Network security risk assessment system

Abstract

The invention relates to the technical field of network security, and provides a network security risk assessment system. The system comprises a PCAP data arrangement module, a data packet labeling stage module, a space-time distribution module, an adjacency optimization module and a risk assessment module. According to the method, a space-time activity distribution diagram is generated through graph wavelet transformation, a second-order time domain analysis method, a neighborhood self-adaptive smooth-spatial domain analysis method and a standardized processing labelle-HDF5 file, and an adjacent matrix is optimized through combination of space-time activity distribution and an edge characteristic weighting technology and a dynamic random walk optimization method. The dynamic analysis capability of the network topology structure is enhanced; the optimized data are input into a graph neural network model, and potential safety risks are accurately identified; through the above technology, the system improves the accuracy, real-time performance and adaptability of network security evaluation, and provides an efficient protection solution for a complex network environment.

Description

Technical Field

[0001] The present invention relates to the technical field of network security, and in particular to a network security risk assessment system. Background Art

[0002] With the widespread application of the Internet and the acceleration of the information process, the means and methods of network attacks are constantly evolving. Attackers use various complex means to invade the network, steal data, destroy the system, and even paralyze the entire network through distributed attacks; traditional network security assessment systems mainly rely on simple intrusion detection technology to defend by identifying known attack patterns or features; however, with the continuous changes in attack methods, this feature matching-based defense method has become difficult to effectively respond to new attacks; the existing network security risk assessment system has the following problems: first, it is impossible to efficiently process massive network traffic data and extract effective features; second, it is impossible to dynamically identify and analyze the complex relationship between nodes and connections in the network; finally, for the spatiotemporal variation characteristics of network activities, it is impossible to accurately assess potential security risks and provide effective defense strategies. Summary of the invention

[0003] The present invention provides a network security risk assessment system, which calculates the wavelet coefficients in the label-HDF5 file through a graph wavelet transform method, uses a time domain second-order analysis method to conduct an in-depth analysis of the spatiotemporal activity of the nodes, and optimizes the wavelet coefficients through a neighborhood adaptive smoothing-spatial domain analysis method, thereby generating an accurate spatiotemporal activity distribution graph; this process can effectively reveal the activity pattern of each node in the network, help identify active nodes and stable nodes, and provide an accurate basis for subsequent security assessments; the present invention also introduces spatiotemporal activity distribution and edge characteristic weighting technology, and uses a dynamic random walk optimization method to optimize the adjacency matrix in the label-HDF5 file, gradually improves the original adjacency matrix, accurately reflects the dynamic relationship between network nodes, and enhances sensitivity to potential attacks; by combining the above-mentioned technologies, the present invention can more accurately capture potential security threats in the network and help network managers respond to complex security risks in real time.

[0004] The present invention provides a network security risk assessment system, which includes a PCAP data sorting module, a data packet marking phase module, a time-space distribution module, an adjacency optimization module and a risk assessment module;

[0005] The PCAP data sorting module captures the network traffic data when the attacker and the target communicate over the network and saves it as a pcap file; repairs the pcap file through Pcapfix, including repairing the global header and data packets of the pcap file to generate a repaired pcap file; reorders and cleans the data packets of the repaired pcap file through Reordercap to generate a pre-processed pcap file;

[0006] The packet labeling phase module extracts flow feature data from the preprocessed pap file, generates labels based on the flow feature data, assigns labels to the packets in the preprocessed pap file through the flow labeling script and the packet labeling script, and generates a label-hdf5 file;

[0007] The spatiotemporal distribution module establishes a graph neural network model, which includes nodes and edges. It uses the graph wavelet transform method, the second-order time domain analysis method, and the neighborhood adaptive smoothing-spatial domain analysis method to build a graph wavelet-spatiotemporal activity distribution generation model, and inputs the label-hdf5 file into the graph wavelet-spatiotemporal activity distribution generation model to generate a spatiotemporal activity distribution graph.

