated through resource matching analysis to generate a resource matching matrix; secondly, the multi-agent system algorithm is used to simulate the behavior mode of each management area as an independent agent under the resource matching matrix, and the behavior mode and the collaborative requirements list are collaboratively intelligently optimized through a negotiation mechanism to generate a preliminary collaborative solution set; thirdly, the preliminary collaborative solution set is analyzed for synergy effects, and the optimal collaborative mode and potential mode improvement points are identified by constructing a cooperative game model to generate a synergy effect evaluation matrix; finally, a risk mitigation strategy is constructed based on the risk point evaluation results in the synergy effect evaluation matrix to improve the collaborative efficiency of the preliminary collaborative solution set for uncertain scenarios and generate an optimized collaborative solution set.

[0158] Here is a specific example:

[0159] For example, suppose a national medical institution needs to optimize the information security collaboration of its hospitals across the country to better respond to the cybersecurity threats brought by public health emergencies. First, the central server uses the analytic hierarchy process to prioritize the requirements in the collaboration requirements list between hospitals, evaluates the resource matching degree of each hospital through resource matching analysis, and generates a resource matching matrix; secondly, the multi-agent system algorithm simulates the behavior mode of each hospital as an independent agent under the resource matching matrix, and combines the negotiation mechanism to perform collaborative intelligent optimization of these behavior modes and the collaboration requirements list to generate a preliminary collaboration plan set; thirdly, the preliminary collaboration plan set is analyzed for synergy effects, and the optimal collaboration mode and potential model improvement points are identified by constructing a cooperative game model to generate a synergy effect evaluation matrix; finally, a risk mitigation strategy is constructed based on the risk point evaluation results in the synergy effect evaluation matrix to improve the collaboration efficiency of the preliminary collaboration plan set under uncertainty scenarios and generate an optimized collaboration plan set. In this process, medical institutions not only improve the efficiency of information security collaboration, but also enhance their ability to respond to public health emergencies through scientific risk management and optimization measures, and ensure the stable operation of medical information systems.

[0160] In order to solve the problem of periodic pattern recognition of historical vulnerability data and visual analysis of high-risk areas, in some embodiments, the historical vulnerability data in the standardized cross-regional vulnerability information map is obtained in step 104, and the risk heat map technology is used for visual analysis, including: extracting historical vulnerability data from the standardized cross-regional vulnerability information map, aggregating the historical vulnerability data according to time nodes through time series aggregation analysis to identify the periodic pattern of the historical vulnerability data and generate aggregated historical vulnerability data; introducing risk heat map technology to compare the cross-regional collaborative optimization results in the cross-regional collaborative optimization report with the vulnerability structures of each region in the aggregated historical vulnerability data; A dynamic heat map is constructed to perform risk visualization analysis, identify high-risk concentrated areas in the dynamic heat map, and generate a list of high-risk concentrated areas; an information sharing mechanism is introduced, and for the list of high-risk concentrated areas, an efficient information sharing channel is established between the multiple different management areas, and a secure communication platform is constructed to instantly transmit the risk probability information in the list of high-risk concentrated areas, and an information sharing log is generated; in combination with the information sharing log and the dynamic heat map, a time series prediction algorithm is used to estimate the future vulnerability development trend of the high-risk concentrated areas, formulate a collaborative disposal plan based on the future vulnerability development trend, and generate a cross-region vulnerability sharing and collaborative disposal plan.

[0161] In this embodiment, time series aggregation analysis is a technology for processing time series data. By aggregating data according to time nodes, periodicity and trends in the data can be identified.

[0162] Aggregated historical vulnerability data is a data set generated after time series aggregation analysis, which reflects the distribution of historical vulnerability data at different time nodes.

[0163] Risk heat map technology is a visualization method that uses color depth to indicate the degree of risk and intuitively displays the distribution of vulnerabilities in each management area.

[0164] A dynamic heat map refers to a risk heat map that is updated over time and can reflect the latest risk status of each management area in real time.

[0165] The high-risk concentration area list is a list of high-risk areas identified based on the dynamic heat map, which records the location and risk probability information of each high-risk area in detail.

[0166] Information sharing is a way to ensure that critical information is quickly passed between relevant parties, which can speed up response, especially in the face of emergency situations.

[0167] The secure communication platform is the basis for building an information sharing mechanism. It provides a channel for instantly transmitting risk probability information in the list of high-risk concentration areas. The secure communication platform ensures that all relevant parties can obtain the latest risk information in a timely manner, thereby improving collaboration efficiency.

