Deep Learning-Based Multi-Level Dynamic Threat Detection System

Abstract

This invention provides a multi-layered dynamic threat monitoring system based on deep learning, comprising: a data acquisition module acquiring network traffic, logs, user behavior data samples, and corresponding threat tags; a data preprocessing module preprocessing the data to obtain a second sample; and a feature extraction module generating feature data samples. Next, a data vectorization module converts the data into vector samples, and a semantic sequence construction module analyzes cross-semantic relationships and labels them to form a semantic training dataset. A model training module uses this dataset to train a model, allowing it to learn the relationship between data and labels and map it to network parameters, resulting in a multi-layered dynamic threat monitoring model. Finally, a model deployment module deploys the model on a cloud server, enabling it to process target network operation data characteristics based on network parameters, predict network security threats, and ensure network security.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a multi-layered dynamic threat monitoring system based on deep learning. Background Technology

[0002] With the rapid development of information technology, the internet has increasingly penetrated all aspects of modern society, from core business operations of enterprises to daily information interaction of individuals; it has become an indispensable infrastructure. However, the openness and sharing nature of the internet exposes it to numerous security threats, such as malicious attacks, data breaches, and illegal intrusions. These threats not only seriously endanger personal privacy and property security but also pose significant risks to the economy, security, and stability of enterprises and nations.

[0003] Traditional network security protection technologies mainly include firewalls, intrusion detection systems (IDS), and antivirus software. Firewalls restrict network access by setting rules, preventing unauthorized external access to some extent, but they often struggle to effectively identify internal attacks and malicious traffic through legitimate ports. IDS relies on signature databases or anomaly detection to discover potential intrusions; however, their ability to detect new types of attacks is limited because the characteristics of new attacks are often not included in existing signature databases, and anomaly detection has a high false positive rate, making it difficult to accurately distinguish between normal network behavior changes and genuine attacks. Antivirus software primarily focuses on protecting against known viruses and malware; its effectiveness is significantly reduced against complex and ever-changing network attack methods, especially attacks based on social engineering and zero-day exploits. Summary of the Invention

[0004] In view of this, embodiments of the present invention provide a multi-layered dynamic threat monitoring system based on deep learning to at least partially solve the above problems.

[0005] According to a first aspect of the present invention, a multi-layered dynamic threat monitoring system based on deep learning is provided, comprising: a front-end electronic device and a back-end server, wherein the front-end electronic device is equipped with a data acquisition module, a data preprocessing module, a feature extraction module, a data vectorization module, and a semantic sequence construction module, and the back-end server is equipped with a model training module and a model deployment module; the data acquisition module is used to acquire a first network traffic data sample, a first log data sample, a first user behavior data sample, and network security threat tags for the first network traffic data sample, the first log data sample, and the first user behavior data sample, respectively; the data preprocessing module is used to preprocess the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain a second network traffic data sample, a second log data sample, and a second user behavior data sample, respectively; the feature extraction module is used to extract features from the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, respectively; and the data vectorization module is used to perform feature extraction on the second network traffic data sample, the second log data sample, and the second user behavior data sample, respectively. The system comprises the following modules: a module for obtaining traffic feature vector samples, log feature vector samples, and behavioral feature vector samples from the traffic feature data samples, log feature data samples, and behavioral feature data samples, respectively; a semantic sequence construction module for performing cross-semantic relationship analysis on the traffic feature vector samples, log feature vector samples, and behavioral feature vector samples to obtain a cross-semantic relationship graph, and labeling the network security threat tags on the cross-semantic relationship graph to form a semantic training dataset; a model training module for calling the semantic training dataset to train a deep learning model to be trained, so that the deep learning model learns the relationship between the first network traffic data sample, the first log data sample, the first user behavior data sample and the corresponding network security threat tags, and maps the relationship to the network parameters of the deep learning model to obtain a multi-layered dynamic threat monitoring model; and a model deployment module for deploying the multi-layered dynamic threat monitoring model on the cloud server, so that the multi-layered dynamic threat monitoring model extracts and processes the operational data features of the target network based on its network parameters to predict the network security threats occurring in the target network.

[0006] The solution in this embodiment of the invention has the following technical advantages: First, in terms of data acquisition, this system can comprehensively acquire the first network traffic data sample, the first log data sample, and the first user behavior data sample, and simultaneously acquire their corresponding network security threat tags. This multi-source data acquisition method, compared to traditional single-source data monitoring technology, can capture network activity information from a broader perspective. For example, network traffic data reflects the basic situation of network connections, log data records operational events within the system and applications, and user behavior data reflects the operational trajectory of network users. The combination of these three can avoid missed threat detections due to missing information from a single data source, greatly improving the comprehensiveness of threat monitoring. In the data preprocessing stage, targeted preprocessing operations are performed on different types of data to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample. For example, protocol traffic identification and timestamp correction of network traffic data can remove noisy data and ensure the accuracy of data time sequence, laying the foundation for subsequent accurate analysis; semantic understanding, parsing, knowledge graph construction, and repair of log data help to uncover deeper semantic information and anomalies in log data; multi-source fusion, integrity judgment, and completion of user behavior data can more completely and accurately depict user behavior patterns, reduce misjudgments caused by inaccurate or incomplete data, and thus improve the data quality and analytical reliability of the entire system. The feature extraction module extracts features from different types of preprocessed data, generating traffic feature data samples, log feature data samples, and behavioral feature data samples, which can accurately mine key features related to network security threats in various types of data. For example, feature extraction from the traffic graph structure representation using graph convolutional neural networks can effectively identify key nodes, traffic convergence areas, and traffic association patterns between different network segments, thereby discovering potential malicious traffic distribution characteristics. Extracting semantic roles from log data using pre-trained language models to generate log feature data samples helps understand the association between key elements such as the subject and object of operation in the logs and security threats. Constructing user behavior trajectory graphs and performing graph embedding to generate behavioral feature data samples clearly presents the dynamic changes in user behavior and the correlation between different behaviors, facilitating the detection of abnormal behavior patterns. Compared to traditional, general feature extraction methods, these feature extraction methods can more accurately locate threat-related features and improve the accuracy of threat identification. The data vectorization module further transforms the extracted feature data into vector samples, employing innovative technologies such as allocating attention weights based on feature importance weights, weighted expansion based on semantic embedding models to calculate semantic similarity matrices, and spatiotemporal fusion vectorization during the transformation process.This allows data to be represented in a more suitable form before entering model training, better preserving key information and semantic relationships, which helps improve the model's understanding and learning ability. Compared to traditional simple vectorization methods, it enables the model to capture subtle threat signals in the data more efficiently during training. The semantic sequence construction module performs cross-semantic relationship analysis on traffic feature vector samples, log feature vector samples, and behavioral feature vector samples and constructs a cross-semantic relationship graph, while labeling them with network security threat tags to form a semantic training dataset. This construction of cross-semantic relationships can deeply explore the hidden semantic connections between feature vectors of different types of data. For example, it can discover the inherent correlation between specific patterns in network traffic and specific events in logs and specific user behaviors. These correlations are often important indicators of complex network security threats. By forming a semantic training dataset, richer and deeper training data is provided for deep learning models, enabling them to learn more comprehensive and accurate network security threat feature patterns. Compared to traditional training data construction methods that lack semantic relationship analysis, this can significantly improve the model's ability to identify and generalize complex and ever-changing network security threats. The model training module trains a deep learning model using a semantic training dataset. It employs a multi-branch fusion neural network structure, including branches for traffic feature processing, log feature processing, and behavioral feature processing, as well as a cross-modal fusion layer. This combines various neural network structures such as convolutional neural networks with attention layers, recurrent neural networks with semantic embedding layers, and graph neural networks. Furthermore, it utilizes bilinear pooling layers to enhance multimodal fusion features, fully connected layers to extract local information, nonlinear transformations to predict threat type probability distributions, and cross-entropy loss functions to optimize model parameters. These techniques enable the model to fully learn the complex relationships between the first network traffic data sample, the first log data sample, the first user behavior data sample, and the corresponding cybersecurity threat labels, accurately mapping these relationships to network parameters. This training method, which integrates multimodal data, multiple neural network structures, and innovative training mechanisms, compared to traditional training methods based on a single modality or simple model structure, can train a multi-layered dynamic threat monitoring model with superior performance and more accurate cybersecurity threat identification. Finally, the model deployment module deploys the trained multi-layered dynamic threat monitoring model on a cloud server. Leveraging the powerful computing resources and flexible scalability of the cloud server, it can efficiently extract features from the target network's operational data in real time and predict cybersecurity threats. When faced with large-scale network data and high-concurrency network requests, the system can respond quickly, promptly detect potential threats and issue early warnings, ensuring the safe and stable operation of the target network. This is an advantage that traditional locally deployed monitoring systems with limited computing power cannot match. Attached Figure Description

[0007] Figure 1This is a schematic diagram of a multi-layered dynamic threat monitoring system based on deep learning, provided as an embodiment of the present invention. Detailed Implementation

[0008] like Figure 1 As shown, it includes: a front-end electronic device and a back-end server. The front-end electronic device is equipped with a data acquisition module, a data preprocessing module, a feature extraction module, a data vectorization module, and a semantic sequence construction module. The back-end server is equipped with a model training module and a model deployment module. The data acquisition module is used to acquire a first network traffic data sample, a first log data sample, a first user behavior data sample, and network security threat tags for the first network traffic data sample, the first log data sample, and the first user behavior data sample, respectively. The data preprocessing module is used to preprocess the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain a second network traffic data sample, a second log data sample, and a second user behavior data sample, respectively. The feature extraction module is used to extract features from the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, respectively. The data vectorization module is used to process the traffic feature data samples... The system comprises three modules: a traffic feature vector sample, a log feature vector sample, and a behavior feature vector sample; a semantic sequence construction module, used to perform cross-semantic relationship analysis among the traffic feature vector sample, log feature vector sample, and behavior feature vector sample to obtain a cross-semantic relationship graph, and to label the network security threat tag on the cross-semantic relationship graph to form a semantic training dataset; a model training module, used to call the semantic training dataset to train a deep learning model to be trained, so that the deep learning model learns the relationship between the first network traffic data sample, the first log data sample, the first user behavior data sample and the corresponding network security threat tag, and maps the relationship to the network parameters of the deep learning model to obtain a multi-layer dynamic threat monitoring model; and a model deployment module, used to deploy the multi-layer dynamic threat monitoring model on the cloud server, so that the multi-layer dynamic threat monitoring model can extract and process the operational data features of the target network based on its network parameters to predict the network security threats occurring in the target network.

[0009] Optionally, when the data acquisition module acquires the first network traffic data sample, the first log data sample, the first user behavior data sample, and the network security threat labels of the first network traffic data sample, the first log data sample, and the first user behavior data sample respectively, the steps include: the data acquisition module sends a collection request to the SDN controller, causing the SDN controller to guide traffic that meets predetermined requirements to the collection port specified by the data acquisition module for the collection of the first network traffic data sample according to the network global view and flow table rules; the collected first network traffic data sample is compressed based on a set content-aware lossless compression mechanism and cached in a local cache; based on the labeling component of the constructed multi-source threat intelligence, it is matched with the first network traffic data sample in the local cache to assign a network security threat label to the first network traffic data sample. Optionally, when the data acquisition module acquires the first network traffic data sample, the first log data sample, the first user behavior data sample, and the network security threat tags for the first network traffic data sample, the first log data sample, and the first user behavior data sample, the steps include the following: The data acquisition module calls a containerized log acquisition node to collect the first log data sample from different log sources to generate a blockchain block containing a timestamp, device identifier, and log summary, and performs consensus verification on the blockchain block to determine the authenticity of the first log data sample; in response to the authenticity of the first log data sample being greater than a set authenticity threshold, the first log data sample is parsed and constructed into a knowledge graph according to entities and relationships and stored in a graph database; based on the annotation mechanism of user and device behavior profiles, it is matched with the graph database to annotate the corresponding network security threat tags in the knowledge graph. Optionally, when the data acquisition module acquires the first network traffic data sample, the first log data sample, the first user behavior data sample, and the network security threat tags of the first network traffic data sample, the first log data sample, and the first user behavior data sample, the steps include the following: The data acquisition module calls a monitoring interface based on a cross-platform development framework and the system's underlying layer to detect the system's underlying layer, so as to capture in real time user gesture operations, system-level application calls, and interactive behaviors between different applications; based on differential privacy, the interactive behaviors are associated with the corresponding user subjects and noise is added to generate the first user behavior data sample; the first user behavior data sample is added to the distributed ledger one by one; based on a set context-aware dynamic labeling mechanism, the network security threat tags of the first user behavior data sample are labeled in the distributed ledger.

[0010] Specifically, the above provides an illustrative example of the steps involved in the data acquisition module:

[0011] I. Detecting and capturing user behavior data

[0012] The data acquisition module captures real-time data such as user gestures, system-level application calls, and interactions between different applications by calling monitoring interfaces based on a cross-platform development framework and the system's underlying layer. From an execution perspective, this is equivalent to starting multiple monitoring threads or utilizing the system's underlying callback mechanism to continuously listen for relevant system events.

[0013] Define the following variables to represent the amount of relevant data: Let N gesture This represents the number of user gesture operations captured per unit of time. For example, a single finger swipe or tap is counted as one gesture operation. N gesture The value of changes in real time with user actions, and its magnitude reflects the frequency of user interaction with the system in terms of gesture operations. Let N be... appcall N represents the number of times a system-level application is called per unit of time. N is the number of times a system-level application is started, switched, or its internal functional modules are called. appcall The count will increase, reflecting the activity level of each application in the system. Let N be... interact This indicates the number of interactions between different applications per unit of time, such as application A sending data to application B or requesting services. This value reflects the collaborative work or information transfer between applications.

[0014] When performing this step, these counter variables need to be continuously updated, for example, through the corresponding system event listener function, as shown in the following code example:

[0015] # Initialize the counter variable

[0016] N_gesture = 0

[0017] N_app_call = 0

[0018] N_interact = 0

[0019] #Example of defining a system-level event listener function (corresponding listener interface)

[0020] defon_gesture_event():

[0021] globalN_gesture

[0022] N_gesture+=1

[0023] defon_app_call_event():

[0024] globalN_app_call

[0025] N_app_call+=1

[0026] defon_interact_event():

[0027] globalN_interact

[0028] N_interact+=1

[0029] #Register event listeners (in practice, follow the registration method of the corresponding framework)

[0030] register_event_listener('gesture_event',on_gesture_event)

[0031] register_event_listener('app_call_event',on_app_call_event)

[0032] register_event_listener('interact_event',on_interact_event)

[0033] #Continuous monitoring

[0034] whileTrue:

[0035] continue# Keep listening and wait for the event to trigger the corresponding function to update the counter variable.

