A network security risk assessment system

Abstract

The present invention relates to the field of network security technology and proposes a network security risk assessment system; the system includes a PCAP data collation module, a data packet annotation phase module, a spatiotemporal distribution module, an adjacency optimization module, and a risk assessment module; the present invention generates a spatiotemporal activity distribution graph through graph wavelet transform, a second-order time-domain analysis method, a neighborhood adaptive smoothing-spatial analysis method, and a standardized processing label-HDF5 file, and optimizes the adjacency matrix through spatiotemporal activity distribution and edge feature weighting technology combined with a dynamic random walk optimization method, thereby enhancing the dynamic analysis capability of the network topology structure; the optimized data is input into a graph neural network model to accurately identify potential security risks; through the above technologies, the system improves the accuracy, real-timeness, and adaptability of network security assessment and provides an efficient protection solution for complex network environments.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security risk assessment system. Background Technology

[0002] With the widespread application of the Internet and the acceleration of informatization, the methods and means of network attacks are constantly evolving. Attackers use various complex methods to intrude into networks, steal data, damage systems, and even paralyze the entire network through distributed attacks. Traditional network security assessment systems mainly rely on simple intrusion detection technology, defending by identifying known attack patterns or characteristics. However, with the continuous changes in attack methods, this feature-matching-based defense method is no longer effective in dealing with new types of attacks. Existing network security risk assessment systems have the following problems: First, they cannot efficiently process massive amounts of network traffic data to extract effective features; second, they cannot dynamically identify and analyze the complex relationships between nodes and connections in the network; and finally, they cannot accurately assess potential security risks and provide effective defense strategies for the spatiotemporal changes in network activity. Summary of the Invention

[0003] This invention provides a network security risk assessment system. The system calculates wavelet coefficients in the tag-HDF5 file using graph wavelet transform, performs in-depth analysis of node spatiotemporal activity using second-order temporal analysis, and optimizes the wavelet coefficients using a neighborhood adaptive smoothing-spatial analysis method, thereby generating an accurate spatiotemporal activity distribution map. This process effectively reveals the activity patterns of each node in the network, helping to identify active and stable nodes and providing precise data for subsequent security assessments. The invention also introduces a weighted technique combining spatiotemporal activity distribution and edge characteristics, employing a dynamic random walk optimization method to optimize the adjacency matrix in the tag-HDF5 file, gradually improving the original adjacency matrix, accurately reflecting the dynamic relationships between network nodes, and enhancing sensitivity to potential attacks. By combining these technologies, this invention can more accurately capture potential security threats in the network, helping network administrators respond to complex security risks in real time.

[0004] This invention provides a network security risk assessment system, which includes a PCAP data processing module, a packet labeling phase module, a spatiotemporal distribution module, an adjacency optimization module, and a risk assessment module.

[0005] The PCAP data processing module captures network traffic data during network communication between attackers and targets and saves it as a pacp file; it repairs the pacp file using Pcapfix, including repairing the global header and data packets of the pacp file, and generates a repaired pacp file; and it reorders and cleans the data packets of the repaired pacp file using Reordercap, generating a preprocessed pacp file.

[0006] The packet labeling stage module extracts flow feature data from the preprocessed pacp file, generates labels based on the flow feature data, assigns the labels to the packets in the preprocessed pacp file through the flow labeling script and the packet labeling script, and generates a label-hdf5 file.

[0007] The spatiotemporal distribution module establishes a graph neural network model, which includes nodes and edges. Using graph wavelet transform, second-order temporal analysis, and neighborhood adaptive smoothing-spatial analysis, a graph wavelet-spatiotemporal activity distribution generation model is constructed. The tag-hdf5 file is input into the graph wavelet-spatiotemporal activity distribution generation model to generate a spatiotemporal activity distribution map.

