Network multi-step attack prediction method based on space-time fusion dynamic graph convolution

Abstract

The invention relates to a network multi-step attack prediction method based on space-time fusion dynamic graph convolution. Compared with the prior art, the defect that network attack prediction is difficult to meet actual application requirements is overcome. The method comprises the following steps: extracting network alarm attributes; performing data preprocessing on the alarm attribute data; constructing a network multi-step attack prediction model; and performing multi-step attack prediction. According to the method, the attack probability can be predicted, and the specific parameters of the expected attack can be predicted, so that better network defense measures can be applied.

Description

Technical Field

[0001] The present invention relates to the technical field of computer network security, and more specifically, to a network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution. Background Art

[0002] Given the increasing number and intensity of network attacks, it is necessary to continuously monitor and analyze the large amount of data transmitted globally. This has led to the development of various network monitoring and analysis systems, including Intrusion Detection Systems (IDS), honeypots, network traffic monitors, etc. Such systems are widely deployed in today's networks to help administrators cope with various attacks and intrusions. Sometimes, data from these systems is also shared among multiple organizations using various data sharing platforms, which allows for more proactive solutions (such as blocking the most dangerous attackers in other networks) rather than reactive solutions. In recent years, the availability of a large amount of information on detected network attacks, as well as the latest advances in machine learning, have enabled research to focus not only on detection but also on the prediction of network attacks.

[0003] In recent years, many attack prediction methods have been proposed in the field of network security. Although they are good proof-of-concepts showing that it is possible to predict future attacks, their capabilities are still very limited and their use in practice is also limited. For example, they only allow predicting the expected number of attacks detected within a future time interval, the most likely next step of an ongoing multi-stage attack, or just predicting the probability of an attack from a given source.

[0004] Traditional intrusion detection systems and defense technologies mostly rely on rule and feature analysis. Although they can detect attacks, they often have difficulty dealing with complex and ever-changing attack behaviors and cannot predict the specific characteristics and development trends of attacks. Most existing prediction methods can only provide attack quantity or simple next-step predictions, lacking accurate predictions of attack types, intensities, and targets. In view of the continuous growth and complexity of current network attacks, how to propose a new network attack prediction method aiming to improve the accuracy and proactivity of network security protection has become a technical problem that urgently needs to be solved. Summary of the Invention

[0005] The purpose of the present invention is to solve the defect that network attack prediction in the prior art is difficult to meet the actual application requirements, and to provide a network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution to solve the above problems.

[0006] To achieve the above purpose, the technical solution of the present invention is as follows:

[0007] A network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution, comprising the following steps:

[0008] 11) Extraction of network alarm attributes: Obtain security alarm data from different network intrusion prevention systems and extract alarm attribute data in IDEA format;

[0009] 12) Preprocess the alarm attribute data;

[0010] 13) Constructing a network multi-step attack prediction model: Using the spatiotemporal fusion dynamic graph convolutional recurrent network to construct a network multi-step attack prediction model;

[0011] 14) Perform multi-step attack prediction: monitor network traffic data, obtain security alarm data and pre-process it, input the security alarm data into the network multi-step attack prediction model, and predict potential attack events.

[0012] The extraction of the network alarm attribute comprises the following steps:

[0013] 21) Keep the entries in the IDEA format alarm attribute data that match the preset alarm tuple, and remove all irrelevant data columns. The extracted alarm attributes include: DetectTime: alarm generation time, numeric type; SourceIP: source IP address of the attack, numeric type; TargetIP: target IP address of the attack, numeric type; Port: port of the target system accessed, category value; Protocol: protocol used when executing the attack, category value; Category: attack category, category value; Node: name of the detector that issued the alarm, category value; Node Type: type of detector that issued the alarm, category value;

[0014] 22) For alerts on missing categorical values, create a new dummy category "Other Column Name" for each column;

[0015] 23) The Port field is divided into 16 categories. The 15 most frequently occurring port numbers in all historical alarm sequences are considered as independent categories, and the remaining port numbers are classified as "other ports";

[0016] 24) For alerts where the TargetIP field is missing, insert a dummy address of 0.0.0.0.

