Network security dynamic early warning method, device and electronic equipment

Abstract

The present invention proposes a dynamic network security early warning method, device, and electronic device, including: constructing a network knowledge graph; defining a query target, including identifying potential attacks and finding potential attack paths; using a fruit fly optimization algorithm to map threat characteristics into a three-dimensional odor concentration field, and optimizing the graph query algorithm, wherein the three-dimensional odor concentration field includes threat type, urgency, and propagation speed; based on the query target, searching the network knowledge graph using the optimized graph query algorithm to find potential attacks and attack paths, and triggering early warnings in a timely manner. The present invention uses a fruit fly optimization algorithm to map threat characteristics into a three-dimensional odor concentration field and optimizes the graph query algorithm, so that the optimized graph query algorithm can fully consider the node concentration field, prioritize and locate nodes with higher threat levels in the network knowledge graph search, greatly improving search efficiency and more accurately and efficiently finding potential attacks and attack paths in the network knowledge graph.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security dynamic early warning method, device and electronic equipment. Background Art

[0002] With the rapid development of the Internet, network security issues have become increasingly prominent. In order to effectively respond to these network security challenges, the industry has been continuously researching various network security protection and early warning technologies.

[0003] Traditional network security early warning technologies often have the following defects, making it difficult to meet the current complex and ever-changing network security needs: they are usually based on static rules and characteristics for defense, which makes it difficult to adapt to the dynamic changes in the network environment and the continuous evolution of attack methods; there are often information islands between different security devices, which makes it impossible to effectively share and integrate threat intelligence, resulting in low early warning efficiency; when faced with large-scale and complex network attacks, the response speed is often slow and effective defense measures cannot be taken in time. Summary of the Invention

[0004] Based on this, the purpose of the present invention is to propose a network security dynamic early warning method, device and electronic equipment to solve the above-mentioned problems.

[0005] The network security dynamic early warning method proposed in the present invention includes:

[0006] Store entities and entity relationships in network data in the form of a graph structure to form a network knowledge graph;

[0007] According to the requirements of network security early warning, the query objectives are defined, including identifying potential attacks and finding potential attack paths;

[0008] Using the fruit fly optimization algorithm, the threat signature is mapped into a three-dimensional odor concentration field, which is then used to optimize the graph query algorithm. The three-dimensional odor concentration field includes the type, urgency, and propagation speed of network security threats.

[0009] Based on the query target, the optimized graph query algorithm is used to search in the network knowledge graph to find potential attacks and attack paths, and trigger early warnings in a timely manner.

[0010] Furthermore, the threat signature is mapped into a three-dimensional odor concentration field through the fruit fly optimization algorithm, and the graph query algorithm is optimized, including:

[0011] Randomly selecting N starting nodes in the network knowledge graph as the initial positions of the fruit fly population, so that each fruit fly individual carries a three-dimensional position vector including a node ID, a relationship type, and a confidence level;

[0012] The fitness function is defined based on the type, urgency, and propagation speed of network security threats to quantify the odor concentration of the computing node. The higher the concentration value, the more critical the corresponding node is on the attack path. The formula is:

[0013]

[0014] Among them, ω1, ω2, ω3 are weight coefficients, ω1+ω2+ω3=1, is the quantitative value of the threat type of node i, is the quantitative value of the threat urgency of node i, is the quantitative value of the threat propagation speed of node i;

[0015] For each fruit fly's current position node, its odor concentration value is calculated according to the fitness function, and the position of the fruit fly is updated according to the concentration gradient, so that it moves towards the high-concentration node;

[0016] Repeat the odor concentration calculation and position update until the termination condition is met, and determine the final position distribution of the fruit fly population and the optimized node concentration field, which includes the odor concentration value of each node as the initial threat quantification value.

[0017] Furthermore, based on the query target, searching the network knowledge graph using an optimized graph query algorithm to find potential attacks and attack paths includes:

[0018] According to the final position distribution of the fruit fly population, high-concentration nodes are extracted as candidate key nodes, and the candidate set of attack paths is constructed by sorting them by concentration values;

[0019] Deploy multiple search agents to initiate traversal queries on high-concentration nodes in the attack path candidate set to find potential attacks and attack paths;

[0020] Activate the attack pattern memory library and compress and store the discovered new attack patterns using sparse autoencoding features;

[0021] Regularly synchronize external threat intelligence libraries and update the node threat quantification values ​​and relationship weights in the network knowledge graph.

[0022] Furthermore, the deployment of multiple search agents includes:

[0023] For the high-concentration nodes in the attack path candidate set, the traversal priority is calculated by combining the node odor concentration value, the number of neighboring nodes, and the average odor concentration of neighboring nodes. The formula is:

[0024] ,

[0025] Among them, S iis the odor concentration value of node i, that is, the initial threat quantization value of node i, N i is the number of neighbor nodes, is the average concentration of neighbor nodes, α+β+γ=1;

[0026] Each high-density node is assigned to a plurality of search agents according to the traversal priority, wherein each search agent is responsible for a subgraph area.

[0027] Furthermore, the initiation of a traversal query on high-concentration nodes in the attack path candidate set to search for potential attacks and attack paths includes:

[0028] For each sub-region that the search agent is responsible for, preload the initial concentration field data and adjacency matrix of the sub-region it is responsible for;

[0029] Starting from the node with the highest concentration value in the sub-area, visit the neighboring nodes in descending order of the current threat quantization value;

[0030] Determine whether the traversal path deviates from the normal pattern, including frequent visits to low-concentration nodes, too single threat type on the path, and drastic fluctuations in threat values;

[0031] If the traversal path deviates from the normal pattern, the current path feature vector is extracted and similarity is calculated with the known attack patterns stored in the attack pattern memory. The path feature vector includes the statistical distribution of the threat quantization value of the path node, the threat type sequence, and the path entropy.

[0032] If the similarity exceeds the similarity threshold, it is marked as a potential attack and an alarm is triggered. The alarm content includes the path node list and threat type;

[0033] When the traversal covers all high-concentration nodes and their direct neighbors in the attack path candidate set, the traversal is terminated, and an attack path map is generated and a risk score report is output.