[0008] The adjacency optimization module, based on the spatiotemporal activity distribution map, uses a dynamic random walk optimization method to optimize the adjacency matrix in the tag-hdf5 file and outputs an optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

[0009] The risk assessment module inputs optimized spatiotemporal diffusion matrix, node feature matrix and label data into graph neural network model. The graph neural network model identifies potential security risks and generates a cybersecurity risk assessment report, which includes risk score, source tracing analysis results, prediction suggestions and defense strategy optimization schemes.

[0010] Furthermore, the dynamic random walk optimization method specifically includes the following steps: initial node selection, edge weighted walk, diffusion matrix generation, and iterative optimization.

[0011] Furthermore, the spatiotemporal distribution module, in the process of generating a spatiotemporal activity distribution map, specifically includes the following steps:

[0012] Step S1: Read the label-hdf5 file and extract the node feature matrix, adjacency matrix, and label data; the node feature matrix contains the feature information of the nodes, the adjacency matrix contains the connection relationship between the nodes, and the label data assigns labels to the nodes;

[0013] Step S2: Calculate the low-frequency and high-frequency wavelet coefficients of each node in the graph neural network model using the graph wavelet transform method; the low-frequency wavelet coefficients reflect the spatiotemporal stability of the node, and the high-frequency wavelet coefficients reflect the spatiotemporal activity of the node.

[0014] Step S3: Calculate the spatiotemporal activity coefficients of each node through time domain analysis and spatial domain analysis to generate a spatiotemporal activity distribution map. Time domain analysis measures the activity of nodes in the time dimension by the change of low-frequency wavelet coefficients, while spatial domain analysis measures the dynamic changes of nodes in the graph structure space by the high-frequency wavelet coefficients.

[0015] Furthermore, step S3 specifically includes the following steps:

[0016] Step S31: Time Domain Analysis: Calculate the rate of change of the low-frequency wavelet coefficients as the first-order rate of change; calculate the acceleration of the rate of change of the low-frequency wavelet coefficients as the second-order rate of change; standardize the first-order and second-order rates of change of the low-frequency wavelet coefficients to generate time activity data, using the following formula:

[0017] First-order change formula:

[0018] ;

[0019] in, Indicates a time index. Indicates the node index. Indicates the window offset index. Indicates the size of the time window. Represents a node In time The low-frequency wavelet coefficients, Represents a node In time The rate of change of the low-frequency wavelet coefficients, Represents a node At two adjacent time steps and The variation amplitude of the low-frequency wavelet coefficients; This indicates that the cumulative variation has been normalized.

[0020] Second-order transformation formula:

[0021] ;

[0022] in, Represents the node In time The second-order rate of change of the low-frequency wavelet coefficients measures the acceleration of the trend of change of nodes in the time dimension. Normalize the sum of the second-order rates of change. Represents a node At two adjacent time steps and The amplitude of the low-frequency wavelet coefficient variation between them; It represents the absolute difference in the rate of change between time steps;

[0023] Step S32: Spatial Domain Analysis: Adaptive neighborhood smoothing is applied to the high-frequency wavelet coefficients to generate smoothed high-frequency wavelet coefficients, enhancing the stability of node spatial dynamics. The smoothed high-frequency wavelet coefficients are then standardized to measure the dynamic changes of nodes in the graph structure space, generating spatial activity data. The formula used is as follows:

[0024] Neighborhood smoothing formula:

[0025] ;

[0026] in, Indicates the neighbor node index. Represents a node and neighboring nodes In time Dynamic similarity weights; Represents an exponential function. Represents a node In time High-frequency wavelet coefficients, Representing neighboring nodes In time High-frequency wavelet coefficients, Represents a node and neighboring nodes The absolute difference of high-frequency wavelet coefficients; In time The high-frequency wavelet coefficients are represented as follows: The standard deviation of the high-frequency wavelet coefficients of the node set is represented. To represent small constants and prevent the denominator from being 0, This represents the negative value after normalization of the dynamic difference;

[0027] ;

[0028] in, Represents a node In time The smoothed high-frequency wavelet coefficients, This represents the weighted sum of the high-frequency wavelet coefficients of each node in the neighborhood. This represents the normalized sum of the weights of the neighboring nodes;

[0029] Step S33: Generate distribution map: Combine temporal activity data and spatial activity data to calculate the spatiotemporal activity coefficient of the nodes; generate a spatiotemporal activity distribution map based on the spatiotemporal activity coefficient of the nodes.