[0008] The adjacency optimization module optimizes the adjacency matrix in the tag-hdf5 file based on the spatiotemporal activity distribution graph using a dynamic random walk optimization method, and outputs an optimized spatiotemporal diffusion matrix to replace the adjacency matrix;

[0009] The risk assessment module inputs the optimized spatiotemporal diffusion matrix, node feature matrix and label data into the graph neural network model, identifies potential security risks through the graph neural network model, and generates a network security risk assessment report. The network security risk assessment report includes risk scores, traceability analysis results, prediction recommendations and defense strategy optimization plans.

[0010] Furthermore, the dynamic random walk optimization method specifically includes the following steps: initial node selection, edge weighted walk, diffusion matrix generation and iterative optimization.

[0011] Furthermore, the process of generating a spatiotemporal activity distribution map in the spatiotemporal distribution module specifically includes the following steps:

[0012] Step S1: read the label-hdf5 file, extract the node feature matrix, adjacency matrix and label data; the node feature matrix contains the feature information of the node, the adjacency matrix contains the connection relationship between the nodes, and the label data is the node specified label;

[0013] Step S2: Calculate the low-frequency wavelet coefficient and high-frequency wavelet coefficient of each node in the graph neural network model by using the graph wavelet transform method; the low-frequency wavelet coefficient reflects the spatiotemporal stability of the node, and the high-frequency wavelet coefficient reflects the spatiotemporal activity of the node;

[0014] Step S3: Calculate the spatiotemporal activity coefficient of each node through time domain analysis and space domain analysis to generate a spatiotemporal activity distribution diagram. The time domain analysis measures the activity of the node in the time dimension through the change of low-frequency wavelet coefficients, and the space domain analysis measures the dynamic change of the node in the graph structure space through high-frequency wavelet coefficients.

[0015] Further, step S3 specifically includes the following steps:

[0016] Step S31: Time domain analysis: calculate the rate of change of the low-frequency wavelet coefficients as the first-order rate of change of the low-frequency wavelet coefficients; calculate the acceleration of the rate of change of the low-frequency wavelet coefficients as the second-order rate of change of the low-frequency wavelet coefficients; standardize the first-order rate of change of the low-frequency wavelet coefficients and the second-order rate of change of the low-frequency wavelet coefficients to generate time activity data. The formula used is as follows:

[0017] First-order change formula:

[0018] ;

[0019] in, Represents the time index, represents the node index, Represents the window offset index, Indicates the size of the time window, Representation Node In time The low-frequency wavelet coefficients of Representation Node In time The rate of change of the low-frequency wavelet coefficients, Representation Node At two adjacent time steps and The variation amplitude of the low-frequency wavelet coefficients; Indicates that the accumulated change amplitude is normalized;

[0020] Second order change formula:

[0021] ;

[0022] in, Representation node In time The second-order change rate of the low-frequency wavelet coefficients measures the acceleration of the node's change trend in the time dimension; Normalize the sum of the second-order rates of change, Representation Node At two adjacent time steps and The variation range of low-frequency wavelet coefficients between ; Represents the absolute difference in the rate of change between time steps;

[0023] Step S32: Spatial domain analysis: Perform neighborhood adaptive smoothing on the high-frequency wavelet coefficients to generate smoothed high-frequency wavelet coefficients to enhance the stability of node spatial dynamics; perform standardization on the smoothed high-frequency wavelet coefficients to measure the dynamic changes of nodes in the graph structure space and generate spatial activity data. The formula used is as follows:

[0024] Neighborhood smoothing formula:

[0025] ;

[0026] in, represents the neighbor node index, Representation Node and neighbor nodes In time Dynamic similarity weights of represents the exponential function, Representation Node In time The high frequency wavelet coefficients of Represents neighbor nodes In time The high frequency wavelet coefficients of Representation Node and neighbor nodes The absolute difference of high-frequency wavelet coefficients; In time The high-frequency wavelet coefficients represent represents the standard deviation of the high-frequency wavelet coefficients of the node set, Represents a small constant to prevent the denominator from being 0. Indicates the negative value after normalization of the dynamic difference;

