Network security early warning method and system based on distributed cooperation

Abstract

The invention discloses a network security early warning method and system based on distributed cooperation, and relates to the technical field of security early warning, and the method comprises the steps: deploying distributed collection nodes, collecting node data, carrying out the preprocessing, and extracting the static features and dynamic features of the data; and performing dimension reduction on the static features of the nodes, performing static risk assessment based on the static features after dimension reduction to obtain a static risk score, and generating a dynamic risk score based on the dynamic features. According to the method, accurate classification and feature extraction of static data and dynamic data are realized, optimization modeling is carried out for the two types of features, the problems of insufficient real-time performance and data islands in a traditional network security method are solved, comprehensive global risk assessment can be realized through weighted fusion of static risk scores and dynamic risk scores, and the risk assessment efficiency is improved. And in combination with an automatic early warning response mechanism, the efficiency and accuracy of network security monitoring are remarkably improved, so that complex security threats in a large-scale distributed network environment can be more effectively coped with.

Description

Technical Field

[0001] The present invention relates to the field of security early warning technology, and in particular to a distributed collaboration-based network security early warning method and system. Background Art

[0002] With the rapid development of network technology and the continuous improvement of informatization, the types and complexity of network security threats are also increasing, posing serious challenges to the key business systems of various organizations. Traditional network security monitoring methods mostly adopt a single-node centralized architecture, relying on fixed rule matching or single-dimensional statistical analysis, which is often inadequate when dealing with complex threats in large-scale distributed networks. At the same time, with the popularization of the Internet of Things, cloud computing and 5G technologies, network traffic has grown exponentially, data sources have become more dispersed, and network status has become more dynamic, which has posed unprecedented challenges to traditional monitoring solutions. In recent years, security methods based on machine learning have gradually emerged. They build threat models by learning from historical data, which can improve the accuracy of threat detection to a certain extent. However, these methods' static processing of data leads to insufficient real-time performance and cannot effectively cope with dynamically changing network status. Especially in the face of distributed network environments, data island problems, lack of timeliness and low collaboration efficiency further restrict the ability of network security monitoring. Summary of the invention

[0003] In view of the above existing problems, the present invention is proposed.

[0004] Therefore, the present invention provides a network security early warning method and system based on distributed collaboration to solve the problems that the existing methods lack real-time performance when statically processing data and cannot effectively respond to dynamically changing network conditions. Especially in the face of a distributed network environment, data island problems, lack of timeliness and low collaboration efficiency further restrict the ability of network security monitoring.

[0005] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0006] In a first aspect, the present invention provides a network security early warning method based on distributed collaboration, which comprises:

[0007] Deploy distributed collection nodes to collect node data and pre-process it to extract static and dynamic features of the data;

[0008] Reduce the dimension of the static features of the node, perform static risk assessment based on the reduced dimension static features to obtain a static risk score, and generate a dynamic risk score based on the dynamic features;

[0009] A global risk score is obtained based on the static risk score and the dynamic risk score, and an early warning response is performed based on the risk score.

[0010] As a preferred solution of the network security early warning method based on distributed collaboration described in the present invention, wherein: the deployment of distributed collection nodes to collect node data and perform preprocessing, and extracting static and dynamic features of the data refers to deploying distributed data collection nodes at multiple key locations of the network to collect flow data, device status data and security log data of each node in real time;

[0011] Clean and standardize the collected data, use the sliding window method to process the collected time series data, construct the trajectory matrix, perform singular value decomposition on the trajectory matrix, and remove the noise component;

[0012] The data is divided into static data and dynamic data through the support vector machine model;

[0013] Preliminarily extract the static features of static data based on statistical methods, and preliminarily extract the dynamic features of dynamic data through time series decomposition;

[0014] After the static and dynamic features are extracted, the features of each data point are arranged in columns to form a static feature matrix and a dynamic feature matrix.

[0015] As a preferred solution of the distributed collaboration-based network security early warning method of the present invention, wherein: the dimensionality reduction of the static features of the node refers to normalizing and sparse regularization noise reduction of the obtained static feature matrix to obtain a noise-reduced feature matrix A with a dimension of m*n, where m is the number of samples and n is the feature dimension;

[0016] Use Euclidean distance to calculate the distance between the sample point and other points. For each sample point s, select the k sample points closest to it and build a neighborhood set Q.