[0168] Information sharing logs are log files that record the results of each information sharing, including the time, content and effect of sharing. These logs provide data support for evaluating the effectiveness of information sharing.

[0169] Time series forecasting algorithm is a technique used to predict future events or trends by building models based on historical data to predict future possibilities.

[0170] The collaborative disposal plan is a specific action plan formulated based on future vulnerability development trends, aiming to take preventive measures in advance and reduce security risks.

[0171] The cross-regional vulnerability sharing and collaborative disposal plan is the result of integrating information sharing logs and dynamic heat maps, combined with the final plan generated by the time series prediction algorithm. This plan provides a scientific basis for cooperation between management areas and ensures the effectiveness of vulnerability management and disposal.

[0172] In an embodiment of the present application, first, historical vulnerability data is extracted from a standardized cross-region vulnerability information map, and these data are aggregated according to time nodes through time series aggregation analysis to identify the periodic pattern of the historical vulnerability data and generate aggregated historical vulnerability data; secondly, risk heat map technology is introduced to construct a dynamic heat map for the cross-region collaborative optimization results in the cross-region collaborative optimization report and the vulnerabilities of each region in the aggregated historical vulnerability data, and risk visualization analysis is performed to identify high-risk concentration areas in the dynamic heat map and generate a list of high-risk concentration areas; thirdly, an information sharing mechanism is introduced to establish an efficient information sharing channel between multiple different management areas, and a secure communication platform is constructed to instantly transmit risk probability information in the list of high-risk concentration areas, and an information sharing log is generated; finally, in combination with the information sharing log and the dynamic heat map, a time series prediction algorithm is used to estimate the future vulnerability development trend of the high-risk concentration area, a collaborative disposal plan based on the future vulnerability development trend is formulated, and a cross-region vulnerability sharing and collaborative disposal plan is generated.

[0173] Here is a specific example:

[0174] For example, suppose a national energy department needs to improve the information security level of its power plants across the country and hopes to predict future security threats through in-depth analysis of historical vulnerability data. First, the central server extracts historical vulnerability data from the standardized cross-region vulnerability information map, aggregates these data according to time nodes through time series aggregation analysis, identifies the periodic pattern of historical vulnerability data, and generates aggregated historical vulnerability data; secondly, introduces risk heat map technology, constructs a dynamic heat map for the cross-region collaborative optimization results in the cross-region collaborative optimization report and the regional vulnerabilities in the aggregated historical vulnerability data, conducts risk visualization analysis, identifies high-risk concentration areas in the dynamic heat map, and generates a list of high-risk concentration areas; thirdly, introduces an information sharing mechanism, establishes an efficient information sharing channel between multiple different management areas, builds a secure communication platform to instantly transmit risk probability information in the list of high-risk concentration areas, and generates information sharing logs; finally, combined with information sharing logs and dynamic heat maps, the time series prediction algorithm is used to estimate the future vulnerability development trend of high-risk concentration areas, formulates a collaborative disposal plan based on future vulnerability development trends, and generates cross-region vulnerability sharing and collaborative disposal plans. During this process, the energy department not only improved its information security early warning capabilities, but also ensured the stable operation of the power system and enhanced the overall safety protection level through scientific prediction and coordinated disposal.

[0175] The present application considers that in order to solve the problems of inaccurate causal relationship analysis and difficulty in capturing complex interaction patterns in the prior art, the present invention embodiment proposes this optional solution to solve the above technical problems, and thus proposes a new optional solution, which includes:

[0176] The dynamic Bayesian network algorithm is used to extract the spatiotemporal feature vectors in the spatiotemporal association graph. The spatiotemporal feature vectors are combined with the spatiotemporal sequence data for causal relationship analysis through the temporal causal reasoning module in the dynamic Bayesian network algorithm. A conditional probability distribution table is constructed to quantify the causal relationship strength in the causal relationship analysis results. The causal pattern of the spatiotemporal sequence data evolving over time is analyzed according to the causal relationship strength, and a causal relationship matrix is ​​generated, including:

[0177] The continuous time series data in the spatiotemporal association map is divided into a number of fixed-length time windows by using a time series segmentation technique, and a spatial interpolation method is applied to fill in the potential missing points of geographic spatial data in the fixed-length time windows to generate a spatiotemporal feature vector;

[0178] The spatiotemporal eigenvector is calculated using the following formula:

[0179] ;