[0034] Furthermore, after starting from the node with the highest concentration value in the sub-area and visiting neighboring nodes in descending order of the current threat quantization value, the method further includes:

[0035] During the visit, if three consecutive nodes are found to be high-concentration nodes and the threat types of the nodes belong to the same attack chain, a deep search is triggered and the exploration continues along the gradient descent direction of the threat quantization value;

[0036] When the growth rate of the cumulative threat value of the path is less than the backtracking threshold for two consecutive steps, backtracking is triggered and the deep search is terminated.

[0037] Furthermore, the updating of the node threat quantification value and relationship weight in the network knowledge graph includes:

[0038] During the traversal process, real-time threat data streams are obtained;

[0039] For the nodes on the traversal path, the real-time threat quantification value is dynamically updated. The update formula is:

[0040] ,

[0041] in, is the real-time threat quantification value of node i on the path, is the initial threat quantization value of node i, δ is the attenuation coefficient, Δt is the time window, is the real-time threat increment of node i;

[0042] A node sequence containing multiple high-concentration nodes and associated threat types is defined as a high-threat path, and the weight of the high-threat path is strengthened. The formula is:

[0043] ,

[0044] ,

[0045] ,

[0046] ,

[0047] TypeCorrelation = Number of consecutive matching stages / Total number of attack chain stages,

[0048] in, is the weight after strengthening from node i to node j, is the original weight from node i to node j, λ is the reinforcement coefficient, PathThreat is the path threat score, TypeCorrelation is the path threat type correlation, θ is the correlation strength coefficient, is the entropy weight coefficient of node i, which is used to reflect the diversity of threat types. is the threat type entropy value of node i, is the occurrence probability of the e-th threat type at node i, m is the total number of threat types faced by node i, and n is the number of nodes on the path.

[0049] Furthermore, the dynamically updating of the real-time threat quantification value of the nodes on the traversal path further includes:

[0050] During the traversal process, if the number of nodes visited by the search agent exceeds the node number threshold, k low-concentration nodes are randomly selected and their threat quantification values ​​are temporarily increased.

[0051] The present invention further provides a network security dynamic early warning device for implementing the above-mentioned network security dynamic early warning method, the device comprising:

[0052] Knowledge graph module: used to store entities and entity relationships in network data in the form of a graph structure to form a network knowledge graph;

[0053] Query target module: used to define query targets based on network security early warning requirements, including identifying potential attacks and finding potential attack paths;

[0054] Optimization module: This module uses the fruit fly optimization algorithm to map threat signatures into a three-dimensional odor concentration field, optimizing the graph query algorithm. The three-dimensional odor concentration field includes the type, urgency, and propagation speed of network security threats.

[0055] Threat detection module: used to search the network knowledge graph based on the query target through the optimized graph query algorithm to find potential attacks and attack paths and trigger early warnings in a timely manner.

[0056] The present invention also proposes a network security dynamic warning device, which includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, the above-mentioned network security dynamic warning method is implemented.

[0057] In summary, the network security dynamic early warning method of the present invention, by constructing a network knowledge graph and using the network knowledge graph as the data foundation, can better mine the potential relationships between data and support complex query operations so as to quickly locate information related to specific entities or relationships; according to the needs of network security early warning, it defines identifying potential attacks and finding potential attack paths as query targets, providing a clear direction and pertinence for the search of the graph query algorithm; through the fruit fly optimization algorithm, the threat characteristics are mapped into a three-dimensional odor concentration field, and the graph query algorithm is optimized so that the optimized graph query algorithm can fully consider the node concentration field, that is, the odor concentration value of each node. Since these concentration values ​​comprehensively reflect the characteristics of the node in terms of threat type, urgency and propagation speed, the graph query algorithm can give priority to and locate those nodes with higher threat levels during the network knowledge graph search process, reduce unnecessary searches, and greatly improve search efficiency, thereby more accurately and efficiently finding potential attacks and attack paths in the network knowledge graph, triggering early warnings in a timely manner, and ensuring network operation security.

[0058] Additional aspects and advantages of the present invention will be set forth in part in the following description and, in part, will be obvious from the following description, or may be learned through embodiments of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments with reference to the accompanying drawings, in which:

[0060] Figure 1 This is a flowchart of a network security dynamic early warning method according to a first embodiment of the present invention;

[0061] Figure 2 This is a system block diagram of a network security dynamic early warning device according to a second embodiment of the present invention;

[0062] Figure 3 This is a structural diagram of a network security dynamic early warning device according to embodiment 3 of the present invention. DETAILED DESCRIPTION

[0063] To facilitate understanding of the present invention, the present invention will be described more fully below with reference to the accompanying drawings. The drawings illustrate several embodiments of the present invention. However, the present invention may be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to provide a more thorough and comprehensive understanding of the present invention.

[0064] It should be noted that when an element is referred to as being "fixed to" another element, it may be directly on the other element or there may be an intermediate element. When an element is referred to as being "connected to" another element, it may be directly connected to the other element or there may be an intermediate element. The terms "vertical," "horizontal," "left," "right," and similar expressions used herein are for illustrative purposes only.

[0065] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one skilled in the art to which this invention pertains. The terms used in this specification of the present invention are for the purpose of describing specific embodiments only and are not intended to limit the present invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0066] Example 1

[0067] See also Figure 1 The present invention proposes a network security dynamic early warning method, which includes steps S101 to S104:

[0068] S101, storing entities and entity relationships in the network data in the form of a graph structure to form a network knowledge graph.

[0069] It should be noted that network data is collected in real time from multiple sources, such as network traffic logs, system logs, security incident reports, vulnerability databases, etc. The network data is cleaned and preprocessed, including missing value processing, outlier processing, and data standardization.

[0070] The network's entities and relationships are comprehensively presented in a graph structure, building a network knowledge graph. The entities and relationships in the graph are interconnected, forming a complex and orderly network structure that facilitates the discovery of potential threat paths and attack patterns in the network.

[0071] Entity types can include IP addresses, domain names, malware names, attacker identities, etc. Entity relationship types can include attack relationships and dependency relationships. Attack relationships represent attack behaviors between attackers and victims, such as DDoS attacks and malware infections. Dependency relationships represent dependencies between network entities, such as service dependencies and data dependencies.

[0072] Specifically, you can choose a graph database suitable for storing and processing complex network data, such as Neo4j or JanusGraph. You can store the identified entities and entity relationships in the graph database as nodes and edges, and set attributes for the nodes and edges, such as entity type, relationship type, and timestamp. This can integrate network data from different sources into a single graph to form a comprehensive network information library. This graph can then be continuously updated and expanded based on new network data and threat intelligence to maintain its currency.