[0017] Assume that each sample point is represented by a linear combination of neighborhood points;

[0018] Optimize reconstruction weights, minimize reconstruction errors, and define optimization constraints;

[0019] Construct the covariance matrix C between neighborhood points and minimize the error;

[0020] Use Lagrange multiplier method to solve the linear equations to obtain weights, and construct weight matrix W based on the obtained weights;

[0021] Construct an embedding matrix M based on the weight matrix W, perform matrix sparsification and regularization on the embedding matrix, and perform eigenvalue decomposition on the embedding matrix;

[0022] Arrange the first d eigenvectors to generate a low-dimensional embedding feature matrix B;

[0023] The low-dimensional embedding feature matrix B and the feature matrix A are combined through linear weighting to obtain the fused feature matrix C;

[0024] Initialize the projection matrix P, and project the fused feature matrix C into a low-dimensional space based on the initialization projection matrix P to obtain a low-dimensional feature matrix Z;

[0025] Initialize the weight matrix W and the noise matrix E, and construct a joint optimization objective based on the low-dimensional feature matrix Z to balance the reconstruction error, low constraints, and sparse regularization;

[0026] Initialize the low-dimensional feature matrix Z′, and optimize the weight matrix W and noise matrix E while fixing P to minimize the reconstruction error and regularization term;

[0027] Use singular value decomposition to calculate the low-rank weight matrix W′;

[0028] Use sparse regularization to optimize the noise matrix E to obtain E′;

[0029] Under the condition of fixed weight matrix W′ and noise matrix E′, optimize the projection matrix P, minimize the reconstruction error, use singular value decomposition to update the projection matrix P, recalculate the low-dimensional feature matrix Z′1 based on the updated projection matrix, iteratively optimize the three variables, and check the change of the variables after each iteration, set the convergence threshold x, if the change is less than the threshold x, stop the iteration to obtain the global low-dimensional feature matrix;

[0030] Calculate the Euclidean distance of each pair of sample points in the low-dimensional feature matrix, and use the Gaussian kernel function to define the edge weights, fill all edge weights into the adjacency matrix G, calculate the degree matrix J of the adjacency matrix G, and calculate the non-normalized Laplace matrix L based on the adjacency matrix and degree matrix;

[0031] Perform eigenvalue decomposition on the non-normalized Laplace matrix, sort it in ascending order according to the size of the eigenvalues, select the eigenvectors corresponding to the first a smallest eigenvalues, and arrange the selected eigenvectors in columns to generate an optimized low-dimensional feature representation matrix.

[0032] As a preferred solution of the network security early warning method based on distributed collaboration described in the present invention, wherein: performing static risk assessment based on the static features after dimensionality reduction to obtain a static risk score refers to performing static risk assessment using XGBoost classifier training optimized by the whale optimization algorithm, including:

[0033] Use historical static data as training set;

[0034] Initialize the size of the whale group and the maximum number of iterations. Each whale individual represents the hyperparameter configuration of GBoost. Set the search range for each hyperparameter and define the fitness function.

[0035] The fitness function includes accuracy, sensitivity and specificity;

[0036] Calculate the distance between the current whale position and the optimal position, and use the calculated distance to update the whale position;

[0037] Iterate and optimize the position. After each iteration, use the training data to train the XGBoost model and calculate the fitness value to update the optimal position until the maximum number of iterations is reached to obtain the optimal hyperparameters after optimization.

[0038] The optimal hyperparameters obtained based on WOA optimization are used to train the XGBoost classifier to obtain a trained XGBoost classifier, and the static features in the low-dimensional feature representation matrix are input into the XGBoost classifier to obtain a static risk score.

[0039] As a preferred solution of the network security early warning method based on distributed collaboration described in the present invention, wherein: generating a dynamic risk score based on dynamic features refers to extracting the standardized dynamic data features in the dynamic feature matrix, using a time convolutional network to perform dilated convolution on the dynamic data, extracting the features of each time step, calculating the importance weight of each channel in the time convolutional network, optimizing the features of each time step based on the obtained importance features, inputting the obtained optimized features into a bidirectional GRU model to obtain a bidirectional hidden state combination of the time step, and using the bidirectional hidden state combination output by the bidirectional GRU model as the final feature representation;

[0040] The feature representation is mapped to the risk score space through the fully connected layer and bias term to obtain the dynamic risk score.

[0041] As a preferred solution of the network security early warning method based on distributed collaboration described in the present invention, wherein: the comprehensive risk score obtained based on the static risk score and the dynamic risk score refers to weighted summing the static risk score and the dynamic risk score obtained by the weighted average method to obtain the comprehensive risk score of the current network.

[0042] As a preferred solution of the network security early warning method based on distributed collaboration described in the present invention, wherein: the early warning response based on risk score refers to setting a risk threshold H. If the comprehensive risk score is greater than the threshold H, an early warning is immediately triggered, and the risk score and related log information are sent to the network operation and maintenance personnel;

[0043] According to the weight ratio of static risk and dynamic risk, the risk types are classified as follows:

[0044] If the static risk weight ratio is greater than the dynamic risk weight ratio, it means that the risk is mainly static risk, otherwise it is mainly dynamic risk;

[0045] Perform security checks based on risk types, including access log audits, traffic analysis, and device health checks. Generate distributed response strategies based on triggered warnings and executed measures, including firewall rule updates, bandwidth limit configurations, and security check instructions. Use distributed message queues to synchronize response strategies to nodes across the entire network. After receiving the strategy, each node executes a response based on its own status and network conditions and feeds back the execution results to the response end of the operation and maintenance personnel.

