Multi-source data fusion prediction method and device for security situation awareness AI large model

Abstract

The invention relates to the technical field of large model prediction, and discloses a multi-source data fusion prediction method and device for a security situation awareness AI large model. The method comprises the following steps: analyzing the characteristic relevance of terminal node characteristic distribution to generate a data source characteristic incidence matrix, performing multi-level distribution reconstruction of a target sensing network according to the data source characteristic incidence matrix, constructing a multi-level sensing framework adaptive to a security situation sensing AI large model, and adjusting the AI model based on the multi-level framework to adapt to the target sensing network. According to the method, the comprehensiveness and the accuracy of security situation awareness are effectively improved through multi-source data fusion and construction of the multi-level awareness framework, and the problem that in the prior art, the adaptability of an AI large model corresponding to multi-source heterogeneous data is low is solved.

Description

Technical Field

[0001] The present invention relates to the technical field of large model prediction, and in particular to a multi-source data fusion prediction method and device for a security situation awareness AI large model. Background Art

[0002] In the current network environment, network security issues are becoming increasingly serious. As network attack methods become increasingly complex and changeable, traditional security protection mechanisms and means have become difficult to cope with complex and changeable security threats. Therefore, security situation awareness technology based on artificial intelligence (AI) and big data analysis has emerged. Security situation awareness refers to the process of comprehensively evaluating and warning network security status through real-time monitoring, analysis, and prediction of data at multiple levels such as networks, systems, and applications, combined with intelligence information. The key to security situation awareness lies in how to comprehensively and accurately obtain network status information, and process and analyze massive information through intelligent algorithms, and ultimately provide reliable security predictions and response measures.

[0003] However, in the existing technology, the data source of the security situation awareness large model is single. When the number of data sources increases, the strong data heterogeneity between the various data sources will make it difficult for the security situation awareness large model to adapt to multiple data sources for perception work. Summary of the invention

[0004] The purpose of the present invention is to provide a multi-source data fusion prediction method and device for a security situation awareness AI large model, aiming to solve the problem of low adaptability of the AI ​​large model to multi-source heterogeneous data in the prior art.

[0005] The present invention is implemented in this way. In a first aspect, the present invention provides a multi-source data fusion prediction method for a security situation awareness AI large model, comprising: Perform information collection and characteristic analysis on the terminal nodes of the target perception network prepared for detection by the security situation awareness AI large model to obtain the characteristic distribution of the terminal nodes of the target perception network; Acquire the perception object feature information of the security situation awareness AI large model, and perform a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network; According to the data source feature association matrix of the target perception network, a multi-level network distribution reconstruction is performed on the terminal node feature distribution of the target perception network to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model; Redeploying model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain a security situation awareness AI big model adapted to the target perception network; Based on the multi-level perception framework, data collection and feature aggregation of each terminal node of the target perception network are performed to obtain network perception information of the target perception network; The network perception information is substituted into a security situation awareness AI big model adapted to the target perception network, and the security situation awareness AI big model is enabled to perform security situation awareness on the target perception network to obtain security prediction features.

[0006] In a second aspect, the present invention provides a multi-source data fusion prediction device for a security situation awareness AI large model, which is used to implement a multi-source data fusion prediction method for a security situation awareness AI large model as described in any one of the first aspects, including: An information collection module is used to collect information and analyze characteristics of terminal nodes of a target perception network prepared for detection by a security situation awareness AI large model, so as to obtain characteristic distribution of terminal nodes of the target perception network; An association analysis module is used to obtain the perception object feature information of the security situation awareness AI large model, and perform a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network; A framework construction module, used to reconstruct the multi-level network distribution of the terminal node feature distribution of the target perception network according to the data source feature association matrix of the target perception network, so as to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model; A model adjustment module, used to redeploy model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain a security situation awareness AI big model adapted to the target perception network; A network perception module, used for collecting data and summarizing features of each terminal node of the target perception network based on the multi-level perception framework to obtain network perception information of the target perception network; The security prediction module is used to substitute the network perception information into the security situation perception AI big model adapted to the target perception network, so that the security situation perception AI big model performs security situation perception on the target perception network to obtain security prediction features.

[0007] The present invention provides a multi-source data fusion prediction method for a security situation awareness AI large model, which has the following beneficial effects: The present invention obtains the characteristic distribution of terminal nodes of the target perception network and the characteristic information of the perception object, and based on this, analyzes the characteristic correlation of the characteristic distribution of the terminal nodes to generate a data source characteristic association matrix, and reconstructs the multi-level distribution of the target perception network according to the data source characteristic association matrix, and constructs a multi-level perception framework adapted to the large AI model of security situation perception, and adjusts the AI ​​model based on the multi-level framework to adapt to the target perception network. Based on the multi-level framework, the network perception information input model is obtained to perform security situation perception and prediction. This method effectively improves the comprehensiveness and accuracy of security situation perception through multi-source data fusion and the construction of a multi-level perception framework, and solves the problem of low adaptability of the AI ​​large model to multi-source heterogeneous data in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0008] Figure 1 It is a schematic diagram of the steps of a multi-source data fusion prediction method for a security situation awareness AI large model provided by an embodiment of the present invention; Figure 2 It is a structural schematic diagram of a multi-source data fusion prediction device of a security situation awareness AI large model provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0009] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not intended to limit the present invention.

[0010] The implementation of the present invention is described in detail below in conjunction with specific embodiments.

[0011] Reference Figure 1 , Figure 2 As shown, a preferred embodiment of the present invention is provided.

[0012] In a first aspect, the present invention provides a multi-source data fusion prediction method for a security situation awareness AI large model, comprising: S1: Collect information and analyze characteristics of terminal nodes of a target perception network prepared for detection by a security situation awareness AI large model, so as to obtain characteristic distribution of terminal nodes of the target perception network; S2: Acquire the perception object feature information of the security situation awareness AI large model, and perform a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network; S3: reconstructing the terminal node feature distribution of the target perception network at multiple levels according to the data source feature association matrix of the target perception network, so as to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model; S4: redeploying model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain a security situation awareness AI big model adapted to the target perception network; S5: Based on the multi-level perception framework, data collection and feature aggregation of each terminal node of the target perception network are performed to obtain network perception information of the target perception network; S6: Substitute the network perception information into the security situation awareness AI big model adapted to the target perception network, and enable the security situation awareness AI big model to perform security situation awareness on the target perception network to obtain security prediction features.

[0013] Specifically, in step S1 of the embodiment provided by the present invention, the target perception network for which information needs to be collected and each terminal node in the network are clearly defined, the scope of the target perception network (such as an enterprise intranet, Internet of Things devices, cloud computing environment, etc.) is determined, and all terminal nodes in the network are identified, including computers, servers, sensors, switches, routers, etc.

[0014] More specifically, basic data of terminal nodes in the target perception network are collected to understand their status and behavior patterns, the location of each terminal node in the network topology, connection relationship, network bandwidth, communication delay, etc., the unique identification information of each node (such as IP address, MAC address, device type, operating system version, etc.) is collected, and the communication data flow of the terminal node is collected, including network traffic (packet size, protocol type, access port, etc.), network request response time, etc., to obtain the running status of the node, such as online status, load status, device health, whether there is anomaly (such as CPU overload, memory consumption abnormality, etc.), collect security logs generated by the node, record security events, intrusion detection alarms, firewall and anti-virus software activities, etc.

[0015] More specifically, the collected terminal node information is analyzed and processed to provide support for the subsequent feature distribution generation, and meaningful features are extracted from the collected information, such as traffic patterns, node health status, behavioral characteristics, etc. The noise and outliers in the collected data are processed to ensure data quality. Different types of features are normalized or standardized to ensure that they can be used in the same model to facilitate subsequent analysis. The relationship between node characteristics is analyzed, such as communication frequency between nodes, communication traffic changes, access patterns, etc., so as to understand the dependencies between nodes.

[0016] More specifically, based on the results of characteristic analysis, the characteristic distribution of each terminal node in the network is generated, laying the foundation for subsequent multi-source data fusion and perception prediction. The nodes are clustered according to the behavioral characteristics of the terminal nodes (such as communication mode, traffic characteristics, operation behavior, etc.). Through clustering algorithms (such as K-means, DBSCAN, etc.), nodes with similar characteristics are classified into one category. The nodes are classified according to their operating status (such as normal, abnormal, attack, etc.), and each node is labeled to indicate its status in the security situation. The characteristic values ​​of each node (such as network traffic, node health status, etc.) are organized into a characteristic distribution matrix to represent the characteristic status of each node in the entire target perception network.