[0036] II. Generating the First User Behavior Data Sample by Adding Noise Based on Differential Privacy

[0037] Based on differential privacy, interactive behaviors are associated with corresponding user entities, and noise is added to generate the first user behavior data sample. Differential privacy protects user privacy by adding specific noise to the data, making it difficult for attackers to infer sensitive information about specific users through data analysis. Let the original user behavior data be represented as a vector X = (x1, x2, ..., x...). n ), where each element x i This corresponds to the quantized values ​​of the different types of behavioral data captured above (for example, x1 could be a normalized value of the number of gesture operations within a certain period, x2 could be a normalized value of the number of application calls, etc.). The process of adding noise can be represented by the following formula:

[0038] X noisy =X+∈

[0039] Among them, Xnoisy It is the first user behavior data sample vector after adding noise, where ∈ is the noise vector, and its elements are usually values ​​randomly sampled from a certain probability distribution (such as the Laplace distribution).

[0040] Taking the Laplace distribution as an example, let the probability density function of the Laplace distribution be:

[0041]

[0042] Here, μ is the location parameter (usually set to 0, indicating that the noise is symmetrically distributed around 0), and b is the scale parameter, which determines the range of noise magnitude. In this application scenario, the choice of the scale parameter b needs to be determined based on the trade-off between privacy protection requirements and data usability. If the b value is large, more noise is added, resulting in a higher level of privacy protection, but this may have some impact on the accuracy of subsequent data analysis; conversely, a smaller b value results in relatively weaker privacy protection, but the data is closer to the original real data, which is more conducive to subsequent accurate threat monitoring and analysis based on behavioral data.

[0043] Code example for generating a noise vector and adding it to the original data (using Python with commonly used scientific computing libraries).

[0044] import numpyasnp

[0045] #The original data vector X has been obtained

[0046] X = np.array([0.2, 0.5, 0.3])

[0047] #Set the scale parameter b of the Laplace distribution

[0048] b = 0.1

[0049] # Generate a noise vector epsilon with the same dimension as X by sampling from the Laplace distribution.

[0050] epsilon=np.random.laplace(0,b,size=X.shape)

[0051] # Generate the first user behavior data sample vector X_noisy after adding noise.

[0052] X_noisy=X+epsilon

[0053] 3. Add the first user behavior data sample to the distributed ledger

[0054] The first user behavior data sample is added to the distributed ledger one by one. The distributed ledger (such as a ledger implemented with blockchain technology) can guarantee the immutability and traceability of the data. From an execution perspective, this involves interaction with the distributed ledger system, such as sending data addition requests to ledger nodes through the corresponding network communication protocols.

[0055] Distributed ledger systems have an interface function for adding data, such as `add_to_ledger(data)`. The following code illustrates how to perform the data addition operation:

[0056] #X_noisy is the first user behavior data sample vector generated earlier after adding noise.

[0057] # Convert it to a format suitable for ledger storage data_to_ledger={

[0058] 'user_behavior':X_noisy.tolist()

[0059] }

[0060] #Call the ledger addition interface

[0061] add_to_ledger(data_to_ledger)

[0062] IV. Context-Aware Dynamic Labeling Mechanism for Labeling Cybersecurity Threats

[0063] Based on a context-aware dynamic labeling mechanism, a cybersecurity threat label is assigned to the first user behavior data sample in the distributed ledger. Context awareness means considering various relevant contextual factors when user behavior occurs to determine whether a threat exists, such as the current network security status, the user's business operation scenario, and system resource usage. Let the following variables be defined to measure the relevant contextual factors: Let S... netstatus This represents the network's security status indicator, with values ​​ranging from [0,1]. For example, 0 indicates the network is secure, while values ​​closer to 1 indicate detected abnormal traffic, suspected attacks, or other insecure situations. The values ​​can be obtained through real-time network security monitoring tools (such as intrusion detection systems) and fed back to the labeling mechanism. businessop This indicates the user's current business operation scenario. Different business operations may correspond to different normal behavior patterns and potential threats. For example, in a financial transfer scenario, frequently modifying the transfer amount and operating too quickly may be abnormal behavior. The relevant modules of the business system can determine the current user's business operation scenario and assign a corresponding value (also in [0,1], where 0 represents a normal, low-risk business scenario and 1 represents a high-risk business scenario prone to security threats). Ssysres This represents the system's resource usage metrics, such as CPU utilization and memory utilization, mapped to values ​​in the range [0,1]. Excessively high resource utilization may indicate abnormal situations such as malicious programs occupying resources, and can be obtained through system performance monitoring tools.

[0064] Construct a context-aware threat assessment function to determine whether a threat is identified and its corresponding threat label. The threat label is represented by L, with values ​​of 0 indicating no threat, 1 indicating a low-level threat, 2 indicating a medium-level threat, and 3 indicating a high-level threat.

[0065]

[0066] Among them, T1, T2, and T3 are thresholds set based on experience and actual security needs. For example, T1 = 0.3, T2 = 0.6, and T3 = 0.9. Different threshold ranges correspond to different threat level judgments.

[0067] The following is a code example of implementing this annotation mechanism:

[0068] # Obtain relevant contextual indicator values

[0069] S_net_status=get_network_status()

[0070] S_business_op=get_business_operation_scenario()

[0071] S_sys_res=get_system_resource_usage()

[0072] #Set threshold

[0073] T1 = 0.3

[0074] T2 = 0.6

[0075] T3 = 0.9

[0076] #Determine threat labels based on evaluation functions

[0077] ifS_net_status+S_business_op+S_sys_res <T1:

[0078] label=0

[0079] elifT1<=S_net_status+S_business_op+S_sys_res <T2:

[0080] label=1

[0081] elifT2<=S_net_status+S_business_op+S_sys_res <T3:

[0082] label=2

[0083] else:

[0084] label=3

[0085] # Label the corresponding data record in the distributed ledger with a threat tag (the ledger has an interface for updating tags).

[0086] update_label_in_ledger(label)

[0087] Optionally, when the data preprocessing module preprocesses the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample, respectively, the steps include: based on the trained protocol classification model, performing protocol traffic identification on the first network traffic data sample to remove noise data in the first network traffic data sample; performing time series analysis on the first network traffic data sample after removing the noise data to correct the timestamp of the first network traffic data sample, and generating the second network traffic data sample accordingly.

[0088] Specifically, the detailed explanation of the relevant steps in the above data preprocessing module is as follows:

[0089] I. Noise Removal Based on Protocol Classification Model

[0090] Let the first network traffic data sample be represented as a set T = {t1, t2, ..., t}. m}, where each element t i Represents a network traffic data packet, which contains several attributes such as the source IP address. src (t i Destination IP address dst (t i ), Port number Port(t i Protocol type (t) i ), Data packet size Size(t) i and timestamp (t) i The trained protocol classification model is a function M, etc. protocol (t iIts output is either the protocol category to which the data packet belongs or a flag indicating whether it is noisy data. For example, if M protocol (t i If M = 0, it means the data packet is considered noise data; if M protocol (t i If ⊙0, it indicates that the data packet belongs to a normal network protocol (such as M). protocol (t i ) = 1 indicates an HTTP protocol data packet, M protocol (t i =2 indicates that it is an FTP protocol data packet, etc.

[0091] The process of performing protocol traffic identification and noise removal can be represented by the following formula: T filtered ={t i |t i ∈T∧M protocol (t i )≠0}

[0092] Among them, T filtered This refers to the set of network traffic data after removing noise, which is the precursor to the second network traffic data sample. From an execution perspective, it needs to traverse the entire first network traffic data sample set T, processing each data packet t... i Call Protocol Classification Model M protocol (t i ), and decide whether to keep the data packet in T based on the output result. filtered The code example is as follows:

[0093] T_filtered=[]

[0094] fort_iinT:

[0095] if M_protocol(t_i) ! = 0:

[0096] T_filtered.append(t_i)

[0097] II. Time Series Analysis and Timestamp Correction

[0098] For the network traffic data set T after removing noise data filtered Time series analysis is performed to correct the timestamps. Let t prev t represents the timestamp of the previous data packet. curr The timestamp of the current data packet, Δt expected This represents the expected time interval based on a normal network latency model (this model can be trained based on network type, bandwidth, historical traffic data, etc.). Define a function Δt. actual(t prev ,t curr )=t curr -t prev The actual time interval is calculated. Then, the timestamp is corrected by comparing the actual time interval with the expected time interval.

[0099] The formula for correcting timestamps can be expressed as:

[0100]

[0101] Here, ∈ is an allowable time error threshold, set according to the network's stability and accuracy requirements. If the difference between the actual time interval and the expected time interval is within the allowable range, the timestamp is normal and no correction is needed; otherwise, the timestamp of the current data packet is corrected to the timestamp of the previous data packet plus the expected time interval.

[0102] Traversing T filtered At this time, it is necessary to record the timestamp of the previous data packet and correct the timestamp of each data packet according to the above formula.

[0103] The code example is as follows:

[0104] t_prev = None

[0105] fort_iinT_filtered:

[0106] ift_previsNone:

[0107] t_prev = t_i.Timestamp

[0108] else:

[0109] delta_t_actual=t_i.Timestampt_prev

[0110] ifabs(delta_t_actualDelta_t_expected)<=epsilon:

[0111] #The timestamp is normal and no correction is needed.

[0112] t_prev = t_i.Timestamp

[0113] else:

[0114] #Correct timestamp

[0115] t_i.Timestamp=t_prev+Delta_t_expected

[0116] t_prev = t_i.Timestamp

[0117] The network traffic data set T after the above timestamp correction filtered This becomes the final second network traffic data sample. Through this preprocessing, using protocol classification models and time series analysis methods, noisy data is effectively removed and timestamps are corrected, improving the quality and usability of network traffic data and laying a solid foundation for subsequent feature extraction and network security threat monitoring and analysis.

[0118] Optionally, the data preprocessing module, when preprocessing the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample, includes the following steps: performing semantic understanding and parsing on the first log data sample based on a sequence-to-sequence model using a recurrent neural network, to parse a system log containing multiple event information into a structured record containing time, event type, event subject, and detailed description; mapping the structured record onto a knowledge system framework of log data established based on ontology to generate a log data knowledge graph; and performing semantic repair on the log data knowledge graph based on log outlier detection using a combination of density clustering and outlier detection to generate the second log data sample.

[0119] Specifically, the detailed explanation of the preprocessing steps for log data samples in the above data preprocessing module is as follows:

[0120] I. Semantic Understanding and Parsing of Sequence-to-Sequence Models Based on Recurrent Neural Networks

[0121] Let the first log data sample be represented as a set of text sequences L = {l1, l2, ..., l...} n}, where each l i This represents a system log text, which is a string containing various event information. The sequence-to-sequence (Seq2Seq) model using a recurrent neural network (RNN) can be viewed as consisting of an encoder and a decoder. For the encoder part, the input log text is... i Each word in the vector is represented as a vector x after word embedding. t (where t represents the word order in the text), the encoder's hidden state update formula can be expressed as (taking a common Long Short-Term Memory (LSTM) network as an example, here the core state update calculation is simplified):

[0122] i t =σ(W xi xt +W hi h t-1 +b i )

[0123] f t =σ(W xf x t +W hf h t-1 +b f )

[0124] o t =σ(W xo x t +W ho h t-1 +b o )

[0125] g t =tanh(W xg x t +W hg h t-1 +b g )

[0126] c t =f t ⊙c t-1 +i t ⊙g t

[0127] h t =o t ⊙tanh(c t )

[0128] Among them: W xi W xf W xo W xg It is input to the corresponding gate (input gate i) t Forgotten Gate t Output gate o t Candidate memory cell phylum g t The weight matrices of the input word vectors x determine the weights of the input word vectors x. t The degree of influence on each state depends on the word vector dimension and the hidden state dimension, etc., and is determined during the model training phase. In this log parsing scenario, different weight matrices capture the association between different word vectors and each hidden state, which is used to learn the semantic information and sequence relationships in the log text. hi W hf W ho W hg The corresponding gate is in its hidden state h from the previous moment. t-1The weight matrix of each state up to the current time step reflects the transmission and influence of hidden states at previous and subsequent time steps in the sequence, helping the model understand the sequential semantics of log text, such as understanding the representation of different events occurring sequentially in the log. i ,b f ,b o ,b g This is the bias vector for the corresponding gate, used to adjust the activation status of each state. t It is a memory cell state that summarizes historical information and is continuously updated as the input log text sequence progresses, accumulating semantic key information in the log text. t This is the final hidden state, which integrates the current input and historical information, representing a semantic encoding representation of the log text at the current position by the encoder. After the encoder passes through it, the final hidden state h is obtained. last (This corresponds to the final encoded state after processing the entire log text), which is used as the initial state input to the decoder. The decoder is also based on a recurrent neural network structure. When generating each structured record element of the output (such as time, event type, event subject, detailed description, etc.), the formula for calculating its output probability distribution can be expressed as (the output vocabulary size is V, which is simplified to illustrate the case of generating a single element; in reality, it may involve multiple rounds of generating different elements):

[0129]

[0130] Among them: W hs From the decoder hidden state h t To the intermediate state s t The weight matrix is ​​used to transform the hidden state and extract a semantic representation suitable for generating the output element. s It is the corresponding bias vector.

[0131] W ps From the intermediate state s t The weight matrix of the probability distribution of the output vocabulary determines the probability of different words becoming the current output element. p It is the corresponding bias vector, p t (v) represents the probability of generating word v at time t. The intermediate state is transformed into a probability distribution using the softmax function, ensuring that the sum of the probabilities of all possible words is 1. Finally, appropriate words are selected based on the probability distribution to form structured record elements; for example, the word with the highest probability is selected as the output for the event type. For each log text l... i The process involves sequentially inputting word vectors into the encoder, updating the hidden state at each time step, and then passing the final hidden state into the decoder to gradually generate the elements of the structured record. A code example is shown below:

[0132] importtorch

[0133] importtorch.nnasnn

[0134] #Seq2Seq model class, containing Encoder and Decoder structures, etc.

[0135] model = Seq2SeqModel()

[0136] # Iterate through each log text in the first log data sample

[0137] forl_iinL:

[0138] # Convert log text l_i into a word vector sequence

[0139] x = word_embedding(l_i)

[0140] #Initialize encoder hidden state, etc.

[0141] h_prev = init_hidden_state()

[0142] c_prev = init_cell_state()

[0143] fortinrange(len(x)):

[0144] #Get the word vector at the current time

[0145] x_t = x[t]

[0146] # Update the hidden state and memory cell state via the encoder (call the function defined in the model, calculated according to the formula above).

[0147] h_t,c_t=model.encoder(x_t,h_prev,c_prev)

[0148] h_prev = h_t

[0149] c_prev = c_t

[0150] # Obtain the encoder's final hidden state as the decoder's initial state

[0151] h_last = h_t

[0152] #Decoder generates structured record elements

[0153] s_t=model.decoder.tanh(model.decoder.W_hs*h_last+model.decoder.b_s)

[0154] p_t=nn.functional.softmax(model.decoder.W_ps*s_t+model.decoder.b_p,dim=0)

[0155] # Select output words based on probability distribution output_word = choose_word(p_t)

[0156] After the above process, each first log data sample l i Parsing results in structured records containing elements such as time, event type, event subject, and detailed description. Let the set of parsed structured records be S = {s1, s2, ..., s...} n}, where each s i A structured representation of a log entry.