[0046] In a second aspect, the present invention provides a network security early warning system based on distributed collaboration, comprising:

[0047] The data collection and preprocessing module is used to collect traffic, device status and security log data through distributed nodes, classify the data and extract data features;

[0048] The feature dimension reduction and risk assessment module is used to reduce the dimension of the static feature matrix and generate a static risk score, and use the dynamic feature matrix to generate a dynamic risk score;

[0049] The comprehensive scoring and early warning response module is used to generate a comprehensive score by combining static and dynamic risk scores, classify risks and generate response strategies based on the comprehensive score, and synchronize them to nodes across the entire network through a distributed message queue.

[0050] In a third aspect, the present invention provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, any step of the network security early warning method based on distributed collaboration as described in the first aspect of the present invention is implemented.

[0051] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, any step of the network security early warning method based on distributed collaboration as described in the first aspect of the present invention is implemented.

[0052] The beneficial effects of the present invention are as follows: the present invention realizes accurate classification and feature extraction of static data and dynamic data by deploying distributed collection nodes, and optimizes modeling for the two types of features respectively, overcoming the lack of real-time performance and data island problems in traditional network security methods. Through the weighted fusion of static risk scores and dynamic risk scores, the present invention can realize comprehensive global risk assessment, and combined with the automated early warning response mechanism, significantly improves the efficiency and accuracy of network security monitoring, thereby more effectively responding to complex security threats in large-scale distributed network environments. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0054] Figure 1 This is a flow chart of the network security early warning method based on distributed collaboration in Example 1.

[0055] Figure 2 This is a schematic diagram of a network security early warning system based on distributed collaboration in Example 1. DETAILED DESCRIPTION

[0056] In order to make the above-mentioned objects, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the accompanying drawings.

[0057] In the following description, many specific details are set forth to facilitate a full understanding of the present invention, but the present invention may also be implemented in other ways different from those described herein, and those skilled in the art may make similar generalizations without violating the connotation of the present invention. Therefore, the present invention is not limited to the specific embodiments disclosed below.

[0058] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The term "in one embodiment" that appears in different places in this specification does not necessarily refer to the same embodiment, nor does it refer to a separate or selective embodiment that is mutually exclusive with other embodiments.

[0059] Example 1, reference Figure 1 and Figure 2 , which is the first embodiment of the present invention, and provides a network security early warning method based on distributed collaboration, comprising the following steps:

[0060] S1, deploy distributed collection nodes to collect node data and pre-process it to extract static and dynamic features of the data;

[0061] Specifically, deploying distributed data collection nodes to collect node data and preprocessing it, extracting static and dynamic features of the data means deploying distributed data collection nodes at multiple key locations of the network to collect traffic data, device status data, and security log data of each node in real time;

[0062] The key locations include core routers and switches for capturing network traffic data, protocol analysis, packet loss detection, etc., firewalls and security devices for capturing access logs, attack events, abnormal traffic, etc., and user devices and terminals for monitoring terminal connection status, login logs, port activity, etc.;

[0063] The traffic data includes data packet size, flow rate, delay, packet loss rate, connection duration, etc., which are used to reflect the load of the network;

[0064] The device status data includes the CPU load, memory usage, port connection status, etc. of the acquisition device, which helps to understand the operating status of the device;

[0065] The security log data includes login records, access paths, abnormal behaviors, attack alerts, device anomalies, etc., and is mainly used for security threat monitoring;

[0066] Clean and standardize the collected data, use the sliding window method to process the collected time series data, construct the trajectory matrix, perform singular value decomposition on the trajectory matrix, and remove the noise component;

[0067] The data is divided into static data and dynamic data through the support vector machine model;

[0068] The static data includes device information, IP address, network configuration, etc.;

[0069] The dynamic data includes time series data such as network traffic, latency, packet loss rate, CPU load, etc.;

[0070] Static features of static data are initially extracted based on statistical methods, and dynamic features of dynamic data are initially extracted through time series decomposition. Static features extracted based on statistics (such as mean and standard deviation) can quickly characterize the global characteristics of the network, and dynamic features extracted through time series decomposition (such as trend and rate of change) effectively capture the time-related patterns of network operation. The separation and extraction of dynamic and static features improves the pertinence and accuracy of subsequent risk assessment;

[0071] After the static and dynamic features are extracted, the features of each data point are arranged in columns to form a static feature matrix and a dynamic feature matrix.