[0027] ;

[0028] in, Representation Node In time The smoothed high-frequency wavelet coefficients are represents the weighted sum of high-frequency wavelet coefficients of each node in the neighborhood, represents the normalized sum of neighborhood node weights;

[0029] Step S33: Generate a distribution graph: combine the temporal activity data and the spatial activity data to calculate the spatiotemporal activity coefficient of the node; generate a spatiotemporal activity distribution graph based on the spatiotemporal activity coefficient of the node.

[0030] Furthermore, the initial node selection specifically includes: selecting an initial random walk node from a graph neural network model according to a spatiotemporal activity distribution graph, and calculating the spatiotemporal activity coefficient of the initial random walk node to generate a random walk spatiotemporal activity coefficient.

[0031] Furthermore, edge-weighted walk specifically includes: introducing a dynamic weighting mechanism for edge characteristics, dynamically adjusting the edge weights in the adjacency matrix according to the spatiotemporal attributes of the edges, and generating a weighted adjacency matrix; combining the spatiotemporal activity coefficient of random walks, simulating dynamic random walks, dynamically updating the node access probability through walk strategies, and generating random walk results; walk strategies include random jumps, restarts, and spatiotemporal jumps, and random walk results include node access probability distribution, edge weight adjustment, spatiotemporal jump records, path records, and active node contributions. The formula used is as follows:

[0032] Node access probability update formula:

[0033] ;

[0034] in, represents the seed node, which is the starting point of the random walk process. Indicates that from the seed node Start at time The node access probability distribution vector, Indicates time The normalized adjacency matrix of represents the edge feature weight matrix, Represents a transpose operation; represents the n×n identity matrix, represents the restart probability, A diagonal matrix representing the spatiotemporal activity coefficients; Represents the seed node The restart probability distribution of the restart, represents the space-time jump term, which takes the previous time step The node access probability distribution Integrate into the current time step;

[0035] Edge feature weight calculation formula:

[0036] ;

[0037] in, Represents edge The starting node of Represents edge The target node, Represents edge In time The weight of Represents edge In time The characteristic value of Represents edge At the previous time step The characteristic value of Representing edge properties The standard deviation of .

[0038] Furthermore, the diffusion matrix generation specifically includes: dynamically calculating the diffusion matrix of the current time step according to the random walk result in combination with the adjacency matrix to generate an enhanced diffusion matrix.

[0039] Furthermore, the iterative optimization specifically includes: setting the maximum number of iterations, repeating the edge weighted walk and diffusion matrix generation, gradually improving the enhanced diffusion matrix, reaching the maximum number of iterations, and outputting the optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

[0040] By adopting the above scheme, the beneficial effects achieved by the present invention are as follows:

[0041] The present invention provides a network security risk assessment system, which successfully implements deep spatiotemporal analysis of network traffic data by introducing a graph wavelet transform method, a second-order time domain analysis method, a neighborhood adaptive smoothing-spatial domain analysis method, and a standardized processing label-HDF5 file; the introduction of this technology enables the system to accurately capture the spatiotemporal activity pattern of nodes in the network and generate a more accurate spatiotemporal activity distribution map, thereby effectively revealing the activity pattern of each node in the network, helping to identify active nodes and stable nodes, providing effective decision support for network security protection, and providing an accurate basis for subsequent security assessments;

[0042] In addition, the present invention optimizes the adjacency matrix by combining the time-space activity distribution and edge characteristic weighting technology, and adopts a dynamic random walk optimization method to further improve the system's ability to analyze complex network topology structures; the optimization method can dynamically adjust the adjacency matrix to more accurately reflect the relationship between nodes, avoiding the limitations of the traditional static adjacency matrix in a dynamic environment; through this optimization, the present invention successfully enhances the ability to identify potential security threats and improves the system's ability to predict and respond to unknown attacks; this improvement makes the present invention more adaptable and practical in the field of network security, and can better cope with increasingly complex security challenges;