[0157] II. Mapping structured records to a knowledge graph within a log data knowledge system framework

[0158] Suppose that a knowledge system framework for log data based on ontology defines some concept sets C = {c1, c2, ..., c...} k (For example, concepts such as "login event" and "file access event" belong to event type-related concepts, while "user" and "server" belong to event subject-related concepts, etc.) and the relation set R = {r1, r2, ..., r m (e.g., relationships such as "before" and "who executed it"). For each structured record s i Its elements can be mapped according to the concepts and relationships within the knowledge system framework. Define a mapping function f. map (s i ), it is based on s i The elements in the knowledge graph are mapped to nodes and edges in the knowledge graph. Elements in the knowledge graph are represented in triplet form, i.e., G = {(n1, r, n2)}, where n1 and n2 are nodes (corresponding to concept instances), and r is a relation. For example, if structured records s i If the event type is "user login" and the event subject is "user A", then the following triplet can be generated and added to the knowledge graph using a mapping function: ("user A", "executed", "user login"). This requires traversing the structured record set S, and for each record... i Call the mapping function f map (s iThe elements are converted into triples of the knowledge graph and added to the knowledge graph. A code example is shown below:

[0159] knowledge_graph=[

[0160] fors_iinS:

[0161] triples = f_map(s_i)

[0162] knowledge_graph.extend(triples)

[0163] In this way, a log data knowledge graph G is generated, which integrates the structured information of all logs in the form of a graph, and more clearly shows the semantic relationships and associations between log data.

[0164] III. Semantic Repair Based on Log Outlier Detection Combining Density Clustering and Outlier Detection

[0165] Let the set of nodes in the log data knowledge graph G be N = {n1, n2, ..., n}. p The edge set is E = {e1, e2, ..., n}. q For the density clustering part, the density-based spatial clustering algorithm (DBSCAN) can be used as an example (other density clustering algorithms are similar in principle), defining concepts such as density reachability and density connectivity to divide the clusters. Let ∈ be the neighborhood radius parameter, and MinPts be the minimum number of points in the neighborhood of the core point (these two parameters are set empirically based on the characteristics of the log data and the clustering effect). Calculate the number of nodes n. i The function of the number of nodes in the ∈-neighborhood can be expressed as:

[0166] N ∈ (n i )={n j |d(n i ,n j )≤∈,n j ∈N}

[0167] Where d(n) i ,n j ) represents node n i and n j The distance metric between nodes (a suitable distance function can be defined based on the semantic similarity of nodes in the knowledge graph, such as calculating the cosine distance based on the vector representation of the corresponding concepts of the nodes) if |N ∈ (n i If |≥MinPts, then n is called n i The core point.

[0168] By continuously searching for density-reachable and density-connected sets of nodes, the nodes are divided into different clusters: Clusters = {C1, C2, ..., C}. r}

[0169] For outlier detection, an outlier score function S can be defined. outlier (n i It combines factors such as the density of the cluster a node belongs to and its distance from other clusters to determine whether a node is an outlier. For example:

[0170]

[0171] in Represents node n i The cluster it belongs to, S is the number of nodes in the cluster, and λ is a weighted parameter that balances the influence of intra-cluster distance and inter-cluster distance (set according to the actual situation). If S outlier (n i If n is greater than a certain set outlier threshold θ, then n is determined to be an outlier. i These are outliers. For detected outliers, semantic repair is required, such as correcting them based on the semantic information of other nodes in their cluster (the repair strategy can be tailored to the specific semantics and application scenario of the log knowledge graph). Let the repair function be f. repair (n i It is based on the outlier n i The relevant information is modified to better conform to normal semantic patterns. First, the neighborhood information of each node is calculated for density clustering; then, outlier scores are calculated to detect outliers; finally, outlier repair operations are performed. Code example is as follows:

[0172] # Initialize the cluster set and outlier set

[0173] Clusters = []

[0174] Outliers = []

[0175] #Perform density clustering

[0176] forn_iinN:

[0177] `neighbors = get_neighbors(n_i, epsilon)` # Gets the nodes in the neighborhood of `epsilon`.

[0178] iflen(neighbors)>=MinPts:

[0179] #This is the core point; we begin expanding the clustering.

[0180] cluster=expand_cluster(n_i,neighbors,epsilon,MinPts)

[0181] Clusters.append(cluster)

[0182] else:

[0183] Outliers.append(n_i)

[0184] #Detect outliers and calculate scores

[0185] forn_iinN:

[0186] outlier_score=calculate_outlier_score(n_i,Clusters,lambda)

[0187] ifoutlier_score>theta:

[0188] #Identified as an outlier

[0189] Outliers.append(n_i)

[0190] #Semantic repair of outliers

[0191] forn_iinOutliers:

[0192] repaired_n_i = f_repair(n_i)

[0193] #Update the repaired nodes to the knowledge graph

[0194] After the above log outlier detection and semantic repair process, the repaired log data knowledge graph is obtained, which is the final second log data sample. By removing outliers and repairing semantic issues, the quality of log data and the effectiveness of network security threat analysis are improved, making it more accurately reflect the actual operating status of the network system.

[0195] Optionally, when the data preprocessing module preprocesses the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample, the steps include: based on establishing a multi-source data association model, cross-validating and fusing the first user behavior data samples from the same user from different channels; and when there is an inconsistency in time or operation order between the first user behavior data sample and the user operation log recorded by the application system, using user login time and permission information as an aid to comprehensively judge and correct the completeness of the first user behavior data sample. Specifically, for missing data parts, a Markov chain-based behavior sequence prediction and completion mechanism is used to complete the missing data to generate the second user behavior data sample, based on the user's historical behavior patterns and group behavior statistical laws.

[0196] Specifically, the detailed explanation of the above-mentioned preprocessing steps for user behavior data samples is as follows:

[0197] I. Cross-validation and fusion based on multi-source data association models

[0198] Let the sets of first user behavior data samples about the same user obtained from different channels be D1 = {d 11 ,d 12 ,…,d 1m}, D2={d 21 ,d 22 ,…,d 2n},…,D k ={d k1 ,d k2 ,…,d kp Here, each set represents data from a specific channel. For example, D1 might be from a user's activity logs on a mobile device, D2 might be from a user's activity logs on a web page, and so on. Each element d within these sets... ij This represents a specific behavioral data record, such as a click or a page view, and each record contains multiple attributes, such as the time t when the behavior occurred. ij type of behavior ij , Operation object obj ij The established multi-source data association model can be viewed as a function M. associate (D1,D2,…,D k Its goal is to perform cross-validation and fusion by analyzing the correlations between data from different channels.

[0199] First, define a similarity metric function to measure the similarity between two behavioral data records from different channels. This function can be defined based on attributes such as behavior type or target audience. Let the similarity function be S(d). i1j1 ,d i2j2 The value of the cross-validation parameter is between [0,1], where 0 represents complete dissimilarity and 1 represents complete immutability. For the cross-validation part, it is necessary to iterate through all possible pairs of data from different channels to determine whether they corroborate each other. The validation logic can be represented by the following formula: Validation pass condition: Where θ validate This is a set similarity threshold, determined based on the characteristics of the data and the requirements for verification accuracy. If the similarity between two records is greater than or equal to this threshold, they are considered to have mutually verified each other's authenticity and reasonableness to a certain extent. For the fusion part, a weighted average method can be used to merge similar data records (this is just an example of a common fusion method; it can be adjusted according to specific needs). The two similar records to be merged are d... a and d b Their corresponding weights are w a and w b (The weights can be determined based on factors such as channel reliability and data timeliness, and must satisfy w) a +w b =1), the fused record d fusion The formula for calculating a certain attribute (taking the time of the behavior as an example) is as follows: t fusion =w a ×t a +w b ×t b The same approach can be applied to the fusion of other attributes. After processing all fusionable data records, the fused user behavior data set D is obtained. fused From an execution perspective, the code example is as follows:

[0200] D_fused=[]

[0201] for i in range(len(D_1)):

[0202] forjinrange(len(D_2)):

[0203] similarity = S(D_1[i], D_2[j])

[0204] ifsimilarity>=theta_validate:

[0205] #Determine weights

[0206] w_a = 0.5

[0207] w_b = 0.5

[0208] #Time attribute of fusion behavior (taking time attribute as an example)

[0209] t_fusion=w_a*D_1[i].time+w_b*D_2[j].time

[0210] #Merge with other attributes (specific code omitted, similar to the merging method for time attributes)

[0211] d_fusion=create_fused_data(D_1[i],D_2[j],t_fusion)

[0212] D_fused.append(d_fusion)

[0213] II. Correcting data integrity using user login time and permission information

[0214] Let D be the set of user behavior data after the above fusion. fused ={d f1 ,d f2 ,…,d fq The set of user operation logs recorded by the application system is L = {l1, l2, ..., l}. r Each log entry also contains relevant attributes such as time and operation.

[0215] Let the user login time be T. login Permission information can be represented by a set P = {p1, p2, ..., p...} s} indicates that each element p i This represents a permission (such as read / write permission, access to specific functions, etc.). Define a time difference function Δt(d) fi ,l j )=|t fi -t lj | is used to measure the time difference between user behavior data records and operation logs, and then a permission matching function Match(p) is defined. i ,d fi This function is used to determine whether permission information matches behavioral data (the return value is a boolean, True if they match, False if they don't). When inconsistencies are found between user behavior data samples and user operation logs recorded by the application system in terms of time or operation sequence, the following rules are used to comprehensively determine whether and how to correct them:

[0216] Correction condition 1 (excessive time difference): Δt(d fi ,lj )>θ time , where θ time This is a set time difference threshold. If the time difference exceeds this threshold, it is considered too large, and the time attribute of the behavioral data may need to be corrected. Correction condition 2 (permission mismatch): Match(p i ,d fi In other words, when permissions do not match, it is also necessary to consider correcting the relevant attributes of the behavior data (such as determining whether the behavior should be executed under the current permissions). When the correction conditions are met, the behavior data is corrected based on the user's login time and permission information. For example, if the time attribute needs to be corrected, and the time of the behavior data is earlier than the login time (an unreasonable situation), its time can be corrected to a reasonable time after the login time (corrected to the login time plus a small time interval ΔT), expressed by the following formula (taking the correction of the time attribute as an example):

[0217]

[0218] Where θ time_max It is another set maximum reasonable time range threshold used to avoid over-correction.

[0219] From an execution perspective, the code example is as follows:

[0220] for i in range(len(D_fused)):

[0221] forjinrange(len(L)):

[0222] time_diff=Delta_t(D_fused[i],L[j])

[0223] permission_match=Match(P,D_fused[i])

[0224] iftime_diff>theta_timeornotpermission_match:

[0225] ifD_fused[i].time <T_login:

[0226] D_fused[i].time=T_login+Delta_T

[0227] elifD_fused[i].time>T_login+theta_time_max:

[0228] D_fused[i].time=D_fused[i].time-Delta_T

[0229] III. Improving Missing Data Based on Markov Chain Behavioral Sequence Prediction

[0230] After the preceding steps, some data may still be missing. For these missing data portions, a behavior sequence prediction and completion mechanism based on Markov chains is used. Let the user's historical behavior sequence be represented as H = {h1, h2, ..., h...}. u}, where each h i It is a behavioral state (a state description that can be comprehensively represented by behavior type, operation object, etc.). The statistical law of group behavior can be represented by the transition probability matrix P, where the elements P ij This matrix represents the probability of transitioning from behavioral state i to behavioral state j. It can be obtained by analyzing historical behavioral data from a large number of users. Let h be the behavioral state preceding the current missing data position. prev To predict the next action state to fill in the missing data, according to the principle of Markov chains, the probability of predicting the next action state is calculated as follows: P(h next =j|h prev ) = P prevj

[0231] That is, the probability of the next action state being j is equal to the probability of the current preceding action state being h. prev The probability P of transitioning to state j prevj Then, sampling can be performed based on this probability distribution (e.g., using a roulette wheel algorithm) to determine the actual completion behavior state h. fill .

[0232] From an execution perspective, the code example is as follows:

[0233] fordinD_fused:

[0234] ifd.is_missing(): # Function to determine if data is missing.

[0235] prev_state = get_prev_state(d) # Get the state of the behavior before the missing data location

[0236] probabilities = P[prev_state] # Get the transition probability vector

[0237] fill_state = sample_state(probabilities) # Determine the behavior state for filling based on probability sampling

[0238] d.fill(fill_state) # Fills the missing data positions with the completed state.

[0239] After the aforementioned steps of cross-validation and fusion, integrity correction, and missing data completion, the final processed user behavior data set constitutes the second user behavior data sample. This preprocessing method fully leverages multi-source data, relevant auxiliary information, and historical and group behavior patterns to improve the quality and completeness of user behavior data, providing a more reliable data foundation for subsequent feature extraction and cybersecurity threat monitoring.

[0240] Optionally, when the feature extraction module performs feature extraction on the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, the steps include: taking the nodes in the network as vertices of the graph, the network connections between nodes and the traffic flow relationship as edges, and the traffic size and transmission frequency as edge weights to construct a traffic graph structure representation; performing feature extraction on the traffic graph structure representation based on a graph convolutional neural network to remove key nodes in the top network, traffic convergence areas, and traffic association patterns between different network segments, and generating the traffic feature data samples accordingly.

[0241] Therefore, the detailed explanation of the feature extraction steps for network traffic data samples is as follows:

[0242] I. Constructing the flow graph structure representation

[0243] Suppose there are N nodes in the network, and the set V = {v1, v2, ..., v...} is used. N Let} represent these nodes, and each node v i This corresponds to an entity in the network (such as a router, server, or terminal device). The network connections between nodes and the traffic flow relationships constitute the set of edges E = {e...} ij |i,j∈{1,2,…,N}}, where e ij Indicates from node v i to node v j If there is no edge from v i to v j If the direct connection or traffic flow is to the corresponding e ij It does not exist. For each edge e ij Its weight is defined as a binary tuple. in Indicates from node v i to node v j Traffic volume (e.g., measured in bytes per second, etc.) This represents the traffic transmission frequency (e.g., the number of data packets transmitted per second, measured in packets / second). Therefore, the entire traffic graph structure can be represented by G = (V, E, W), where... It is a set of edge weights. This graph structure needs to be constructed by traversing all nodes in the network and their connections, collecting traffic volume and transmission frequency information. A code example is shown below:

[0244] V = [] # Initialize the node set

[0245] E = [] # Initialize the edge set

[0246] W = [] # Initialize the edge weight set

[0247] # Obtain node information, connection status, and traffic through the network monitoring interface for i in range(len(all_nodes)):

[0248] for j in range(len(all_nodes)):

[0249] if has_connection(i,j): # Function to determine if nodes i and j are connected.