[0030] Furthermore, the initial node selection specifically includes: selecting initial random walk nodes from the graph neural network model based on the spatiotemporal activity distribution map, calculating the spatiotemporal activity coefficients of the initial random walk nodes, and generating random walk spatiotemporal activity coefficients.

[0031] Furthermore, the edge-weighted walk specifically includes: introducing a dynamic weighting mechanism based on edge characteristics, dynamically adjusting the edge weights in the adjacency matrix according to the spatiotemporal attributes of the edges to generate a weighted adjacency matrix; combining the spatiotemporal activity coefficients of random walks to simulate dynamic random walks, dynamically updating the node visit probabilities through walk strategies to generate random walk results; walk strategies include random jumps, restarts, and spatiotemporal jumps, and random walk results include node visit probability distributions, edge weight adjustments, spatiotemporal jump records, path records, and active node contributions, using the following formulas:

[0032] Node access probability update formula:

[0033] ;

[0034] in, This represents the seed node, which is the starting point of the random walk process. Indicates from the seed node Start at time The node access probability distribution vector, Indicates time The normalized adjacency matrix, Represents the edge characteristic weight matrix. Indicates the transpose operation; Describes an n×n identity matrix. Indicates the probability of restarting. A diagonal matrix representing the spatiotemporal activity coefficients; Represents seed node The probability distribution of restarting after a restart. This indicates a spacetime jump term, which jumps from the previous time step. Node access probability distribution Integrate into the current time step;

[0035] Edge characteristic weight calculation formula:

[0036] ;

[0037] in, Representing an edge The starting node, Representing an edge The target node, Representing an edge In time The weights; Representing an edge In time The characteristic value, Representing an edge In the previous time step The characteristic value, Representing edge properties The standard deviation.

[0038] Furthermore, the diffusion matrix generation specifically includes: dynamically calculating the diffusion matrix at the current time step based on the random walk results and the adjacency matrix, and generating an enhanced diffusion matrix.

[0039] Furthermore, the iterative optimization specifically includes: setting a maximum number of iterations, repeating edge-weighted walks and diffusion matrix generation, gradually improving and enhancing the diffusion matrix, reaching the maximum number of iterations, and outputting an optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

[0040] By adopting the above solution, the beneficial effects achieved by the present invention are as follows:

[0041] This invention provides a network security risk assessment system. By introducing graph wavelet transform, second-order time-domain analysis, neighborhood adaptive smoothing-spatial analysis, and standardized processing of HDF5 files, the system successfully achieves deep spatiotemporal analysis of network traffic data. This technology enables the system to accurately capture the spatiotemporal activity patterns of nodes in the network, generating more accurate spatiotemporal activity distribution maps. This effectively reveals the activity patterns of each node in the network, helps identify active and stable nodes, provides effective decision support for network security protection, and provides precise evidence for subsequent security assessments.

[0042] Furthermore, this invention combines spatiotemporal activity distribution and edge characteristic weighting techniques, employing a dynamic random walk optimization method to optimize the adjacency matrix, thereby further enhancing the system's ability to analyze complex network topologies. This optimization method can dynamically adjust the adjacency matrix, more accurately reflecting the relationships between nodes and avoiding the limitations of traditional static adjacency matrices in dynamic environments. Through this optimization, this invention successfully enhances the ability to identify potential security threats and improves the system's ability to predict and respond to unknown attacks. This improvement makes this invention more adaptable and practical in the field of network security, better able to address increasingly complex security challenges.