[0017] More specifically, the collected feature distribution data is stored and updated regularly to keep the data real-time. The feature distribution data is stored in a queryable data storage system (such as a database or a time series database). The node feature distribution data is updated regularly to ensure that the perception model can make predictions based on the latest network status.

[0018] It is understandable that through detailed terminal node information collection and feature analysis, the behavior, status and communication mode of each terminal node can be fully understood. This comprehensive information capture provides a solid foundation for subsequent security situation awareness. Through in-depth analysis of node features and generation of feature distribution, it ensures that the AI ​​big model can understand the real structure and dynamics of the target network, thereby improving its accuracy in predicting potential security risks. During the feature analysis process, node characteristics that are different from normal behavior patterns can be identified, and abnormal behavior or security threats can be discovered. For example, a sudden increase in traffic or behavior that does not conform to normal access patterns may indicate a potential attack.

[0019] More specifically, the regularly updated feature distribution ensures that the security situation awareness model can reflect changes in network status in real time and enhances the ability to identify emerging security threats. Any node status changes in the network will be promptly reflected in the feature distribution, providing the latest information support for the model. Through a comprehensive analysis of node characteristics and behaviors, it provides input for multi-source data fusion. Information from different nodes can be fused to generate a global network security situation view, which helps the model to perform more accurate risk assessment. The standardization and correlation analysis of various node features provide support for subsequent multi-level network reconstruction and redeployment of model perception parameters, ensuring that the AI ​​model can adapt and adjust according to the complexity of the network environment.

[0020] Specifically, in step S2 of the embodiment provided by the present invention, the scope of the perception object is determined. The perception object can be elements of different levels or types in the network, such as various terminal nodes, communication flows, applications, sensor data, etc., and various relevant feature information is collected from the perception object. These features include: network traffic characteristics, including traffic size, frequency, protocol type, data packet size, transmission delay, etc., behavioral characteristics, such as access patterns, behavioral patterns, operating system types, process information, etc., security log data, including intrusion detection logs, authentication logs, firewall logs, anti-virus software logs, etc., attack behavior characteristics, including identified attack patterns, attack source information, attack types, etc.

[0021] More specifically, the characteristic information of the perceived objects is used to analyze the characteristics of the terminal nodes in the network, reveal the relationship between the nodes, compare the characteristics of the terminal nodes in the target perception network (such as traffic characteristics, behavioral characteristics, etc.), and cluster the nodes with similar characteristics into a group, which helps to understand the similarities and potential relationships between nodes. The correlation between node characteristics is analyzed based on the characteristics of the perceived objects (such as network traffic and security logs, etc.). For example, security incidents at certain nodes during high traffic moments or abnormal behavior in specific applications may indicate security issues.

[0022] More specifically, the feature correlation between the perceived object and each terminal node in the target perception network is analyzed, a data source feature correlation matrix is ​​generated, and the perceived object features and terminal node features are analyzed by statistical or machine learning methods to find out the correlation between them. Commonly used correlation calculation methods include: correlation coefficient analysis: using Pearson correlation coefficient, Spearman rank correlation coefficient, etc. to calculate the linear relationship between the perceived object features and the node features, distance measurement methods: such as Euclidean distance, Manhattan distance, etc., used to measure the feature differences between nodes, information entropy and mutual information: quantifying the information flow between the perceived object features and the node features.

[0023] More specifically, the correlation results between nodes and perceived object features are represented in the form of a matrix. Each matrix element represents the strength of the correlation between a certain feature and a specific node. The data source feature correlation matrix of the target perception network is a two-dimensional matrix. The horizontal axis represents the nodes (or certain characteristics of the nodes), and the vertical axis represents the various features of the perceived object. Each element in the matrix represents the correlation or similarity between the node and the perceived object feature.

[0024] More specifically, through optimization and adjustment, the accuracy and availability of the correlation matrix are improved. Through methods such as principal component analysis (PCA) and independent component analysis (ICA), the redundant features in the data source feature matrix are reduced, the most representative information is extracted, and the feature correlation in the matrix is ​​weighted. Higher weights are given to those features that are more closely related to security situation awareness, which helps the AI ​​model focus on more important data sources. The data source feature correlation matrix is ​​regularly updated according to changes in the network environment and the occurrence of security incidents to ensure the real-time and adaptability of the model.

[0025] More specifically, the generated association matrix is ​​applied to the security situation awareness model to optimize prediction and decision-making. The data source feature association matrix of the generated target perception network is input into the security situation awareness AI model. The auxiliary model adjusts its reasoning process according to the correlation between the node and the perceived object when making security predictions. According to the data in the association matrix, the perception strategy is dynamically adjusted to increase the attention to specific nodes or features in a targeted manner, especially when dealing with security incidents.

[0026] It is understandable that through feature correlation analysis, the AI ​​model can understand the deep connection between the perceived object and the network nodes, and improve its perception of the network security situation. The generated data source feature association matrix helps the model accurately identify the relationship between nodes and improve the detection ability of complex security threats. It associates the perceived object features with the node features, so that multiple data sources in the network (such as traffic data, security logs, etc.) can be integrated in the model to form a comprehensive security view. This multi-source data fusion helps to comprehensively evaluate the security situation of the network.

[0027] More specifically, the data source feature association matrix can reflect the actual state and dynamic changes of the target perception network, enabling the AI ​​large model to adapt to changes in the network environment. In particular, when responding to new attack patterns or abnormal behaviors, the association matrix can provide the necessary information support to help the model respond more quickly. By continuously updating the association matrix, the AI ​​model can adjust the perception and prediction strategies in real time, which enables the model to quickly adapt to changes in the network, promptly detect potential security threats or attack behaviors, and provide more real-time security protection.

[0028] More specifically, the generation of the association matrix enables the model to make decisions in a data-driven manner. Based on the association between nodes, the model can make more accurate security predictions and judgments. For example, when the characteristics of a node are highly correlated with the attack pattern, the model can give priority to the security of the node. By deeply analyzing the association between the node and the characteristics of the perceived object, the model can effectively reduce false positives and negatives. This precise association analysis can help the model focus on real security risks and improve the efficiency of network security protection.

[0029] Specifically, in step S3 of the embodiment provided by the present invention, based on the data source feature association matrix, the feature distribution of each terminal node in the target perception network is analyzed, and the potential structural relationship between the nodes is mined. By analyzing the correlation degree in the data source feature association matrix, the relationship between the features is identified. For example, some node features may be highly consistent in multiple nodes, indicating that these nodes may belong to the same functional module or security risk type.

[0030] More specifically, the association information in the matrix is ​​used to find nodes with similar characteristics in the network to form a multi-level distribution structure. For example, based on the clustering of node feature similarity, the network can be divided into multiple hierarchical structures. A reasonable correlation threshold is set. Only when the feature correlation between nodes exceeds this threshold will they be considered as part of the same hierarchical structure. This can be achieved by setting a certain metric (such as the Pearson correlation coefficient).

[0031] More specifically, the multi-level structure of the target perception network is reconstructed based on the analysis results to make it suitable for the multi-level perception framework of the security situation awareness AI large model. According to the correlation between nodes in the data source feature association matrix, the nodes in the network are divided into multiple levels. Each level represents the feature distribution of a node, reflecting the similarity and functional correlation between nodes. Based on the hierarchical division, the topological structure of the target perception network is reconstructed. Each level can be regarded as a sub-network. The internal nodes have a high degree of correlation. The connection between layers represents the dependency relationship and information transmission between different levels. The bottom layer usually contains low-level perception data, such as traffic, logs and other information. The middle layer represents the feature association between different nodes, reflecting more complex network behaviors and potential attack modes. The high layer can include security situations inferred from the bottom and middle layer information, such as intrusion detection, attack identification, etc., define cross-level data flows and information transmission mechanisms, ensure collaboration and information sharing between levels, and ensure the security perception and protection capabilities of the overall network.

[0032] More specifically, the multi-level network distribution reconstruction results are integrated into a multi-level perception framework suitable for AI large models. A multi-level perception framework is designed, in which each layer represents a functional module in network perception (for example, data collection, behavior analysis, risk assessment, etc.). The input of each layer is the node characteristics and network status of the layer, and the output is the assessment result of the security situation of the layer. In each layer, the AI ​​large model processes the input of a specific layer and identifies the security threats of the corresponding layer. For example, the bottom layer can be responsible for detecting anomalies in network traffic, the middle layer is responsible for analyzing the communication behavior between nodes, and the top layer is responsible for making comprehensive security decisions based on the outputs of the bottom and middle layers. The layers share information through a designed collaborative mechanism. For example, the middle layer may adjust the analysis strategy of node behavior based on the detection results of the bottom layer, while the top layer can make a comprehensive assessment and prediction based on the inputs of the bottom and middle layers.