[0017] The data preprocessing of the alarm attribute data comprises the following steps:

[0018] 31) Prune SourceIP and TargetIP to / 24 prefix;

[0019] 32) Convert all categorical variables into numerical values ​​through label encoding;

[0020] 33) Use the Word2vec model to vectorize and represent the attack types;

[0021] 34) Perform MinMax scaling on each column of the alarm data after the above processing to ensure that all training data is normalized between 0 and 1, and merge multiple features of each alarm event into one vector;

[0022] 35) Arrange all alarm events in ascending order of timestamp according to the DetectTime field to ensure the causality of the time series;

[0023] 36) Construct time series samples according to the time sliding window, arrange the N events in each window in chronological order to form a sample .

[0024] The steps for constructing the network multi-step attack prediction model include the following:

[0025] 41) Replace the matrix multiplication in GRU with a dynamic graph convolution module, and design a network structure composed of GRU units based on dynamic graph convolution, that is, the network multi-step attack prediction model;

[0026] 411) Generate a dynamic adjacency matrix by fusing time period embedding and node features,

[0027] 412) Use graph convolution operations with decomposable parameter matrices to process spatial features;

[0028] 42) Realize the joint modeling of spatio-temporal features through the reset gate, update gate and candidate state gate. For any time step , given the input sample and the previous hidden state , the implementation of the network structure composed of GRU units based on dynamic graph convolution includes the following steps:

[0029] 421) Calculate the forgetting ratio through the reset gate :

[0030] ,

[0031] where, represents the sigmoid activation function to ensure the non-linear activation of the network, is the weight matrix used to calculate the reset gate , is a learnable parameter, is the bias term of the reset gate;

[0032] 422) Calculate the memory ratio through the update gate:

[0033] ,

[0034] Among them, is the weight matrix for calculating the update gate and are learnable parameters, is the bias term of the update gate;

[0035] 423) Generate a candidate state:

[0036] ,

[0037] Among them, is an activation function, represents element-wise multiplication, are learnable parameters, represents the weight matrix of the hidden state, represents the bias term of the hidden state, is the candidate state;

[0038] 424) Output the spatio-temporal fusion feature :

[0039] ;

[0040] 425) Map the spatio-temporal fusion feature output by the dynamic graph convolutional GRU to the prediction target space through a fully connected layer and generate a probability distribution through the Softmax function, representing the possibility that the attack event at the next moment belongs to each type :

[0041] ,

[0042] Among them, and are learnable parameters.

[0043] The generation of the dynamic adjacency matrix by fusing the time period embedding and node features includes the following steps:

[0044] 51) For any time step , splice the sample of the alarm node with the daily cycle and weekly cycle time embedding vectors to form the input feature ;

[0045] ,

[0046] Among them, , represents the feature dimension, B is the batch size, representing the number of samples processed at one time, represents the sequence length, represents the splicing symbol, and respectively represent the daily cycle and weekly cycle cyclic embeddings at time t, which are the input features of the dynamic graph generation module, is a three-dimensional tensor representing the features of multiple nodes in a batch, is a matrix composed of N rows and D columns;

[0047] 52) The concatenated input features are processed by a multi-layer perceptron to obtain a dynamic feature signal:

[0048] ,

[0049] where, represents the dynamic feature signal after filtering;

[0050] 53) Use element-wise multiplication to and the static, randomly initialized node embeddings to combine. The parameters of the node embedding are learnable and generate dynamic filters for the source node and target node embeddings respectively:

[0051] ,

[0052] ,

[0053] where, represents element-wise multiplication, is the activation function, and represent the node embeddings of the source node and target node respectively, is the source node dynamic filter, the target node dynamic filter, is a hyperparameter that controls the saturation of the activation function and controls the strength of the filter;

[0054] 54) The dynamic adjacency matrix is calculated by considering the similarity between nodes. The similarity is based on the product of the node embeddings and , and the calculation formula is as follows:

[0055] ,

[0056] where, ReLU and tanh are activation functions used to introduce non-linearity; the final is the dynamic adjacency matrix at time step and represents the dynamic dependence relationship between nodes.