[0180] in, For management area The spatiotemporal eigenvector of ; is the total length of the time series data, that is, the number of data points in the entire time window; is a specific time point in the time series, ranging from 1 to ; For time The weight factor at ; For management area In time The eigenvalue at ; is the mean of the time series; is the standard deviation of the time series;

[0181] A conditional probability distribution model is introduced to evaluate the dependency between the spatiotemporal feature vectors, and a conditional probability distribution table is constructed to quantify the strength of the dependency, and the complex interaction pattern between the spatiotemporal feature vectors is captured by a nonlinear function to generate a probability of causal strength;

[0182] The probability of causal relationship strength is calculated using the following formula:

[0183] ;

[0184] in, For management area For management area The probability of the strength of causal relationship; and Management Area and The spatiotemporal eigenvector of ; is the correlation matrix between the spatiotemporal eigenvectors; is a nonlinear function used to capture the complex interactions between spatiotemporal feature vectors; A regulation factor to adjust the importance of the linear relationship between spatiotemporal eigenvectors; A moderator to enhance the effect of nonlinear interaction terms; to control the regulatory factors for the interaction between the spatiotemporal feature vectors of other management areas; A regulatory factor to balance the differential impacts between different management areas; is not equal to The index of the management area; is the total number of management areas; A correlation matrix to describe the indirect effects between different management areas; A nonlinear function to assess the dynamic differences between different management areas;

[0185] The causal relationship strength probability is integrated into a unified matrix structure through a matrix construction algorithm, and threshold filtering is performed to remove low probability value structures in the unified matrix structure, highlight significant causal relationship paths in the unified matrix structure, and generate a causal relationship matrix.

[0186] This method aims to improve the accuracy of causal relationship analysis in cross-regional vulnerability library sharing and collaborative disposal, ensure the effective capture of complex interaction patterns between different management areas, and thus provide more scientific decision-making support. Through precise time series segmentation, geospatial data filling, complex nonlinear function modeling and matrix structured processing, in-depth analysis of spatiotemporal feature vectors and their causal relationships can be achieved.

[0187] Assume that a multinational bank needs to improve the information security level of its branches around the world and hopes to predict future security threats through in-depth analysis of spatiotemporal feature vectors;

[0188] Assumptions Days (a year), (midpoint of the year), (assumed standard deviation), (assuming that each time point is equally important), Random number series (simulating security event data);

[0189] ;

[0190] Assumptions ; and is the pre-training matrix, and is a predefined function;

[0191] ;

[0192] Assuming that the threshold is set to 0.9, since the calculated result 0.95 is greater than the set threshold, it shows that the information security sharing scheme has high effectiveness and security, and can ensure that the data is not tampered with or leaked during transmission and storage. This is because the higher probability of causal relationship strength reflects that under the current network conditions, the management area The security incidents have a significant impact on the management area, so that preventive measures can be taken in advance to ensure the security of the overall system. Through the above steps, the effective management and optimization of the cross-region vulnerability library is ensured, the early warning capability of information security is improved, and the security protection level and response speed of the entire multinational bank are enhanced.

[0193] This application considers that in order to solve the problems of inaccurate resource demand prediction between management areas, complex dependencies, and low decision-making coordination efficiency in the cross-region trust model in the prior art, the embodiment of the invention proposes this optional solution to solve the above technical problems, and therefore proposes a new optional solution, which includes:

[0194] Using a multi-agent system algorithm, taking each management area in the cross-region trust model as an independent agent, simulating the behavior pattern of the independent agent under the resource matching matrix, and performing collaborative intelligent optimization on the behavior pattern and the collaboration requirement list through the negotiation mechanism in the multi-agent system algorithm, the decision-making coordination between the multiple different management areas is improved, and a preliminary collaboration solution set is generated, including:

[0195] Analyze the historical behavior data of each management area in the cross-region trust model through a behavior pattern recognition algorithm, identify typical behavior patterns and change trends in the historical behavior data, apply a resource demand prediction model, take the resource matching matrix as a constraint condition, and evaluate the resource demand of each management area in the cross-region trust model in the future to generate a behavior pattern fitness;

[0196] The behavior pattern fitness is calculated using the following formula:

[0197] ;

[0198] in, For management area Adaptability of behavior patterns; The index of the management area, from 1 to ; is the total number of management areas; Manage areas under the resource matching matrix and The resource differences between Managing zones in a cross-zone trust model right The amount of trust change; and Parameters to moderate the impact of resource differences and trust changes; For management area Current coordination gaps relative to the list of collaboration needs; The impact weights for coordination gaps;