[0043] Ultimately, through the combination of the above technologies, this invention achieves accurate assessment of potential network risks. The generated network security risk assessment report not only provides risk scores but also includes source tracing analysis results, predictive suggestions, and optimized defense strategies. It provides network administrators with comprehensive security protection and helps them formulate more effective defense strategies. The system's accuracy and real-time performance have been greatly improved, effectively supporting network security management decisions and enhancing the overall effectiveness of network security protection. Attached Figure Description

[0044] Figure 1A schematic diagram of a network security risk assessment system provided by the present invention;

[0045] Figure 2 This is a schematic diagram of the structure of the PCAP data processing module and the data packet labeling stage module in Example 1;

[0046] Figure 3 This is a flowchart illustrating step S3 in Example 3. Detailed Implementation

[0047] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention.

[0048] Example 1, according to Figure 1 and Figure 2 The present invention provides a network security risk assessment system, which includes a PCAP data processing module, a packet labeling phase module, a spatiotemporal distribution module, an adjacency optimization module, and a risk assessment module.

[0049] The PCAP data processing module captures network traffic data during network communication between attackers and targets and saves it as a pacp file; it repairs the pacp file using Pcapfix, including repairing the global header and data packets of the pacp file, and generates a repaired pacp file; and it reorders and cleans the data packets of the repaired pacp file using Reordercap, generating a preprocessed pacp file.

[0050] The packet labeling stage module extracts flow feature data from the preprocessed pacp file, generates labels based on the flow feature data, assigns the labels to the packets in the preprocessed pacp file through the flow labeling script and the packet labeling script, and generates a label-hdf5 file.

[0051] The spatiotemporal distribution module establishes a graph neural network model, which includes nodes and edges. Using graph wavelet transform, second-order temporal analysis, and neighborhood adaptive smoothing-spatial analysis, a graph wavelet-spatiotemporal activity distribution generation model is constructed. The tag-hdf5 file is input into the graph wavelet-spatiotemporal activity distribution generation model to generate a spatiotemporal activity distribution map.

[0052] The adjacency optimization module, based on the spatiotemporal activity distribution map, uses a dynamic random walk optimization method to optimize the adjacency matrix in the tag-hdf5 file and outputs an optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

[0053] The risk assessment module inputs the optimized spatiotemporal diffusion matrix, node feature matrix, and label data into the graph neural network model. The graph neural network model identifies potential security risks and generates a cybersecurity risk assessment report, which includes risk scores, source tracing analysis results, prediction suggestions, and optimized defense strategies.

[0054] The dynamic random walk optimization method specifically includes the following steps: initial node selection, edge weighted walk, diffusion matrix generation, and iterative optimization.

[0055] Example 2, based on Example 1, describes the process by which the spatiotemporal distribution module generates a spatiotemporal activity distribution map, specifically including the following steps:

[0056] Step S1: Read the label-hdf5 file and extract the node feature matrix, adjacency matrix, and label data; the node feature matrix contains the feature information of the nodes, the adjacency matrix contains the connection relationship between the nodes, and the label data assigns labels to the nodes;

[0057] Step S2: Calculate the low-frequency and high-frequency wavelet coefficients of each node in the graph neural network model using the graph wavelet transform method; the low-frequency wavelet coefficients reflect the spatiotemporal stability of the node, and the high-frequency wavelet coefficients reflect the spatiotemporal activity of the node.

[0058] Step S3: Calculate the spatiotemporal activity coefficients of each node through time domain analysis and spatial domain analysis to generate a spatiotemporal activity distribution map. Time domain analysis measures the activity of nodes in the time dimension by the change of low-frequency wavelet coefficients, while spatial domain analysis measures the dynamic changes of nodes in the graph structure space by the high-frequency wavelet coefficients.