[0073] S102: Define query targets based on network security early warning requirements. The query targets include identifying potential attacks and finding potential attack paths.

[0074] When a network operates normally, various network devices and systems generate data with certain patterns and characteristics. For example, the number of daily visits to a server will fluctuate within a relatively stable range, and the distribution of the IP addresses from which these visits originate will also show certain patterns. However, abnormal behavior may occur, such as a sudden increase or decrease in the number of visits, or a concentration of IP addresses from unusual locations. For example, if a single IP address initiates a large number of connection requests to different ports within a short period of time, which is inconsistent with historical normal connection patterns, it can be flagged as a potential attack.

[0075] An attack path refers to the series of nodes and connections an attacker might traverse to achieve their target. In a network knowledge graph, these nodes can be IP addresses, servers, applications, and so on, while connections represent the communication relationships between them. For example, an attacker might first compromise an external server and then use that server as a springboard to further attack critical systems within the internal network. By identifying possible attack paths, weak links along the path can be strengthened in advance, such as patching system vulnerabilities and strengthening access controls, thereby reducing the probability of a successful attack.

[0076] Specifically, a graph query algorithm can be used to search for possible attack paths within the network knowledge graph. Based on the attack relationships and dependencies between nodes, combined with the initial threat quantification values ​​obtained through the fruit fly optimization algorithm, the algorithm identifies the paths most likely to be exploited by attackers. For example, starting from the attacker's identity node, the algorithm follows the attack relationship edges to find a path that can reach the key target node. The algorithm then assesses the path's riskiness based on the threat quantification values ​​of the nodes along the path.

[0077] S103, using the fruit fly optimization algorithm, mapping the threat characteristics into a three-dimensional odor concentration field, and optimizing the graph query algorithm, wherein the three-dimensional odor concentration field includes the threat type, urgency, and propagation speed of network security.

[0078] Using the Fruit Fly Optimization algorithm, threat signatures are mapped into a three-dimensional odor concentration field, which is then used to optimize the graph query algorithm. This approach leverages the characteristics of the Fruit Fly Optimization algorithm, combined with the specific dimensions of cybersecurity threats, to quantitatively evaluate nodes in the network knowledge graph, thereby improving the efficiency and accuracy of the graph query algorithm in searching for potential threat paths.

[0079] Specifically, threat signatures can be mapped into a three-dimensional odor concentration field, where the three dimensions represent the type, urgency, and propagation speed of the network security threat. By calculating the quantitative values ​​of each node in these three dimensions and deriving the node's odor concentration value based on the fitness function, a node concentration field for the entire network knowledge graph is constructed. This node concentration field not only enables a more comprehensive and accurate assessment of the importance of nodes in potential attack paths, but also provides clear search directions for graph query algorithms. During the query process, nodes with high concentration values ​​can be prioritized based on the node concentration gradient, significantly improving search efficiency and facilitating the identification of potential threat paths.

[0080] Further optionally, the threat signature is mapped into a three-dimensional odor concentration field by using a fruit fly optimization algorithm to optimize the graph query algorithm, including:

[0081] Randomly selecting N starting nodes in the network knowledge graph as the initial positions of the fruit fly population, so that each fruit fly individual carries a three-dimensional position vector including a node ID, a relationship type, and a confidence level;

[0082] The fitness function is defined based on the type, urgency, and propagation speed of network security threats to quantify the odor concentration of the computing node. The higher the concentration value, the more critical the corresponding node is on the attack path. The formula is:

[0083] ,

[0084] Among them, ω1, ω2, ω3 are weight coefficients, ω1+ω2+ω3=1, is the quantitative value of the threat type of node i, is the quantitative value of the threat urgency of node i, is the quantitative value of the threat propagation speed of node i;

[0085] For each fruit fly's current position node, its odor concentration value is calculated according to the fitness function, and the position of the fruit fly is updated according to the concentration gradient, so that it moves towards the high-concentration node;

[0086] Repeat the odor concentration calculation and position update until the termination condition is met, and determine the final position distribution of the fruit fly population and the optimized node concentration field, which includes the odor concentration value of each node as the initial threat quantification value.

[0087] It is understandable that in the specific application of this embodiment, first, N starting nodes are randomly selected in the network knowledge graph as the initial positions of the fruit fly population, for example, N is 50 to 200. Each fruit fly individual carries a three-dimensional position vector, including a node ID, a relationship type, and a confidence level, which is used to represent the location information of the current node in the network.

[0088] The threat signature is mapped into a three-dimensional odor concentration field, where the three dimensions represent the network security threat type, urgency, and propagation speed. By calculating the quantitative values ​​of each node in these three dimensions and deriving the node's odor concentration value based on the fitness function, a node concentration field for the entire network knowledge graph is constructed. Higher concentration values ​​indicate a more critical node in the attack path.

[0089] For each fruit fly's current location, the fitness function calculates its odor concentration, and updates the fly's position according to the concentration gradient, moving it toward nodes with higher concentrations. This process simulates the behavior of fruit flies searching for food sources based on odor concentration. Through continuous iterative updates, the fruit fly population gradually gathers toward nodes with higher threat levels.

[0090] Repeat the odor concentration calculation and position update until a termination condition is met. This can include reaching the maximum number of iterations, concentration convergence, and other conditions. When the termination condition is met, the final position distribution of the fruit fly population and the optimized node concentration field are determined, including the odor concentration value of each node, which serves as the initial threat quantification value. These initial threat quantification values ​​provide a more accurate basis for node assessment in subsequent graph query algorithms.

[0091] The following example further illustrates this:

[0092] Suppose a network knowledge graph contains multiple nodes, representing different servers, network devices, and so on. Using the fruit fly optimization algorithm, threat signatures are mapped into a three-dimensional odor concentration field: Node A represents an external server. Its threat type is a high-risk vulnerability exploit, with a high urgency and a fast propagation speed. Its odor concentration value is high according to the fitness function calculation. Node B represents an ordinary internal printer. Its threat type is a low-risk configuration error, with a low urgency and a slow propagation speed. Its odor concentration value is low according to the fitness function calculation.

[0093] During the graph query algorithm optimization process, the fruit fly population will gradually gather towards node A, because node A has a high concentration value, indicating its importance in the potential attack path. This allows the subsequent search process to prioritize node A and its associated paths, greatly improving the efficiency and accuracy of the potential attack path search.