[0199] A multi-agent negotiation mechanism is introduced to simulate the process of consensus reached by the management areas in the cross-region trust model through negotiation, a nonlinear interaction function is applied to capture the complex dependencies between the management areas, and the influence of a specific management area in each management area is enhanced or weakened through fitness weight adjustment to obtain a generation probability;

[0200] The generation probability is calculated using the following formula:

[0201] ;

[0202] in, is the generation probability; For management area Adaptability of behavior patterns; To avoid small positive numbers with zero denominator; is a parameter for adjusting the strength of the nonlinear term; and Respectively with Frequency parameters of resource fitness and coordination gap when agents interact; is the index of the agent participating in the negotiation mechanism, ranging from 1 to ; is the number of agents participating in the negotiation mechanism; Parameters for controlling the overall solution generation tendency; The index of the management area, from 1 to ; for the management area Current coordination gaps relative to the list of collaboration needs;

[0203] Through the scheme optimization algorithm, the high generation probability collaboration requirements in the collaboration requirement list are screened out, conflict detection is performed, the potential conflicts between the high generation probability collaboration requirements are checked, and the potential conflicts are weakened through the multi-agent negotiation mechanism to fit the high generation probability collaboration requirements and generate a preliminary collaboration scheme set.

[0204] This method aims to improve the efficiency of decision-making and coordination in cross-region vulnerability library sharing and collaborative disposal, ensure the effective capture of complex interaction patterns between different management areas, and provide more scientific decision support. Through precise behavior pattern recognition, resource demand prediction, complex nonlinear function modeling, and multi-agent negotiation mechanism, it can achieve in-depth analysis of future resource demand and collaboration demand of each management area, and generate an optimized preliminary collaboration plan set.

[0205] In the behavioral pattern fitness, the resource difference index term :Measure the degree of resource difference through exponential function, parameter Used to adjust the impact of resource differences; trust change index item :Use exponential function to evaluate the trust change, parameter Used to adjust the impact of trust changes; fitness normalization term : Using linear function Reflects the management area The current coordination gap relative to the collaboration needs list, parameters Used to weigh the importance of coordination gaps;

[0206] Among them, resource differences and trust changes Extracted from historical behavior data; parameters and Determine through cross-validation optimization; reconcile gaps Calculated based on the collaborative requirements list; parameters Determined by cross-validation optimization;

[0207] In the generation probability, the fitness weight term : Adjust the behavior mode adaptability of each management area; small positive number : Set to a small positive number to avoid zero denominator; nonlinear interaction terms: : Using sine and cosine functions Capturing complex dependencies, parameters Used to control the strength of the nonlinear term through the frequency parameter and Reflects the frequency of interaction between different agents;

[0208] Among them, behavioral pattern fitness Calculated by the above formula; parameter Set to a small positive number to avoid zero denominator; parameter Determine through cross-validation optimization; reconcile gaps Calculated based on the collaboration requirements list; Determined by cross-validation optimization;

[0209] Assume that a national power grid company needs to improve the information security level of its substations across the country and hopes to optimize the collaborative disposal strategy by accurately predicting the future resource demand of each management area;

[0210] Assumptions (Total number of managed areas), ;

[0211] ;

[0212] Assumptions (the number of agents participating in the negotiation mechanism);

[0213] ;

[0214] Assuming that the threshold is set to 0.9, since the calculated result 0.92 is greater than the set threshold, it shows that the information security sharing scheme has high effectiveness and security, and can ensure that the data is not tampered with or leaked during transmission and storage. This is because the higher generation probability reflects that under the current network conditions, the various management areas can effectively reach a consensus, so as to take preventive measures in advance to ensure the security of the overall system. Through the above steps, the effective management and optimization of the cross-regional vulnerability library is ensured, the early warning capability of information security is improved, and the security protection level and response speed of the entire power grid company are enhanced.

[0215] Figure 2 A schematic diagram of a cross-region vulnerability library sharing and collaborative handling system is provided for an embodiment of the present application. Figure 2 As shown, the device comprises:

[0216] A receiving module 21 is used to receive vulnerability database information from multiple different management areas, introduce a multi-level information circulation framework, and convert the information format of the vulnerability database information through multi-level information exchange rules in the multi-level information circulation framework to generate a standardized cross-region vulnerability information map;

[0217] The analysis module 22 is used to use the dynamic Bayesian network algorithm to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and perform causal relationship analysis on the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm to focus on the causal pattern of the spatiotemporal sequence data evolving over time, adopt an event-driven architecture, and use the instant response mechanism in the event-driven architecture to respond to the causal pattern evolving over time, dynamically update the standardized cross-region vulnerability information map according to the instant response result, and generate a cross-region trust model;

[0218] The optimization module 23 is used to use the multi-agent system algorithm to extract the multi-party collaboration needs in the cross-region trust model, and to perform collaborative intelligent optimization on the multi-party collaboration needs through the negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. The real-time streaming data analysis technology is used to build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, and the multi-party collaboration needs are monitored in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model and generate a cross-region collaborative optimization report.