[0057] The spatial feature processing using graph convolution operation with decomposable parameter matrix includes the following steps:

[0058] 61) Normalize the obtained adjacency matrix to ensure the stability of graph convolution operation:

[0059] ,

[0060] wherein, is the output of the graph convolution layer, representing the new feature representation of the node after fusing its own features and neighbor features, is the identity matrix, is the node degree matrix, and the degree matrix is a diagonal matrix representing the number of connections of each node, and are both learnable parameters, is the sample feature of the alarm node;

[0061] 62) To prevent overfitting and improve the model effect, further optimize the graph convolution, and reduce the computational complexity through the linear combination of three learnable parameter matrices:

[0062] ,

[0063] wherein, , and are three different learnable parameters, is used to map the features of the node from the original dimension to the new dimension, is used for further feature mapping, is the bias vector, is the time step of the dynamic adjacency matrix.

[0064] A computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, a network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution is realized.

[0065] A computer device includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes, a network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution is realized.

[0066] A network security defense system integrates a network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution. The network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution is linked with a firewall and an intrusion prevention device, and the defense strategy is dynamically adjusted according to the prediction result.

[0067] Beneficial effects

[0068] Compared with the prior art, the network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution of the present invention can not only predict the probability of an attack, but also predict the specific parameters of the expected attack (such as its type and target), so that better network defense measures can be applied.

[0069] The present invention constructs a dynamic graph structure to model the spatio-temporal interaction relationship between security alert nodes, uses a graph convolutional network to extract topological features, and combines a gated recurrent unit (GRU) to learn the temporal evolution law of attack behaviors. This method innovatively adopts a spatio-temporal fusion mechanism to dynamically aggregate the state information of neighboring nodes and the temporal dependence features extracted by GRU, realizing accurate modeling of complex attack links. It can mine the spatio-temporal correlation of attack behaviors from a large amount of heterogeneous security data, use GRU to capture long-term dependence relationships, and at the same time combine dynamic graph convolution to infer the potential movement strategies of attackers. By fusing spatio-temporal features, the model can accurately predict potential network attack trends, realize early warning of attack behaviors, provide more comprehensive prediction support for network defense systems, and provide data basis for real-time defense decisions, improving the intelligence and initiative of network protection.

[0070] The present invention ensures the comprehensiveness and representativeness of data by obtaining alert data from different intrusion prevention systems and extracting important alert attributes; secondly, by preprocessing the alert data, including cleaning, format unification, and normalization operations, the data quality is effectively improved, laying a solid foundation for subsequent analysis; then, a multi-step attack prediction model based on a spatio-temporal fusion dynamic graph convolutional recurrent network is constructed, and the spatial correlation of security alert nodes is modeled through a dynamic graph, and GRU is used to capture the temporal evolution law of attack behaviors, so as to realize the prediction of multi-step attack behaviors; finally, by formulating rules for estimating the accuracy of attack prediction, the performance of the model is further optimized to ensure the reliability and practicability of the prediction results. The present invention can provide threat warnings for security teams and improve the overall efficiency and effect of network security defense. Through this method, network security managers can take more targeted defense measures before an attack occurs, such as optimizing firewall rules, setting rate limits, and login attempt limits, etc., so as to effectively reduce the losses caused by attacks and improve network security. Brief description of the drawings

[0071] Figure 1 It is the sequence diagram of the method of the present invention;

[0072] Figure 2 It is the architecture diagram of the network multi-step attack prediction model involved in the present invention;

[0073] Figure 3This is a diagram of the architecture of the gated recurrent unit based on dynamic graph involved in the present invention;

[0074] Figure 4 This is a diagram of the network attack prediction accuracy estimation process involved in the present invention. DETAILED DESCRIPTION

[0075] In order to have a further understanding and recognition of the structural features and the effects achieved by the present invention, a preferred embodiment and accompanying drawings are used for detailed description as follows:

[0076] like Figure 1 As shown, the network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution described in the present invention includes the following steps:

[0077] The first step is to extract network alarm attributes: obtain security alarm data generated by different network intrusion prevention systems and extract alarm attribute data in IDEA format.