[0059] Example 3, according to Figure 3 This embodiment is based on embodiment two. In this embodiment, step S3 specifically includes the following steps:

[0060] Step S31: Time Domain Analysis: Calculate the rate of change of the low-frequency wavelet coefficients as the first-order rate of change; calculate the acceleration of the rate of change of the low-frequency wavelet coefficients as the second-order rate of change; standardize the first-order and second-order rates of change of the low-frequency wavelet coefficients to generate time activity data, using the following formula:

[0061] First-order change formula:

[0062] ;

[0063] in, Indicates a time index. Indicates the node index. Indicates the window offset index. Indicates the size of the time window. Represents a node In time The low-frequency wavelet coefficients, Represents a node In time The rate of change of the low-frequency wavelet coefficients, Represents a node At two adjacent time steps and The variation amplitude of the low-frequency wavelet coefficients; This indicates that the cumulative variation has been normalized.

[0064] Second-order transformation formula:

[0065] ;

[0066] in, Represents the node In time The second-order rate of change of the low-frequency wavelet coefficients measures the acceleration of the trend of change of nodes in the time dimension. Normalize the sum of the second-order rates of change. Represents a node At two adjacent time steps and The amplitude of the low-frequency wavelet coefficient variation between them; It represents the absolute difference in the rate of change between time steps;

[0067] Step S32: Spatial Domain Analysis: Adaptive neighborhood smoothing is applied to the high-frequency wavelet coefficients to generate smoothed high-frequency wavelet coefficients, enhancing the stability of node spatial dynamics. The smoothed high-frequency wavelet coefficients are then standardized to measure the dynamic changes of nodes in the graph structure space, generating spatial activity data. The formula used is as follows:

[0068] Neighborhood smoothing formula:

[0069] ;

[0070] in, Indicates the neighbor node index. Represents a node and neighboring nodes In time Dynamic similarity weights; Represents an exponential function. Represents a node In time High-frequency wavelet coefficients, Representing neighboring nodes In time High-frequency wavelet coefficients, Represents a node and neighboring nodes The absolute difference of high-frequency wavelet coefficients; In time The high-frequency wavelet coefficients are represented as follows: The standard deviation of the high-frequency wavelet coefficients of the node set is represented. To represent small constants and prevent the denominator from being 0, This represents the negative value after normalization of the dynamic difference;

[0071] ;

[0072] in, Represents a node In time The smoothed high-frequency wavelet coefficients, This represents the weighted sum of the high-frequency wavelet coefficients of each node in the neighborhood. This represents the normalized sum of the weights of the neighboring nodes;

[0073] Step S33: Generate distribution map: Combine temporal activity data and spatial activity data to calculate the spatiotemporal activity coefficient of the nodes; generate a spatiotemporal activity distribution map based on the spatiotemporal activity coefficient of the nodes.

[0074] Example 4, this example is based on Example 2. In this example, step S3 specifically includes the following steps:

[0075] Step R1: Time Domain Analysis: Analyze the low-frequency wavelet coefficients of the nodes, calculate the rate of change of the low-frequency wavelet coefficients, and measure the activity of the nodes in the time dimension as the first-order rate of change of the low-frequency wavelet coefficients; standardize the first-order rate of change of the low-frequency wavelet coefficients to generate time activity data, using the following formula:

[0076] First-order change formula:

[0077] ;

[0078] in, Indicates a time index. Indicates the node index. Indicates the window offset index. Indicates the size of the time window. Represents a node In time The low-frequency wavelet coefficients, Represents a node In time The rate of change of the low-frequency wavelet coefficients, Represents a node At two adjacent time steps and The variation amplitude of the low-frequency wavelet coefficients; This indicates that the cumulative variation has been normalized.

[0079] Step R2: Spatial domain analysis: Standardize the high-frequency wavelet coefficients to measure the dynamic changes of nodes in the graph structure space and generate spatial activity data;

[0080] Step R3: Generate distribution map: Combine temporal activity data and spatial activity data to calculate the spatiotemporal activity coefficient of the nodes; generate a spatiotemporal activity distribution map based on the spatiotemporal activity coefficient of the nodes.