[0219] The sharing module 24 is used to obtain the historical vulnerability data in the standardized cross-regional vulnerability information map, and use the risk heat map technology to visualize the cross-regional collaborative optimization results in the cross-regional collaborative optimization report and the regional vulnerabilities in the historical vulnerability data. Information is shared based on the high-risk concentrated areas in the visualization analysis results, and a predictive analysis model is used to estimate the future vulnerability development trend of the high-risk concentrated areas, and a cross-regional vulnerability sharing and collaborative disposal plan is generated.

[0220] Figure 2 The cross-region vulnerability library sharing and collaborative handling system can execute Figure 1 The implementation principle and technical effects of the cross-region vulnerability library sharing and collaborative disposal method described in the illustrated embodiment will not be repeated. The specific manner in which each module and unit performs operations in the cross-region vulnerability library sharing and collaborative disposal system in the above embodiment has been described in detail in the embodiment of the method, and will not be elaborated here.

[0221] In one possible design, Figure 2 The cross-region vulnerability library sharing and collaborative handling system of the illustrated embodiment can be implemented as a computing device, such as Figure 3 As shown, the computing device may include a storage component 31 and a processing component 32;

[0222] The storage component 31 stores one or more computer instructions, wherein the one or more computer instructions are called and executed by the processing component 32 .

[0223] The processing component 32 is used to: receive vulnerability library information from multiple different management areas, introduce a multi-level information flow framework, and convert the information format of the vulnerability library information through the multi-level information exchange rules in the multi-level information flow framework to generate a standardized cross-region vulnerability information map; use a dynamic Bayesian network algorithm to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and perform causal relationship analysis on the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm to focus on the causal pattern of the spatiotemporal sequence data evolving over time, adopt an event-driven architecture, and respond to the causal pattern evolving over time through the instant response mechanism in the event-driven architecture, dynamically update the standardized cross-region vulnerability information map according to the instant response results, and generate a cross-region trust model; use a multi-agent system algorithm to extract the multi-party collaboration requirements in the cross-region trust model. The multi-party collaboration needs are collaboratively and intelligently optimized through the negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. The real-time streaming data analysis technology is used to build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology. The multi-party collaboration needs are monitored in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model and generate a cross-region collaborative optimization report. The historical vulnerability data in the standardized cross-region vulnerability information map is obtained, and the risk heat map technology is used to visualize the cross-region collaborative optimization results in the cross-region collaborative optimization report and the vulnerabilities of each region in the historical vulnerability data. Information is shared according to the high-risk concentrated areas in the visualization analysis results, and the predictive analysis model is used to estimate the future vulnerability development trend of the high-risk concentrated areas to generate a cross-region vulnerability sharing and collaborative disposal plan.

[0224] The processing component 32 may include one or more processors to execute computer instructions to complete all or part of the steps in the above method. Of course, the processing component may also be implemented by one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors or other electronic components to perform the above method.

[0225] The storage component 31 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash memory, magnetic disk or optical disk.

[0226] Of course, the computing device may also include other components, such as input / output interfaces, display components, communication components, etc.

[0227] The input / output interface provides an interface between the processing component and the peripheral interface module, which may be an output device, an input device, etc.

[0228] The communication component is configured to facilitate, among other things, wired or wireless communications between the computing device and other devices.

[0229] Among them, the computing device can be a physical device or an elastic computing host provided by a cloud computing platform, etc. In this case, the computing device can refer to a cloud server, and the above-mentioned processing components, storage components, etc. can be basic server resources rented or purchased from the cloud computing platform.

[0230] The present application also provides a computer storage medium storing a computer program, wherein the computer program can achieve the above-mentioned Figure 1 A method for sharing and collaboratively handling a cross-region vulnerability library in the illustrated embodiment.