[0078] Since the alerts generated by different network intrusion prevention systems differ in structure and content, it is necessary to convert these heterogeneous alert data into a unified standard format for further analysis and processing. Alerts from different security devices are provided in IDEA format, a simple JSON-based format for describing various security events, which is designed to be easy for people to read and understand, and can be directly parsed and generated by computers.

[0079] (1) The entries in the IDEA format alarm attribute data that match the preset alarm tuple are retained, and all irrelevant data columns are removed. The extracted alarm attributes include: DetectTime: alarm generation time, numeric type; SourceIP: source IP address of the attack, numeric type; TargetIP: target IP address of the attack, numeric type; Port: the port through which the target system is accessed (such as port 80, port 5600, etc.), category value; Protocol: the protocol used when executing the attack (such as TCP, UDP, etc.), category value; Category: attack category (such as reconnaissance, scanning, attack attempt, etc.), category value; Node: the name of the detector that issued the alarm, category value; Node Type: the type of detector that issued the alarm (such as honeypot, IDS, traffic monitor, etc.), category value.

[0080] (2) For alerts on missing categorical values, create a new dummy category “Other Column Name” for each column.

[0081] (3) The Port field is divided into 16 categories. In all historical alarm sequences, the 15 port numbers with the highest frequency are considered as independent categories, and the remaining port numbers are classified as "other ports" category.

[0082] For alerts with a missing TargetIP field, insert a virtual address 0.0.0.0.

[0083] Step 2: Perform data preprocessing on the alarm data.

[0084] Although having an end-to-end learning system is ideal, it is not feasible to directly input complex IDEA format alerts into a deep learning model. Therefore, appropriate data conversion and preprocessing are prerequisites for effectively utilizing the model.

[0085] First, only the entries corresponding to the selected alert tuples are retained in the security alarm dataset, and all other irrelevant columns are removed. Next, the missing value problem in the dataset is addressed. For alerts with missing categorical values (such as protocol, detector type, etc.), a new virtual category "other column name" will be created for each column (e.g., "other protocol", "other detector", etc.). In addition, although the Port field contains numbers, it should be regarded as a categorical variable because the port number is only used as a label and does not represent an actual numerical value. Therefore, the Port field is divided into 16 categories. Among all the historical alert sequences, the 15 most frequently occurring port numbers are regarded as independent categories, and the remaining port numbers with lower frequencies are grouped into the "other ports" category. For alerts with a missing TargetIP field, a virtual address 0.0.0.0 will be inserted. After all missing values are processed, data preprocessing is then carried out.

[0086] During the preprocessing process, the SourceIP and TargetIP entries are trimmed to their / 24 prefixes. Since deep learning algorithms require numerical data rather than text information, all categorical variables (such as protocol, detector, type, etc.) are converted to numerical values through label encoding, which essentially assigns digital labels to categorical data. In addition, to ensure the semantic integrity of the attack type, a Word2vec model is used to vectorize and represent the attack type. Finally, MinMax scaling is performed on each column in the dataset to ensure that all training data is normalized between 0 and 1, thus avoiding the adverse effects of large numerical values on the training process.

[0087] Perform MinMax scaling on each column of the alarm data after the above processing to ensure that all training data is normalized between 0 and 1, and merge multiple features of each alarm event into one vector. Arrange all alarm events in ascending order of timestamp according to the DetectTime field to ensure the causality of the time series. Construct time series samples according to the time sliding window, and arrange the N events within each window in chronological order to form a sample. 。

[0088] Step 3: Construct a network multi-step attack prediction model: Use a spatio-temporal fusion dynamic graph convolutional recurrent network to construct a network multi-step attack prediction model.

[0089] The multi-step attack prediction architecture proposed by the present invention is as Figure 2 shown. Its core is a dynamic graph convolutional recurrent network based on spatio-temporal fusion. This network uses a dynamic graph-based gated recurrent unit (DGGRU) as the basic building block, which innovatively replaces the matrix multiplication operation in the traditional GRU with a dynamic graph convolution operation, thereby realizing the collaborative modeling of the spatio-temporal characteristics of network attack behaviors, as Figure 3 shown. By fusing spatio-temporal characteristics, the model can accurately predict potential network attack trends, achieve early warning of attack behaviors, provide more comprehensive prediction support for network defense systems, and provide data basis for real-time defense decisions, improving the intelligence and initiative of network protection.