[0250] v_i = all_nodes[i]

[0251] v_j = all_nodes[j]

[0252] V.append(v_i)

[0253] V.append(v_j)

[0254] e_ij=(v_i,v_j)

[0255] E.append(e_ij)

[0256] traffic_size = get_traffic_size(i,j) # Function to get traffic size

[0257] traffic_freq = get_traffic_freq(i,j) # Function to get traffic transmission frequency

[0258] w_ij=(traffic_size, traffic_freq)

[0259] W.append(w_ij)

[0260] G = (V, E, W) # Constructing the flow graph structure

[0261] II. Feature Extraction Based on Graph Convolutional Neural Network (GCN)

[0262] The core operation of graph convolutional neural networks is to perform convolution operations on the graph structure to aggregate information from neighboring nodes, thereby extracting graph features.

[0263] Let the feature matrix of the nodes in the l-th layer of the graph convolutional neural network be... Where N is the number of nodes (consistent with the number of nodes in the previously defined graph), d (l) This represents the feature dimension of the l-th layer. Initially (i.e., when l = 0), the node feature matrix H... (0) Each row can be initialized using some basic attributes of the node itself (such as the node's degree, IP address encoding, and other simple features, with the dimension set to d). (0) ).

[0264] The formula for graph convolution operations is usually expressed as follows:

[0265] in: Let e ​​be the adjacency matrix of graph G, if e ij ∈E (i.e., node v) i and v j If there is an edge connecting them, then A ij =1, otherwise A ij =0. To account for the node's own information (i.e., self-loops), it is usually constructed... Where I is the identity matrix, which ensures that each node can aggregate its own information during convolution. It is a degree matrix, a diagonal matrix, whose diagonal elements D ii Equal to node v i The degree (i.e., the number of edges connected to the node) is also calculated for ease of subsequent calculations. Its diagonal elements That is, considering the node degree after the self-loop. is the learnable weight matrix of layer l, which determines how features from the previous layer are mapped to the current layer. Different weight values ​​learn the importance of different feature combinations for extracting target features (such as key nodes, traffic convergence areas, etc.) during training. By adjusting the weights, the network can focus on extracting features valuable for network security threat assessment. σ(·) is an activation function (such as the commonly used ReLU function), used to introduce non-linear factors, enabling the network to learn more complex feature relationships. It performs non-linear activation on node features after linear transformation and normalization, helping to uncover non-linear feature patterns hidden in the graph structure, such as complex traffic correlation patterns between different network segments. After several layers (L layers) of graph convolution operations, the final feature matrix H is obtained. (L)This includes the high-level features of the extracted graph, which can be used to identify key nodes in the network, traffic convergence areas, and traffic association patterns between different network segments.

[0266] For example, to identify key nodes, a key node scoring function S can be defined. node (v i The score is calculated based on the feature vectors of the corresponding nodes in the final feature matrix.

[0267] in It is node v i In the final characteristic matrix H (L) The k-th eigenvalue, w node,k It is a pre-defined weight vector w used to measure the importance of each dimension of features to the judgment of key nodes. node The k-th element is used to obtain the critical node score of the node through weighted summation. Nodes with higher scores can be identified as critical nodes. The determination of traffic convergence areas can be based on a comprehensive assessment of factors such as the similarity of features between nodes and traffic weights. For traffic association patterns between different network segments, the relationships between node groups corresponding to different network segments in the feature space and the traffic flow direction and magnitude relationships reflected by edge weights can be analyzed to uncover corresponding patterns (this can also be achieved through complex analysis and calculations based on feature matrices and edge weights; detailed formulas are not listed here).

[0268] Following the graph convolution operation formula above, matrix multiplication and normalization are performed sequentially at each layer to update the node feature matrix. A code example is shown below:

[0269]

[0270] Finally, based on the analysis and judgment results of key nodes, traffic convergence areas, and traffic correlation patterns, corresponding traffic characteristic data samples were compiled. These samples will serve as the basic data for subsequent further analysis and network security threat monitoring, providing strong support for accurately grasping the security-related characteristics in network traffic.

[0271] Optionally, when the feature extraction module performs feature extraction on the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, the steps include: labeling each word in the second log data sample with a corresponding semantic role based on a pre-trained language model; and extracting the subject, object, method, time, and location of the event based on the labeled semantic roles to generate the log feature data sample.

[0272] Specifically, the detailed explanation of the feature extraction steps for the log data samples is as follows:

[0273] I. Annotating Semantic Roles Based on Pre-trained Language Models

[0274] Let the second log data sample be represented as a text set L = {l1, l2, ..., l...} n}, where each l i This represents a preprocessed log text, which is itself a sequence of words, and can be represented as l. i ={w i1 ,w i2 ,…,w im}, here w ij Represents log text l i The j-th word in the text. The pre-trained language model used is a function M. language (w ij It can output corresponding semantic role labels for input words. Common semantic role labels may include different categories such as "Agent", "Patient", "Instrument", "Time", and "Location", represented by a set R = {r1, r2, ..., r...}. k} is used to represent all possible semantic role categories.

[0275] For each word w ij After processing by the pre-trained language model, a probability distribution vector for semantic roles will be obtained. Its calculation formula can be expressed as (here, we take the common method of outputting probability distribution based on neural network-based language models as an example; in practice, it will involve complex model structures and parameter calculations): p ij =M language (w ij ) = softmax(W·e ij +b)

[0276] Where: e ij It is the word w ij The word vector representation is obtained by mapping words to a fixed-dimensional vector space through the word embedding layer in the language model. The word vector dimension is set to d, i.e. Word vectors contain semantic and grammatical information about words. For example, words with similar semantics are relatively close in the vector space, which makes it easier for the model to perform semantic analysis based on this. It is a weight matrix that determines the mapping relationship from the word vector space to the semantic role probability distribution space. Different weight values ​​will cause different word vector features to correspond to different semantic role probabilities. It is learned during the training process of the pre-trained language model. Through learning from a large amount of text data, the model can adjust the weights so that it can accurately output a reasonable semantic role probability distribution for words in different contexts. This is the bias vector, used to fine-tune the probability distribution. It is also determined during model training and helps improve the model's generalization ability and annotation accuracy on different datasets. `softmax(·)` is the normalized exponential function, which undergoes a linear transformation (W·e...). ij The result after +b) is converted into a probability distribution vector such that the sum of all elements in the vector is 1, and each element p i r j s (indicating the word w) ij Labeled as semantic role r s The probability of a word taking values ​​between $[0,1]$ allows for a direct determination of the most likely semantic role based on probability. The process iterates through each word in each log text, inputting it into a pre-trained language model to obtain the corresponding semantic role probability distribution vector. Then, the semantic role with the highest probability is selected as the annotation result for that word (other probability-based decision-making methods, such as setting a threshold, can also be used). A code example is shown below:

[0277]

[0278] II. Extracting Log Feature Data Samples Based on Annotated Semantic Roles

[0279] After semantic role labeling of each word in the log text, key features such as the subject, object, method, time, and location of the event are extracted based on these labels to generate log feature data samples. Let's assume we start from log text l i The extracted event subject set is A i ={a i1 ,a i2 ,…,a ip The set of operands is O. i ={o i1 ,o i2 ,…,o iq The set of operation methods is M. i ={m i1 ,m i2 ,…,m ir}, the time set is T i ={t i1 ,ti2 ,…,t is The set of locations is G. i ={g i1 ,g i2 ,…,g it The rules for extracting these features can be defined as follows: Extracting the event subject: If the word w ij If the semantic role is labeled as "Agent", then the term is added to the event subject set, i.e.: a il =w ij If and only if the semantic role label r ij =“Agent”. Extracting the operation object: If the word w ij If the semantic role is labeled as "Patient", then the word is added to the set of operation objects, i.e.: o im =w ij If and only if the semantic role label r ij =“Patient”. Extraction operation method: If the word w ij If a word is labeled with the semantic role of "instrument" or other semantic roles related to operation methods (depending on the specific definition), then that word is added to the operation method set, i.e.: m in =w ij If and only if the semantic role label r ij ∈{the set of semantic roles related to the operation method}. Extraction time: if word w ij If the semantic role of a word is labeled "Time", then that word is added to the time set, i.e.: t io =w ij If and only if the semantic role label r ij = "Time". Location of retrieval: If the word w ij If the semantic role of a word is labeled "Location", then that word is added to the location set, i.e.: g ip =w ij If and only if the semantic role label r ij = "Location". Then, iterate through each log entry and the words with semantic roles marked within them, collecting the corresponding feature information according to the extraction rules described above. A code example is shown below:

[0280]

[0281] Through the process described above, which involves labeling semantic roles based on a pre-trained language model and further extracting key features, a set of log feature data samples is ultimately generated. These samples can focus on key elements in the log text that are closely related to cybersecurity threat analysis, providing a valuable data foundation for subsequent operations such as accurate cybersecurity threat monitoring and abnormal behavior judgment based on log data.

[0282] Optionally, when the feature extraction module extracts features from the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, the steps include: using the user as a node, the user's operational behaviors at different times, on different application systems or devices as edges, and the time interval between the behaviors and the frequency of the operations as attributes of the edges, to construct a user behavior trajectory graph; mapping the user behavior trajectory graph to a low-dimensional vector space through graph embedding to determine the dynamic change process of user behavior and the correlation between different behaviors, and generating the behavior feature data samples accordingly. Specifically, the detailed explanation of the above feature extraction steps for user behavior data samples is as follows:

[0283] I. Constructing a User Behavior Trajectory Map

[0284] Suppose there are N users in the system, and the set is U = {u1, u2, ..., u...} N Let} represent these users, and each user u i This refers to the nodes in the behavior trajectory graph being constructed. The user's actions at different times, on different application systems, or on different devices constitute the set of edges E = {e...} ij |i,j∈{1,2,…,N}}, where e ij Indicates from user u i To user u j An edge (which can also be a connection between different user actions, i.e., when i = j) represents the association between users or between different user actions. For each edge e ij Define two attributes: the time interval between the occurrence of the behavior, denoted as Δt. ij It means from user u i A certain action to user u j The time interval between related actions can be calculated by subtracting the timestamps of the corresponding actions. The unit can be seconds, minutes, etc. For example, if user u i At time T i An operation was performed by user u j At time T j If the relevant operation is performed, then Δt ij =T j -Ti The frequency attribute of the operation is set to f. ij It can statistically analyze user data within a certain time frame. i This type of behavior to user u j The frequency of related behaviors is used to measure, for example, from user u in the past hour. i Login operation to user u j If the file download operation occurred 5 times, then the corresponding f can be downloaded. ij The value is set to 5 (the specific statistical range and measurement method can be determined according to the actual application scenario). Thus, the entire user behavior trajectory can be represented by G = (U, E, A), where A = {(Δt)} ij ,f ij )|e ij ∈E} is the set of edge attributes.

[0285] From an execution perspective, it's necessary to traverse the user behavior data recorded by the system, identify different users and their operational behaviors at different times, on different application systems or devices, and calculate the corresponding time intervals and frequency of operations to construct this graph structure. A code example is as follows:

[0286]

[0287] II. Mapping user behavior trajectory graphs to a low-dimensional vector space using graph embedding

[0288] The purpose of graph embedding is to represent the nodes (in this case, users) in a graph structure and the relationships between them (represented by edges and edge attributes) using low-dimensional vectors, so as to analyze the dynamic changes in user behavior and the correlation between different behaviors. Common graph embedding methods include DeepWalk, Node2Vec, and Graph Convolutional Networks (GCN). Here, we will use Node2Vec as an example to illustrate (its principles and related formulas). Node2Vec is a method that generates vector representations of nodes in a graph based on random walks combined with word vector learning methods (such as Word2Vec).

[0289] First, define the relevant parameters of the random walk: Let the walk length be l, representing the number of nodes visited consecutively from the starting node in each random walk. For example, setting l = 8 means that each random walk will visit 8 nodes sequentially (there may be repeated visits). Let the return parameter be p, which controls the probability of the random walk returning to the previous node, used to adjust the "breadth" of the walk. A larger p value makes the walk more inclined to explore near the current node, while a smaller p value makes the walk more likely to "jump" to more distant nodes. Let the entry / exit parameter be q, which controls the trade-off between exploring new nodes outward and returning to the region of already visited nodes inward. Different q values ​​affect the "bias" of the walk path, such as the effect of favoring depth-first search or breadth-first search. For each node u i A series of node sequences are generated by performing multiple random walks, starting from node u. i Let S be the set of node sequences obtained by performing r random walks. i ={s i1 ,s i2 ,…,s ir}, where each s ik It is a sequence of nodes of length l, for example, s ik =[v k1 ,v k2 ,…,v kl ], here v km Let represent the node visited in the m-th step of the k-th random walk. Then, a Skip-Gram model similar to Word2Vec is used to learn the vector representation of the node. Let the vector representation of the node be . (where d is the dimension of the low-dimensional vector space, for example, d = 128), for each center node and its context nodes in the node sequence (similar to the relationship between a word and its context words in word vector learning), optimization learning is performed through the following objective function (here, the core part is simplified and some regularization terms are ignored):

[0290] Where c represents the index of the center node in the sequence (here, the middle position is taken; for example, for a sequence of length l, c = l / 2), m is the set context window size (indicating how many nodes before and after the center node are considered as context, for example, m = 2), Pr(v k,j+c |v kc ) indicates that at a given central node v kc In this case, its context node v k,j+c The probability of occurrence can be obtained by transforming the inner product of the node vectors using the softmax function. The calculation formula is as follows:

[0291] Among them, zkc It is the central node v kc The vector representation of z k,j+c It is the context node v k,j+c The vector representation is obtained by continuously adjusting the node vector z. i The goal is to maximize the objective function by bringing the frequently co-occurring nodes in the random walk (representing nodes corresponding to strongly correlated user behaviors in the behavior trajectory graph) closer together in the vector space. This allows us to learn a low-dimensional vector representation that reflects the correlation and dynamic changes in user behavior. The process follows the random walk and vector learning steps described above. A code example is shown below:

[0292] import node2vec

[0293] #User behavior trajectory map G has been built

[0294] graph = convert_to_graph_object(G) # Converts a custom graph structure to a library-supported graph object.

[0295] # Initialize the Node2Vec model and set relevant parameters (walk length, return parameters, input / output parameters, etc.)

[0296] model=node2vec.Node2Vec(graph,dimensions=128,walk_length=8,num_walks=10,p=1,q=1)

[0297] #Train the model, perform random walks and vector learning

[0298] model.fit()

[0299] # Get the vector representation of the node, i.e., the embedded vector.