[0231] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0232] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0233] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0234] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for sharing and coordinating vulnerability databases across regions, characterized in that: include: Receive vulnerability database information from multiple different management areas, introduce a multi-level information circulation framework, convert the information format of the vulnerability database information through multi-level information exchange rules in the multi-level information circulation framework, and generate a standardized cross-region vulnerability information map; A dynamic Bayesian network algorithm is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and a causal relationship analysis is performed on the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm to focus on the causal pattern of the spatiotemporal sequence data evolving over time. An event-driven architecture is used to respond to the causal pattern evolving over time through the instant response mechanism in the event-driven architecture. The standardized cross-region vulnerability information map is dynamically updated according to the instant response results to generate a cross-region trust model. An instant response log is generated during the generation of the cross-region trust model. The generation of the instant response log includes: performing pattern recognition processing on the causal pattern in the causal relationship model, identifying the key pattern in the causal relationship model that reflects the causal relationship between different events, performing impact path analysis, parsing the impact path and impact intensity involved in the key pattern, and generating key Pattern library; adopting an event-driven architecture, by introducing the instant response mechanism in the event-driven architecture into the causal relationship model, responding immediately to the key pattern library combined with the causal pattern evolving over time, dynamically updating the standardized cross-region vulnerability information map according to the instant response results, and generating an initial response instruction set; monitoring the actual effect of the initial response instruction set after implementation in real time, applying a deviation correction algorithm, comparing the deviation value between the expected effect of the initial response instruction set and the actual effect, identifying potential deviation-inducing factors, optimizing the initial response instruction set according to the potential deviation-inducing factors, and generating an optimized response instruction set; collecting all response results after the implementation of the optimized response instruction set, integrating all response results through log generation processing, introducing a log synchronization mechanism, and instantly synchronizing the log generation processing results to the optimized response instruction set to generate an instant response log; Using a multi-agent system algorithm, extract the multi-party collaboration needs in the cross-region trust model, and perform collaborative intelligent optimization on the multi-party collaboration needs through the negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. Using real-time streaming data analysis technology, build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, and monitor the multi-party collaboration needs in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model and generate a cross-region collaborative optimization report. The historical vulnerability data in the standardized cross-regional vulnerability information map is obtained, and the risk heat map technology is used to perform a visual analysis of the cross-regional collaborative optimization results in the cross-regional collaborative optimization report and the vulnerabilities of each region in the historical vulnerability data. Information is shared according to the high-risk concentrated areas in the visualization analysis results, and a predictive analysis model is used to estimate the future vulnerability development trend of the high-risk concentrated areas, and a cross-regional vulnerability sharing and collaborative disposal plan is generated.

2. The method according to claim 1, characterized in that The dynamic Bayesian network algorithm is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and the temporal causal reasoning module in the dynamic Bayesian network algorithm is used to perform causal relationship analysis on the spatiotemporal sequence data to focus on the causal pattern of the spatiotemporal sequence data evolving over time. An event-driven architecture is used to respond to the causal pattern evolving over time through the instant response mechanism in the event-driven architecture, and the standardized cross-region vulnerability information map is dynamically updated according to the instant response result to generate a cross-region trust model, including: Performing time labeling processing on the cross-region vulnerability data in the standardized cross-region vulnerability information map, attaching detailed time labels by parsing the time field in the time labeling processing result, executing anomaly detection algorithms, identifying and correcting potential outliers in the detailed time labels, and generating corrected time labels; Using a dynamic Bayesian network algorithm, extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and perform causal relationship analysis on the modified time label combined with the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm, so as to focus on the causal pattern of the spatiotemporal sequence data evolving over time and generate a causal relationship model; Adopting an event-driven architecture, by introducing an instant response mechanism in the event-driven architecture into the causal relationship model, responding immediately to the causal pattern evolving over time, dynamically updating the standardized cross-region vulnerability information map according to the instant response result, and generating an instant response log; According to the immediate response results, response speed and response effectiveness are introduced as response performance. Through response performance evaluation and analysis, the emergency response performance of each management area in the immediate response log is quantitatively evaluated. The causal relationship model is optimized through the emergency response performance to generate a cross-region trust model.