[0033] More specifically, by optimizing the multi-level perception framework, improving perception capabilities and decision-making efficiency, and ensuring that the framework has high accuracy and robustness in practical applications, in the multi-level perception framework, the data features of each layer may be redundant. PCA (principal component analysis) or other dimensionality reduction techniques are used to reduce the dimension of the data, improve computing efficiency, and retain useful information. Combine multiple AI models to perform multi-level data processing. For example, the bottom layer uses a traffic-based anomaly detection model, the middle layer uses a behavior analysis-based model, and the high layer uses a comprehensive evaluation model for security decisions. In the multi-level perception framework, each layer is able to learn and adapt according to the dynamic changes of the network. For example, through technologies such as reinforcement learning, the model can automatically adjust its perception strategy according to the occurrence of security incidents and changes in the network environment.

[0034] It is understandable that through multi-level network distribution reconstruction, the network can be perceived from different levels and angles, providing richer security information. Each level focuses on different aspects of the network (such as traffic monitoring, node behavior, attack detection, etc.), thereby improving the accuracy and depth of overall perception. This multi-level framework can flexibly adapt to different network environments and security needs. For example, in a high-traffic network, the underlying perception system can focus more on traffic analysis, while in advanced attack modes, the high-level perception system can be responsible for comprehensive analysis of multiple data sources to provide a global security situation assessment.

[0035] More specifically, through information sharing and collaborative work between different levels, security data at different levels can be effectively utilized. For example, the anomaly detection results at the bottom level can be used as input for the middle-level analysis, and the behavior analysis results at the middle level can provide support for the decision-making of the high-level. In this way, security protection can be more three-dimensional and comprehensive. The multi-level framework is adaptive and can be adjusted in real time according to the actual network environment, threat situation and the occurrence of security incidents. The system can continuously optimize its perception strategy based on network changes and historical data feedback, and improve its response capabilities in different situations.

[0036] More specifically, through a hierarchical structure, each layer can process different tasks in parallel to improve the processing efficiency of the overall system. For example, the bottom layer quickly processes traffic data and filters out abnormal information, the middle layer quickly analyzes behavioral characteristics, and the top layer makes the final security decision. This parallel processing can greatly improve the system response speed and shorten the detection and response time of security incidents.

[0037] Specifically, in steps S4, S5, and S6 of the embodiment provided by the present invention, the parameter configuration of the security situation awareness AI large model is adjusted according to the multi-level perception framework so that it can better adapt to the actual needs of the target perception network. According to the characteristics of the multi-level perception framework, the security needs and characteristics of each layer are analyzed. For example, the underlying perception system may pay more attention to traffic anomalies and attack pattern detection, while the high-level may focus on the global impact of attacks, trend prediction, etc. The perception parameters of each level of the AI ​​model are redesigned and adjusted. For example, different weights, input formats, and model architectures can be set for network features at different levels. The underlying model may rely more on traffic monitoring and pattern recognition, the middle layer can rely on more complex behavior analysis models, and the high-level uses reinforcement learning and other technologies for comprehensive evaluation.

[0038] More specifically, based on the actual data of the target network, the AI ​​model is retrained to ensure that it can efficiently process perception data from different levels and quickly adapt to the new network environment using technologies such as transfer learning. The output of each layer of the model is not only a single security decision or alarm, but also needs to consider collaboration and information feedback with other layers to ensure the consistency of the overall perception.

[0039] More specifically, based on a multi-level perception framework, data is collected from each terminal node of the target perception network, effective features are extracted and summarized into network perception information, and raw data from terminal devices, network traffic, behavior logs, etc. are collected through the underlying nodes in the perception framework. These data contain information such as network operation status, node activity, traffic patterns, abnormal behaviors, etc. Feature extraction, feature extraction is performed on the collected data, including but not limited to: traffic characteristics: including traffic size, frequency, protocol type, etc., behavior characteristics: such as node access mode, interaction history, abnormal behavior, etc., security event characteristics: such as known attack characteristics, network abnormal events, etc. The features extracted from each terminal node are summarized to form a unified network perception information set. This information set should be able to represent the security situation of the entire network, including the operation status of each terminal, behavior analysis, and potential security threats.

[0040] More specifically, the collected and summarized network perception information is input into the security situation awareness AI big model adapted to the target perception network to conduct security situation awareness analysis, and necessary preprocessing is performed on the network perception information, such as data cleaning, denoising, and standardization, to ensure that the input data meets the requirements of the AI ​​big model. According to the input requirements of the AI ​​big model, the format and dimension of the data are adjusted. The multi-level perception framework may generate data at different levels. It is necessary to ensure that the data can be effectively transmitted to the AI ​​models at each level. The summarized perception information is substituted into the AI ​​big model for reasoning and analysis. The model evaluates security threats according to the data characteristics of each layer, and combines deep learning and machine learning algorithms to identify potential security threats, attack patterns and risk points. The AI ​​big model will output security situation awareness results based on perception information at different levels, including assessment of threats at each layer, analysis of network status, etc.

[0041] More specifically, based on the output of the AI ​​big model, security prediction features for the target perception network are generated to provide a basis for subsequent security protection decisions. The AI ​​big model conducts security situation assessment based on the input network perception information and predicts possible security incidents such as attacks and intrusions. These prediction features can be threat levels, attack paths, potential losses, etc.

[0042] More specifically, key security prediction features are extracted from the model output, including: attack prediction features: such as the types of attacks that may occur in the future, the probability of attacks occurring, etc., network health status: including the security status assessment of each terminal in the network, whether there are potential vulnerabilities, etc., risk assessment: based on the AI ​​model, the risk level of each node in the network is classified to evaluate the security status of the entire network, and the prediction features are used as security decision support information to provide decision-making basis for network security administrators or automated protection systems.

[0043] It is understandable that through the deployment and optimization of the multi-level perception framework, it is possible to analyze security threats in the network from multiple dimensions and at a finer granularity, improve the accuracy and comprehensiveness of the overall security situation awareness, and the perception results of the bottom, middle and high layers can complement each other to avoid omissions and false alarms. By redeploying the AI ​​model perception parameters, it can be dynamically adjusted according to the characteristics of the target network, so that the large AI model can adapt to changes in different network environments and different types of security threats, thereby improving the adaptability and robustness of the model in the actual network.

[0044] More specifically, the perception data of each terminal node is aggregated and processed in a hierarchical manner to avoid the problem of data overload. The characteristic information at each level can optimize data flow and processing efficiency while maintaining information accuracy, and improve the real-time response capability of the system. The AI ​​large model can output accurate security prediction features based on network perception information, and effectively identify potential security threats and attack patterns. These predictions can make security warnings in advance, help network security teams take protective measures in advance, and reduce the occurrence of network security incidents.

[0045] More specifically, by inputting multi-level perception information into the AI ​​big model, it is possible to conduct comprehensive security situation awareness of the target perception network, which can not only detect known threats, but also predict unknown attack risks and provide all-round security protection. The security prediction features provide real-time decision support for subsequent security protection measures. Based on the rapid reasoning and prediction of the AI ​​model, it can quickly identify threats and automatically trigger protection strategies, reduce the time of manual intervention, ensure the real-time and timely response of network security, and through the collaborative work of hierarchical perception and AI big models, the system can more accurately identify real threats in the network, reduce false alarms and missed alarms, avoid waste of resources, and ensure the efficient operation of network security.

[0046] The present invention provides a multi-source data fusion prediction method for a security situation awareness AI large model, which has the following beneficial effects: The present invention obtains the characteristic distribution of terminal nodes of the target perception network and the characteristic information of the perception object, and based on this, analyzes the characteristic correlation of the characteristic distribution of the terminal nodes to generate a data source characteristic association matrix, and reconstructs the multi-level distribution of the target perception network according to the data source characteristic association matrix, and constructs a multi-level perception framework adapted to the large AI model of security situation perception, and adjusts the AI ​​model based on the multi-level framework to adapt to the target perception network. Based on the multi-level framework, the network perception information input model is obtained to perform security situation perception and prediction. This method effectively improves the comprehensiveness and accuracy of security situation perception through multi-source data fusion and the construction of a multi-level perception framework, and solves the problem of low adaptability of the AI ​​large model to multi-source heterogeneous data in the prior art.