[0072] By deploying distributed collection nodes, all-round and multi-source data collection is achieved. Through refined data preprocessing and classification, accurate extraction of dynamic and static features is ensured. Combined with methods such as trajectory matrix and singular value decomposition, a solid foundation is laid for subsequent dimensionality reduction and risk assessment. This distributed collaboration-based network security early warning method provides innovative technical support for dynamic perception and accurate response to network security risks through comprehensive quantification and integration of static and dynamic risks, and significantly improves security monitoring and response capabilities in large-scale network environments.

[0073] S2. Reduce the dimension of the static features of the node, perform static risk assessment based on the reduced dimension static features to obtain a static risk score, and generate a dynamic risk score based on the dynamic features;

[0074] Specifically, reducing the dimension of the static features of the node means normalizing and sparse regularization denoising the obtained static feature matrix to obtain a denoised feature matrix A with a dimension of m*n, where m is the number of samples and n is the feature dimension;

[0075] Normalization unifies the scale of eigenvalues, ensuring that data of different dimensions have the same influence in subsequent calculations. Sparse regularization effectively removes redundant features and noise by retaining high-energy components, improving the quality of the feature matrix. In network traffic monitoring, normalization enables unified analysis of status data of different devices (such as routers and switches). Sparse regularization reduces storage and computing resource consumption, and is suitable for real-time analysis needs of large-scale distributed networks.

[0076] Use Euclidean distance to calculate the distance between the sample point and other points. For each sample point s, select the k sample points closest to it and build a neighborhood set Q.

[0077] Constructing a neighborhood set by Euclidean distance can capture the local structural relationship of sample points;

[0078] Assuming that each sample point is represented by a linear combination of neighborhood points, the reconstruction formula is as follows:

[0079]

[0080] In the formula, x i is the reconstructed sample point, w ij is the weight coefficient, indicating the neighborhood point x j Reconstruct the point x i The contribution of is calculated by optimizing the objective function (such as reconstruction error);

[0081] Optimize the reconstruction weights to minimize the reconstruction error:

[0082]

[0083] Where r(w) is the reconstruction error and m is the number of samples;

[0084] Define optimization constraints:

[0085]

[0086] Construct the covariance matrix C between neighborhood points and minimize the error:

[0087] C ij =(x i -x j ) T (x i -x j ),x j ∈Q,

[0088] In the formula, C ij is the covariance between neighboring points;

[0089] Use Lagrange multiplier method to solve the linear equations to obtain weights, and construct weight matrix W based on the obtained weights;

[0090] The embedding matrix M is constructed based on the weight matrix W, the embedding matrix is ​​sparse and regularized, and the eigenvalue decomposition is performed on the embedding matrix:

[0091] Mv=λv,

[0092] In the formula, v is the eigenvector, which represents the low embedding dimension of the data, and λ is the eigenvalue, which represents the weight of the eigenvector. The smaller the eigenvalue, the more important the corresponding eigenvector.

[0093] By extracting key eigenvectors through eigenvalue decomposition, the generated low-dimensional feature matrix not only reduces data complexity but also maximizes the ability to distinguish the original information. When applied to network performance prediction, the network health status can be quickly calculated based on the low-dimensional feature matrix. For large-scale network monitoring, this process reduces the demand for computing resources while retaining the global perspective of key performance indicators.

[0094] The construction of the embedding matrix and its sparsification operation further compress the feature dimension, ensuring the complete retention of important information during the dimension reduction process, while eliminating redundant features. In intelligent operation and maintenance, the sparsification process reduces the interference of redundant features on decision-making and can quickly extract the associated features of equipment failures. The optimization results of the embedding matrix support the integration and analysis of collaborative information between multiple network nodes, improving the overall efficiency of the distributed network.

[0095] Arrange the first d eigenvectors to generate a low-dimensional embedding feature matrix B;

[0096] The low-dimensional embedding feature matrix B and the feature matrix A are combined through linear weighting to obtain the fused feature matrix C;

[0097] The matrix C generated by fusing the low-dimensional feature matrix B with the original matrix A retains the dimensionality reduction information while ensuring the global consistency of the projection results, providing a more comprehensive feature expression. In threat modeling, the fused matrix provides a unified view of static and dynamic features, making it easier to identify complex multi-stage attacks.

[0098] Initialize the projection matrix P to project the initial feature matrix C into the low-dimensional space. Based on the initialization projection matrix P, project the fused feature matrix C into the low-dimensional space to obtain the low-dimensional feature matrix Z:

[0099] Z=P T C,

[0100] Initialize the weight matrix W and the noise matrix E, and construct a joint optimization objective based on the low-dimensional feature matrix Z to balance the reconstruction error, low constraints, and sparse regularization. The formula is as follows:

[0101]

[0102] In the formula, α is the low-rank regularization weight, which controls the global structure of the data, retains global information through the low-rank constraint of W, and is selected through cross-validation or experimental tuning. β is the sparse regularization weight, which removes noise and invalid features, improves data quality through the sparse constraint of E, and is optimized through experiments. When the value is small, the noise removal is weaker, and when it is large, the noise removal is stronger.