3. The method according to claim 2, characterized in that The dynamic Bayesian network algorithm is used to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and the time series causal reasoning module in the dynamic Bayesian network algorithm is used to perform causal relationship analysis on the modified time label in combination with the spatiotemporal sequence data, so as to focus on the causal pattern of the spatiotemporal sequence data evolving over time and generate a causal relationship model, including: Performing time series analysis on the correction time tag, accurately mapping each record in the correction time tag to a corresponding time point and geographic location, performing association rule mining analysis, identifying the spatiotemporal correlation between the corresponding time point and geographic location, and generating a spatiotemporal correlation map; Using a dynamic Bayesian network algorithm, extract the spatiotemporal feature vectors in the spatiotemporal association graph, perform causal relationship analysis on the spatiotemporal feature vectors in combination with the spatiotemporal sequence data through a temporal causal reasoning module in the dynamic Bayesian network algorithm, and construct a conditional probability distribution table to quantify the causal relationship strength in the causal relationship analysis results, parse the causal pattern of the spatiotemporal sequence data evolving over time according to the causal relationship strength, and generate a causal relationship matrix; Introducing multi-scale feature extraction technology, extracting key feature vectors at different time scales from the causal relationship matrix, applying hierarchical clustering analysis, performing hierarchical clustering processing on similar feature vectors in the key feature vectors, and generating a multi-scale feature vector set; A causal network construction process is introduced to connect the different time scale features in the multi-scale feature vector set into a complete causal network to systematically reflect the feature interactions between the different time scale features and generate a causal relationship model.

4. The method according to claim 1, characterized in that: The multi-agent system algorithm is used to extract the multi-party collaboration needs in the cross-region trust model, and the multi-party collaboration needs are collaboratively and intelligently optimized through the negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. The real-time streaming data analysis technology is used to build a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, and the multi-party collaboration needs are monitored in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model, and a cross-region collaborative optimization report is generated, including: Utilizing natural language processing technology, parsing the collaboration records and historical communication content between management areas in the cross-region trust model, extracting multi-party collaboration requirements in the collaboration records and historical communication content, and generating a collaboration requirement list; Using a multi-agent system algorithm, taking each management area in the cross-region trust model as an independent agent, simulating the behavior pattern of the independent agent, and performing collaborative intelligent optimization on the behavior pattern and the collaboration requirement list through a negotiation mechanism in the multi-agent system algorithm, thereby improving the decision-making coordination among the multiple different management areas and generating an optimized collaboration solution set; Adopting real-time streaming data analysis technology, building a real-time data monitoring platform through the continuous query engine in the real-time streaming data analysis technology, monitoring the optimized collaboration solution set in real time through the data monitoring platform, improving the multi-party collaboration efficiency in the cross-region trust model, and generating a real-time monitoring report; By introducing a feedback loop mechanism, the collaborative results of the real-time monitoring report are fed back to the execution center of each management area in the cross-region trust model. The execution center improves the optimized collaboration solution set and then loops the real-time monitoring process, integrating the feedback loop results after the introduction of the feedback loop mechanism to generate a cross-region collaborative optimization report.

5. The method according to claim 4, characterized in that The multi-agent system algorithm is used to take each management area in the cross-region trust model as an independent agent, simulate the behavior pattern of the independent agent, and perform collaborative intelligent optimization on the behavior pattern and the collaboration requirement list through the negotiation mechanism in the multi-agent system algorithm, thereby improving the decision-making coordination between the multiple different management areas and generating an optimized collaboration solution set, including: Using the analytic hierarchy process, the requirements in the collaboration requirements list are prioritized, and through resource matching analysis, the resource matching degree of each management area in the cross-region trust model is evaluated according to the requirements priority ranking results to generate a resource matching matrix; Using a multi-agent system algorithm, taking each management area in the cross-region trust model as an independent agent, simulating the behavior pattern of the independent agent under the resource matching matrix, and performing collaborative intelligent optimization on the behavior pattern and the collaboration requirement list through a negotiation mechanism in the multi-agent system algorithm, thereby improving the decision-making coordination among the multiple different management areas and generating a preliminary collaboration solution set; Conducting synergy analysis on the preliminary collaboration solution set, identifying the best collaboration mode and potential mode improvement points in the preliminary collaboration solution set by constructing a cooperative game model, and generating a synergy evaluation matrix; A risk mitigation strategy is constructed based on the risk point assessment results in the synergy effect assessment matrix to improve the collaboration efficiency of the preliminary collaboration solution set for uncertain scenarios and generate an optimized collaboration solution set.