[0047] Preferably, the step of collecting information and analyzing characteristics of terminal nodes of a target perception network prepared for detection by a security situation awareness AI large model to obtain characteristic distribution of terminal nodes of the target perception network includes: S11: marking the object network where the security situation awareness AI large model is to be deployed as a target perception network, and collecting network topology information of the target perception network to obtain network topology information of the target perception network; S12: collecting information of each terminal node of the target perception network based on the network topology information of the target perception network to obtain node information of each terminal node of the target perception network; S13: performing node characteristic analysis of node independent state and node association state on the node information of each terminal node of the target sensing network to obtain original node characteristics of each terminal node; S14: The original node characteristics of each of the terminal nodes are summarized as a whole to obtain a network characteristic map of the target perception network, and based on the network characteristic map, the original node characteristics of each of the terminal nodes are subjected to overall correction of node characteristics and network links of node characteristics to obtain the terminal node characteristic distribution of the target perception network.

[0048] Specifically, the network is marked as a target perception network, and its topological structure is obtained to provide a basis for subsequent node information collection. The network system to be detected is marked as a target perception network. This step is to clarify the scope of the network and provide a clear object for subsequent operations. The topological information of the target perception network is collected. The topological information includes: the type of each node (such as server, terminal, router, etc.), the connection relationship of each node (physical and logical connection between nodes), network hierarchy (such as local area network, wide area network, etc.), and the collected network topology information is modeled to generate a topology map to facilitate subsequent analysis and node information collection.

[0049] More specifically, based on the network topology, information of each terminal node is collected to lay the foundation for subsequent feature analysis. According to the network topology information, all terminal nodes in the target perception network are identified. Terminal nodes usually refer to terminal devices, workstations, IoT devices, etc.

[0050] More specifically, the following information is collected for each terminal node: basic device information: device type, model, operating system, IP address, MAC address, etc., network behavior information: including data traffic, connection history, communication protocol, etc., security log information: such as access logs, system event logs, security alerts, etc., resource usage information: CPU load, memory usage, storage status, etc.

[0051] More specifically, we conduct an in-depth analysis of the status of each terminal node, parse out the independent characteristics of the node and the correlation characteristics between nodes, and conduct independent status analysis on each terminal node, focusing on the operating status of a single node, which usually includes: the node's workload, resource usage, security event detection, such as virus, malware, intrusion detection, etc., the stability of the network connection and the traffic pattern.

[0052] More specifically, it analyzes the association status between nodes and other nodes, identifies the interaction relationship and data transmission path between nodes in the network, etc. This part of the features helps to identify key nodes, core nodes and vulnerable nodes in the network, analyze the data flow and dependency between nodes, etc., and help evaluate the security status of the overall network.

[0053] More specifically, the original node characteristics are extracted from the independent state and associated state analysis of each node to provide a basis for the overall security situation awareness of the network. According to the results of the first two steps of analysis, the original characteristics of each node are extracted. These characteristics include: node performance characteristics: such as the node's response time, bandwidth, load, etc., security characteristics: such as whether the node has vulnerabilities, whether it has been attacked, whether there is abnormal behavior, etc., behavioral characteristics: the behavior pattern of the node in the network, including access pattern, traffic pattern, connection pattern, etc., node characteristic recording: the original characteristics of all nodes are recorded to prepare for the subsequent overall summary and correction.

[0054] More specifically, the original characteristics of each terminal node are summarized and an overall characteristic map of the network level is formed to provide support for further analysis of the relationships between nodes and the overall security situation awareness. According to the original characteristics of each terminal node, the characteristics of the entire network are summarized to find out the common characteristics and differential characteristics of various types of nodes, such as: the differences in behavior of different node types (such as routers, switches, terminal devices, etc.), the common characteristics of the security situation, such as common security vulnerabilities and attack modes in the entire network, etc. Network characteristic map generation: Based on the summarized node characteristics, a network characteristic map of the target perception network is constructed. The map includes: information such as the security, performance, and behavior patterns of each node, and the associations between nodes, such as data flow paths and dependencies.

[0055] More specifically, according to the network characteristic map, the original node characteristics of each terminal node are corrected, and the distribution of node characteristics is improved through the network link relationship to form the final terminal node feature distribution. The original characteristics of each terminal node are adjusted and corrected based on the network characteristic map. For example, considering the correlation between nodes, the behavioral characteristics and security status of a node can be corrected according to the node's position in the network and its interaction with other nodes.

[0056] More specifically, based on the network topology, the association status between nodes (such as dependencies, communication paths, data exchange, etc.) is linked to the node characteristics to form a network-wide node characteristic distribution map, and finally a node characteristic distribution map of the target perception network is generated, showing the detailed characteristics of each terminal node and its role in the network. This distribution map can reveal the security status of each node in the network, potential threats, the relationship between nodes, and the impact on the overall network security situation.

[0057] It is understandable that through the comprehensive information collection of the network topology and terminal nodes of the target perception network, the basic attributes, behavior patterns, security status, etc. of each node can be accurately understood, providing rich original data support for subsequent security situation analysis. By analyzing the independent state and associated state of the node, it is possible to not only evaluate the security status of each node, but also deeply explore the interdependence between nodes, providing an important basis for the overall network security situation assessment. Through the overall induction of node characteristics, the generated network characteristic map can fully present the overall picture of the target perception network, allowing the security team to see the status of each node, the weak links in the network and potential security threats at a glance in the map.

[0058] More specifically, by correcting the node characteristics based on the network link relationship, the final terminal node feature distribution is closer to the actual network environment, which can provide more accurate security situation awareness and provide strong data support for subsequent security protection measures. By analyzing the node feature distribution, the security situation awareness system can more accurately predict potential security threats and formulate corresponding protection strategies and emergency response measures based on this information. The complete terminal node feature distribution can help security managers dynamically adjust protection strategies and quickly adapt and adjust protection strategies when facing changes in the network environment or new forms of attacks.

[0059] Preferably, the step of obtaining the perception object feature information of the security situation awareness AI large model, and performing a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network includes: S21: Acquire the training data of the security situation awareness AI big model, and perform information decomposition on the training data to obtain the perception object data and perception result data contained in the training data; S22: performing multi-dimensional analysis of data features of the perceived object data to obtain object data structural features, object data association features, and object data node representation features of the perceived object data, which are used together as the perceived object feature information of the security situation awareness AI big model; S23: performing node representation requirement analysis of each terminal node on the terminal node feature distribution according to the object data node representation feature in the perceived object feature information, so as to obtain a node representation requirement feature distribution corresponding to the terminal node feature distribution; S24: Analyzing the structural conformity and the correlation conformity between the terminal nodes of the node representation requirement feature distribution according to the object data structural features and the object data correlation features in the perception object feature information, so as to obtain the structural feature vector and the correlation feature vector between each terminal node in the target perception network; S25: Perform feature integration on the node expression requirement characteristics of each terminal node of the target perception network, the structural feature vectors between the other terminal nodes, and the associated feature vectors to obtain the data source feature vector of each terminal node. The data source feature vectors of each terminal node together constitute the data source feature association matrix of the target perception network.

[0060] Specifically, the training data of the security situation awareness AI big model is obtained, and the perception object data and perception result data are disassembled therein to provide basic data for subsequent feature analysis, and the training data set of the security situation awareness AI big model is obtained. The training data usually includes network behavior, device logs, attack events, normal behavior, etc. in the real world. The content in the training data is disassembled into two main parts: perception object data, which contains original data about devices, nodes, communications, behaviors, etc. in the network, such as device configuration, traffic patterns, access records, event logs, etc. Perception result data: the results predicted by the security situation awareness model, usually security situation assessment, attack identification, risk level, etc.

[0061] More specifically, a detailed multi-dimensional analysis is performed on the perception object data to extract key information for security situation awareness, form perception object features, analyze the basic structure of the perception object data, such as data format, type, timestamp, hierarchy, etc., for example: the hardware and software configuration of the device, the format and protocol of the data packet, the path and frequency of data transmission, object data association feature analysis, analysis of the association between perception object data, such as: communication relationship between nodes, dependency relationship, data flow pattern, transmission order, node interaction in the network (such as interaction mode between terminal devices, and between devices and servers), object data node representation feature analysis, parsing the representation information of each node in the data, such as: the identifier, role and function of each node, the upstream and downstream relationship of nodes in the network, and the position of the node in the network topology. Through the above steps, the perception object feature information obtained includes: structural features, association features and node representation features.

[0062] More specifically, based on the node expression requirements in the perceived object characteristics, a demand analysis is performed on the characteristics of each terminal node in the target network. Based on the node expression characteristics in the perceived object data, the feature information required for each terminal node in the network is analyzed. This feature information helps to identify the role of terminal nodes in security situation awareness, for example: which nodes have more critical behaviors in the network, and which nodes require more security monitoring and protection. Based on the node expression requirements, a demand feature distribution for each node is formed, covering the structural characteristics, behavioral characteristics, etc. that each terminal node needs to present.