[0103] The joint optimization objective function achieves a balance between reconstruction error and sparse regularization, which not only retains global structural information but also enhances robustness to noise. In abnormal log analysis, it can improve analysis accuracy and reduce false alarm rate by eliminating noise data. For the safe operation of enterprise networks, the optimized data results can directly improve operation and maintenance efficiency.

[0104] Initialize the low-dimensional feature matrix Z′:

[0105] Z′=ZW+E,

[0106] When P is fixed, the weight matrix W and the noise matrix E are optimized to minimize the reconstruction error and the regularization term:

[0107]

[0108] Use singular value decomposition to calculate the low-rank weight matrix W′:

[0109] W′=·diag(max(σ-∈,0))·V T ,

[0110] Where U is the left singular vector matrix, σ is the singular value diagonal matrix, V is the right singular vector matrix, and U, σ and V are the matrix Z T The singular value decomposition result of Z, the matrix Z T Z is obtained by transposing the low-dimensional feature matrix, ∈ is the regularization parameter, T is the transposition operation, and diag() is the diagonalization operation;

[0111] Use sparse regularization to optimize the noise matrix E to obtain E′;

[0112] With the weight matrix W′ and the noise matrix E′ fixed, the projection matrix P is optimized to minimize the reconstruction error:

[0113]

[0114] In the formula, ∥∥ F is the Frobenius norm of the matrix;

[0115] Use singular value decomposition to update the projection matrix P, and recalculate the low-dimensional feature matrix Z′1 based on the updated projection matrix;

[0116] Iterate and optimize the three variables, check the change of the variables after each iteration, set the convergence threshold x, and stop the iteration if the change is less than the threshold x to obtain the global low-dimensional feature matrix;

[0117] Through multi-variable iterative optimization, the model parameters are dynamically adjusted to ensure the global optimality of the final feature matrix, while over-calculation is avoided through convergence threshold restrictions;

[0118] Calculate the Euclidean distance of each pair of sample points in the low-dimensional feature matrix, and use the Gaussian kernel function to define the edge weights, fill all edge weights into the adjacency matrix G, calculate the degree matrix J of the adjacency matrix G, and calculate the non-normalized Laplace matrix L based on the adjacency matrix and degree matrix;

[0119] The unnormalized Laplace matrix is ​​decomposed by eigenvalues, sorted in ascending order by eigenvalue size, the eigenvectors corresponding to the first a smallest eigenvalues ​​are selected, and the selected eigenvectors are arranged in columns to generate an optimized low-dimensional feature representation matrix. The eigenvalue decomposition based on the Laplace matrix can fully reveal the global geometric structure of the data. The optimized low-dimensional feature representation matrix retains the core characteristics of important patterns and can be used to optimize the collaboration efficiency across nodes in a distributed network environment, such as allocating bandwidth resources by identifying hot spots.

[0120] Through the normalization, sparse regularization, feature dimensionality reduction and embedding optimization of the static feature matrix, the local and global information of the data is fully utilized, and the accuracy and efficiency of feature representation are improved. Through the construction and decomposition of the Laplace matrix, the low-dimensional feature matrix is ​​further optimized, making it more robust and discriminative in subsequent applications (such as risk assessment and classification). The overall process is highly innovative and operational, providing an efficient and reliable technical solution for static data processing in large-scale distributed network environments.

[0121] Furthermore, performing static risk assessment based on the static features after dimensionality reduction to obtain a static risk score refers to performing static risk assessment using XGBoost classifier training optimized by the whale optimization algorithm, including:

[0122] Use historical static data as training set;

[0123] Initialize the size of the whale group and the maximum number of iterations. Each whale individual represents the hyperparameter configuration of GBoost. Set the search range for each hyperparameter and define the fitness function.

[0124] The fitness function includes accuracy, sensitivity and specificity;

[0125] Calculate the distance between the current whale position and the optimal position, and use the calculated distance to update the whale position;

[0126] Iterate and optimize the position. After each iteration, use the training data to train the XGBoost model and calculate the fitness value to update the optimal position until the maximum number of iterations is reached to obtain the optimal hyperparameters after optimization.

[0127] The optimal hyperparameters obtained based on WOA optimization are used to train the XGBoost classifier to obtain a trained XGBoost classifier. The static features in the low-dimensional feature representation matrix are input into the XGBoost classifier to obtain a static risk score. The hyperparameter configuration based on WOA optimization significantly improves the training efficiency and model performance of the XGBoost classifier, enabling the classifier to process the static features after dimensionality reduction more accurately.