[0300] node_embeddings=model.wv.vectors

[0301] # Associate node vectors with their corresponding users user_embeddings={}

[0302] for user,index in user_index_mapping.items():

[0303] user_embeddings[user]=node_embeddings[index]

[0304] Based on the low-dimensional vector representations of each node (user) in the obtained user behavior trajectory map, further analysis can be performed on the distance between these vectors (e.g., by calculating cosine similarity), the trend of vector changes (the change of vectors corresponding to different behaviors over time), etc., to determine the dynamic changes in user behavior and the correlation between different behaviors, thereby generating behavioral feature data samples. For example, the difference between user vectors at different time points can be calculated to measure the degree of behavioral change, or user behavior can be classified based on vector similarity through cluster analysis. Key behavioral feature information can be extracted based on these analysis results, ultimately forming behavioral feature data samples, providing effective data support for subsequent operations such as network security threat monitoring. For example, by calculating the difference between two user vectors z... i and z j The cosine similarity is used to measure the correlation of their behaviors. The formula for cosine similarity is as follows:

[0305] Among them, z i ·z j Let ||z| denote the dot product of two vectors. i ‖ and ‖z j ‖ represent vector z i and z j The modulus (length) is used to calculate similarity, which can determine the degree of correlation between different user behaviors. Related correlation information is then collected and organized as part of the behavioral feature data sample for later use.

[0306] From an execution perspective, the code example is as follows:

[0307]

[0308] Through the complete process of constructing user behavior trajectory maps and graph embedding described above, behavioral feature data samples are generated. These samples can characterize user behavior features from the perspectives of behavioral correlation and dynamic changes, which helps to promptly detect abnormal user behavior patterns and potential security threats in cybersecurity scenarios.

[0309] Optionally, when the data vectorization module obtains traffic feature vector samples, log feature vector samples, and behavioral feature vector samples from the traffic feature data samples, log feature data samples, and behavioral feature data samples, respectively, the steps include: analyzing the feature importance weights of each traffic feature data sample under different network security threat scenarios through a constructed knowledge base of network security threat cases and corresponding traffic feature data. Based on the feature importance weights, assigning different attention weights to different traffic feature data samples to integrate the traffic feature data samples with attention weights into traffic feature vector samples. Specifically, the detailed explanation of the above-mentioned traffic feature data sample vectorization steps is as follows:

[0310] I. Analyzing the feature importance weights of traffic characteristic data samples

[0311] Suppose that the constructed knowledge base of cybersecurity threat cases and corresponding traffic characteristic data contains M different cybersecurity threat scenarios, denoted by the set S = {s1, s2, ..., s...}. M Let} represent these scenarios, for example, s1 can represent a "DDoS attack scenario", s2 can represent a "port scanning attack scenario", etc., and each scenario corresponds to a specific form of traffic characteristic manifestation. Meanwhile, let the set of traffic characteristic data samples be F = {f1, f2, ..., f...} N}, where each f i This represents a traffic characteristic data sample, which contains multiple specific traffic characteristic attributes, such as traffic size, packet frequency, and source port distribution, and can be represented as f. i ={a i1 ,a i2 ,…,a iK}, here a ij Let a represent the j-th specific traffic feature attribute in the i-th traffic feature data sample. For each traffic feature attribute a ij To analyze its performance in different cybersecurity threat scenarios m The importance weights are determined by defining a weight function w. ijm To represent attribute a ij In scene s m The importance weight is assigned to an attribute, with a value ranging from [0,1]. 0 indicates that the attribute has almost no effect on threat assessment in this scenario, while 1 indicates that the attribute is crucial for threat assessment in this scenario. To calculate this weight, statistical analysis or machine learning methods are used (information gain calculation is used as an example to illustrate the basic principle). In scenario s... m Given a known positive sample set P (representing traffic data samples where this security threat exists). m And the negative sample set (representing traffic data samples where the security threat does not exist) N mStatistical analysis of attribute a ij The probability distribution of occurrence in the positive and negative sample sets. Let attribute a. ij In the positive sample set P m The probability of it appearing in is In the negative sample set N m The probability of it appearing in is The information gain formula can then be used to calculate the attribute in scenario s. m The following are the importance weights for judging threats:

[0312] w ijm =IG(a ij ,s m = Entropy(s m )-Entropy(s m |a ij )

[0313] Where: Entropy(s m ) represents scene s m Information entropy, used to measure the degree of uncertainty in determining whether a threat exists in a given scenario, is calculated using the following formula:

[0314] Entropy(s m )=-p + log2 p + -p - log2p -

[0315] Here p + p is the proportion of positive samples in all samples (the sum of positive and negative samples). - This represents the proportion of negative samples. For example, if there are 50 positive samples and 50 negative samples, for a total of 100 samples, then p... + =0.5, p - =0.5, this formula can be used to calculate the initial uncertainty of the scene. Entropy(s) m |a ij ) indicates that in the case of known attribute a ij In the case of scenario s m The conditional information entropy reflects the degree to which the uncertainty of threat assessment in a scenario is reduced after knowing the value of the attribute. The calculation formula is as follows (taking the case of discrete attributes as an example):

[0316]

[0317] Where V ij It is attribute a ij The set of all possible values, s mv In attribute aij When the value is v, scenario s m The corresponding sample subset, |s mv | is the number of samples in the subset, |s m | is scene s m The total number of samples. By calculating this conditional information entropy and combining it with the previous information entropy, we can obtain the information gain, i.e., attribute a. ij In scene s m The importance weight w ijm .

[0318] From an execution perspective, it is necessary to traverse each cybersecurity threat scenario, and for each scenario's positive and negative sample sets, then traverse each attribute in each traffic feature data sample, calculating its importance weight according to the above formula. A code example is shown below:

[0319]

[0320] II. Assign attention weights based on feature importance weights and integrate them into traffic feature vector samples.

[0321] After obtaining the importance weight w of each traffic feature attribute in different scenarios ijm Next, different attention weights need to be assigned to different traffic feature data samples based on these weights, and then integrated into traffic feature vector samples. Let f be the number of attention weights assigned to the traffic feature data samples. i In scene s m The attention weight is α im It can be achieved by analyzing sample f i The importance weights of all feature attributes in this scenario are normalized and calculated using the following formula:

[0322]

[0323] Here, the sum of weights is converted to a positive number using the exponential function exp(·), and then normalization is performed (the denominator is the sum of similar weights for all traffic feature data samples in this scenario), so that the sum of the attention weights for all samples in this scenario is 1. This highlights the traffic feature data samples that are relatively more important in this specific scenario. Then, the traffic feature data samples with attention weights are integrated into a traffic feature vector sample. Let the integrated traffic feature vector sample be v, whose dimension is the same as the number of feature attributes K of the traffic feature data samples. The formula for calculating each element of the vector is as follows:

[0324]

[0325] That is, for the k-th element of the vector, it is obtained by traversing all network security threat scenarios and all traffic feature data samples, multiplying the attention weight of each sample in each scenario with the corresponding feature attribute value and then summing them up. In this way, the information in different traffic feature data samples is integrated into a vector according to its importance and correlation with different threat scenarios, thus obtaining the traffic feature vector sample.

[0326] The attention weight of each sample in each scenario is calculated according to the above attention weight calculation formula. Then, the value of each element of the traffic feature vector sample is calculated according to the integration formula. The code example is as follows:

[0327]

[0328] Through the above-described operational process combining specific formulas from an execution perspective, the importance weights of traffic feature data samples can be analyzed based on the cybersecurity threat case knowledge base, and attention weights can be reasonably allocated. Finally, a traffic feature vector sample is obtained, which can better reflect the relationship between traffic features and cybersecurity threats, providing an effective data representation for subsequent model training and cybersecurity threat monitoring.

[0329] Optionally, when the data vectorization module obtains traffic feature vector samples, log feature vector samples, and behavior feature vector samples from the traffic feature data samples, log feature data samples, and behavior feature data samples, respectively, the steps include: mapping keywords and key phrases in the log feature data samples to a low-dimensional vector space based on a pre-trained semantic embedding model, so that words with similar semantics present a close positional relationship in the vector space, thereby capturing the semantic association between the log feature data samples and calculating the semantic similarity matrix between the log feature samples accordingly; weighting and expanding the log feature data samples according to the semantic similarity matrix to fuse semantically related log feature data samples, and generating the log feature vector samples accordingly. Specifically, a detailed explanation of the above scheme is as follows:

[0330] I. Mapping words to a low-dimensional vector space and calculating the semantic similarity matrix based on a pre-trained semantic embedding model

[0331] 1. Mapping vocabulary to a low-dimensional vector space

[0332] Let the log feature data sample set be L = {l1, l2, ..., l n}, where each l i This represents a log feature data sample, where each sample contains several keywords and key phrases, and can be represented as l i ={w i1 ,w i2 ,…,wim}, here w ij Represents log feature data sample l i The j-th keyword or key phrase in the text.

[0333] We use a pre-trained semantic embedding model to map these words, transforming them into vector representations in a low-dimensional vector space. Let the pre-trained semantic embedding model be E(·), and for a word w... ij The mapped vector is represented as (where d is the dimension of the low-dimensional vector space, for example, d = 300), then we have: v ij =E(w ij )

[0334] The pre-trained semantic embedding model E(·) here is trained on a large amount of text data to obtain rich semantic information. It achieves the mapping from words to vectors through a complex neural network structure and parameters. Its purpose is to allow words with similar semantics to present similar positional relationships in this low-dimensional vector space, which is convenient for subsequent capture of semantic associations.

[0335] From an execution perspective, it is necessary to iterate through each keyword and key phrase in the log feature data sample and call the pre-trained semantic embedding model to obtain the corresponding vector representation. A code example is shown below:

[0336]

[0337] After obtaining the vector representations of each word in all log feature data samples, the semantic similarity matrix between log feature samples needs to be calculated. Let log feature data sample l i and l j The semantic similarity between them is s ij Its value ranges between $[0,1]$, where 0 indicates that the two are semantically unrelated and 1 indicates that the semantics are highly similar or even equivalent.

[0338] Cosine similarity is used to calculate semantic similarity, and the formula is as follows:

[0339] Where: v i Represents log feature data sample l i The comprehensive vector representation, through sample l i It is obtained by aggregating the vectors of all keywords and key phrases in the text. A common aggregation method is average aggregation, i.e.:

[0340] v here ik That is, sample l iThe vector representation of the k-th word is used to obtain a vector that represents the semantics of the entire log feature data sample through average aggregation. j Similarly, it is the log feature data sample l j The comprehensive vector representation is obtained by a similar aggregation method. i ·v j The inner product of two vectors represents the degree of similarity in direction between them. The closer the directions, the more similar the vectors are semantically, and the larger the inner product value. ‖v i ‖ and ‖v j ‖ represent vectors v i and v j The modulus (length) is normalized by dividing by the product of the vector moduli to ensure that the similarity value is within the interval [0,1]. For n log feature data samples, an n×n semantic similarity matrix S is constructed, where the elements S ij The s obtained from the above calculation ij .

[0341] From an execution perspective, it is necessary to iterate through all log feature data sample pairs, calculate their semantic similarity according to the formula above, and fill them into the semantic similarity matrix. A code example is shown below:

[0342]

[0343] II. Generating Log Feature Vector Samples by Weighted Expansion and Fusion Based on Semantic Similarity Matrix

[0344] 1. Weighted expansion

[0345] Suppose that log feature data samples l are analyzed based on the semantic similarity matrix. i The vector after weighted expansion is The calculation method is as follows:

[0346]

[0347] Where: s ik It is a log feature data sample l i With l k The semantic similarity (obtained from the semantic similarity matrix S) is used as a weight to measure the sample l. k For sample l i In the fusion process, higher semantic similarity indicates a stronger correlation between the two elements, which is of greater importance during weighted expansion. k vector v k (also l) k The comprehensive vector representation, obtained by the aggregation method described above, is for l. i The greater the contribution, the better. This is achieved by analyzing the vectors corresponding to all log feature data samples according to their relationship with l.i The semantic similarity is weighted and summed to obtain the weighted expanded vector. This incorporates information from semantically related samples into the vector representation of each sample, further strengthening the semantic association at the vector level. From an execution perspective, a weighted expansion operation should be performed on each log feature data sample according to the above formula, as shown in the code example below:

[0348]

[0349]

[0350] Let the final generated log feature vector sample be... It is obtained by fusing all weighted expanded vectors. A common fusing method is average fusing, and the calculation formula is as follows:

[0351] All weighted expanded vectors By performing an equal-weighted average, a vector representation that integrates the semantic information of all log feature data samples is obtained as the final log feature vector sample. This vector can more comprehensively reflect the semantic content and potential security-related features contained in the logs.

[0352] From an execution perspective, the final log feature vector sample is calculated according to the above fusion formula, as shown in the code example below:

[0353] V_final=[0for_in range(len(L[0].vector_list))]

[0354] for l in range(len(V_final)):

[0355] V_final[l]=sum([V_star[i][l]for iin range(len(L))]) / len(L)

[0356] To address this, a pre-trained semantic embedding model maps keywords and key phrases from logs to a low-dimensional vector space. This allows textual information, which was originally scattered and difficult to measure semantic relationships directly, to be intuitively represented in the vector space, meaning that words with similar semantics are located close to each other. The semantic similarity matrix calculated on this basis can accurately quantify the degree of semantic relationship between different log feature data samples. This helps to uncover the inherent connections between log content that appears different on the surface but is actually semantically related. For example, logs from different modules recording the same system operation but using slightly different wording can be better linked through vector space and similarity calculation, providing a more comprehensive perspective for subsequent analysis of the overall system operation status and security posture. Furthermore, the process of weighted expansion and fusion of log feature data samples based on the semantic similarity matrix to generate the final vector sample fully utilizes semantic relationship information. Instead of simply piling up log features, it rationally fuses the information of each sample according to the degree of semantic relevance. This ensures that the final log feature vector sample gathers key information from multiple semantically related samples, reflecting more deeply the system behavior represented by the logs and the security-related clues hidden within. This avoids information omissions and misjudgments that may result from analyzing individual log samples in isolation. Furthermore, converting log feature data samples into vector form provides a unified and standardized data representation method, which is easier to process in subsequent data analysis, machine learning, and deep learning algorithms compared to the original text form. Vectors can easily participate in various mathematical operations, feature extraction, and serve as input and output for models, improving the efficiency and flexibility of data processing. For example, log feature vector samples can be directly input into classification models to determine the existence of cybersecurity threats, or used in clustering models to classify different types of log behavior patterns. Finally, because log feature vector samples incorporate rich semantic information, they inherently contain more representative and informative features. When used as input for training and prediction of cybersecurity-related models, they can help models better capture key information such as abnormal behavior patterns and potential security threats reflected in logs, thereby improving the accuracy and reliability of the models, enhancing the performance of the entire log-based cybersecurity threat monitoring system, and more effectively ensuring the secure operation of network systems.