[0094] S104: Based on the query target, the optimized graph query algorithm is used to search in the network knowledge graph to find potential attacks and attack paths, and trigger an early warning in a timely manner.

[0095] The optimized graph query algorithm fully considers the node concentration field, specifically the odor concentration value (initial threat quantification value) of each node. These concentration values ​​comprehensively reflect the node's characteristics in terms of threat type, urgency, and propagation speed. This allows the algorithm to prioritize nodes with higher threat levels during the search process, thereby improving search efficiency, accurately and efficiently identifying security threats within the network, and triggering timely warnings to ensure secure network operations.

[0096] Further optionally, based on the query target, searching the network knowledge graph using an optimized graph query algorithm to find potential attacks and attack paths includes:

[0097] According to the final position distribution of the fruit fly population, high-concentration nodes are extracted as candidate key nodes, and the candidate set of attack paths is constructed by sorting them by concentration values;

[0098] Deploy multiple search agents to initiate traversal queries on high-concentration nodes in the attack path candidate set to find potential attacks and attack paths;

[0099] Activate the attack pattern memory library and compress and store the discovered new attack patterns using sparse autoencoding features;

[0100] Regularly synchronize external threat intelligence libraries and update the node threat quantification values ​​and relationship weights in the network knowledge graph.

[0101] As can be understood, the fruit fly optimization algorithm maps nodes into a three-dimensional odor concentration field based on threat characteristics. The resulting position distribution of the fruit fly swarm reflects the node's importance in threat assessment. High-concentration nodes are extracted from this position distribution to construct a candidate set of attack paths. Specifically, a concentration threshold, such as 1.5 times the global average concentration, can be set to filter out nodes with significantly higher-than-average threat levels. Alternatively, the top D% (e.g., top 20%) nodes can be selected to construct a candidate set of attack paths, focusing on the nodes with the highest threat levels.

[0102] Nodes with high concentrations represent high-risk nodes in the network and are key points in the attack path. Attackers often use these nodes as entry points or transit points. Therefore, prioritizing exploration of these nodes and their neighbors can more accurately and efficiently identify potential threats.

[0103] Deploy multiple search agents to perform traversal queries on high-density nodes in parallel, increasing search speed. Starting with high-density nodes, the traversal query expands from these nodes to their neighboring nodes. This approach gradually discovers other nodes and relationships connected to the high-density nodes, thereby constructing potential attack paths.

[0104] New attack patterns discovered are compressed using sparse autoencoder features and stored in the attack pattern memory to reduce storage overhead and support fast pattern matching. The attack pattern memory is used to store known attack patterns (such as DDoS attacks, malware infections, SQL injection attacks, brute force attacks, etc.) as well as newly discovered attack patterns, enabling fast pattern matching during searches, identifying the current attack pattern, and issuing timely warnings.

[0105] Based on information from external threat intelligence libraries, the node threat quantification values ​​and relationship weights in the network knowledge graph are updated. This improves the accuracy and effectiveness of the graph query algorithm and better discovers potential attacks and paths.

[0106] Further optionally, the deploying of multiple search agents includes:

[0107] For the high-concentration nodes in the attack path candidate set, the traversal priority is calculated by combining the node odor concentration value, the number of neighboring nodes, and the average odor concentration of neighboring nodes. The formula is:

[0108] ,

[0109] Among them, S i is the odor concentration value of node i, that is, the initial threat quantization value of node i, N i is the number of neighbor nodes, is the average concentration of neighbor nodes, α+β+γ=1;

[0110] Each high-density node is assigned to a plurality of search agents according to the traversal priority, wherein each search agent is responsible for a subgraph area.

[0111] It is understandable that when deploying the search agent, it can be deployed specifically according to the traversal priority calculated by combining the node odor concentration value, the number of neighboring nodes, and the average odor concentration of the neighboring nodes.

[0112] Among them, S i is the concentration value of node i, also known as the initial threat quantification value, reflecting the threat level of the node itself. A higher concentration value indicates that the node is more important in the potential attack path, and therefore should be given a higher weight when calculating the traversal priority.

[0113] N i The number of neighbor nodes represents the connection range of node i. The more neighbor nodes there are, the wider the influence of the node in the network is, and it may form potential attack paths with more other nodes.

[0114] The average concentration of neighboring nodes reflects the threat level of the environment around node i. If the average concentration of neighboring nodes is high, it means that the overall threat level of the area where the node is located is high, and the node is more likely to become part of the attack path.

[0115] α, β, and γ are weight coefficients used to balance the impact of different parameters on traversal priority. The coefficient values ​​can be adjusted based on actual network security requirements and node characteristics. For example, if the threat level of the node itself is considered more important, the value of α can be appropriately increased.

[0116] Based on the calculated traversal priority, each high-density node is assigned to multiple search agents, each responsible for a subgraph region. This ensures a balanced number of nodes and a balanced total concentration across all agents, preventing overloading of some search agents while leaving others idle, improving search efficiency. This also ensures a relatively balanced threat profile across each agent's region, facilitating a comprehensive and in-depth exploration of potential threats within the network.

[0117] For example, for the top 5% highest concentration nodes, since they pose an extremely high threat and are key nodes in the attack path, assigning 2-3 agents to explore in parallel can speed up the search and increase the probability of discovering potential attacks and paths.

[0118] Further optionally, the initiating a traversal query on high-concentration nodes in the attack path candidate set to search for potential attacks and attack paths includes:

[0119] For each sub-region that the search agent is responsible for, preload the initial concentration field data and adjacency matrix of the sub-region it is responsible for;

[0120] Starting from the node with the highest concentration value in the sub-area, visit the neighboring nodes in descending order of the current threat quantization value;

[0121] Determine whether the traversal path deviates from the normal pattern, including frequent visits to low-concentration nodes, too single threat type on the path, and drastic fluctuations in threat values;

[0122] If the traversal path deviates from the normal pattern, the current path feature vector is extracted and similarity is calculated with the known attack patterns stored in the attack pattern memory. The path feature vector includes the statistical distribution of the threat quantization value of the path node, the threat type sequence, and the path entropy.

[0123] If the similarity exceeds the similarity threshold, it is marked as a potential attack and an alarm is triggered. The alarm content includes the path node list and threat type;

[0124] When the traversal covers all high-concentration nodes and their direct neighbors in the attack path candidate set, the traversal is terminated, and an attack path map is generated and a risk score report is output.