[0043] Finally, through the combination of the above technologies, the present invention realizes the accurate assessment of potential network risks. The generated network security risk assessment report not only provides risk scores, but also includes traceability analysis results, prediction suggestions and defense strategy optimization solutions; it provides comprehensive security protection for network management personnel and helps them formulate more effective defense strategies; the accuracy and real-time performance of the system have been greatly improved, which can effectively support network security management decisions and enhance the overall effectiveness of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] Figure 1A schematic diagram of a module of a network security risk assessment system provided by the present invention;

[0045] Figure 2 It is a structural diagram of the PCAP data sorting module and the data packet marking phase module in the first embodiment;

[0046] Figure 3 This is a schematic diagram of the process of step S3 in Example 3. DETAILED DESCRIPTION

[0047] The technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments; based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0048] Embodiment 1, according to Figure 1 and Figure 2 ,The present invention provides a network security risk assessment system, which includes a PCAP data sorting module, a data packet annotation phase module, a spatiotemporal distribution module, an adjacency optimization module and a risk assessment module;

[0049] The PCAP data sorting module captures the network traffic data when the attacker and the target communicate over the network and saves it as a pcap file; repairs the pcap file through Pcapfix, including repairing the global header and data packets of the pcap file to generate a repaired pcap file; reorders and cleans the data packets of the repaired pcap file through Reordercap to generate a pre-processed pcap file;

[0050] The packet labeling phase module extracts flow feature data from the preprocessed pap file, generates labels based on the flow feature data, assigns labels to the packets in the preprocessed pap file through the flow labeling script and the packet labeling script, and generates a label-hdf5 file;

[0051] The spatiotemporal distribution module establishes a graph neural network model, which includes nodes and edges. It uses the graph wavelet transform method, the second-order time domain analysis method, and the neighborhood adaptive smoothing-spatial domain analysis method to build a graph wavelet-spatiotemporal activity distribution generation model, and inputs the label-hdf5 file into the graph wavelet-spatiotemporal activity distribution generation model to generate a spatiotemporal activity distribution graph.

[0052] The adjacency optimization module optimizes the adjacency matrix in the tag-hdf5 file based on the spatiotemporal activity distribution graph using a dynamic random walk optimization method, and outputs an optimized spatiotemporal diffusion matrix to replace the adjacency matrix;

[0053] The risk assessment module inputs the optimized spatiotemporal diffusion matrix, node feature matrix and label data into the graph neural network model, identifies potential security risks through the graph neural network model, and generates a network security risk assessment report. The network security risk assessment report includes risk scores, traceability analysis results, prediction recommendations and defense strategy optimization solutions;

[0054] The dynamic random walk optimization method specifically includes the following steps: initial node selection, edge weighted walk, diffusion matrix generation and iterative optimization.

[0055] Embodiment 2: This embodiment is based on embodiment 1. In this embodiment, the process of generating a spatiotemporal activity distribution diagram by the spatiotemporal distribution module specifically includes the following steps:

[0056] Step S1: read the label-hdf5 file, extract the node feature matrix, adjacency matrix and label data; the node feature matrix contains the feature information of the node, the adjacency matrix contains the connection relationship between the nodes, and the label data is the node specified label;

[0057] Step S2: Calculate the low-frequency wavelet coefficient and high-frequency wavelet coefficient of each node in the graph neural network model by using the graph wavelet transform method; the low-frequency wavelet coefficient reflects the spatiotemporal stability of the node, and the high-frequency wavelet coefficient reflects the spatiotemporal activity of the node;

[0058] Step S3: Calculate the spatiotemporal activity coefficient of each node through time domain analysis and space domain analysis to generate a spatiotemporal activity distribution diagram. The time domain analysis measures the activity of the node in the time dimension through the change of low-frequency wavelet coefficients, and the space domain analysis measures the dynamic change of the node in the graph structure space through high-frequency wavelet coefficients.