[0357] Optionally, when the data vectorization module obtains traffic feature vector samples, log feature vector samples, and behavioral feature vector samples from the traffic feature data samples, log feature data samples, and behavioral feature data samples, the steps include the following: For the behavioral feature data samples, considering that user behavior has two important dimensions—time and space—a spatiotemporal fusion vectorization technology is innovatively adopted. The time and space dimensions of the behavioral feature data samples are respectively encoded to obtain time vectors and space vectors. The time dimension includes the time, duration, and frequency of the behavior, and the space dimension includes the geographical location of the behavior and the application system or device in which it occurs. Based on a tensor fusion mechanism, the time vector and space vector are fused to generate the behavioral feature vector samples.

[0358] Specifically, the detailed explanation of the above steps for vectorizing behavioral feature data samples is as follows:

[0359] I. Encoding the temporal and spatial dimensions of behavioral feature data samples

[0360] 1. Time-dimensional feature encoding

[0361] Let the set of behavioral feature data samples be B = {b1, b2, ..., b}. n}, where each b i This represents a sample of behavioral feature data, which includes multiple time-related attributes associated with user behavior, such as the time when the behavior occurred. (This can be represented by a timestamp, such as a specific point in time accurate to the second), duration. (Units can be seconds, minutes, etc., indicating the duration of an action), frequency (The number of times this behavior occurs within a certain time frame, such as the number of operations per hour). These time-dimensional features need to be encoded, transforming them into a time vector representation. A linear encoding method is used (which can be adjusted according to the specific encoding algorithm). Let the encoded time vector be... (d t The time vector dimension is set, for example, d. t =3), and its dimensional elements can be calculated in the following way:

[0362]

[0363] in: These are the minimum and maximum values ​​of the time when the behavior occurs in all behavioral feature data samples, respectively. This is achieved by analyzing the time when the behavior occurs in a specific sample. Subtract the minimum value and divide by the range difference (maximum value minus minimum value), then normalize the result to the $[0,1]$ interval. This allows the characteristics of the behavior at different times of the samples to be compared and processed on a uniform scale. It refers to the corresponding element in the time vector at the moment the behavior occurs, after normalization. Similarly, These are the minimum and maximum durations of the actions across all samples. It is the element in the time vector corresponding to the normalized duration of the sample behavior; These are the minimum and maximum values ​​of the behavior frequency. These are the vector elements after the behavior frequency has been normalized.

[0364] From an execution perspective, it is necessary to traverse each behavioral feature data sample, obtain its attribute values ​​in the time dimension, and then perform normalization encoding according to the above formula to generate a time vector. A code example is shown below:

[0365]

[0366] 2. Spatial Dimension Feature Encoding

[0367] For each behavioral feature data sample b i Its spatial dimension includes the geographical location where the behavior occurs (which can be represented by latitude and longitude coordinates, denoted as ). and (representing longitude and latitude respectively), and the application system or device in which it is located (which can be represented by discrete category numbers, denoted as s). i For example, 1 represents a mobile application system, 2 represents a web application system, etc. Similarly, spatial dimension features are encoded, and the encoded spatial vector is denoted as . (d s The dimension of the spatial vector is set, for example, d. s =3), the calculation methods for each dimension element are as follows:

[0368]

[0369] in: These are the minimum and maximum longitude values ​​of the geographical locations where the behavior occurred, respectively, among all behavioral feature data samples. It is to take sample b i The longitude coordinates are normalized and their corresponding elements in the spatial vector so that they can reflect the positional characteristics at a uniform scale. These are the minimum and maximum values ​​of latitude. These are the vector elements after normalizing the corresponding sample dimensions. min s max These are the minimum and maximum values ​​of the category number representing the application system or device across all samples. It is the element in the spatial vector after the device or system category number corresponding to the sample is normalized, which facilitates subsequent comprehensive consideration of various features of the spatial dimension.

[0370] From an execution perspective, it is necessary to traverse each behavioral feature data sample, obtain the spatial dimension attribute values, and encode them into spatial vectors according to the above formula. A code example is shown below:

[0371]

[0372] II. Generating Behavioral Feature Vector Samples by Fusing Time and Spatial Vectors Based on Tensor Fusion Mechanism

[0373] Let the behavioral feature vector samples generated after fusion through the tensor fusion mechanism be... (d is the dimension of the final behavioral feature vector sample. For example, d = 6, which can be the sum of the time vector dimension and the spatial vector dimension, etc., depending on the fusion method.)

[0374] Tensor fusion directly concatenates the time vector and the space vector, and the calculation formula is as follows:

[0375] That is, the time vector and space vectors They are concatenated sequentially to form a new vector, which serves as a sample of the behavioral feature vector. For example, if the time vector has dimension d... t =3, spatial vector dimension d s =3, then the fused behavioral feature vector sample Of course, other tensor fusion mechanisms can also be used, such as tensor product fusion based on operations like tensor product, with the calculation formula as follows:

[0376] in This represents the tensor product operation, which can be used to extract the interaction information between the dimensions of the time vector and the space vector, generate a new tensor with higher dimensions, and then transform it into the final behavioral feature vector sample through appropriate dimensionality reduction and other processing methods. This makes the fused vector not only contain the features of time and space respectively, but also reflect the relationship between them.

[0377] From an execution perspective, if it's a simple concatenation and fusion, you only need to combine the corresponding time and space vectors in order; if it's a more complex method like tensor product fusion, you need to follow the corresponding mathematical operation rules. A code example is shown below:

[0378] for i in range(len(B)):

[0379] v_i_b=B[i].time_vector+B[i].space_vector

[0380] B[i].behavior_vector = v_i_b

[0381] Therefore, by considering that user behavior has two important dimensions—time and space—and encoding the features of these two dimensions separately, we can comprehensively and meticulously capture the characteristics of user behavior. For example, information such as the time, duration, and frequency of behavior in the time dimension can reflect users' operating habits, activity levels, and periodic patterns of behavior; while geographical location and application system or device information in the spatial dimension can reflect the environment in which user behavior occurs and the platform used. By fusing the feature vectors of these two dimensions, the final generated behavioral feature vector sample can completely present the overall picture of user behavior, avoiding the problem of losing key information by focusing on only a single dimension, and providing a rich data foundation for subsequent more accurate analysis of user behavior patterns and judgment of anomalies. In addition, especially when using complex tensor fusion mechanisms such as tensor product, it is not only possible to simply combine time and space features, but also to uncover the interactive correlation information between the two dimensions. For example, some users always perform specific operations at specific times (time dimension) in a specific geographical location (spatial dimension). This cross-dimensional correlation may indicate specific behavioral patterns or potential security risks. By integrating this correlation information into the behavioral feature vector sample through the fusion process, it is helpful to further analyze the hidden patterns behind user behavior and potential security risks. Furthermore, transforming behavioral feature data samples into a unified vector representation, namely behavioral feature vector samples, facilitates subsequent processing in various machine learning and deep learning models. Whether for behavioral classification (e.g., distinguishing between normal and abnormal behavior), clustering (grouping similar behavioral patterns), or other data analysis tasks, vector-based data is more readily used in mathematical operations and as input / output for models. Compared to the original, dispersed form containing temporal and spatial attributes, it improves data processing efficiency and versatility, and facilitates integration with various algorithms and models. Finally, because behavioral feature vector samples integrate features from multiple temporal and spatial dimensions and incorporate related information, they contain richer and more representative information. When used as input for network security-related models (e.g., monitoring for malicious or intrusive behavior based on behavioral features), they help models better capture complex changes in user behavior patterns and anomalies, thereby improving model accuracy and reliability. This more effectively realizes network security protection functions based on user behavior analysis and enhances the ability to monitor and respond to user behavior-related security threats in network systems.

[0382] Optionally, when the semantic sequence construction module performs cross-semantic relationship analysis on the traffic feature vector samples, log feature vector samples, and behavioral feature vector samples to obtain a cross-semantic relationship graph, and labels the network security threat on the cross-semantic relationship graph to form a semantic training dataset, the steps include: performing effective cross-semantic relationship analysis on the traffic feature vector samples, log feature vector samples, and behavioral feature vector samples to construct a semantic alignment network; based on the semantic alignment network and a graph attention mechanism, constructing a cross-semantic relationship fusion graph containing all traffic, log, and behavioral feature vector samples, where nodes are different feature vector samples and edges represent potential semantic associations between feature vector samples of different modalities; and based on a predefined network security threat rule knowledge base, a case knowledge graph based on historical network security events, and real-time updated external professional threat intelligence, performing cross-semantic relationship pattern reasoning on the cross-semantic relationship fusion graph to label the network security threat and form a semantic training dataset accordingly.

[0383] Specifically, the detailed explanation of the above plan is as follows:

[0384] I. Constructing a semantic alignment network for cross-semantic relation analysis

[0385] 1. Semantic Alignment Network Construction

[0386] Let the sample set of flow feature vectors be... The log feature vector sample set is The behavioral feature vector sample set is To construct a semantic alignment network to analyze cross-semantic relationships between them, this network can be viewed as a function G. align The goal of the (F,L,B) algorithm is to find semantic correspondences between feature vector samples of different modalities (traffic, logs, behavior). A common approach is to measure the degree of semantic association by calculating the similarity between vectors. For example, for traffic feature vector samples f... i and log feature vector samples l j Cosine similarity can be used to calculate their semantic similarity. Let the similarity be . The calculation formula is as follows:

[0387]

[0388] Where: f i ·l j Represents vector f i and l j The inner product of vectors reflects the degree of consistency in direction between two vectors. A larger inner product indicates that the vectors are closer in direction in the vector space, which, from a semantic perspective, means that the two vectors may have a stronger semantic relationship.i ‖ and ‖l j ‖ are vectors f i and l j The similarity is normalized by dividing by the product of the vector moduli. The value of is between $[0,1]$, which facilitates comparison and measurement of the semantic similarity between different sample pairs. Similarly, the similarity between traffic feature vector samples and behavior feature vector samples (let be ) is also considered. ) and the similarity between log feature vector samples and behavioral feature vector samples (let's say) The cosine similarity is also calculated using the aforementioned formula. Then, based on a set similarity threshold θ (e.g., θ = 0.5, empirically set according to actual data and application scenarios), if... Then it is assumed that the flow feature vector sample f i and log feature vector samples l j There are potential semantic relationships between them, and by analogy, the relationships between samples of different modalities are constructed, which constitute the semantic alignment network. From an execution perspective, it is necessary to traverse the feature vector sample sets of different modalities, calculate the similarity between each pair, and determine the relationship based on a threshold. The code example is as follows:

[0389]

[0390] 2. The role of semantic alignment networks

[0391] Semantic alignment networks can help to initially uncover potential semantic relationships between feature vector samples from different modalities. For example, in cybersecurity scenarios, certain specific traffic feature vector samples may be semantically related to log feature vector samples reflecting specific abnormal operations and corresponding abnormal behavior feature vector samples. This network can discover these relationships, providing a foundation for further in-depth fusion and analysis, avoiding viewing data from different modalities in isolation, and helping to integrate multi-source information to gain a more comprehensive understanding of cybersecurity.

[0392] II. Constructing a Cross-Semantic Relationship Fusion Graph Based on Graph Attention Mechanism

[0393] 1. Principles and applications of graph attention mechanism

[0394] After constructing the semantic alignment network, a cross-semantic relation fusion graph is built based on the Graph Attention Network (GAT) mechanism. Let G be the cross-semantic relation fusion graph. fusion= (V, E), where the node set V = F∪L∪B, which contains all traffic, log, and behavioral feature vector samples, and the edge set E represents the potential semantic associations between feature vector samples of different modalities (based on the semantic alignment network mining above and further strengthened and refined by the graph attention mechanism). The core of the graph attention mechanism is to calculate the attention weights between each node in the graph and its neighboring nodes, thereby aggregating the information of neighboring nodes and updating its own node representation. For node v i ∈V (where v) i It can be a traffic, log, or behavioral feature vector sample), and its update formula in the graph attention layer is as follows (taking a single-layer graph attention mechanism as an example, in practice, multiple layers can be stacked):

[0395] e ij =LeakyReLU(a T [Wv i ||Wv j ])

[0396]

[0397]

[0398] Where: e ij Represents node v i For neighbor node v j The intermediate calculation result of the attention coefficient is obtained by passing the node v i and v j The vector representation first undergoes a shared linear transformation (through the weight matrix). d in It is the dimension of the input vector, d out (This refers to the transformed dimensions), then concatenated (using || to represent the concatenation operation), and then passed through a LeakyReLU activation function. This activation function introduces non-linearity, helping to learn more complex attention relationships. It is a learnable weight vector used to further refine the calculation of the attention coefficient. α ij The final calculated node v i For neighbor node v j Attention weights, which are applied to intermediate results e ij We obtain the result by performing exponentiation and normalization, here. Represents node v i The set of neighboring nodes of node v is normalized through this normalization operation, making node v i The sum of attention weights for all neighboring nodes is 1, which allows for the reasonable aggregation of information from neighboring nodes. It is node v iThe vector representation updated by the graph attention mechanism is obtained by representing the vector representations of neighboring nodes v. j According to the corresponding attention weight α ij The weighted summation is then passed through an activation function σ (such as the ReLU function) for nonlinear transformation. In this way, the node incorporates relevant information from its neighbors and focuses on the information of its neighbors that are more semantically related to itself based on attention weights, thereby enhancing the semantic fusion effect between nodes in the cross-semantic relationship fusion graph.

[0399] From an execution perspective, it is necessary to perform information update operations on each node in the cross-semantic relationship fusion graph according to the computation steps of the graph attention mechanism described above. A code example is shown below:

[0400]

[0401] 2. The significance of cross-semantic relation fusion graphs

[0402] The cross-semantic relationship fusion graph constructed through the graph attention mechanism further integrates semantic information between feature vector samples from different modalities. This ensures that each node (feature vector sample) not only contains its own original information but also incorporates information from other semantically related samples. Furthermore, this fusion is based on dynamic adjustment of attention weights, allowing for a greater focus on relevant information crucial to the semantic understanding of the current node. In network security analysis scenarios, for example, traffic feature vector samples can better combine log and behavioral semantic information to jointly reflect the network security status, providing a richer, more comprehensive, and fused semantic foundation for accurate subsequent labeling of network security threats.

[0403] III. Based on relevant knowledge, perform cross-semantic relation pattern reasoning and label network security threats to form a semantic training dataset.