[0125] It is understandable that when starting a traversal query for a high-concentration node, for each sub-area that the search agent is responsible for, first preload the initial concentration field data (including node ID + initial concentration value S i ) and the adjacency matrix (stored in sparse matrix format, used to describe the connection relationship between nodes).

[0126] Starting from the node with the highest concentration value within a sub-area, the network visits neighboring nodes in descending order of their current threat quantification values. Nodes with the highest concentration values ​​represent the most threatening nodes, and starting from these nodes allows for faster identification of the core of potential attack paths. The current threat quantification values ​​of neighboring nodes reflect their threat levels within the current network environment. Visiting in descending order prioritizes neighboring nodes with higher threat levels, further focusing on potential attack paths. Local attack pattern detection is performed every 10 nodes visited to promptly identify abnormal patterns in the traversal path and avoid missing potential attacks.

[0127] The node sequence, cumulative threat value, and path entropy of the access path are recorded. The node sequence can be used to construct the traversal path. The cumulative threat value reflects the overall threat level of the nodes on the path and can be used as an important indicator to determine whether the path is a potential attack path. The path entropy is calculated based on the distribution of path threat types and reflects the diversity of threat types along the path. The lower the path entropy, the more uniform the threat type and the more likely there is an anomaly.

[0128] Determine whether the traversal path deviates from the normal pattern, such as frequent visits to low-concentration nodes, an overly single threat type on the path, or drastic fluctuations in threat values. The judgment criteria can be as follows: if the ratio of the number of low-concentration nodes visited within the window to the total number of nodes visited is greater than 0.6, then low-concentration nodes are frequently visited. Normally, a traversal path prioritizes visiting high-concentration nodes. Frequent visits to low-concentration nodes may indicate that the path has deviated from the normal pattern, posing a potential attack.

[0129] If the current path entropy is less than the historical average path entropy × 0.7, the path threat type is considered too simple. Because normal attack paths usually involve multiple threat types, if the path threat type is too simple, it may be an abnormal attack pattern.

[0130] If the standard deviation / mean of the cumulative threat value of a path is greater than 0.3, the threat value is considered to have fluctuated significantly. Drastic fluctuations in the threat value may indicate abnormal threat changes along the path, possibly caused by attack behavior.

[0131] If the traversal path deviates from the normal pattern, the current path feature vector is extracted and compared with known attack patterns stored in the attack pattern memory to determine whether the current path is similar to known attack patterns and thus determine whether it is a potential attack. The path feature vector includes the statistical distribution of the threat quantification values ​​of the path nodes, the threat type sequence, and the path entropy. If the similarity exceeds the similarity threshold (e.g., > 85%), it is marked as a potential attack and an alarm is triggered. The alarm content includes the path node list and threat type.

[0132] When the traversal covers all high-concentration nodes and their immediate neighbors in the attack path candidate set, the traversal terminates, generating an attack path map and outputting a risk score report. The attack path map includes key nodes (i.e., high-concentration nodes), path weights, and threat type distribution to visually illustrate potential attack paths. The risk score report includes threat type and urgency classification, providing security managers with detailed risk assessment information.

[0133] Further optionally, after starting from the node with the highest concentration value in the sub-area and accessing neighboring nodes in descending order of current threat quantization values, the method further includes:

[0134] During the visit, if three consecutive nodes are found to be high-concentration nodes and the threat types of the nodes belong to the same attack chain, a deep search is triggered and the exploration continues along the gradient descent direction of the threat quantization value;

[0135] When the growth rate of the cumulative threat value of the path is less than the backtracking threshold for two consecutive steps, backtracking is triggered and the deep search is terminated.

[0136] Understandably, high-concentration nodes represent nodes with a higher threat level in network threat assessments. If three high-concentration nodes appear consecutively, it indicates that the current access path may be in an area with a high concentration of threats, which is likely to hide important potential attack paths.

[0137] When the threat types of nodes belong to the same attack chain, it indicates that the current path may be following a real attack path. For example, an attacker may first gain network access through initial access, then escalate privileges to gain more control, and finally move laterally to expand the scope of the attack. In this case, deep search can help discover the complete attack path.

[0138] If both of the above conditions are met simultaneously—that is, three consecutive nodes are both high-concentration nodes and part of the same attack chain—then the path is likely a high-threat potential attack path. Triggering deep exploration can more accurately screen out truly valuable paths. Specifically, exploration can be continued along the descending gradient of threat quantification, moving from high-threat nodes to relatively lower-threat nodes. In attack scenarios, attackers often exploit nodes with gradually decreasing threat levels to advance their attacks and reduce the risk of detection. For example, an attacker might first attack a high-threat core server and then further penetrate the network by controlling lower-threat end devices.

[0139] This search direction aligns with attacker behavior patterns in real-world attacks and can more effectively identify subsequent steps in the attack path. It avoids blind searches and focuses search resources on areas where attack paths are more likely to exist, further improving search efficiency.

[0140] If the growth rate is less than the backtracking threshold for two consecutive steps, it indicates that the threat level of the current path is increasing slowly, and it may have deviated from the main attack path or entered a low-threat area. This triggers backtracking, terminates the deep search, and avoids wasting search resources.

[0141] Further optionally, updating the node threat quantification value and relationship weight in the network knowledge graph includes:

[0142] During the traversal process, the real-time threat quantification value of the nodes on the traversal path is dynamically updated. The update formula is:

[0143] ,

[0144] in, is the real-time threat quantification value of node i on the path, is the initial threat quantization value of node i, δ is the attenuation coefficient, Δt is the time window, is the real-time threat increment of node i;

[0145] A node sequence containing multiple high-concentration nodes and associated threat types is defined as a high-threat path, and the weight of the high-threat path is strengthened. The formula is:

[0146] ,

[0147] ,

[0148] ,

[0149] ,

[0150] TypeCorrelation = Number of consecutive matching stages / Total number of attack chain stages,

[0151] in, is the weight after strengthening from node i to node j, is the original weight from node i to node j, λ is the reinforcement coefficient, PathThreat is the path threat score, TypeCorrelation is the path threat type correlation, θ is the correlation strength coefficient, is the entropy weight coefficient of node i, which is used to reflect the diversity of threat types. is the threat type entropy value of node i, is the occurrence probability of the e-th threat type at node i, m is the total number of threat types faced by node i, and n is the number of nodes on the path.