[0081] Example 5, based on Example 3, specifically includes the following steps for initial node selection: selecting initial random walk nodes from the graph neural network model according to the spatiotemporal activity distribution map, calculating the spatiotemporal activity coefficients of the initial random walk nodes, and generating random walk spatiotemporal activity coefficients.

[0082] Example 6, based on Example 5, specifically includes the following: Introducing a dynamic weighting mechanism based on edge characteristics, dynamically adjusting edge weights in the adjacency matrix according to the spatiotemporal attributes of edges to generate a weighted adjacency matrix; Simulating a dynamic random walk by combining the spatiotemporal activity coefficients of the random walk, dynamically updating the node access probability through the walk strategy to generate the random walk result; The walk strategy includes random jumps, restarts, and spatiotemporal jumps; The random walk result includes the node access probability distribution, edge weight adjustment, spatiotemporal jump records, path records, and active node contributions. The formulas used are as follows:

[0083] Node access probability update formula:

[0084] ;

[0085] in, This represents the seed node, which is the starting point of the random walk process. Indicates from the seed node Start at time The node access probability distribution vector, Indicates time The normalized adjacency matrix, Represents the edge characteristic weight matrix. Indicates the transpose operation; Describes an n×n identity matrix. Indicates the probability of restarting. A diagonal matrix representing the spatiotemporal activity coefficients; Represents seed node The probability distribution of restarting after a restart. This indicates a spacetime jump term, which jumps from the previous time step. Node access probability distribution Integrate into the current time step;

[0086] Edge characteristic weight calculation formula:

[0087] ;

[0088] in, Representing an edge The starting node, Representing an edge The target node, Representing an edge In time The weights; Representing an edge In time The characteristic value, Representing an edge In the previous time step The characteristic value, Representing edge properties Standard deviation;

[0089] This represents a matrix that stores the weights of all edges. It is a matrix One of the elements.

[0090] Example 7, based on Example 5, specifically includes: simulating a dynamic random walk based on the spatiotemporal activity coefficients of the random walk, dynamically updating the node access probability through the walk strategy, and generating the random walk result; the walk strategy includes random jump, restart, and spatiotemporal jump, and the random walk result includes the node access probability distribution, edge weight adjustment, spatiotemporal jump record, path record, and active node contribution.

[0091] Example 8, based on Example 7, specifically includes the following steps for generating the diffusion matrix: dynamically calculating the diffusion matrix at the current time step based on the random walk results and the adjacency matrix, and generating an enhanced diffusion matrix; the iterative optimization specifically includes: setting a maximum number of iterations, repeating the edge weighted walk and diffusion matrix generation, gradually improving the enhanced diffusion matrix, reaching the maximum number of iterations, and outputting an optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

[0092] The present invention and its embodiments have been described above. This description is not restrictive. The accompanying drawings are only one embodiment of the present invention, and the actual structure is not limited thereto. In short, if a person skilled in the art is inspired by this description and designs a similar structure and embodiment without departing from the spirit of the present invention, such design should fall within the protection scope of the present invention.