[0059] Embodiment 3, according to Figure 3 This embodiment is based on the second embodiment. In this embodiment, step S3 specifically includes the following steps:

[0060] Step S31: Time domain analysis: calculate the rate of change of the low-frequency wavelet coefficients as the first-order rate of change of the low-frequency wavelet coefficients; calculate the acceleration of the rate of change of the low-frequency wavelet coefficients as the second-order rate of change of the low-frequency wavelet coefficients; standardize the first-order rate of change of the low-frequency wavelet coefficients and the second-order rate of change of the low-frequency wavelet coefficients to generate time activity data. The formula used is as follows:

[0061] First-order change formula:

[0062] ;

[0063] in, Represents the time index, represents the node index, Represents the window offset index, Indicates the size of the time window, Representation Node In time The low-frequency wavelet coefficients of Representation Node In time The rate of change of the low-frequency wavelet coefficients, Representation Node At two adjacent time steps and The variation amplitude of the low-frequency wavelet coefficients; Indicates that the accumulated change amplitude is normalized;

[0064] Second order change formula:

[0065] ;

[0066] in, Representation node In time The second-order change rate of the low-frequency wavelet coefficients measures the acceleration of the node's change trend in the time dimension; Normalize the sum of the second-order rates of change, Representation Node At two adjacent time steps and The variation range of low-frequency wavelet coefficients between ; Represents the absolute difference in the rate of change between time steps;

[0067] Step S32: Spatial domain analysis: Perform neighborhood adaptive smoothing on the high-frequency wavelet coefficients to generate smoothed high-frequency wavelet coefficients to enhance the stability of node spatial dynamics; perform standardization on the smoothed high-frequency wavelet coefficients to measure the dynamic changes of nodes in the graph structure space and generate spatial activity data. The formula used is as follows:

[0068] Neighborhood smoothing formula:

[0069] ;

[0070] in, represents the neighbor node index, Representation Node and neighbor nodes In time Dynamic similarity weights of represents the exponential function, Representation Node In time The high frequency wavelet coefficients of Represents neighbor nodes In time The high frequency wavelet coefficients of Representation Node and neighbor nodes The absolute difference of high-frequency wavelet coefficients; In time The high-frequency wavelet coefficients represent represents the standard deviation of the high-frequency wavelet coefficients of the node set, Represents a small constant to prevent the denominator from being 0. Indicates the negative value after normalization of the dynamic difference;

[0071] ;

[0072] in, Representation Node In time The smoothed high-frequency wavelet coefficients are represents the weighted sum of high-frequency wavelet coefficients of each node in the neighborhood, represents the normalized sum of neighborhood node weights;

[0073] Step S33: Generate a distribution graph: combine the temporal activity data and the spatial activity data to calculate the spatiotemporal activity coefficient of the node; generate a spatiotemporal activity distribution graph based on the spatiotemporal activity coefficient of the node.

[0074] Embodiment 4: This embodiment is based on embodiment 2. In this embodiment, step S3 specifically includes the following steps:

[0075] Step R1: Time domain analysis: Analyze the low-frequency wavelet coefficients of the node, calculate the change rate of the low-frequency wavelet coefficients, measure the activity of the node in the time dimension, and use it as the first-order change rate of the low-frequency wavelet coefficients; standardize the first-order change rate of the low-frequency wavelet coefficients to generate time activity data. The formula used is as follows:

[0076] First-order change formula:

[0077] ;

[0078] in, Represents the time index, represents the node index, Represents the window offset index, Indicates the size of the time window, Representation Node In time The low-frequency wavelet coefficients of Representation Node In time The rate of change of the low-frequency wavelet coefficients, Representation Node At two adjacent time steps and The variation amplitude of the low-frequency wavelet coefficients; Indicates that the accumulated change amplitude is normalized;

[0079] Step R2: Spatial analysis: Standardize the high-frequency wavelet coefficients, measure the dynamic changes of nodes in the graph structure space, and generate spatial activity data;

[0080] Step R3: Generate a distribution graph: Combine the temporal activity data and the spatial activity data to calculate the spatiotemporal activity coefficient of the node; generate a spatiotemporal activity distribution graph based on the spatiotemporal activity coefficient of the node.