[0152] Understandably, for the nodes on the traversal path, their real-time threat quantification values ​​are dynamically updated to more accurately assess the threat level of the nodes in the current network environment.

[0153] At the same time, the relationship weights between nodes in the network knowledge graph are dynamically updated. Specifically, high-threat paths can be weighted to highlight them in the network knowledge graph, making it easier to detect potential serious threats. A high-threat path can be defined as a node sequence containing multiple high-concentration nodes with associated threat types. A high concentration of nodes indicates a high threat level, while an associated threat type indicates that these nodes may belong to the same attack chain or have similar threat characteristics.

[0154] Further optionally, the dynamically updating the real-time threat quantification value of the nodes on the traversal path further includes:

[0155] During the traversal process, when the number of nodes visited by the search agent exceeds the node number threshold, k low-concentration nodes are randomly selected and their threat quantification values ​​are temporarily increased.

[0156] Understandably, when traversing a network knowledge graph, high-density nodes are often more likely to attract attention, but low-density nodes can also harbor potential threats. If we focus only on high-density nodes, the search process may become trapped in localized high-threat areas, while ignoring other paths that may harbor threats.

[0157] When the number of nodes visited by a search agent exceeds a threshold, the local optimality can be broken by temporarily increasing the threat quantification value of low-density nodes, making the search more comprehensive. This guides the search agent to explore areas that may have been overlooked and uncover potential security risks. For example, in some cases, attackers may use low-threat nodes as a springboard to gradually infiltrate the core areas of the network.

[0158] The trigger condition can be set as the number of nodes visited in a single traversal being greater than 100. If the network scale is large, the threshold can be appropriately increased; if the security requirements are high and you want to conduct a comprehensive exploration earlier, the threshold can be lowered.

[0159] You can explore by randomly selecting 5 to 10 low-concentration nodes to increase the threat quantification value. This range should be selected to ensure exploration diversity while avoiding too many nodes that may cause the search to be too dispersed.

[0160] The threat quantification value of low-concentration nodes can be increased to 2-5 times the original value. Too small an increase may not effectively guide the search, while too large an increase may cause the search to be overly focused on these temporarily increased nodes.

[0161] In summary, the network security dynamic early warning method of the present invention, by constructing a network knowledge graph and using the network knowledge graph as the data foundation, can better mine the potential relationships between data and support complex query operations so as to quickly locate information related to specific entities or relationships; according to the needs of network security early warning, it defines identifying potential attacks and finding potential attack paths as query targets, providing a clear direction and pertinence for the search of the graph query algorithm; through the fruit fly optimization algorithm, the threat characteristics are mapped into a three-dimensional odor concentration field, and the graph query algorithm is optimized so that the optimized graph query algorithm can fully consider the node concentration field, that is, the odor concentration value of each node. Since these concentration values ​​comprehensively reflect the characteristics of the node in terms of threat type, urgency and propagation speed, the graph query algorithm can give priority to and locate those nodes with higher threat levels during the network knowledge graph search process, reduce unnecessary searches, and greatly improve search efficiency, thereby more accurately and efficiently finding potential attacks and attack paths in the network knowledge graph, triggering early warnings in a timely manner, and ensuring network operation security.

[0162] Example 2

[0163] See also Figure 2The present invention proposes a network security dynamic early warning device, which includes:

[0164] Knowledge graph module: used to store entities and entity relationships in network data in the form of a graph structure to form a network knowledge graph;

[0165] Query target module: used to define query targets based on network security early warning requirements, including identifying potential attacks and finding potential attack paths;

[0166] Optimization module: This module uses the fruit fly optimization algorithm to map threat signatures into a three-dimensional odor concentration field, optimizing the graph query algorithm. The three-dimensional odor concentration field includes the type, urgency, and propagation speed of network security threats.

[0167] Threat detection module: used to search the network knowledge graph based on the query target through the optimized graph query algorithm to find potential attacks and attack paths and trigger early warnings in a timely manner.

[0168] Further optionally, the optimization module is further configured to:

[0169] Randomly selecting N starting nodes in the network knowledge graph as the initial positions of the fruit fly population, so that each fruit fly individual carries a three-dimensional position vector including a node ID, a relationship type, and a confidence level;

[0170] The fitness function is defined based on the type, urgency, and propagation speed of network security threats to quantify the odor concentration of the computing node. The higher the concentration value, the more critical the corresponding node is on the attack path. The formula is:

[0171] ,

[0172] Among them, ω1, ω2, ω3 are weight coefficients, ω1+ω2+ω3=1, is the quantitative value of the threat type of node i, is the quantitative value of the threat urgency of node i, is the quantitative value of the threat propagation speed of node i;

[0173] For each fruit fly's current position node, its odor concentration value is calculated according to the fitness function, and the position of the fruit fly is updated according to the concentration gradient, so that it moves towards the high-concentration node;

[0174] Repeat the odor concentration calculation and position update until the termination condition is met, and determine the final position distribution of the fruit fly population and the optimized node concentration field, which includes the odor concentration value of each node as the initial threat quantification value.

[0175] Further optionally, the threat detection module is further configured to:

[0176] According to the final position distribution of the fruit fly population, high-concentration nodes are extracted as candidate key nodes, and the candidate set of attack paths is constructed by sorting them by concentration values;

[0177] Deploy multiple search agents to initiate traversal queries on high-concentration nodes in the attack path candidate set to find potential attacks and attack paths;

[0178] Activate the attack pattern memory library and compress and store the discovered new attack patterns using sparse autoencoding features;

[0179] Regularly synchronize external threat intelligence libraries and update the node threat quantification values ​​and relationship weights in the network knowledge graph.

[0180] Further optionally, the threat detection module is further configured to:

[0181] For the high-concentration nodes in the attack path candidate set, the traversal priority is calculated by combining the node odor concentration value, the number of neighboring nodes, and the average odor concentration of neighboring nodes. The formula is:

[0182] ,

[0183] Among them, S i is the odor concentration value of node i, that is, the initial threat quantization value of node i, N i is the number of neighbor nodes, is the average concentration of neighbor nodes, α+β+γ=1;

[0184] Each high-density node is assigned to a plurality of search agents according to the traversal priority, wherein each search agent is responsible for a subgraph area.