[0063] More specifically, based on the structural and correlation characteristics of the perceived object data, the structural conformity and correlation conformity between the terminal node features are analyzed to generate a feature vector. By analyzing the relationship between nodes, network topology, behavior patterns, etc., the structural consistency between the terminal nodes is measured. For example, whether the node follows a certain structural pattern, such as network hierarchy, connection pattern, etc., and whether the geographical location of the node and other nodes in the network conforms to specific structural laws.

[0064] More specifically, by analyzing the behavioral relationships and dependencies between nodes, the correlation between terminal nodes is evaluated, for example: whether the traffic patterns between nodes are consistent, whether there is a data transmission chain, the dependencies between nodes, such as the failure of one node may affect the security of other nodes, and generating structural feature vectors and association feature vectors: Based on the above analysis, a structural feature vector and an association feature vector are generated for each terminal node. Each vector describes the node's position, structure, and degree of correlation with other nodes in the network.

[0065] More specifically, the node representation requirement characteristics, structural feature vectors and associated feature vectors of the terminal nodes are integrated to generate the data source feature vector of each terminal node, and summarized into a data source feature association matrix. The node representation requirement characteristics, structural feature vectors and associated feature vectors of each terminal node are integrated to generate a complete data source feature vector for the node. In the feature integration process, the weighted ratio between the features should be considered to ensure that the influence of each feature on the final result is reasonable, and the features should be standardized to avoid the uneven influence of certain features on the integration result due to different dimensions.

[0066] More specifically, each terminal node will eventually obtain a data source feature vector, which represents the structure, behavior, dependency and other characteristics of the node. The feature vectors of all terminal nodes are combined into a data source feature association matrix. Each row in the matrix represents the feature vector of a terminal node, and the rows reflect the association between nodes.

[0067] More specifically, the data source feature association matrix of the target perception network is finally generated to provide data support for subsequent security situation awareness, attack detection, risk assessment, etc. The generated data source feature association matrix is ​​verified to check the rationality and validity of the data in the matrix. The verification process includes: ensuring that the integration method of the data source feature vector is accurate, ensuring that the correlation between nodes reflects the actual network behavior, and using the finally generated data source feature association matrix in the security situation awareness model as input data for subsequent security analysis, risk prediction, attack identification and other tasks.

[0068] It is understandable that through multi-dimensional analysis of the perceived object data, various characteristic information of the terminal nodes in the target network can be fully extracted. This characteristic information includes the structural characteristics of the nodes, behavior patterns, and the correlation between nodes, etc., which helps to fully understand the security situation of the network. Through the analysis of node expression requirements, the role and characteristic requirements of each terminal node in security situation awareness can be accurately identified. This analysis helps to achieve targeted data collection and the formulation of security protection strategies. The analysis of structural conformity and correlation conformity between nodes can reveal the dependencies, weaknesses and potential security risks between nodes in the network, which helps to conduct a more detailed analysis and evaluation of the security of the entire network.

[0069] More specifically, through feature integration and data source feature vector generation, a comprehensive feature representation can be generated for each terminal node. The final data source feature association matrix can accurately reflect the relationships and characteristics between each node in the network, which is helpful for subsequent security situation awareness and risk assessment. The data source feature association matrix provides rich and accurate data support for the security situation awareness model, helping the model to more accurately identify abnormal behaviors, attack patterns and potential risks in the network, thereby improving the security protection capabilities of the entire network.

[0070] Preferably, the step of reconstructing the multi-level network distribution of the terminal node feature distribution of the target perception network according to the data source feature association matrix of the target perception network to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model includes: S31: configuring clustering weights for the node expression requirement characteristics, the structural feature vectors, and the association feature vectors according to a preset standard, and performing clustering analysis on the data source feature vectors of the data source feature association matrix according to the configured clustering weights to obtain a data source feature clustering set of the data source feature association matrix; S32: configuring and adjusting the clustering weights of the node expression requirement feature, the structural feature vector, and the association feature vector, and performing cluster analysis of the data source feature vectors on the data source feature association matrix according to the adjusted clustering weights to obtain a data source feature clustering set of the data source feature association matrix; S33: reconstructing the node link relationship of the terminal nodes for the terminal node feature distribution according to the various data source feature clustering sets to obtain multiple terminal node perception structures, and performing data collection and feature aggregation of each terminal node on the target perception network based on each of the terminal node perception structures to obtain experimental perception information corresponding to each terminal node perception structure; S34: Perform perception experiments and value evaluation on the experimental perception information corresponding to each of the terminal node perception structures according to the security situation awareness AI big model, and perform selection operations on each of the terminal node perception structures according to the results of the value evaluation to select several of the terminal node perception structures as network perception levels. The various network perception levels together constitute a multi-level perception framework of the security situation awareness AI big model.

[0071] Specifically, the clustering weights of the node expression requirement characteristics, structural feature vectors and associated feature vectors are configured according to the preset standards, and the feature vectors in the data source feature association matrix are classified through cluster analysis to provide a basis for the subsequent network distribution reconstruction. The clustering weights of each feature dimension are set according to the requirements and model characteristics of the target security situation awareness. For example, structural features and associated features may be more important for network topology analysis and attack detection, so they are given higher weights. The configured clustering weights will affect the importance of each feature in the clustering analysis, and thus affect the clustering effect of the data source feature vectors. Standard clustering algorithms (such as K-means, spectral clustering, etc.) are used to perform cluster analysis on the feature vectors in the data source feature association matrix. According to the configured clustering weights, the algorithm will group them according to the similarity of each feature vector to form a data source feature clustering set.

[0072] More specifically, the configured clustering weights are adjusted and the clustering analysis is re-executed to obtain different feature clustering results under different clustering weight settings, providing more perspectives for the reconstruction of multi-level network distribution. According to the results of the initial clustering analysis, the clustering weights of different feature dimensions are adjusted. After the adjustment, the weights of some features may be increased and the weights of other features may be reduced to explore the clustering effects under different configurations. Using the adjusted clustering weights, a second clustering analysis is performed on the data source feature association matrix. Compared with the first clustering, this step of adjustment can reveal different node association patterns or feature distributions.

[0073] More specifically, the link relationship of the terminal nodes is reconstructed according to the clustering set of various data source features to provide a multi-level network distribution for the subsequent multi-level perception framework design. By analyzing the first and second clustering results, multiple perception structures at different levels are constructed to represent the perception targets of different features at different levels. Through the analysis of the clustering set, the connection method of each terminal node in the multi-level perception network is determined. The link relationship between these nodes represents their roles and interaction methods in the multi-level perception framework, and the corresponding node link relationship will constitute different terminal node perception structures.

[0074] More specifically, based on the constructed terminal node perception structure, data collection and feature aggregation are performed on the target perception network to form experimental perception information. According to the constructed node perception structure, the monitoring range and data collection strategy of each terminal node are specified. Each terminal node collects corresponding data according to its perception structure, such as traffic data, event logs, security status information, etc. The collected data is processed, valuable feature information is extracted, and the aggregated data will provide data support for subsequent security situation awareness and risk assessment.

[0075] More specifically, the security situation awareness AI big model is used to conduct perception experiments on the experimental perception information of different terminal node perception structures, and to conduct value assessments to evaluate the effects and values ​​of different structures. Based on the experimental perception information, the security situation awareness AI big model is used to conduct experiments on different terminal node perception structures. The experiments will simulate various security events, attack modes, etc. in the network environment, detect the response capabilities of each perception structure to security events, and use the security situation awareness AI big model to evaluate the effects of each perception structure. The evaluation indicators include accuracy, timeliness, coverage, sensitivity, etc. Through these evaluations, the perception structure with the best performance can be identified.

[0076] More specifically, the best terminal node perception structure is selected according to the value assessment results, and it is composed of a multi-level perception framework of the security situation awareness AI model. According to the value assessment results, several terminal node perception structures with the best performance are selected. These structures represent the key nodes and behavior patterns in network perception, which are of great significance in security situation awareness. The selected terminal node perception structures will form different levels of the multi-level perception framework. Each level reflects different network perception tasks and security detection goals. These levels work together to form a complete security situation awareness model.