[0128] By combining the whale optimization algorithm with the XGBoost classifier, static risk assessment is performed on the static features after dimensionality reduction, which can effectively improve the accuracy and real-time performance of network security monitoring. Its innovation lies in the introduction of WOA to optimize the XGBoost hyperparameters to ensure the optimal performance of the classifier. The accuracy, sensitivity and specificity are used as fitness functions to achieve multi-dimensional optimization of the classification effect. The generated static risk score can accurately quantify the network status and provide strong support for global risk assessment and dynamic early warning. This method is suitable for complex distributed network environments and provides important technical guarantees for improving the intelligence and efficiency of network security monitoring systems.

[0129] Furthermore, generating a dynamic risk score based on dynamic features refers to extracting the standardized dynamic data features in the dynamic feature matrix, using a temporal convolutional network to perform dilated convolution on the dynamic data, and the temporal convolutional network achieves dependency modeling of long time series through dilated convolution, without the need for step-by-step iteration of traditional recurrent networks, with higher computational efficiency, while retaining the local and global features of the time series, extracting the features of each time step, calculating the importance weight of each channel in the temporal convolutional network, optimizing the features of each time step based on the obtained importance features, inputting the obtained optimized features into a bidirectional GRU model to obtain a bidirectional hidden state combination of the time step, and using the bidirectional hidden state combination output by the bidirectional GRU model as the final feature representation;

[0130] The bidirectional GRU model combines the forward and backward time step information to fully capture the forward and backward dependencies of dynamic features, making the feature representation more global and complete;

[0131] The feature representation is mapped to the risk score space through the fully connected layer and bias term to obtain the dynamic risk score.

[0132] The temporal convolutional network is a neural network architecture for time series analysis. It uses dilated convolution to capture long-term dependencies with fewer parameters while retaining temporal features. The bidirectional GRU is a gated recurrent unit (GRU) model that combines forward and backward time step states, which can capture past and future dependencies in time series. The present invention realizes the generation of dynamic risk scores through the standardization of dynamic feature matrices, dilated convolution of the temporal convolutional network, optimization of the channel attention mechanism, and time step feature combination of the bidirectional GRU model. The above method not only effectively solves the redundancy and importance identification problems in dynamic feature extraction, but also further improves the accuracy of dynamic risk quantification through feature mapping of the fully connected layer.

[0133] S3. Obtain a global risk score based on the static risk score and the dynamic risk score, and perform an early warning response based on the risk score;

[0134] Specifically, obtaining a comprehensive risk score based on the static risk score and the dynamic risk score means performing a weighted summation of the obtained static risk score and the dynamic risk score by a weighted average method to obtain a comprehensive risk score of the current network.

[0135] The comprehensive risk assessment method based on static risk scoring and dynamic risk scoring achieves comprehensive quantification of network security situation through weighted average fusion strategy. Compared with the traditional single risk assessment method, this method combines the advantages of long-term stability analysis and real-time dynamic detection, and has higher accuracy and adaptability. Its wide applicability and flexibility not only provide a scientific basis for network security management, but also significantly improve the efficiency of early warning triggering and response strategies.

[0136] Furthermore, early warning response based on risk score means setting a risk threshold H by statistically analyzing the distribution of historical network risk scores. If the comprehensive risk score is greater than the threshold H, an early warning is immediately triggered, and the risk score and related log information are sent to the network operation and maintenance personnel;

[0137] According to the weight ratio of static risk and dynamic risk, the risk types are classified as follows:

[0138] If the static risk weight ratio is greater than the dynamic risk weight ratio, it means that the risk is mainly static risk, otherwise it is mainly dynamic risk;

[0139] When static risks dominate, the system can give priority to configuration repair, port status audit and other measures to avoid the expansion of system vulnerabilities. When dynamic risks dominate, the system can quickly concentrate resources for real-time traffic analysis and threat blocking to prevent the spread of attacks. The classification mechanism ensures that security resource allocation is more accurate and efficient, improves overall protection capabilities, and performs security checks according to risk types, including access log audits, traffic analysis and device health checks. Distributed response strategies are generated based on triggered warnings and executed measures, including firewall rule updates, bandwidth limit configurations and security check instructions. Distributed message queues (such as Kafka) are used to synchronize response strategies to nodes across the entire network. After receiving the strategy, each node executes a response based on its own status and network conditions and feeds back the execution results to the response end of the operation and maintenance personnel.

[0140] The responding end refers to a mobile terminal (mobile phone, computer, etc.).

[0141] Through the early warning response mechanism of comprehensive risk scoring, real-time monitoring and efficient response to network security risks are achieved. By classifying static and dynamic risk types, the system can allocate resources and formulate response strategies more targetedly. The distributed response strategy ensures the high efficiency of coordinated protection across the entire network, while the closed-loop feedback and visualization support on the response end further enhance the efficiency of operation and maintenance. Overall, this method significantly improves the accuracy, efficiency and operability of network security early warning.