[0404] 1. Cross-semantic relation pattern reasoning and labeling

[0405] Based on a predefined knowledge base of cybersecurity threat rules (let's call it K) rules ), a case knowledge graph based on historical cybersecurity incidents (let's call it K) cases ) and real-time updated external professional threat intelligence (set as I) threat This method uses cross-semantic relation pattern reasoning on the cross-semantic relation fusion graph to label cybersecurity threats. Let the set of cybersecurity threat labels be... For example, t1 could represent the label "DDoS attack," and t2 could represent the label "malware intrusion," etc. For each node (feature vector sample) in the cross-semantic relationship fusion graph, the existence of a corresponding cybersecurity threat is determined by searching for matching patterns in the knowledge base, knowledge graph, and threat intelligence, and the corresponding label is then assigned. For example, for node v... i (A node is a fusion of traffic feature vector samples and log and behavior feature vector samples), and a matching function M(v) can be defined. i ,K rules ,K cases ,I threat The return value is a set of tags representing possible cybersecurity threat tags that match the node. The specific matching process can be a combination of various methods such as rule matching, graph structure matching, and semantic similarity matching (the matching logic here is customized according to the specific knowledge base, knowledge graph, threat intelligence structure, and application scenario). For example, if there is a rule in the cybersecurity threat rule knowledge base: "When there is a sudden traffic surge in the traffic feature vector and a specific error record appears in the log feature vector and the behavioral feature vector shows abnormal operation, it is determined to be a DDoS attack," when node v i When the corresponding fused feature vector satisfies the condition of this rule, M(v) i ,K rules ,K cases ,I threat This will return a collection that contains the tag "DDoS attack".

[0406] From an execution perspective, it is necessary to traverse all nodes in the cross-semantic relationship fusion graph, call the matching function to perform pattern matching, and label the corresponding cybersecurity threat tags. A code example is shown below:

[0407]

[0408] 2. Create a semantic training dataset

[0409] After the above process of labeling cybersecurity threats, the entire labeled cross-semantic relationship fusion graph constitutes the semantic training dataset. This dataset can be represented by D = {(v...} i ,t i )|v i ∈V,t i ∈v i .threat lThe abels representation is used, where each element is a pair consisting of a feature vector sample and a corresponding cybersecurity threat label. It can be used for subsequent training of machine learning and deep learning models (such as classification models), allowing the model to learn the relationship between feature vectors after different semantic fusions and cybersecurity threats, thereby enabling accurate cybersecurity threat judgment on new unlabeled data.

[0410] To address this, by constructing a semantic alignment network and a cross-semantic relationship fusion graph based on a graph attention mechanism, the semantic information among feature vector samples from three different modalities—traffic, logs, and behavior—can be fully integrated. Instead of viewing data from each modality in isolation, this approach mines the potential semantic relationships between them and effectively fuses them. This results in feature vector samples containing more comprehensive and richer semantic content, reflecting the operational status of the network system and potential cybersecurity threats from multiple perspectives. This avoids the information bias caused by relying on only a single modality, improving the accuracy of cybersecurity situational awareness. Furthermore, the graph attention mechanism dynamically allocates attention weights based on the semantic relationships between nodes during the fusion process. This allows each feature vector sample to focus on parts closely related to its own semantics when fusing information from other modalities. This more accurately strengthens important cross-semantic relationships and filters out relatively unimportant noise, making the fused semantic information more targeted and effective. This helps to more clearly capture key semantic patterns related to cybersecurity threats in complex network environments. Furthermore, by leveraging a predefined knowledge base of cybersecurity threat rules, a case knowledge graph of historical cybersecurity incidents, and real-time updated external professional threat intelligence, cross-semantic relationship pattern reasoning is performed to label cybersecurity threats. This approach fully integrates domain expert knowledge, historical experience, and the latest security intelligence information, ensuring that the labeled tags better reflect actual cybersecurity situations, reducing the possibility of misjudgments and omissions, and improving the accuracy of cybersecurity threat identification. This provides a more reliable basis for subsequent cybersecurity management and response measures. Finally, the resulting semantic training dataset integrates multimodal fusion feature vectors and accurately labeled cybersecurity threats, providing high-quality training data for machine learning and deep learning models. Models trained on such rich and representative data can better learn the complex relationships between different semantic features and cybersecurity threats, improving the model's generalization ability and predictive ability for unknown cybersecurity threats. This enables more effective monitoring and prevention of cybersecurity threats in practical applications, ensuring the stable operation of network systems.

[0411] Optionally, the deep learning model includes a multi-branch fusion neural network structure, including a traffic feature processing branch, a log feature processing branch, a behavior feature processing branch, and a cross-modal fusion layer; the traffic feature processing branch includes a convolutional neural network and an attention layer, the log feature processing branch includes a recurrent neural network and a semantic embedding layer, and the behavior feature processing branch includes a graph neural network; the model training module calls the semantic training dataset to train the deep learning model to be trained, so that the deep learning model learns the relationship between the first network traffic data sample, the first log data sample, the first user behavior data sample and the corresponding network security threat label, and maps the relationship to the network parameters of the deep learning model to obtain a multi-level dynamic threat monitoring model, including the following steps: extracting local features of the traffic feature vector sample based on the convolutional neural network, and dynamically allocating weights based on the attention layer according to the importance of different local features in network security threat judgment to generate key traffic feature samples; extracting time series characteristics in the log feature vector sample based on the recurrent neural network to capture the correlation between log events at different time points to obtain time series features; mapping the time series features to a low-dimensional vector space based on the semantic embedding layer, so that they have similar semantics. Log features are located close to each other in the vector space to obtain log semantic sequence feature samples; based on the graph neural network, user behavior is used as nodes in the graph, and the associations between behaviors are used as edges, and neighbor node information is aggregated to generate behavior propagation features; based on the cross-modal fusion layer, the key traffic feature samples, log semantic sequence feature samples, and behavior propagation features are fused along different fusion paths to obtain multiple multimodal fused feature samples; based on the bilinear pooling layer, the second-order interaction information between the key traffic feature samples, log semantic sequence feature samples, and behavior propagation features is calculated to strengthen the multimodal fused feature samples; the multimodal fusion samples after feature strengthening are then processed. The fused feature samples are input into the fully connected layer to extract local information samples about cybersecurity threats contained in the fused feature samples of different modalities in their respective dimensions. The local information samples are then subjected to a nonlinear transformation to predict the probability distribution of cybersecurity threat types. Based on the cross-entropy loss function, the degree of difference between the predicted probability distribution of cybersecurity threat categories and the cybersecurity threat labels is calculated. The network parameters of the deep learning model are then adjusted through backpropagation to learn the relationship between the first network traffic data sample, the first log data sample, the first user behavior data sample, and the corresponding cybersecurity threat labels, until a multi-layered dynamic threat monitoring model is obtained.

[0412] Specifically, the detailed explanation of the above deep learning model training scheme is as follows:

[0413] I. Branch Operations for Flow Feature Processing

[0414] 1. Convolutional Neural Networks Extract Local Features

[0415] Let the sample set of traffic feature vectors be F = {f1, f2, ..., f...} n}, where each flow feature vector sample (d f (Represents the dimension of the traffic feature vector sample).

[0416] For a Convolutional Neural Network (CNN), there are m convolutional kernels, each with a size of k×k (this is an example of a two-dimensional system; if it were a one-dimensional feature vector, k would be the length), a stride of s, and padding of p. The kernel weight matrix is ​​represented as follows: (j = 1, 2, ..., m) The bias term represents the number of feature map channels output by the j-th convolutional kernel (i.e., the feature dimension obtained after convolution by this kernel). For sample f i The local feature value obtained at position (x,y) after convolution by the j-th convolution kernel. The calculation formula is as follows:

[0417]

[0418] Where (x, y) are the coordinates on the feature map. By sliding the convolution kernel across the flow feature vector samples according to rules such as kernel size and stride, the corresponding element is multiplied and accumulated with the kernel weights, and then a bias term is added to obtain the local feature value at that position. Performing the above operation on the entire sample region yields the feature map output by the j-th convolution kernel. (h and w are the feature map height and width calculated based on the input size, kernel size, stride and padding, respectively).

[0419] From an execution perspective, for each traffic feature vector sample, it is necessary to traverse each convolutional kernel and calculate the local feature value at the corresponding position according to the above formula. The code example is as follows:

[0420]

[0421] 2. Attention layer generates key traffic feature samples

[0422] Let the set of local feature maps obtained after convolution be... (corresponding to the traffic feature vector sample f) i (m feature maps). Define a learnable query vector. (d q The attention weights are calculated based on the dimension of the convolutional output features (which is typically adapted through a linear transformation). The following formula is used to measure the importance of each local feature map in cybersecurity threat assessment:

[0423]

[0424] in: The feature map vector is obtained by performing a dot product operation between the query vector and the feature map vector. This reflects the degree of correlation between the feature map and the focus represented by the query vector (related to network security threat assessment); the larger the value, the stronger the correlation. Then, for all feature maps... The attention weights are obtained by performing exponential operations and normalization. This ensures that the sum of the weights corresponding to all feature maps is 1, thereby highlighting important local features. Key traffic feature samples. The formula is obtained by weighting and summing the local feature maps according to attention weights:

[0425]

[0426] From an execution perspective, attention weights must first be calculated, and then a weighted sum is performed to generate key traffic feature samples. A code example is shown below:

[0427]

[0428] II. Log Feature Processing Branch Operations

[0429] 1. Recurrent Neural Networks for Extracting Time Series Characteristics

[0430] Let the log feature vector sample set be L = {l1, l2, ..., l n}, each of which (d l (The log feature vector sample dimension) and arranged in chronological order.

[0431] Taking Long Short-Term Memory (LSTM) networks as an example, for log feature vector samples l i In the processing of time step t, the calculation formula for the LSTM unit is as follows (simplified core part):

[0432]

[0433] Where: l it It is a log feature vector sample l i At time step t, the input vector (corresponding to the elements in the log feature vector), h t-1 It is the hidden state vector of the previous time step (the initial hidden state h0 can be randomly initialized), c t-1 It is the cell state vector of the previous time step (the initial cell state c0 can be reasonably initialized). and It is a weight matrix corresponding to different gating structures (input gate, forget gate, output gate, candidate memory unit). Through these weights, the input vector and the hidden state vector of the previous time step are linearly transformed, and then the activation function is used to update each state. This is the corresponding bias vector used for fine-tuning state updates. σ(·) is the sigmoid activation function (compressing values ​​to the [0,1] interval), ⊙ represents element-wise multiplication, and tanh(·) is the hyperbolic tangent activation function (mapping values ​​to the [-1,1] interval). Through these operations, LSTM can capture the correlation between log events at different time points. After processing all log feature vector samples, the final hidden state vector h is... T (T is the length of the sample time series) is the extracted time series feature, denoted as...

[0434] From an execution perspective, each time step needs to be processed sequentially according to the LSTM unit update rules described above. A code example is shown below:

[0435]

[0436] 2. Semantic embedding layer generates log semantic sequence feature samples

[0437] Suppose the time series features obtained through a recurrent neural network (corresponding log feature vector sample l) i (Time series feature vectors). The semantic embedding layer has a weight matrix. (d embed (for low-dimensional vector space dimensions) and bias vector Time series features are mapped to a low-dimensional vector space to obtain log semantic sequence feature samples. The calculation formula is:

[0438]

[0439] Through this linear transformation, based on the semantic mapping relationship learned by the semantic embedding layer, log features with similar semantics are brought closer together in the vector space, which facilitates subsequent fusion processing.

[0440] From an execution perspective, the mapping operation is performed according to the above formula, and the code example is as follows:

[0441] for i in range(len(L)):

[0442] L[i].semantic_sequence_feature=torch.mm(torch.tensor(W_embed),L[i].time_sequence_feature)+torch.tensor(b_embed)

[0443] III. Behavioral Feature Processing Branch Operations

[0444] Let the set of behavioral feature vector samples be B = {b1, b2, ..., b}. n The graph G = (V, E) is constructed using user behaviors as nodes and the relationships between behaviors as edges (where V = B, and E represents the set of edges reflecting the relationships between behaviors). Taking a Graph Convolutional Neural Network (GCN) as an example, let the node feature matrix of the l-th layer of the GCN be... (When l = 0, H) (0) It is the behavioral feature vector sample matrix, with dimension d. (0) After each convolutional layer, the dimension becomes d. (l) ).

[0445] The formula for graph convolution is as follows:

[0446]

[0447] in: Let G be the adjacency matrix of graph G. If node i and node j are connected by an edge (i.e., the behavior feature vector sample b), then... i and b j If the actions represented are related, then A ij =1, otherwise A ij =0, (I is the identity matrix) Consider node self-loops. It is a degree matrix, with diagonal elements D ii It is the degree of node i. diagonal elements This facilitates subsequent calculations. The l-th layer learnable weight matrix determines the feature mapping, and by adjusting it, it can focus on mining behavioral propagation features related to cybersecurity threats. σ(·) is an activation function (such as the ReLU function) that introduces non-linearity to help learn complex feature relationships. After L layers of graph convolution operations, the final feature matrix H is obtained. (L) Each row vector serves as the behavior propagation feature of the corresponding behavior feature vector sample, for example, behavior feature vector sample b. i Behavioral propagation characteristics are The convolution operation formula described above is used to perform matrix multiplication, normalization, and other operations in each layer to update the node feature matrix. A code example is shown below:

[0448]

[0449] IV. Cross-modal fusion layer operation

[0450] Let the key traffic feature sample set be... The log semantic sequence feature sample set is The set of behavioral propagation feature samples is

[0451] The cross-modal fusion layer fuses these features along different fusion paths, for example, a concatenation fusion method (this is just an example; in practice, it can be more complex). For the multimodal fusion feature sample m corresponding to the i-th sample... i The calculation formula is as follows:

[0452]

[0453] Here, [;] indicates that different feature vectors are concatenated in sequence to form a new fused feature vector. Multiple multimodal fused feature samples can be obtained through different fusion paths (such as different concatenation orders, adding weights, etc.), which fuse information from different modalities, explore the correlation between them, and provide more comprehensive data for subsequent analysis.

[0454] V. Bilinear Pooling Layer Operations

[0455] Let the multimodal fusion feature samples be... (d m (For the fused feature dimensions), enhanced feature samples are obtained through bilinear pooling. Bilinear pooling computes second-order interaction information between features of different modalities to capture more complex relationships between features and thus enhance feature representation. First, key traffic feature samples... Log semantic sequence feature samples Behavioral transmission characteristics Performing the outer product operation yields a third-order tensor T. i The formula for calculating its elements is as follows:

[0456]

[0457] in, In other words, corresponding to the dimension indices of the three feature vectors, a third-order tensor containing second-order interaction information is obtained through element-wise multiplication. However, directly using this third-order tensor results in too high a dimension and complex subsequent calculations, so dimensionality reduction is usually performed. Dimensionality reduction involves flattening this third-order tensor into a vector and then applying a linear transformation (e.g., multiplying by a learnable weight matrix). d pool (The target dimension after dimensionality reduction) and a bias term are added. The enhanced feature samples are obtained, and the calculation formula is as follows:

[0458]

[0459] Among them, vec(T) i ) indicates that the third-order tensor T i Flattening is an operation that transforms a tensor into a vector, which involves arranging all elements of the tensor in a certain order into a one-dimensional vector. This allows for the fusion of second-order interactive information through linear transformations and mapping it to a suitable dimensional space, thereby enhancing the multimodal fusion feature samples.