[0077] It can be understood that cluster analysis helps to discover the optimal terminal node distribution structure through the distribution patterns of data source characteristics and network topological relationships. Through two rounds of clustering weight configuration and analysis, the network structure can be optimized to meet the multi-level data perception needs of the security situation awareness model. By clustering data source characteristics and reconstructing node link relationships, key nodes can be accurately located, revealing the roles and functions of different nodes in the multi-level perception framework. This refined node structure design makes network security monitoring and attack detection more efficient. Based on the precise perception structure, data collection is more targeted, reducing the collection of irrelevant data, thereby improving data processing efficiency. The summarized feature information is more representative and accurate, which enhances the perception ability of the model. The constructed multi-level perception framework can flexibly adapt to different types of security threats and network changes. Each level can independently handle different types of security issues. The collaboration between layers enhances the responsiveness and defense depth of the overall system.

[0078] More specifically, through perception experiments and value assessments, the effectiveness of each perception structure can be verified in real time, and then the entire perception framework can be optimized, and ultimately the optimal node structure can be selected, which will make the security situation awareness AI large model more accurate and efficient in practical applications. Through the implementation of a multi-level perception framework, the network's perception depth and response capabilities are enhanced, and it can respond quickly to attacks at different levels. This hierarchical perception framework improves the overall network security defense capabilities and reduces security risks.

[0079] Preferably, the step of redeploying the model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain the security situation awareness AI big model adapted to the target perception network includes: S41: Adaptively deploy the model perception parameters of the model input port of the security situation awareness AI big model according to each network perception level of the multi-level perception framework, so that the model input end of the security situation awareness AI big model has level ports corresponding to each network perception level of the multi-level perception framework, so that the model perception capability of the security situation awareness AI big model is suitable for the multi-level perception framework.

[0080] Specifically, understand the functions and feature requirements of each network perception layer in the multi-level perception framework in order to adapt these requirements to the input ports of the security situation awareness AI model, conduct a detailed analysis of the multi-level perception framework, identify the input requirements, data characteristics and perception tasks of each layer. For example, one layer may focus on traffic data perception, while another layer may focus on network topology changes or attack pattern detection. Extract the perception requirements and input features of each layer, understand its requirements for the perception capabilities of the AI ​​model, and ensure that the data at each layer can be effectively input into the AI ​​model for processing.

[0081] More specifically, according to the characteristics of each network perception level, the perception parameters of the input port of the AI ​​large model are reconfigured to ensure that data at different levels are compatible with the model and can be effectively processed. According to the data characteristics and requirements of each perception level, the perception parameters of the input port are adjusted. For example, for the network traffic perception level, it may be necessary to perform feature selection and preprocessing on the traffic data to adapt to the input requirements of the model, and to standardize or normalize the input data of each level to ensure that data at different levels have consistent formats and scales, thereby ensuring that the input port of the model can effectively process data from multiple sources.

[0082] More specifically, in the input port setting of the AI ​​large model, ensure that an independent port is configured for each layer. Each port corresponds to the data input of a different perception layer. This can avoid interference between data at different layers, maintain the independence of data processing, and adapt the frequency, granularity, and timeliness of the input data according to the perception tasks of each layer. For example, some perception layers may require real-time data stream input, while other layers can use historical data.

[0083] More specifically, ensure that each perception level of the multi-level perception framework matches the perception capability of the AI ​​big model to achieve seamless connection and processing of information. Connect the ports of each level of the security situation awareness AI big model with the network perception levels of the multi-level perception framework to ensure that the data of each level can enter the AI ​​model through the correct input port and be processed by the corresponding module. Based on the input characteristics of different levels, tune the parameters of the model input port. Adjustments include but are not limited to the preprocessing method of the input data, feature extraction method, data weight distribution, etc., to ensure that the data at each level can maximize its perception capability. By adjusting the perception parameters of the input port, the adaptability of the AI ​​big model to each perception level is improved, thereby enhancing the overall perception capability of the model and ensuring that the AI ​​model can accurately and comprehensively identify and analyze multi-level and multi-type security incidents.

[0084] More specifically, verify whether the redeployed perception parameters can effectively improve the perception ability of the model, ensure that the model can process data at different levels efficiently and accurately, and verify whether the data input at each perception level can smoothly enter the AI ​​model and be effectively processed by setting different experimental scenarios. The experiment includes simulating network attacks, normal traffic, abnormal events and other scenarios, evaluating the perception results, and checking the perception ability performance of the model at each level. The evaluation criteria may include accuracy, recall rate, response time, etc. Further adjust and optimize the perception parameters according to the verification results to ensure that the perception parameters of the model input port are fully matched with the multi-level perception framework and can effectively support the perception ability of the model.

[0085] More specifically, the adjusted and verified model perception parameters are deployed to the actual security situation awareness system to ensure that the model can exert the expected perception capabilities in the actual environment. The optimized AI large model is deployed together with the multi-level perception framework to the actual security situation awareness system to ensure that the data at each level can be accurately input and processed by the AI ​​model. The deployed system is monitored in real time to ensure that the model can continue to maintain a high level of perception capabilities in actual operation. If there is a decline in perception capabilities or adaptability problems, timely adjustments are made.

[0086] It is understandable that by redeploying the model perception parameters, the AI ​​large model can better adapt to the specific requirements of each level in the multi-level perception framework, thereby improving the perception system's ability to process data at different levels. By configuring an independent input port for each perception level and adapting its perception parameters, data at each level can be input into the model more efficiently and accurately. This can reduce errors caused by inconsistent input data formats and improve the accuracy of the model. By precisely adjusting the perception parameters of the input port, the AI ​​large model can process data from different levels and perform effective analysis based on the characteristics of each level, which enables the model to provide more accurate perception and response to security issues at different levels.

[0087] More specifically, through adaptive deployment, it is ensured that the model can efficiently process the input of the multi-level perception framework, thereby improving the response speed, accuracy and sensitivity of the entire security situation awareness system, which helps to promptly discover and respond to potential security risks when facing complex network security threats. By accurately adjusting and verifying the perception parameters of the input port, the system can avoid errors or instabilities caused by not adapting to data at different perception levels, thereby enhancing the stability and reliability of the entire security situation awareness AI model. Through detailed configuration and verification in the early stage, the need for adjustment of the model in actual application can be reduced. In this way, the security situation awareness system can be put into use earlier and maintain efficient operation for a long time.

[0088] Preferably, the step of collecting data and summarizing features of each terminal node of the target perception network based on the multi-level perception framework to obtain network perception information of the target perception network includes: S51: Real-time data collection is performed on each terminal node of the target perception network to obtain node perception data of each terminal node, and node perception data of each terminal node is sequentially combined with each other based on each level perception network of the multi-level perception framework to obtain node perception data combination distribution corresponding to each level perception network; S52: According to the node identification requirement characteristics, the structural characteristic vectors, and the clustering weight configurations of the associated characteristic vectors in the data source characteristic vectors of each of the hierarchical perception networks, a formal analysis and extraction process of the data key characteristics are performed on the distribution of each of the node perception data combinations to obtain the data key characteristics of the node perception data of each terminal node in each of the node perception data combinations; S53: Combine key data features of the node perception data of each terminal node in the node perception data combination to obtain combined perception information of the node perception data combination, and the combined perception information of each node perception data combination together constitutes the network perception information of the target perception network.

[0089] Specifically, real-time data of each terminal node in the target perception network is obtained for subsequent perception data processing and feature extraction. A data acquisition module is deployed on each terminal node of the target perception network to collect perception data of each node in real time. The data includes but is not limited to network traffic, node status, network topology information, attack logs, etc. The collected data is formatted into standardized data packets or data streams to ensure that the data of each terminal node can be uniformly input into the subsequent processing module for easy aggregation and analysis.

[0090] More specifically, according to the design of the multi-level perception framework, the perception data of each terminal node is orderly combined according to the perception networks of different levels to form the data combination required by the hierarchical perception network. The perception data from different terminal nodes are classified into different perception levels according to the design requirements of the multi-level perception framework. Each level corresponds to different types of perception tasks (such as traffic analysis, attack detection, node status monitoring, etc.). In each perception level, the data from the terminal nodes are orderly combined. This combination method takes into account the data characteristics of different levels to ensure that the final combined data can reflect the multi-level network perception information and ensure that the data combination of each level can be correctly mapped to the corresponding perception layer to avoid cross-contamination between data, so that the data of each level can focus on specific security perception goals.

[0091] More specifically, key features are extracted and analyzed for data combinations at each level to identify key information that can reflect the network security situation. Based on the hierarchical structure of the perception framework, the node identification requirement features, structural feature vectors, and associated feature vectors in each node perception data combination are analyzed. These feature vectors play an important role in reflecting node status, traffic patterns, attack behaviors, etc. Cluster analysis is performed on different types of feature vectors, and the feature vectors are weighted using clustering weight configuration. This helps to distinguish the most valuable features at different levels in multi-dimensional features and reduce the interference of redundant features. According to the characteristics of data sources at different levels, key features closely related to the network security situation are extracted. For example, the attack detection level may focus on extracting attack behavior features, and the traffic monitoring level may focus on traffic fluctuation features.