[0090] In the attack prediction method proposed by the present invention, the generation of the dynamic graph is crucial. This method uses a dynamic adjacency matrix to model spatial dependence relationships, which is independent of the predefined adjacency matrix and can be applied to any situation without prior knowledge. For each time step , the features of the alarm nodes are connected with the time information to form the input of the dynamic graph generation module:

[0091] ,

[0092] where, , represents the feature dimension; and respectively represent the daily cycle and weekly cycle embeddings at time t, and the symbol represents the concatenation operation. Subsequently, the input features are processed by a multi-layer perceptron (MLP) to obtain a dynamic feature signal:

[0093] ,

[0094] where, represents the filtered dynamic feature signal, and is combined with the randomly initialized static node embedding feature through element-wise multiplication ( has learnable parameters). In actual implementation, the system will generate two groups of dynamic filters for the source node and the target node respectively, and their expressions are:

[0095] ,

[0096] ,

[0097] where represents element-wise multiplication. The dynamic adjacency matrix is obtained by calculating the similarity between alarm nodes, specifically as follows:

[0098] ,

[0099] where is a hyperparameter used to determine the saturation level of the activation function; is the time step of the dynamic adjacency matrix. After normalization, the obtained dynamic adjacency matrix is input into the graph convolution module:

[0100] ,

[0101] where and are learnable parameter matrices. To prevent overfitting caused by too many parameters, the graph convolution is optimized, and the optimization formula is as follows:

[0102] ,

[0103] where , and are three different learnable parameters. In the experiment , the computational complexity is significantly reduced through matrix decomposition.

[0104] The multi-step attack prediction task faces the challenge of complex spatio-temporal correlations. To effectively capture these features, the present invention first explores spatial and short-term temporal correlations by generating a dynamic graph, and then introduces GRU to solve the dependence problem in long-term time series. The matrix multiplication in GRU is creatively replaced by a dynamic graph convolution module, constructing a network structure composed of GRU units based on dynamic graph convolution. In the proposed method, the GRU operation acts independently on each alarm node, and all nodes share the same GRU parameters. This design strategy not only enhances the generalization ability of the model, enabling it to handle graph data of different scales and structures, but also improves the parameter efficiency and reduces the risk of overfitting. Specifically, for any time step , given the input and the previous hidden state , the implementation of DGGRU can be described by the following formula:

[0105] ,

[0106] ,

[0107] ,

[0108] ,

[0109] where represents the sigmoid activation function, ensuring the non-linear activation of the network, and are the reset and update gates of time , , and are the learnable parameters of DGGRU. This method can simultaneously capture the spatial and temporal correlations in the traffic network within a unified framework, significantly improving the performance and interpretability of the multi-step attack prediction model.

[0110] Step 4, perform multi-step attack prediction: Monitor network traffic data, obtain security alert data and preprocess it, and input the preprocessed alert data into the network multi-step attack prediction model to predict potential attack events.

[0111] The prediction accuracy is estimated by comparing the prediction results of all test vectors with the corresponding true value warnings. The difference metric (error value) between the actual warning and the prediction result is calculated by the weighted sum of the differences in each field. The comparison method for each field is described below and is shown in Figure 4 .

[0112] Classification fields: For classification fields such as category, port, and protocol, directly compare the predicted result with the actual (true value) warning. If they match, the error component of this field is set to 0; otherwise, it is set to 1. In addition, considering that the port and protocol values of some true value samples are "other port numbers" and "other protocols" respectively, which means that this field is empty in the original reported warning (marked as "other" during the preprocessing), any prediction for this case is considered correct, and the error component is counted as 0.

[0113] TargetIP field: The three octets in the TargetIP field are compared as follows. The first and second octets must match exactly because any mismatch in these octets means that the predicted and actual TargetIPs are far apart and may be in completely different networks. Therefore, if the first or second octet does not match, the error component of TargetIP is set to 1.0, and the third octet is not compared. If the first and second octets of the predicted warning match the actual warning, the third octet is compared by calculating the number of common leftmost bits n (i.e., the length of the common prefix, in binary).