Claims

1. A network security risk assessment system, comprising a PCAP data processing module and a packet labeling stage module, wherein the PCAP data processing module captures network traffic data and generates a preprocessed pcap file; the packet labeling stage module extracts flow feature data from the preprocessed pcap file and generates a tag-hdf5 file; characterized in that: The system also includes a spatiotemporal distribution module and an adjacency optimization module; The spatiotemporal distribution module establishes a graph neural network model, which includes nodes and edges. It uses graph wavelet transform, second-order temporal analysis, and neighborhood adaptive smoothing-spatial analysis to construct a graph wavelet-spatiotemporal activity distribution generation model. The tag-hdf5 file is input into the graph wavelet-spatiotemporal activity distribution generation model to generate a spatiotemporal activity distribution map. The adjacency optimization module optimizes the adjacency matrix in the tag-hdf5 file using a dynamic random walk optimization method based on the spatiotemporal activity distribution map, and outputs an optimized spatiotemporal diffusion matrix to replace the adjacency matrix. The process by which the spatiotemporal distribution module generates a spatiotemporal activity distribution map specifically includes the following steps: Step S1: Read the label-hdf5 file and extract the node feature matrix, adjacency matrix, and label data; Step S2: Calculate the low-frequency and high-frequency wavelet coefficients of each node in the graph neural network model using the graph wavelet transform method; Step S3: Calculate the spatiotemporal activity coefficients of each node through time domain analysis and spatial domain analysis to generate a spatiotemporal activity distribution map. Time domain analysis measures the activity of nodes in the time dimension by the change of low-frequency wavelet coefficients, while spatial domain analysis measures the dynamic changes of nodes in the graph structure space by the high-frequency wavelet coefficients. The risk assessment module inputs optimized spatiotemporal diffusion matrix, node feature matrix and label data into graph neural network model. The graph neural network model identifies potential security risks and generates a cybersecurity risk assessment report, which includes risk score, source tracing analysis results, prediction suggestions and defense strategy optimization schemes.

2. The network security risk assessment system according to claim 1, characterized in that: The dynamic random walk optimization method specifically includes the following steps: initial node selection, edge weighted walk, diffusion matrix generation, and iterative optimization.

3. The network security risk assessment system according to claim 1, characterized in that: Step S3 specifically includes the following steps: Step S31: Time Domain Analysis: Calculate the rate of change of the low-frequency wavelet coefficients as the first-order rate of change of the low-frequency wavelet coefficients; calculate the acceleration of the rate of change of the low-frequency wavelet coefficients as the second-order rate of change of the low-frequency wavelet coefficients; standardize the first-order rate of change and the second-order rate of change of the low-frequency wavelet coefficients to generate time activity data. Step S32: Spatial domain analysis: Perform neighborhood adaptive smoothing on the high-frequency wavelet coefficients to generate smoothed high-frequency wavelet coefficients; perform standardization on the smoothed high-frequency wavelet coefficients to measure the dynamic changes of nodes in the graph structure space and generate spatial activity data. Step S33: Generate distribution map: Combine temporal activity data and spatial activity data to calculate the spatiotemporal activity coefficient of the nodes; generate a spatiotemporal activity distribution map based on the spatiotemporal activity coefficient of the nodes.

4. The network security risk assessment system according to claim 2, characterized in that: The initial node selection specifically includes: selecting initial random walk nodes from the graph neural network model based on the spatiotemporal activity distribution map, and calculating the spatiotemporal activity coefficients of the initial random walk nodes to generate random walk spatiotemporal activity coefficients.

5. A network security risk assessment system according to claim 4, characterized in that: The edge-weighted walk specifically includes: introducing a dynamic weighting mechanism based on edge characteristics, dynamically adjusting the edge weights in the adjacency matrix according to the spatiotemporal attributes of the edges to generate a weighted adjacency matrix; combining the spatiotemporal activity coefficients of random walks to simulate dynamic random walks, dynamically updating the node visit probability through the walk strategy, and generating random walk results.

6. A network security risk assessment system according to claim 5, characterized in that: The diffusion matrix generation specifically includes: dynamically calculating the diffusion matrix at the current time step based on the random walk results and the adjacency matrix, and generating an enhanced diffusion matrix.

7. A network security risk assessment system according to claim 6, characterized in that: The iterative optimization specifically includes: setting a maximum number of iterations, repeating edge-weighted walks and diffusion matrix generation, gradually improving and enhancing the diffusion matrix, reaching the maximum number of iterations, and outputting an optimized spatiotemporal diffusion matrix to replace the adjacency matrix.

Images