[0092] More specifically, the key features in the perception data of each terminal node are integrated to form a final node perception data combination. The key features in the node perception data of each level are combined in order to ensure that the data combination in each level contains not only the perception data of the node itself, but also the correlation features between it and other nodes. The extracted key features are combined together to form hierarchical perception information. For example, for the attack detection level, the combined perception information that may be generated includes information such as attack type, attack source, and attack target.

[0093] More specifically, the perception information of each level is summarized to form the final network perception information of the entire target perception network, and the perception information generated at each level is aggregated to form an overall view of network perception. These perception information include node perception data from different levels, network topology information, attack event analysis, etc. The merged network perception information is output for subsequent security analysis, decision support or response mechanism.

[0094] It is understandable that by combining and analyzing the data of each terminal node of the target perception network by level, the multi-level and comprehensive perception capability of the perception framework can be effectively improved. The combination and analysis of data at different levels ensures the system's comprehensive understanding of the network security situation. By collecting the data of the terminal nodes in real time and classifying them into different levels, the data at each level can better reflect its specific perception target and reduce redundancy and noise. This hierarchical processing helps to improve the accuracy and efficiency of data analysis.

[0095] More specifically, through cluster analysis and feature extraction, we can ensure that the most valuable features are extracted from massive network data. The effective identification and weighting of features will help improve the early detection and warning capabilities of security threats. The generated network perception information not only covers information at all levels from nodes to networks, but also includes a comprehensive assessment of network behavior, attack patterns and potential risks. This can provide more comprehensive decision-making support for security operation and maintenance personnel and help them respond to various security threats in a timely manner. Real-time data collection and feature analysis ensure the timeliness of network perception information, which enables the system to quickly identify abnormal behavior or potential attacks in the network and enhance the system's real-time response capabilities to security threats.

[0096] More specifically, the design of the multi-level perception framework enables the system to conduct comprehensive monitoring at different levels, thereby improving the ability to identify and protect against complex network threats. At the same time, the aggregated network perception information can help security analysts locate and defend against potential risks more quickly. Since each level can independently analyze and process different types of data, the system can more flexibly adapt to new network architectures, equipment or security requirements. Perception information at different levels can also be flexibly combined and adjusted, thereby ensuring the system's continued adaptability and scalability.

[0097] Preferably, the step of substituting the network perception information into a security situation awareness AI big model adapted to the target perception network, and allowing the security situation awareness AI big model to perform security situation awareness on the target perception network to obtain security prediction features includes: S61: Receive and parse the network perception information through the hierarchical ports of each network perception level of the multi-level perception framework corresponding to the security situation awareness AI big model, so that each combined perception information in the network perception information is transmitted to each hierarchical port respectively, so as to be substituted into the security situation awareness AI big model through each hierarchical port; S62: the security situation awareness AI big model performs corresponding forms of security situation awareness processing on the combined perception information substituted into each of the hierarchical ports, so as to obtain security perception results corresponding to each of the combined perception information; S63: Perform weighted combination analysis on each of the safety perception results to obtain the safety prediction feature.

[0098] Specifically, the network perception information obtained from each terminal node is passed to the security situation awareness AI big model for security situation analysis and prediction. The security situation awareness AI big model receives the sorted network perception information through the various level ports of the multi-level perception framework. This information has been previously combined, feature extracted and processed. The perception data of each level contains network information at different levels, such as node status, traffic patterns, attack events, etc. The AI ​​big model parses these network perception information according to the definition of each level port, and transmits them to the corresponding level ports respectively. Each port will receive the combined perception information of the corresponding level and prepare for subsequent security situation analysis. This step ensures that the data is clearly divided according to the hierarchical structure when entering the AI ​​big model, which is convenient for processing and analysis.

[0099] More specifically, based on the perception data at each level, the security situation of the network is processed to obtain the security perception results of each combination of perception information. After receiving the network perception information, the ports at each level will substitute it into the AI ​​big model for analysis. The combined perception information processed by each port is related to its specific perception target. For example, the perception information at the attack detection level may be used to identify potential network attack behaviors, and the perception information at the traffic monitoring level is used to identify traffic anomalies. For each combined perception information input by the port, the security situation perception AI big model performs security situation analysis through deep learning, reinforcement learning or other intelligent algorithms. The model will identify potential threat patterns, abnormal behaviors, signs of attacks, etc., and output the security perception results corresponding to each combination of perception information. During the processing, the AI ​​big model will predict and analyze the perception information based on the learned historical data and security knowledge. For the input data at each level, the AI ​​model will output a set of security perception results, which may include attack risk scores, potential threat types, and traffic anomaly levels.

[0100] More specifically, the security perception results of each level are weighted and combined to obtain a comprehensive security prediction feature that reflects the security situation of the entire target perception network. The security situation perception AI model will weight the security perception results of each level according to their importance and credibility. For example, the security perception results of some levels (such as the attack detection level) may have a greater impact on the overall security situation, so they will be given a higher weight, while some levels (such as the traffic monitoring level) may have a smaller predictive effect on the security situation, and their results have a lower weight. The weighted security perception results will be combined for further analysis. This process can use weighted summation, weighted average, maximum value or other suitable algorithms to combine multiple security perception results into a unified security prediction feature. The result of the combined analysis is the final security prediction feature, which reflects the current security situation of the entire network. These features may include the network's risk level, possible attack types, potential vulnerabilities or abnormal behaviors, etc.

[0101] More specifically, the final security prediction features are generated and output for security decision-making, response mechanisms or early warning systems. The security situation awareness AI model outputs the security prediction features after comprehensive analysis. These features can be used as a basis for subsequent decision support to help security personnel take timely response measures (such as traffic filtering, node isolation, strengthening firewalls, etc.). Based on the output security prediction features, the system can trigger the corresponding automatic response mechanism or feedback to security operation and maintenance personnel for further decision-making and processing.

[0102] It is understandable that by introducing a multi-level perception framework, the security situation awareness AI big model can fully receive and process perception information from different levels, so as to effectively capture the network security situation from different angles. This multi-dimensional information processing method can improve the accuracy of the system's security situation awareness and help discover potential security risks and attacks. The security situation awareness AI big model is based on real-time collected network perception information for analysis, enabling the system to respond quickly to new threat situations. At the same time, the model can adapt to new attack modes and network environments through continuous updating and training, and improve its prediction capabilities. The generated security prediction features provide security personnel with a comprehensive network security status assessment, helping them make more targeted and forward-looking decisions, which not only improves the targeted nature of network protection, but also reduces security risks caused by information asymmetry or slow response.

[0103] More specifically, the security perception results at different levels are weighted to obtain unified security prediction features, allowing the model to comprehensively consider various types of data (such as traffic, node status, attack behavior, etc.), thereby comprehensively evaluating the security situation of the network. This fusion analysis method avoids the limitations of single-dimensional analysis and enhances the judgment of the system. The weighted combination analysis of security perception results allows the AI ​​large model to adjust the weights of each level according to real-time conditions, making the response to key security events faster. For example, when a network attack occurs, the results of the attack detection level may be given a higher weight, allowing the model to focus more on identifying and handling attack behaviors.

[0104] More specifically, through multi-level security perception and comprehensive prediction, the AI ​​big model can trace and predict security threats more accurately, providing strong support for responding to complex multi-source attacks. The model can not only identify the current security situation, but also predict potential risks and deploy protective measures in advance. As the network environment and attack patterns continue to evolve, the AI ​​big model has self-learning capabilities and can improve its ability to identify and predict new threats through continuous training and optimization. This feature enables the system to continuously adapt to complex network security challenges.

[0105] Reference Figure 2 As shown, in a second aspect, the present invention provides a multi-source data fusion prediction device for a security situation awareness AI large model, which is used to implement a multi-source data fusion prediction method for a security situation awareness AI large model as described in any one of the first aspects, including: An information collection module is used to collect information and analyze characteristics of terminal nodes of a target perception network prepared for detection by a security situation awareness AI large model, so as to obtain characteristic distribution of terminal nodes of the target perception network; An association analysis module is used to obtain the perception object feature information of the security situation awareness AI large model, and perform a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network; A framework construction module, used to reconstruct the multi-level network distribution of the terminal node feature distribution of the target perception network according to the data source feature association matrix of the target perception network, so as to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model; A model adjustment module, used to redeploy model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain a security situation awareness AI big model adapted to the target perception network; A network perception module, used for collecting data and summarizing features of each terminal node of the target perception network based on the multi-level perception framework to obtain network perception information of the target perception network; The security prediction module is used to substitute the network perception information into the security situation perception AI big model adapted to the target perception network, so that the security situation perception AI big model performs security situation perception on the target perception network to obtain security prediction features.