[0114] DetectTime: It is calculated by the difference of the logarithms (base 10) of the DetectTime values of the actual and predicted results. Using logarithms ensures that warnings with expected times very close to each other have higher precision, while warnings further into the future are given lower precision. To this end, the absolute timestamps are first recalculated relative to the last warning in the historical window, expressed as Figure 4 in and , so they indicate how close or far the warning is from the present. After that, the error of DetectTime is calculated as and the absolute value of the difference of the logarithms.

[0115] The error components of each field are multiplied by the corresponding weights according to the importance of each field in the warning prediction. For example, the error component of the Category field is given the highest weight (2.0) because the attack type is considered the most important feature. The approximate time and target (DetectTime and TargetIP fields) may also be quite important, so their weights are medium (1.0). The Port and Protocol fields contain similar types of information (i.e., the services being attacked) and are highly correlated with each other. A mismatch in one usually means a mismatch in the other. Therefore, we assign a weight of 0.5 to each field, and the total weight of the two added together is 1.0. Finally, each error component is multiplied by the corresponding (normalized) weight and summed up.

[0116] The above shows and describes the basic principles, main features and advantages of the present invention. Those skilled in the art of this industry should understand that the present invention is not limited by the above embodiments. What is described in the above embodiments and the specification is only the principle of the present invention. Without departing from the spirit and scope of the present invention, the present invention will have various changes and improvements, and these changes and improvements all fall within the scope of the present invention claimed. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. A multi-step attack prediction method for a network based on spatio-temporal fusion dynamic graph convolution, characterized in that, The following steps are involved: 11) Extraction of network alarm attributes: Obtain security alarm data from different network intrusion prevention systems and extract alarm attribute data in IDEA format; 12) Preprocess the alarm attribute data; 13) Constructing a network multi-step attack prediction model: Using the spatiotemporal fusion dynamic graph convolutional recurrent network to construct a network multi-step attack prediction model; 14) Perform multi-step attack prediction: monitor network traffic data, obtain security alarm data and pre-process it, input the security alarm data into the network multi-step attack prediction model, and predict potential attack events.

2. The network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution according to claim 1, characterized in that, The extraction of the network alarm attribute comprises the following steps: 21) Keep the entries in the IDEA format alarm attribute data that match the preset alarm tuple, and remove all irrelevant data columns. The extracted alarm attributes include: DetectTime: alarm generation time, numeric type; SourceIP: source IP address of the attack, numeric type; TargetIP: target IP address of the attack, numeric type; Port: port of the target system accessed, category value; Protocol: protocol used when executing the attack, category value; Category: attack category, category value; Node: name of the detector that issued the alarm, category value; Node Type: type of detector that issued the alarm, category value; 22) For alerts on missing categorical values, create a new dummy category "Other Column Name" for each column; 23) The Port field is divided into 16 categories. The 15 most frequently occurring port numbers in all historical alarm sequences are considered as independent categories, and the remaining port numbers are classified as "other ports"; 24) For alerts where the TargetIP field is missing, insert a dummy address of 0.0.0.

0.

3. The network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution according to claim 1, wherein, The data preprocessing of the alarm attribute data comprises the following steps: 31) Prune SourceIP and TargetIP to / 24 prefix; 32) Convert all categorical variables into numerical values ​​through label encoding; 33) Use the Word2vec model to vectorize the attack types; 34) Perform MinMax scaling on each column of the processed alarm data to ensure that all training data are normalized between 0 and 1, and merge multiple features of each alarm event into one vector; 35) Arrange all alarm events in ascending order by timestamp according to the DetectTime field to ensure the causality of the time series; 36) Construct time series samples according to the time sliding window, arrange the N events within each window in chronological order to form a sample .