[0142] This embodiment also provides a network security early warning system based on distributed collaboration, including:

[0143] The data collection and preprocessing module is used to collect traffic, device status and security log data through distributed nodes, classify the data and extract data features step by step;

[0144] The feature dimension reduction and risk assessment module is used to reduce the dimension of the static feature matrix and generate a static risk score, and use the dynamic feature matrix to generate a dynamic risk score;

[0145] The comprehensive scoring and early warning response module is used to generate a comprehensive score by combining static and dynamic risk scores, classify risks and generate response strategies based on the comprehensive score, and synchronize them to nodes across the entire network through a distributed message queue.

[0146] This embodiment also provides a computer device, which is suitable for the case of a network security early warning method based on distributed collaboration, including: a memory and a processor; the memory is used to store computer executable instructions, and the processor is used to execute computer executable instructions to implement the network security early warning method based on distributed collaboration proposed in the above embodiment.

[0147] The computer device may be a terminal, and the computer device includes a processor, a memory, a communication interface, a display screen and an input device connected via a system bus. The processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be achieved through WIFI, an operator network, NFC (near field communication) or other technologies. The display screen of the computer device may be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device may be a touch layer covering the display screen, or a key, trackball or touchpad provided on the housing of the computer device, or an external keyboard, touchpad or mouse, etc.

[0148] This embodiment also provides a storage medium on which a computer program is stored. When the program is executed by a processor, the network security early warning method based on distributed collaboration proposed in the above embodiment is implemented; the storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (Static Random Access Memory, referred to as SRAM), electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, referred to as EEPROM), erasable programmable read-only memory (Erasable Programmable Read Only Memory, referred to as EPROM), programmable read-only memory (Programmable Red-Only Memory, referred to as PROM), read-only memory (Read-Only Memory, referred to as ROM), magnetic storage, flash memory, disk or optical disk.

[0149] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A network security early warning method based on distributed collaboration, characterized in that: include, Deploy distributed collection nodes to collect node data and pre-process it to extract static and dynamic features of the data; Reduce the dimension of the static features of the node, perform static risk assessment based on the reduced dimension static features to obtain a static risk score, and generate a dynamic risk score based on the dynamic features; A global risk score is obtained based on the static risk score and the dynamic risk score, and an early warning response is performed based on the risk score.

2. The distributed collaboration-based network security early warning method according to claim 1, characterized in that: Deploying distributed data collection nodes to collect node data and pre-processing, extracting static and dynamic features of the data means deploying distributed data collection nodes at multiple key locations of the network to collect flow data, device status data and security log data of each node in real time; Clean and standardize the collected data, use the sliding window method to process the collected time series data, construct the trajectory matrix, perform singular value decomposition on the trajectory matrix, and remove the noise component; The data is divided into static data and dynamic data through the support vector machine model; Preliminarily extract the static features of static data based on statistical methods, and preliminarily extract the dynamic features of dynamic data through time series decomposition; After the static and dynamic features are extracted, the features of each data point are arranged in columns to form a static feature matrix and a dynamic feature matrix.

3. The distributed collaboration-based network security early warning method according to claim 2, characterized in that: The dimensionality reduction of the static features of the node refers to normalizing and sparse regularization denoising the obtained static feature matrix to obtain a denoised feature matrix A with a dimension of m*n, where m is the number of samples and n is the feature dimension; Use Euclidean distance to calculate the distance between the sample point and other points. For each sample point s, select the k sample points closest to it and build a neighborhood set Q. Assume that each sample point is represented by a linear combination of neighborhood points; Optimize reconstruction weights, minimize reconstruction errors, and define optimization constraints; Construct the covariance matrix C between neighborhood points and minimize the error; Use Lagrange multiplier method to solve the linear equations to obtain weights, and construct weight matrix W based on the obtained weights; Construct an embedding matrix M based on the weight matrix W, perform matrix sparsification and regularization on the embedding matrix, and perform eigenvalue decomposition on the embedding matrix; Arrange the first d eigenvectors to generate a low-dimensional embedding feature matrix B; The low-dimensional embedding feature matrix B and the feature matrix A are combined through linear weighting to obtain the fused feature matrix C; Initialize the projection matrix P, and project the fused feature matrix C into a low-dimensional space based on the initialization projection matrix P to obtain a low-dimensional feature matrix Z; Initialize the weight matrix W and the noise matrix E, and construct a joint optimization objective based on the low-dimensional feature matrix Z to balance the reconstruction error, low constraints, and sparse regularization; Initialize the low-dimensional feature matrix Z′, and optimize the weight matrix W and noise matrix E while fixing P to minimize the reconstruction error and regularization term; Use singular value decomposition to calculate the low-rank weight matrix W′; Use sparse regularization to optimize the noise matrix E to obtain E′; Under the condition of fixed weight matrix W′ and noise matrix E′, optimize the projection matrix P, minimize the reconstruction error, use singular value decomposition to update the projection matrix P, recalculate the low-dimensional feature matrix Z′1 based on the updated projection matrix, iteratively optimize the three variables, and check the change of the variables after each iteration, set the convergence threshold x, if the change is less than the threshold x, stop the iteration to obtain the global low-dimensional feature matrix; Calculate the Euclidean distance of each pair of sample points in the low-dimensional feature matrix, and use the Gaussian kernel function to define the edge weights, fill all edge weights into the adjacency matrix G, calculate the degree matrix J of the adjacency matrix G, and calculate the non-normalized Laplace matrix L based on the adjacency matrix and degree matrix; Perform eigenvalue decomposition on the non-normalized Laplace matrix, sort it in ascending order according to the size of the eigenvalues, select the eigenvectors corresponding to the first a smallest eigenvalues, and arrange the selected eigenvectors in columns to generate an optimized low-dimensional feature representation matrix.