[0106] In this embodiment, for the specific implementation of each module in the above-mentioned device embodiment, please refer to the above-mentioned method embodiment, which will not be described in detail here.

[0107] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. A multi-source data fusion prediction method for a large AI model of security situation awareness, characterized in that: include: Perform information collection and characteristic analysis on the terminal nodes of the target perception network prepared for detection by the security situation awareness AI large model to obtain the characteristic distribution of the terminal nodes of the target perception network; Acquire the perception object feature information of the security situation awareness AI large model, and perform a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network; According to the data source feature association matrix of the target perception network, a multi-level network distribution reconstruction is performed on the terminal node feature distribution of the target perception network to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model; Redeploying model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain a security situation awareness AI big model adapted to the target perception network; Based on the multi-level perception framework, data collection and feature aggregation of each terminal node of the target perception network are performed to obtain network perception information of the target perception network; The network perception information is substituted into a security situation awareness AI big model adapted to the target perception network, and the security situation awareness AI big model is enabled to perform security situation awareness on the target perception network to obtain security prediction features.

2. The multi-source data fusion prediction method of the security situation awareness AI large model as claimed in claim 1 is characterized in that: The steps of collecting information and analyzing characteristics of terminal nodes of a target perception network prepared for detection by a security situation awareness AI large model to obtain characteristic distribution of terminal nodes of the target perception network include: Mark the object network where the security situation awareness AI large model is to be deployed as a target perception network, and collect network topology information of the target perception network to obtain network topology information of the target perception network; Based on the network topology information of the target perception network, information of each terminal node of the target perception network is collected to obtain node information of each terminal node of the target perception network; Performing node characteristic analysis of node independent state and node association state on the node information of each terminal node of the target sensing network to obtain original node characteristics of each terminal node; The original node characteristics of each of the terminal nodes are summarized as a whole to obtain a network characteristic map of the target perception network, and based on the network characteristic map, the original node characteristics of each of the terminal nodes are subjected to overall correction of node characteristics and network links of node characteristics to obtain the terminal node characteristic distribution of the target perception network.

3. The multi-source data fusion prediction method of the security situation awareness AI large model as claimed in claim 1 is characterized in that: The steps of obtaining the perception object feature information of the security situation awareness AI large model, and performing a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network include: Acquire the training data of the security situation awareness AI big model, and perform information decomposition on the training data to obtain the perception object data and perception result data contained in the training data; Perform multi-dimensional analysis of data features of the perceived object data to obtain object data structural features, object data association features, and object data node representation features of the perceived object data, which are used together as the perceived object feature information of the security situation awareness AI big model; According to the object data node representation feature in the perceived object feature information, the terminal node feature distribution is subjected to node representation requirement analysis of each terminal node to obtain a node representation requirement feature distribution corresponding to the terminal node feature distribution; According to the object data structural features and object data association features in the perception object feature information, the node representation requirement feature distribution is analyzed for structural conformity and association conformity between terminal nodes to obtain structural feature vectors and association feature vectors between each terminal node in the target perception network; The node expression requirement characteristics of each terminal node of the target perception network, the structural feature vectors between the other terminal nodes, and the associated feature vectors are integrated to obtain the data source feature vector of each terminal node. The data source feature vectors of each terminal node together constitute the data source feature association matrix of the target perception network.

4. The multi-source data fusion prediction method of the security situation awareness AI large model as described in claim 3 is characterized in that: The steps of reconstructing the terminal node feature distribution of the target perception network at multiple levels according to the data source feature association matrix of the target perception network to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model include: According to a preset standard, clustering weights are configured for the node expression requirement characteristics, the structural feature vectors, and the association feature vectors, and cluster analysis of the data source feature vectors is performed on the data source feature association matrix according to the configured clustering weights to obtain a data source feature clustering set of the data source feature association matrix; The clustering weights of the node expression requirement characteristics, the structural feature vectors, and the association feature vectors are configured and adjusted, and cluster analysis of the data source feature vectors of the data source feature association matrix is ​​performed according to the adjusted clustering weights to obtain a data source feature clustering set of the data source feature association matrix; Reconstructing the node link relationship of the terminal nodes according to the terminal node feature distribution based on the various data source feature clustering sets to obtain multiple terminal node perception structures, and collecting data and summarizing features of each terminal node in the target perception network based on each of the terminal node perception structures to obtain experimental perception information corresponding to each terminal node perception structure; According to the security situation awareness AI big model, perception experiments and value evaluations are performed on the experimental perception information corresponding to each of the terminal node perception structures, and a selection operation is performed on each of the terminal node perception structures according to the results of the value evaluation to select several of the terminal node perception structures as network perception levels. The various network perception levels together constitute a multi-level perception framework of the security situation awareness AI big model.

5. The multi-source data fusion prediction method of the security situation awareness AI large model as described in claim 4 is characterized in that: The steps of redeploying the model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain the security situation awareness AI big model adapted to the target perception network include: According to each network perception level of the multi-level perception framework, the model perception parameters of the model input port of the security situation awareness AI big model are adaptively deployed, so that the model input end of the security situation awareness AI big model has level ports corresponding to each network perception level of the multi-level perception framework, so that the model perception capability of the security situation awareness AI big model is suitable for the multi-level perception framework.

6. The multi-source data fusion prediction method of the security situation awareness AI large model as described in claim 4 is characterized in that: The step of collecting data and summarizing features of each terminal node of the target perception network based on the multi-level perception framework to obtain network perception information of the target perception network includes: Real-time data collection is performed on each terminal node of the target perception network to obtain node perception data of each terminal node, and node perception data of each terminal node is sequentially combined with each other based on each level perception network of the multi-level perception framework to obtain node perception data combination distribution corresponding to each level perception network; According to the clustering weight configuration of the node identification requirement characteristics, the structural characteristic vector and the associated characteristic vector in the data source characteristic vector of each of the hierarchical perception networks, the data key characteristics of each of the node perception data combinations are formally analyzed and extracted to obtain the data key characteristics of the node perception data of each terminal node in each of the node perception data combinations; The key data features of the node perception data of each terminal node in the node perception data combination are combined to obtain the combined perception information of the node perception data combination, and the combined perception information of each of the node perception data combinations together constitute the network perception information of the target perception network.

7. The multi-source data fusion prediction method of the security situation awareness AI large model as claimed in claim 6 is characterized in that: Substituting the network perception information into a security situation awareness AI big model adapted to the target perception network, and allowing the security situation awareness AI big model to perform security situation awareness on the target perception network to obtain security prediction features includes: The network perception information is received and parsed through the hierarchical ports of each network perception level of the multi-level perception framework corresponding to the security situation awareness AI big model, so that each combined perception information in the network perception information is transmitted to each hierarchical port respectively, so as to be substituted into the security situation awareness AI big model through each hierarchical port; The security situation awareness AI big model performs corresponding forms of security situation awareness processing on the combined perception information substituted into each of the hierarchical ports to obtain security perception results corresponding to each of the combined perception information; A weighted combination analysis is performed on each of the safety perception results to obtain the safety prediction feature.

8. A multi-source data fusion prediction device for a large AI model of security situation awareness, characterized in that: A multi-source data fusion prediction method for implementing a security situation awareness AI large model as described in any one of claims 1 to 7, comprising: An information collection module is used to collect information and analyze characteristics of terminal nodes of a target perception network prepared for detection by a security situation awareness AI large model, so as to obtain characteristic distribution of terminal nodes of the target perception network; An association analysis module is used to obtain the perception object feature information of the security situation awareness AI large model, and perform a data source feature correlation analysis of the target perception network on the terminal node feature distribution according to the perception object feature information to obtain a data source feature correlation matrix of the target perception network; A framework construction module, used to reconstruct the multi-level network distribution of the terminal node feature distribution of the target perception network according to the data source feature association matrix of the target perception network, so as to obtain a multi-level perception framework of the target perception network suitable for the security situation awareness AI large model; A model adjustment module, used to redeploy model perception parameters of the security situation awareness AI big model according to the multi-level perception framework to obtain a security situation awareness AI big model adapted to the target perception network; A network perception module, used for collecting data and summarizing features of each terminal node of the target perception network based on the multi-level perception framework to obtain network perception information of the target perception network; The security prediction module is used to substitute the network perception information into the security situation perception AI big model adapted to the target perception network, so that the security situation perception AI big model performs security situation perception on the target perception network to obtain security prediction features.

Images