[0185] Further optionally, the threat detection module is further configured to:

[0186] For each sub-region that the search agent is responsible for, preload the initial concentration field data and adjacency matrix of the sub-region it is responsible for;

[0187] Starting from the node with the highest concentration value in the sub-area, visit the neighboring nodes in descending order of the current threat quantization value;

[0188] Determine whether the traversal path deviates from the normal pattern, including frequent visits to low-concentration nodes, too single threat type on the path, and drastic fluctuations in threat values;

[0189] If the traversal path deviates from the normal pattern, the current path feature vector is extracted and similarity is calculated with the known attack patterns stored in the attack pattern memory. The path feature vector includes the statistical distribution of the threat quantization value of the path node, the threat type sequence, and the path entropy.

[0190] If the similarity exceeds the similarity threshold, it is marked as a potential attack and an alarm is triggered. The alarm content includes the path node list and threat type;

[0191] When the traversal covers all high-concentration nodes and their direct neighbors in the attack path candidate set, the traversal is terminated, and an attack path map is generated and a risk score report is output.

[0192] Further optionally, the threat detection module is further configured to:

[0193] During the visit, if three consecutive nodes are found to be high-concentration nodes and the threat types of the nodes belong to the same attack chain, a deep search is triggered and the exploration continues along the gradient descent direction of the threat quantization value;

[0194] When the growth rate of the cumulative threat value of the path is less than the backtracking threshold for two consecutive steps, backtracking is triggered and the deep search is terminated.

[0195] Further optionally, the threat detection module is further configured to:

[0196] During the traversal process, real-time threat data streams are obtained;

[0197] For the nodes on the traversal path, the real-time threat quantification value is dynamically updated. The update formula is:

[0198] ,

[0199] in, is the real-time threat quantification value of node i on the path, is the initial threat quantization value of node i, δ is the attenuation coefficient, Δt is the time window, is the real-time threat increment of node i;

[0200] A node sequence containing multiple high-concentration nodes and associated threat types is defined as a high-threat path, and the weight of the high-threat path is strengthened. The formula is:

[0201] ,

[0202] ,

[0203] ,

[0204] ,

[0205] TypeCorrelation = Number of consecutive matching stages / Total number of attack chain stages,

[0206] in, is the weight after strengthening from node i to node j, is the original weight from node i to node j, λ is the reinforcement coefficient, PathThreat is the path threat score, TypeCorrelation is the path threat type correlation, θ is the correlation strength coefficient, is the entropy weight coefficient of node i, which is used to reflect the diversity of threat types. is the threat type entropy value of node i, is the occurrence probability of the e-th threat type at node i, m is the total number of threat types faced by node i, and n is the number of nodes on the path.

[0207] Further optionally, the threat detection module is further configured to:

[0208] During the traversal process, if the number of nodes visited by the search agent exceeds the node number threshold, k low-concentration nodes are randomly selected and their threat quantification values ​​are temporarily increased.

[0209] Example 3

[0210] Please refer to Figure 3 The present invention also proposes a network security dynamic early warning device, which is shown as a network security dynamic early warning device in the third embodiment of the present invention, including a memory 20, a processor 10, and a computer program 30 stored in the memory and executable on the processor. When the processor 10 executes the computer program 30, the network security dynamic early warning method as described above is implemented.

[0211] Among them, the network security dynamic warning device can specifically be a computer, a server, a host computer, etc., and the processor 10 in some embodiments can be a central processing unit (CPU), a controller, a microcontroller, a microprocessor or other data processing chip, used to run the program code stored in the memory 20 or process data, such as executing access restriction programs, etc.

[0212] The memory 20 includes at least one type of readable storage medium, including flash memory, a hard disk, a multimedia card, a card-type memory (such as SD or DX memory), a magnetic storage device, a magnetic disk, an optical disk, and the like. In some embodiments, the memory 20 may be an internal storage unit of the network security dynamic early warning device, such as the device's hard disk. In other embodiments, the memory 20 may also be an external storage device of the network security dynamic early warning device, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash memory card, and the like. Furthermore, the memory 20 may include both the internal storage unit and an external storage device of the network security dynamic early warning device. The memory 20 can be used not only to store application software installed in the network security dynamic early warning device and various data, but also to temporarily store data that has been output or is about to be output.

[0213] The above-described embodiments merely illustrate several implementations of the present invention, and while their descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that a person skilled in the art would be able to make numerous variations and improvements without departing from the spirit of the present invention, all of which fall within the scope of protection of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

Claims

1. A dynamic network security early warning method, characterized in that: The method comprises: Store entities and entity relationships in network data in the form of a graph structure to form a network knowledge graph; According to the requirements of network security early warning, the query objectives are defined, including identifying potential attacks and finding potential attack paths; Using the fruit fly optimization algorithm, the threat signature is mapped into a three-dimensional odor concentration field, which is then used to optimize the graph query algorithm. The three-dimensional odor concentration field includes the type, urgency, and propagation speed of network security threats. Based on the query target, the optimized graph query algorithm is used to search the network knowledge graph to find potential attacks and attack paths, and trigger early warnings in a timely manner; The method of mapping threat characteristics into a three-dimensional odor concentration field by using the fruit fly optimization algorithm and optimizing the graph query algorithm includes: Randomly selecting N starting nodes in the network knowledge graph as the initial positions of the fruit fly population, so that each fruit fly individual carries a three-dimensional position vector including a node ID, a relationship type, and a confidence level; The fitness function is defined based on the type, urgency, and propagation speed of network security threats to quantify the odor concentration of the computing node. The higher the concentration value, the more critical the corresponding node is on the attack path. The formula is: ， Among them, ω1, ω2, ω3 are weight coefficients, ω1+ω2+ω3=1, is the quantitative value of the threat type of node i, is the quantitative value of the threat urgency of node i, is the quantitative value of the threat propagation speed of node i; For each fruit fly's current position node, its odor concentration value is calculated according to the fitness function, and the position of the fruit fly is updated according to the concentration gradient, so that it moves towards the high-concentration node; Repeat the odor concentration calculation and position update until the termination condition is met, and determine the final position distribution of the fruit fly population and the optimized node concentration field, including the odor concentration value of each node, as the initial threat quantification value; Based on the query target, searching the network knowledge graph using an optimized graph query algorithm to find potential attacks and attack paths includes: According to the final position distribution of the fruit fly population, high-concentration nodes are extracted as candidate key nodes, and the candidate set of attack paths is constructed by sorting them by concentration values; Deploy multiple search agents to initiate traversal queries on high-concentration nodes in the attack path candidate set to find potential attacks and attack paths; Activate the attack pattern memory library and compress and store the discovered new attack patterns using sparse autoencoding features; Regularly synchronize external threat intelligence libraries and update the node threat quantification values ​​and relationship weights in the network knowledge graph.