[0081] Embodiment 5. This embodiment is based on embodiment 3. In this embodiment, the initial node selection specifically includes: selecting the initial random walk node from the graph neural network model according to the spatiotemporal activity distribution diagram, and calculating the spatiotemporal activity coefficient of the initial random walk node to generate the random walk spatiotemporal activity coefficient.

[0082] Embodiment 6. This embodiment is based on embodiment 5. In this embodiment, edge weighted walk specifically includes: introducing a dynamic weighting mechanism for edge characteristics, dynamically adjusting the edge weights in the adjacency matrix according to the spatiotemporal attributes of the edge, and generating a weighted adjacency matrix; combining the spatiotemporal activity coefficient of the random walk, simulating dynamic random walks, dynamically updating the node access probability through the walk strategy, and generating random walk results; the walk strategy includes random jumps, restarts, and spatiotemporal jumps, and the random walk results include node access probability distribution, edge weight adjustment, spatiotemporal jump records, path records, and active node contributions. The formula used is as follows:

[0083] Node access probability update formula:

[0084] ;

[0085] in, represents the seed node, which is the starting point of the random walk process. Indicates that from the seed node Start at time The node access probability distribution vector, Indicates time The normalized adjacency matrix of represents the edge feature weight matrix, Represents a transpose operation; represents the n×n identity matrix, represents the restart probability, A diagonal matrix representing the spatiotemporal activity coefficients; Represents the seed node The restart probability distribution of the restart, represents the space-time jump term, which takes the previous time step The node access probability distribution Integrate into the current time step;

[0086] Edge feature weight calculation formula:

[0087] ;

[0088] in, Represents edge The starting node of Represents edge The target node, Represents edge In time The weight of Represents edge In time The characteristic value of Represents edge At the previous time step The characteristic value of Representing edge properties The standard deviation of

[0089] Represents a matrix that stores the weights of all edges. is a matrix an element of .

[0090] Embodiment 7. This embodiment is based on embodiment 5. In this embodiment, the edge-weighted walk specifically includes: simulating dynamic random walk according to the random walk spatiotemporal activity coefficient, dynamically updating the node access probability through the walk strategy, and generating random walk results; the walk strategy includes random jump, restart and spatiotemporal jump, and the random walk results include node access probability distribution, edge weight adjustment, spatiotemporal jump record, path record and active node contribution.

[0091] Embodiment 8. This embodiment is based on embodiment 7. In this embodiment, diffusion matrix generation specifically includes: dynamically calculating the diffusion matrix of the current time step according to the random walk results in combination with the adjacency matrix to generate an enhanced diffusion matrix; iterative optimization specifically includes: setting the maximum number of iterations, repeating edge weighted walks and diffusion matrix generation, gradually improving the enhanced diffusion matrix, reaching the maximum number of iterations, and outputting the optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

[0092] The present invention and its embodiments are described above, which is not restrictive. What is shown in the accompanying drawings is only one of the embodiments of the present invention, and the actual structure is not limited to this. In short, if ordinary technicians in this field are inspired by it and do not deviate from the purpose of the invention, they can creatively design structural methods and embodiments similar to the technical solution, which should all fall within the scope of protection of the present invention.