6. The method according to claim 1, characterized in that The method obtains the historical vulnerability data in the standardized cross-region vulnerability information map, uses the risk heat map technology to visualize the cross-region collaborative optimization results in the cross-region collaborative optimization report and the regional vulnerabilities in the historical vulnerability data, shares information based on the high-risk concentrated areas in the visualization analysis results, and uses a predictive analysis model to estimate the future vulnerability development trend of the high-risk concentrated areas, and generates a cross-region vulnerability sharing and collaborative disposal plan, including: Extracting historical vulnerability data from the standardized cross-region vulnerability information map, aggregating the historical vulnerability data according to time nodes through time series aggregation analysis to identify periodic patterns of the historical vulnerability data, and generating aggregated historical vulnerability data; Introducing risk heat map technology, constructing a dynamic heat map for the cross-region collaborative optimization results in the cross-region collaborative optimization report and the regional vulnerabilities in the aggregated historical vulnerability data, performing risk visualization analysis, identifying high-risk concentrated areas in the dynamic heat map, and generating a list of high-risk concentrated areas; Introducing an information sharing mechanism, establishing an efficient information sharing channel between the multiple different management areas for the high-risk concentrated area list, building a secure communication platform to instantly transmit the risk probability information in the high-risk concentrated area list, and generating an information sharing log; Combining the information sharing log with the dynamic heat map, using the time series prediction algorithm, the future vulnerability development trend of the high-risk concentration area is estimated, a collaborative disposal plan based on the future vulnerability development trend is formulated, and a cross-region vulnerability sharing and collaborative disposal plan is generated.

7. A cross-region vulnerability database sharing and collaborative handling system, characterized in that: include: A receiving module is used to receive vulnerability database information from multiple different management areas, introduce a multi-level information circulation framework, convert the information format of the vulnerability database information through multi-level information exchange rules in the multi-level information circulation framework, and generate a standardized cross-region vulnerability information map; The analysis module is used to use a dynamic Bayesian network algorithm to extract the spatiotemporal sequence data in the standardized cross-region vulnerability information map, and perform causal relationship analysis on the spatiotemporal sequence data through the temporal causal reasoning module in the dynamic Bayesian network algorithm to focus on the causal pattern of the spatiotemporal sequence data evolving over time. An event-driven architecture is adopted to respond to the causal pattern evolving over time through the instant response mechanism in the event-driven architecture. The standardized cross-region vulnerability information map is dynamically updated according to the instant response result to generate a cross-region trust model. An instant response log is generated in the process of generating the cross-region trust model. The generation of the instant response log includes: performing pattern recognition processing on the causal pattern in the causal relationship model, identifying the key pattern in the causal relationship model that reflects the causal relationship between different events, performing impact path analysis, and parsing the impact path and impact intensity involved in the key pattern. Generate a key pattern library; adopt an event-driven architecture, introduce an instant response mechanism in the event-driven architecture into the causal relationship model, respond instantly to the key pattern library in combination with the causal pattern that evolves over time, dynamically update the standardized cross-region vulnerability information map according to the instant response results, and generate an initial response instruction set; monitor the actual effect of the initial response instruction set after implementation in real time, apply a deviation correction algorithm, compare the deviation value between the expected effect of the initial response instruction set and the actual effect, identify potential deviation-inducing factors, optimize the initial response instruction set according to the potential deviation-inducing factors, and generate an optimized response instruction set; collect all response results after the implementation of the optimized response instruction set, integrate all response results through log generation processing, introduce a log synchronization mechanism, synchronize the log generation processing results to the optimized response instruction set in real time, and generate an instant response log; An optimization module is used to use a multi-agent system algorithm to extract the multi-party collaboration needs in the cross-region trust model, and to perform collaborative intelligent optimization on the multi-party collaboration needs through a negotiation mechanism in the multi-agent system algorithm to improve the decision-making coordination among the multiple different management areas. A real-time streaming data analysis technology is used to build a real-time data monitoring platform through a continuous query engine in the real-time streaming data analysis technology, and the multi-party collaboration needs are monitored in real time through the data monitoring platform to improve the multi-party collaboration efficiency in the cross-region trust model and generate a cross-region collaborative optimization report. The sharing module is used to obtain the historical vulnerability data in the standardized cross-regional vulnerability information map, use the risk heat map technology to visualize the cross-regional collaborative optimization results in the cross-regional collaborative optimization report and the regional vulnerabilities in the historical vulnerability data, share information based on the high-risk concentrated areas in the visualization analysis results, and use a predictive analysis model to estimate the future vulnerability development trend of the high-risk concentrated areas, and generate a cross-regional vulnerability sharing and collaborative disposal plan.

8. A computing device, characterized in that It comprises a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are used to be called and executed by the processing component to implement a cross-region vulnerability library sharing and collaborative disposal method as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that A computer program is stored, and when the computer program is executed by a computer, a method for sharing and collaboratively handling a cross-region vulnerability library as described in any one of claims 1 to 6 is implemented.

Images