2. The network security dynamic early warning method according to claim 1, characterized in that: The deployment of multiple search agents includes: For the high-concentration nodes in the attack path candidate set, the traversal priority is calculated by combining the node odor concentration value, the number of neighboring nodes, and the average odor concentration of neighboring nodes. The formula is: ， Among them, S i is the odor concentration value of node i, that is, the initial threat quantization value of node i, N i is the number of neighbor nodes, is the average concentration of neighbor nodes, α+β+γ=1; Each high-density node is assigned to a plurality of search agents according to the traversal priority, wherein each search agent is responsible for a subgraph area.

3. The network security dynamic early warning method according to claim 1, characterized in that: The initiating a traversal query on high-concentration nodes in the attack path candidate set to search for potential attacks and attack paths includes: For each sub-region that the search agent is responsible for, preload the initial concentration field data and adjacency matrix of the sub-region it is responsible for; Starting from the node with the highest concentration value in the sub-area, visit the neighboring nodes in descending order of the current threat quantization value; Determine whether the traversal path deviates from the normal pattern, including frequent visits to low-concentration nodes, too single threat type on the path, and drastic fluctuations in threat values; If the traversal path deviates from the normal pattern, the current path feature vector is extracted and similarity is calculated with the known attack patterns stored in the attack pattern memory. The path feature vector includes the statistical distribution of the threat quantization value of the path node, the threat type sequence, and the path entropy. If the similarity exceeds the similarity threshold, it is marked as a potential attack and an alarm is triggered. The alarm content includes the path node list and threat type; When the traversal covers all high-concentration nodes and their direct neighbors in the attack path candidate set, the traversal is terminated, and an attack path map is generated and a risk score report is output.

4. The network security dynamic early warning method according to claim 3 is characterized in that: After starting from the node with the highest concentration value in the sub-area and visiting neighboring nodes in descending order of current threat quantization values, the method further includes: During the visit, if three consecutive nodes are found to be high-concentration nodes and the threat types of the nodes belong to the same attack chain, a deep search is triggered and the exploration continues along the gradient descent direction of the threat quantization value; When the growth rate of the cumulative threat value of the path is less than the backtracking threshold for two consecutive steps, backtracking is triggered and the deep search is terminated.

5. The network security dynamic early warning method according to claim 1, characterized in that: The updating of the node threat quantification value and relationship weight in the network knowledge graph includes: During the traversal process, real-time threat data streams are obtained; For the nodes on the traversal path, the real-time threat quantification value is dynamically updated. The update formula is: ， in, is the real-time threat quantification value of node i on the path, is the initial threat quantization value of node i, δ is the attenuation coefficient, Δt is the time window, is the real-time threat increment of node i; A node sequence containing multiple high-concentration nodes and associated threat types is defined as a high-threat path, and the weight of the high-threat path is strengthened. The formula is: ， ， ， ， TypeCorrelation = Number of consecutive matching stages / Total number of attack chain stages, in, is the weight after strengthening from node i to node j, is the original weight from node i to node j, λ is the reinforcement coefficient, PathThreat is the path threat score, TypeCorrelation is the path threat type correlation, θ is the correlation strength coefficient, is the entropy weight coefficient of node i, which is used to reflect the diversity of threat types. is the threat type entropy value of node i, is the occurrence probability of the e-th threat type at node i, m is the total number of threat types faced by node i, and n is the number of nodes on the path.

6. The network security dynamic early warning method according to claim 5, characterized in that: The dynamically updating the real-time threat quantification value of the nodes on the traversal path further includes: During the traversal process, if the number of nodes visited by the search agent exceeds the node number threshold, k low-concentration nodes are randomly selected and their threat quantification values ​​are temporarily increased.

7. A network security dynamic early warning device, used to implement the network security dynamic early warning method according to any one of claims 1 to 6, characterized in that: The device comprises: Knowledge graph module: used to store entities and entity relationships in network data in the form of a graph structure to form a network knowledge graph; Query target module: used to define query targets based on network security early warning requirements, including identifying potential attacks and finding potential attack paths; Optimization module: This module uses the fruit fly optimization algorithm to map threat signatures into a three-dimensional odor concentration field, optimizing the graph query algorithm. The three-dimensional odor concentration field includes the type, urgency, and propagation speed of network security threats. Threat detection module: used to search the network knowledge graph based on the query target using an optimized graph query algorithm to find potential attacks and attack paths, and trigger early warnings in a timely manner; Wherein, the optimization module is further used for: Randomly selecting N starting nodes in the network knowledge graph as the initial positions of the fruit fly population, so that each fruit fly individual carries a three-dimensional position vector including a node ID, a relationship type, and a confidence level; The fitness function is defined based on the type, urgency, and propagation speed of network security threats to quantify the odor concentration of the computing node. The higher the concentration value, the more critical the corresponding node is on the attack path. The formula is: ， Among them, ω1, ω2, ω3 are weight coefficients, ω1+ω2+ω3=1, is the quantitative value of the threat type of node i, is the quantitative value of the threat urgency of node i, is the quantitative value of the threat propagation speed of node i; For each fruit fly's current position node, its odor concentration value is calculated according to the fitness function, and the position of the fruit fly is updated according to the concentration gradient, so that it moves towards the high-concentration node; Repeat the odor concentration calculation and position update until the termination condition is met, and determine the final position distribution of the fruit fly population and the optimized node concentration field, including the odor concentration value of each node, as the initial threat quantification value; The threat detection module is further configured to: According to the final position distribution of the fruit fly population, high-concentration nodes are extracted as candidate key nodes, and the candidate set of attack paths is constructed by sorting them by concentration values; Deploy multiple search agents to initiate traversal queries on high-concentration nodes in the attack path candidate set to find potential attacks and attack paths; Activate the attack pattern memory library and compress and store the discovered new attack patterns using sparse autoencoding features; Regularly synchronize external threat intelligence libraries and update the node threat quantification values ​​and relationship weights in the network knowledge graph.

8. Network security dynamic early warning equipment, characterized by: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the network security dynamic early warning method according to any one of claims 1 to 6 is implemented.

Images