4. The distributed collaboration-based network security early warning method according to claim 3, characterized in that: The static risk assessment based on the static features after dimensionality reduction to obtain the static risk score refers to the static risk assessment using XGBoost classifier training optimized by the whale optimization algorithm, including: Use historical static data as training set; Initialize the size of the whale group and the maximum number of iterations. Each whale individual represents the hyperparameter configuration of GBoost. Set the search range for each hyperparameter and define the fitness function. The fitness function includes accuracy, sensitivity and specificity; Calculate the distance between the current whale position and the optimal position, and use the calculated distance to update the whale position; Iterate and optimize the position. After each iteration, use the training data to train the XGBoost model and calculate the fitness value to update the optimal position until the maximum number of iterations is reached to obtain the optimal hyperparameters after optimization. The optimal hyperparameters obtained based on WOA optimization are used to train the XGBoost classifier to obtain a trained XGBoost classifier, and the static features in the low-dimensional feature representation matrix are input into the XGBoost classifier to obtain a static risk score.

5. The distributed collaboration-based network security early warning method according to claim 4, characterized in that: Generating a dynamic risk score based on dynamic features refers to extracting standardized dynamic data features in a dynamic feature matrix, performing dilated convolution on the dynamic data using a temporal convolutional network, extracting features of each time step, calculating the importance weight of each channel in the temporal convolutional network, optimizing features of each time step based on the obtained importance features, inputting the obtained optimized features into a bidirectional GRU model to obtain a bidirectional hidden state combination of the time step, and using the bidirectional hidden state combination output by the bidirectional GRU model as the final feature representation; The feature representation is mapped to the risk score space through the fully connected layer and bias term to obtain the dynamic risk score.

6. The distributed collaboration-based network security early warning method according to claim 5, characterized in that: Obtaining a comprehensive risk score based on the static risk score and the dynamic risk score refers to performing weighted summation of the obtained static risk score and the dynamic risk score by a weighted average method to obtain a comprehensive risk score of the current network.

7. The distributed collaboration-based network security early warning method according to claim 6, characterized in that: The risk score-based early warning response refers to setting a risk threshold H. If the comprehensive risk score is greater than the threshold H, an early warning is immediately triggered, and the risk score and related log information are sent to the network operation and maintenance personnel; According to the weight ratio of static risk and dynamic risk, the risk types are classified as follows: If the static risk weight ratio is greater than the dynamic risk weight ratio, it means that the risk is mainly static risk, otherwise it is mainly dynamic risk; Perform security checks based on risk types, including access log audits, traffic analysis, and device health checks. Generate distributed response strategies based on triggered warnings and executed measures, including firewall rule updates, bandwidth limit configurations, and security check instructions. Use distributed message queues to synchronize response strategies to nodes across the entire network. After receiving the strategy, each node executes a response based on its own status and network conditions and feeds back the execution results to the response end of the operation and maintenance personnel.

8. A network security early warning system based on distributed collaboration, based on the network security early warning method based on distributed collaboration according to any one of claims 1 to 7, characterized in that: include, The data collection and preprocessing module is used to collect traffic, device status and security log data through distributed nodes, classify the data and extract data features step by step; The feature dimension reduction and risk assessment module is used to reduce the dimension of the static feature matrix and generate a static risk score, and use the dynamic feature matrix to generate a dynamic risk score; The comprehensive scoring and early warning response module is used to generate a comprehensive score by combining static and dynamic risk scores, classify risks and generate response strategies based on the comprehensive score, and synchronize them to nodes across the entire network through a distributed message queue.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the network security early warning method based on distributed collaboration described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the network security early warning method based on distributed collaboration described in any one of claims 1 to 7 are implemented.

Images