Claims

1. A network security risk assessment system, comprising a PCAP data sorting module and a data packet marking phase module, wherein the PCAP data sorting module captures network flow data and generates a pre-processed pap file; the data packet marking phase module extracts flow feature data from the pre-processed pap file and generates a label-hdf5 file; characterized in that: The system also includes a spatiotemporal distribution module and an adjacency optimization module; The spatiotemporal distribution module establishes a graph neural network model, which includes nodes and edges; adopts a graph wavelet transform method, a second-order time domain analysis method, and a neighborhood adaptive smoothing-spatial domain analysis method to construct a graph wavelet-spatiotemporal activity distribution generation model, inputs the label-hdf5 file into the graph wavelet-spatiotemporal activity distribution generation model, and generates a spatiotemporal activity distribution graph; The adjacency optimization module optimizes the adjacency matrix in the tag-hdf5 file according to the spatiotemporal activity distribution graph and adopts a dynamic random walk optimization method, and outputs an optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

2. A network security risk assessment system according to claim 1, characterized in that: The dynamic random walk optimization method specifically includes the following steps: initial node selection, edge weighted walk, diffusion matrix generation and iterative optimization.

3. A network security risk assessment system according to claim 1, characterized in that: The process of generating a spatiotemporal activity distribution diagram by the spatiotemporal distribution module specifically includes the following steps: Step S1: Read the label-hdf5 file and extract the node feature matrix, adjacency matrix and label data; Step S2: Calculate the low-frequency wavelet coefficient and high-frequency wavelet coefficient of each node in the graph neural network model by using the graph wavelet transform method; Step S3: Calculate the spatiotemporal activity coefficient of each node through time domain analysis and space domain analysis to generate a spatiotemporal activity distribution diagram. The time domain analysis measures the activity of the node in the time dimension through the change of low-frequency wavelet coefficients, and the space domain analysis measures the dynamic change of the node in the graph structure space through high-frequency wavelet coefficients.

4. A network security risk assessment system according to claim 3, characterized in that: Step S3 specifically includes the following steps: Step S31: time domain analysis: calculate the rate of change of the low-frequency wavelet coefficients as the first-order rate of change of the low-frequency wavelet coefficients; calculate the acceleration of the rate of change of the low-frequency wavelet coefficients as the second-order rate of change of the low-frequency wavelet coefficients; perform standardization on the first-order rate of change of the low-frequency wavelet coefficients and the second-order rate of change of the low-frequency wavelet coefficients to generate time activity data; Step S32: Spatial domain analysis: perform neighborhood adaptive smoothing on the high-frequency wavelet coefficients to generate smoothed high-frequency wavelet coefficients; perform standardization on the smoothed high-frequency wavelet coefficients to measure the dynamic changes of nodes in the graph structure space and generate spatial activity data; Step S33: Generate a distribution graph: combine the temporal activity data and the spatial activity data to calculate the spatiotemporal activity coefficient of the node; generate a spatiotemporal activity distribution graph based on the spatiotemporal activity coefficient of the node.

5. A network security risk assessment system according to claim 2, characterized in that: The initial node selection specifically includes: selecting an initial random walk node from a graph neural network model according to a spatiotemporal activity distribution graph, and calculating the spatiotemporal activity coefficient of the initial random walk node to generate a random walk spatiotemporal activity coefficient.

6. A network security risk assessment system according to claim 5, characterized in that: The edge-weighted walk specifically includes: introducing a dynamic weighting mechanism for edge characteristics, dynamically adjusting the edge weights in the adjacency matrix according to the spatiotemporal attributes of the edges, and generating a weighted adjacency matrix; combining the spatiotemporal activity coefficient of random walks, simulating dynamic random walks, dynamically updating the node access probability through the walk strategy, and generating random walk results.

7. A network security risk assessment system according to claim 6, characterized in that: The diffusion matrix generation specifically includes: dynamically calculating the diffusion matrix of the current time step according to the random walk result and combining the adjacency matrix to generate an enhanced diffusion matrix.

8. A network security risk assessment system according to claim 7, characterized in that: The iterative optimization specifically includes: setting a maximum number of iterations, repeating edge weighted walks and diffusion matrix generation, gradually improving and enhancing the diffusion matrix, reaching a maximum number of iterations, and outputting an optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

Images