4. The network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution according to claim 1, wherein, The construction of the network multi-step attack prediction model comprises the following steps: 41) Replace the matrix multiplication in GRU with a dynamic graph convolution module, and design a network structure composed of GRU units based on dynamic graph convolution, namely, a network multi-step attack prediction model; 411) Generate a dynamic adjacency matrix by fusing time period embedding with node features. 412) Using graph convolution operations with decomposable parameter matrices to process spatial features; 42) Joint spatio-temporal feature modeling is achieved through reset gates, update gates, and candidate status gates. For any time step , given the input sample and the hidden state at the previous moment , the implementation of the network structure composed of GRU units based on dynamic graph convolution includes the following steps: 421) Calculate the forgetting ratio by resetting the gate : ， Among them, represents the sigmoid activation function, ensuring the non-linear activation of the network, is the weight matrix used to calculate the reset gate and are learnable parameters, and is the bias term of the reset gate; 422) Calculate the memory ratio through the update gate: ， Among them, is the weight matrix for calculating the update gate , are learnable parameters is the bias term of the update gate; 423) Generate candidate status: ， Among them, is the activation function, represents element-wise multiplication, are learnable parameters, represents the weight matrix of the hidden state, represents the bias term of the hidden state, is the candidate state; 424) Output spatio-temporal fusion features : ； 425) Map the spatio-temporal fusion features output by the dynamic graph convolutional GRU to the prediction target space through a fully connected layer, and generate a probability distribution through the Softmax function to represent the possibility that the attack event in the next moment belongs to each type : ， Among them, and are learnable parameters.

5. The multi-step attack prediction method for a network based on spatio-temporal fusion dynamic graph convolution according to claim 4, wherein The method of generating a dynamic adjacency matrix by fusing time period embedding and node features comprises the following steps: 51) For any time step , splice the samples of the alarm nodes with the daily cycle and weekly cycle time embedding vectors to form the input features ; ， Among them, , represents the feature dimension, B is the batch size, indicating the number of samples processed at one time, represents the sequence length, represents the concatenation symbol, and respectively represent the daily cycle and weekly cycle circular embeddings at time t, is the input feature of the dynamic graph generation module, is a three-dimensional tensor, representing the features of multiple nodes in a batch, is a matrix composed of N rows and D columns; 52) Input features after splicing Processed by a multi-layer perceptron to obtain a dynamic feature signal: ， Among them, represents the dynamic feature signal after filtering processing; 53) Use element-wise multiplication to combine with static, randomly initialized node embeddings The parameters of the node embeddings are learnable and generate dynamic filters for source and target node embeddings respectively: ， ， Among them, represents element-wise multiplication, is the activation function, and represent the node embeddings of the source node and the target node respectively, is the source node dynamic filter, the target node dynamic filter, is a hyperparameter that controls the saturation of the activation function and controls the strength of the filter; 54) Dynamic adjacency matrix Calculated by considering the similarity between nodes, where the similarity is based on the product of node embeddings and The calculation formula is as follows: ， Among them, ReLU and tanh are activation functions used to introduce non-linearity; the final is the time step of the dynamic adjacency matrix, which represents the dynamic dependence relationships among nodes.

6. The network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution according to claim 4, wherein, The graph convolution operation using a decomposable parameter matrix to process spatial features includes the following steps: 61) For the obtained adjacency matrix perform normalization to ensure the stability of the graph convolution operation: ， Among them, is the output of the graph convolutional layer, representing the new feature representation of the node after fusing its own features and the features of its neighbors. is the identity matrix. is the node degree matrix. The degree matrix is a diagonal matrix, representing the number of connections of each node. and are both learnable parameters. is the sample feature of the alarm node; 62) To prevent overfitting and improve the model's performance, further optimize the graph convolution by reducing the computational complexity through the linear combination of three learnable parameter matrices: ， Among them, , and are three different learnable parameters, used to map the features of nodes from the original dimension to the new dimension, for further feature mapping, is the bias vector, is the time step of the dynamic adjacency matrix.

7. A computer-readable storage medium, characterized in that, A computer program is stored on the storage medium, and when the computer program is executed by a processor, it implements a network multi-step attack prediction method according to any one of claims 1-6.

8. A computer device, characterized in that, It includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes, it implements a network multi-step attack prediction method according to any one of claims 1-6.

9. A network security defense system, characterized in that, Integrated with a network multi-step attack prediction method according to any one of claims 1-6, the network multi-step attack prediction method based on spatio-temporal fusion dynamic graph convolution is linked with a firewall and an intrusion prevention device to dynamically adjust the defense strategy according to the prediction result.

Images