[0460] From an execution perspective, the third-order tensor needs to be calculated first according to the outer product rule, then flattened, and finally multiplied with the weight matrix and a bias term added to obtain the enhanced feature samples. A code example is as follows:

[0461]

[0462]

[0463] VI. Operations of Fully Connected Layers

[0464] The enhanced multimodal fusion feature samples are input into a fully connected layer to extract local information samples about cybersecurity threats contained in each dimension of the different modal fusion feature samples. These local information samples are then subjected to a nonlinear transformation to predict the probability distribution of cybersecurity threat types. Let the set of enhanced multimodal fusion feature samples be... Fully connected layers have learnable weight matrices. (d in It is the enhanced feature dimension of the input, i.e., d pool d out The output dimension of the fully connected layer (set according to the number of types of cybersecurity threats to be predicted, etc.) and the bias vector

[0465] For the input enhanced feature samples The output vector o after the fully connected layer i (This represents a predicted score vector for different types of cybersecurity threats, with each element corresponding to a score for a specific threat type.) The calculation formula is as follows:

[0466]

[0467] Then, in order to transform the score vector into a probability distribution, a softmax function is typically used for non-linear transformation to obtain the probability distribution vector of cybersecurity threat types. The calculation formula is:

[0468]

[0469] Among them, o ij It is the output vector o i The j-th element is converted into a probability value in the interval $[0,1]$ by the softmax function, and the sum of all probability values ​​is 1. In this way, the probability of each type of network security threat can be judged based on the probability.

[0470] From an execution perspective, linear operations and softmax transformations need to be performed according to the above formula. A code example is shown below:

[0471]

[0472] VII. Adjusting Model Parameters Based on Cross-Entropy Loss Function

[0473] Based on the cross-entropy loss function, the degree of difference between the predicted network security threat category probability distribution and the network security threat label is calculated. The network parameters of the deep learning model are then adjusted through backpropagation to learn the relationship between the first network traffic data sample, the first log data sample, the first user behavior data sample and the corresponding network security threat label, until a multi-level dynamic threat monitoring model is obtained.

[0474] Let the predicted probability distribution vector of cybersecurity threat categories be... (The prediction result corresponding to sample i) The real cybersecurity threat label is represented using one-hot encoding as follows: (For example, if there are k threat types, and the true label corresponding to sample i is the m-th threat type, then y i The m-th element is 1, and the rest are 0.

[0475] The formula for calculating the Cross Entropy Loss function is as follows:

[0476] Where n is the number of samples, this loss function measures the difference between the predicted probability distribution and the true label; the smaller the loss value, the closer the prediction result is to the reality. During training, based on this loss value, the backpropagation algorithm is used to adjust the network parameters of the deep learning model (such as the convolutional kernel weights and the weight matrix of the fully connected layer in a convolutional neural network). The backpropagation algorithm updates the parameters according to the gradient of the loss function with respect to each parameter. For example, for the parameter θ (which can be a general representation of the various weight matrices or bias vectors mentioned above), the update formula is as follows:

[0477]

[0478] Here, η is the learning rate, a pre-set positive number used to control the step size of parameter updates. By continuously calculating the loss and performing backpropagation to update the parameters on the training dataset, the model is continuously optimized, gradually learning the relationship between input network traffic, logs, user behavior data samples and corresponding network security threat labels, until the model achieves good performance on evaluation metrics such as the validation set, thus obtaining a multi-layered dynamic threat monitoring model. From an execution perspective, it is necessary to first calculate the cross-entropy loss of each sample, then calculate the gradient of each parameter according to the backpropagation algorithm, and adjust the parameters according to the update formula. This process is performed iteratively multiple times on the training dataset. A code example is shown below:

[0479]

[0480] Therefore, by processing traffic, logs, and behavioral features separately through different branches, the key information contained within each modality of data can be fully extracted. For example, the traffic feature processing branch uses convolutional neural networks and attention layers to extract local features from traffic feature vector samples and focuses on local features important for judging network security threats through attention mechanisms, making the model more attentive to valuable traffic-related clues. The log feature processing branch uses recurrent neural networks to capture the characteristics of logs over time and then strengthens semantic associations through semantic embedding layers, which can better uncover the evolution of system state changes and potential security issues reflected in logs over time. The behavioral feature processing branch uses graph neural networks to aggregate the correlation information between behaviors to generate behavioral propagation features, which helps to understand the propagation patterns and abnormal behaviors of user behavior in the network. In addition, the design of cross-modal fusion layers and bilinear pooling layers allows features from different modalities to be organically integrated and enhanced. The cross-modal fusion layer integrates key features from various modalities through different fusion paths, achieving the convergence of multi-source information and avoiding the isolation of data from different modalities. The bilinear pooling layer further mines the second-order interaction information between features from different modalities, enabling the model to capture more complex and subtle cross-modal correlations. For example, the simultaneous appearance of traffic features with specific log semantic features and behavioral propagation features may indicate security threats. This results in the fused features containing richer and more comprehensive information about the network security situation, improving the model's understanding and analysis capabilities in complex network security scenarios. Furthermore, the model is trained using the cross-entropy loss function combined with the backpropagation algorithm, enabling the model to accurately learn the relationship between network traffic, logs, user behavior data samples, and corresponding network security threat labels. By continuously adjusting network parameters and optimizing the matching degree between the predicted network security threat type probability distribution and the real labels, prediction errors are reduced, and the model's accuracy and reliability in identifying different network security threat types are improved. This allows the model to more effectively monitor network security risks and issue timely warnings in practical applications. Finally, the entire deep learning model structure and training process ultimately yields a multi-layered dynamic threat monitoring model. This model can dynamically analyze the cybersecurity situation based on the characteristics and correlations reflected in different modalities at different levels. Unlike traditional single-dimensional or simple models that can only make static and one-sided judgments, this model can comprehensively consider multiple factors and update its security threat assessment in real time as the network state changes. It better adapts to complex and ever-changing network environments, providing stronger support for cybersecurity.

[0481] Optionally, the model deployment module deploys the multi-layered dynamic threat monitoring model on the cloud server, so that when the multi-layered dynamic threat monitoring model extracts and processes the operational data features of the target network based on its network parameters to predict the network security threats occurring in the target network, the steps include: inputting the preprocessed operational data of the target network into the convolutional neural network in the traffic feature processing branch to extract local features of the network traffic data; the attention layer dynamically allocates weights to generate key traffic features according to the current network security threat judgment; the recurrent neural network extracts the time series characteristics of the log data in the operational data and captures event correlations in the log feature processing branch; the semantic embedding layer maps it to log semantic sequence features; the graph neural network extracts the time series characteristics of the log data in the operational data and captures event correlations in the log feature processing branch; the graph neural network maps it to log semantic sequence features in the behavioral feature processing branch. In the processing branch, behavioral data in the operational data is aggregated with neighbor node information using user behavior as nodes and behavior association as edges to obtain behavioral propagation features. Through a cross-modal fusion layer, the extracted key traffic features, log semantic sequence features, and behavioral propagation features are fused along different fusion paths to obtain multimodal fusion features. A bilinear pooling layer is used to enhance the second-order interaction information between features, thereby strengthening the multimodal fusion features. The enhanced multimodal fusion features are then input into a fully connected layer to extract local information about network security threats contained in different modal fusion features at their respective dimensions. This local information is then subjected to a nonlinear transformation to predict the probability distribution of network security threat types, thereby determining whether a security threat exists in the target network and the specific threat type.

[0482] The prediction process here is similar to the training process described above, and will not be elaborated further.

Claims

1. A multi-layered dynamic threat monitoring system based on deep learning, characterized in that, include: The system includes a front-end electronic device and a back-end server. The front-end electronic device is equipped with a data acquisition module, a data preprocessing module, a feature extraction module, a data vectorization module, and a semantic sequence construction module. The back-end server is equipped with a model training module and a model deployment module. The data acquisition module calls the monitoring interface based on the cross-platform development framework and the system's underlying layer to detect the system's underlying layer in real time, so as to capture things such as user gesture operations, system-level application calls, and interactive behaviors between different applications. Based on differential privacy, the interaction behavior is associated with the corresponding user subject and noise is added to generate a first user behavior data sample; the first user behavior data sample is added to the distributed ledger; based on the set context-aware dynamic labeling mechanism, the network security threat label of the first user behavior data sample is labeled in the distributed ledger. The data preprocessing module is used to preprocess the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample, respectively. The feature extraction module is used to extract features from the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data sample, log feature data sample, and behavior feature data sample, respectively. The data vectorization module is used to obtain traffic feature vector samples, log feature vector samples, and behavior feature vector samples from the traffic feature data samples, log feature data samples, and behavior feature data samples, respectively. The semantic sequence construction module is used to perform cross-semantic relationship analysis on the traffic feature vector samples, log feature vector samples, and behavior feature vector samples to obtain a cross-semantic relationship graph, and to label the network security threat tags on the cross-semantic relationship graph to form a semantic training dataset. The model training module is used to call the semantic training dataset to train the deep learning model to be trained, so that the deep learning model learns the relationship between the first network traffic data sample, the first log data sample, the first user behavior data sample and the corresponding network security threat label, and maps the relationship to the network parameters of the deep learning model to obtain a multi-level dynamic threat monitoring model. The model deployment module is used to deploy the multi-layered dynamic threat monitoring model on the backend server, so that the multi-layered dynamic threat monitoring model can extract and process the operational data features of the target network based on its network parameters to predict the network security threats occurring in the target network. Among them, based on the established context-aware dynamic labeling mechanism, the network security threat label of the first user behavior data sample is labeled in the distributed ledger, and the following variables are defined to measure relevant contextual factors: Let Indicators representing the security status of the network This indicates the metrics representing the user's current business operation scenario. This represents the system's resource usage metrics. A context-aware threat assessment function is constructed to determine whether a threat is identified and its corresponding threat label. The threat label is represented by L, with values ​​of 0 indicating no threat, 1 indicating a low-level threat, 2 indicating a medium-level threat, and 3 indicating a high-level threat. in, , , These thresholds are set based on experience and actual security needs, and different threshold ranges correspond to different threat level judgments.

2. The deep learning-based multi-layered dynamic threat monitoring system according to claim 1, characterized in that, The data acquisition module, when acquiring the first network traffic data sample, the first log data sample, the first user behavior data sample, and the network security threat tags of the first network traffic data sample, the first log data sample, and the first user behavior data sample respectively, includes the following steps: The data acquisition module sends an acquisition request to the SDN controller, which then directs traffic that meets predetermined requirements to the acquisition port specified by the data acquisition module to collect the first network traffic data sample based on the network global view and flow table rules. The collected first network traffic data sample is compressed using a set content-aware lossless compression mechanism and cached in a local cache. Based on the labeling component of the constructed multi-source threat intelligence, it is matched with the first network traffic data sample at the local cache to assign network security threat labels to the first network traffic data sample.

3. The multi-layered dynamic threat monitoring system based on deep learning according to claim 1, characterized in that, The data acquisition module, when acquiring the first network traffic data sample, the first log data sample, the first user behavior data sample, and the network security threat tags of the first network traffic data sample, the first log data sample, and the first user behavior data sample respectively, includes the following steps: The data acquisition module calls containerized log acquisition nodes to collect first log data samples from different log sources to generate a blockchain block containing timestamps, device identifiers, and log summaries, and performs consensus verification on the blockchain block to determine the authenticity of the first log data sample. In response to the fact that the authenticity of the first log data sample is greater than the set authenticity threshold, the first log data sample is parsed and constructed into a knowledge graph according to entities and relationships and stored in the graph database; A labeling mechanism based on user and device behavior profiles is used to match the graph database, thereby labeling the knowledge graph with corresponding cybersecurity threat tags.

4. The multi-layered dynamic threat monitoring system based on deep learning according to claim 1, characterized in that, The data preprocessing module preprocesses the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample, respectively, including the following steps: Based on the trained protocol classification model, protocol traffic identification is performed on the first network traffic data sample to remove noise data in the first network traffic data sample. Time series analysis is performed on the first network traffic data sample after the noise data has been removed to correct the timestamp of the first network traffic data sample, and a second network traffic data sample is generated accordingly.

5. The multi-layered dynamic threat monitoring system based on deep learning according to claim 1, characterized in that, The data preprocessing module preprocesses the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample, respectively, including the following steps: Based on a sequence-to-sequence model using a recurrent neural network, the first log data sample is semantically understood and parsed to parse a system log containing multiple event information into a structured record containing time, event type, event subject, and detailed description. The structured records are mapped onto a knowledge system framework for log data built on ontology to generate a log data knowledge graph. Log outlier detection is based on a combination of density clustering and outlier detection. The log data knowledge graph is then semantically repaired to generate the second log data sample.

6. The multi-layered dynamic threat monitoring system based on deep learning according to claim 1, characterized in that, The data preprocessing module preprocesses the first network traffic data sample, the first log data sample, and the first user behavior data sample to obtain the second network traffic data sample, the second log data sample, and the second user behavior data sample, respectively, including the following steps: Based on the establishment of a multi-source data association model, the first user behavior data samples from the same user from different channels are cross-validated and fused. When there is an inconsistency in time or operation sequence between the first user behavior data samples and the user operation logs recorded by the application system, the user login time and permission information are used as auxiliary tools to comprehensively judge and correct the integrity of the first user behavior data samples. For the missing data parts, a behavior sequence prediction and completion mechanism based on Markov chains is used to complete the missing data based on the user's historical behavior patterns and the statistical laws of group behavior to generate the second user behavior data samples.

7. The deep learning-based multi-layered dynamic threat monitoring system according to claim 1, characterized in that, When the feature extraction module performs feature extraction on the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, the following steps are included: The nodes in the network are used as vertices of the graph, the network connections between nodes and the flow direction are used as edges, and the magnitude and frequency of the flow are used as the weights of the edges to construct a flow graph structure. Feature extraction is performed on the traffic graph structure representation based on graph convolutional neural networks to remove key nodes in the top network, traffic convergence areas, and traffic association patterns between different network segments, and traffic feature data samples are generated accordingly.

8. The multi-layered dynamic threat monitoring system based on deep learning according to claim 1, characterized in that, When the feature extraction module performs feature extraction on the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, the following steps are included: Based on a pre-trained language model, each word in the second log data sample is labeled with a corresponding semantic role. Based on the labeled semantic roles, the subject, object, method, time and location of the event are extracted to generate the log feature data sample.

9. A multi-layered dynamic threat monitoring system based on deep learning according to claim 1, characterized in that, When the feature extraction module performs feature extraction on the second network traffic data sample, the second log data sample, and the second user behavior data sample to generate traffic feature data samples, log feature data samples, and behavior feature data samples, the following steps are included: Using users as nodes, user actions at different times, on different application systems or devices are used as edges, and the time interval between actions and the frequency of actions are used as attributes of the edges to construct a user behavior trajectory graph. The user behavior trajectory graph is mapped to a low-dimensional vector space by graph embedding to determine the dynamic changes in user behavior and the correlation between different behaviors, and the behavior feature data samples are generated accordingly.

Images