Network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution

Abstract

This invention relates to a network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution. Compared to existing technologies, this method addresses the drawback of network attack prediction, which often struggles to meet practical application requirements. The method includes the following steps: extracting network alarm attributes; preprocessing the alarm attribute data; constructing a network multi-step attack prediction model; and performing multi-step attack prediction. This method not only predicts the probability of an attack but also the specific parameters of the anticipated attack, enabling the application of better network defense measures.

Description

Technical Field

[0001] The present invention relates to the field of computer network security technology, and in particular to a network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution. Background Art

[0002] Given the increasing number and intensity of cyberattacks, there's a need to continuously monitor and analyze the vast amounts of data transmitted globally. This has led to the development of various network monitoring and analysis systems, including intrusion detection systems (IDS), honeypots, and network traffic monitors. These systems are widely deployed in today's networks, helping administrators respond to a variety of attacks and intrusions. Data from these systems is sometimes shared across multiple organizations using various data-sharing platforms, allowing for more proactive solutions (such as blocking the most dangerous attackers in other networks) rather than reactive ones. In recent years, the availability of extensive information on detected cyberattacks, coupled with recent advances in machine learning, has enabled research to focus not only on detection but also on prediction.

[0003] In recent years, a number of attack prediction methods have been proposed in the field of cybersecurity. While they serve as good proof-of-concepts, showing that predicting future attacks is possible, their capabilities remain very limited, and their use in practice is limited. For example, they only allow predicting the expected number of attacks detected in a future time interval, the most likely next step of a multi-stage attack already in progress, or simply predicting the probability of an attack coming from a given source.

[0004] Traditional intrusion detection systems and defense technologies rely heavily on rule-based and signature analysis. While these systems can detect attacks, they often struggle to handle complex and dynamic attack behaviors and are unable to predict specific attack characteristics and trends. Existing prediction methods can only provide a quantitative estimate of the number of attacks or a simple prediction of the next step, lacking precise predictions of attack type, intensity, and target. Given the increasing sophistication and growth of cyberattacks, developing a new cyberattack prediction method to improve the accuracy and proactiveness of network security protection has become a pressing technical challenge. Summary of the Invention

[0005] The purpose of the present invention is to solve the defect that network attack prediction in the prior art is difficult to meet the needs of actual applications, and to provide a network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution to solve the above problem.

[0006] In order to achieve the above object, the technical solution of the present invention is as follows:

[0007] A network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution includes the following steps:

[0008] 11) Extraction of network alarm attributes: Obtain security alarm data from different network intrusion prevention systems and extract alarm attribute data in IDEA format;

[0009] 12) Preprocess the alarm attribute data;

[0010] 13) Constructing a network-based multi-step attack prediction model: Utilizing a spatiotemporal fusion dynamic graph convolutional recurrent network to construct a network-based multi-step attack prediction model;

[0011] 14) Perform multi-step attack prediction: Monitor network traffic data, obtain security alert data and pre-process it, input the security alert data into the network multi-step attack prediction model to predict potential attack events.

[0012] Extracting the network alarm attributes includes the following steps:

[0013] 21) Retain the entries in the IDEA format alarm attribute data that match the preset alarm tuple, and remove all irrelevant data columns. The extracted alarm attributes include: DetectTime: alarm generation time, numeric type; SourceIP: source IP address of the attack, numeric type; TargetIP: target IP address of the attack, numeric type; Port: port of the target system accessed, category value; Protocol: protocol used when executing the attack, category value; Category: attack category, category value; Node: name of the detector that issued the alarm, category value; Node Type: type of detector that issued the alarm, category value;

[0014] 22) For alerts on missing categorical values, create a new dummy category "Other column names" for each column;

[0015] 23) The Port field is divided into 16 categories. The 15 most frequently occurring port numbers in all historical alarm sequences are considered as independent categories, and the remaining port numbers are classified as "other ports";

[0016] 24) For alerts where the TargetIP field is missing, a dummy address 0.0.0.0 is inserted.

[0017] The data preprocessing of the alarm attribute data comprises the following steps:

[0018] 31) Prune SourceIP and TargetIP to / 24 prefix;

[0019] 32) Convert all categorical variables into numerical values ​​through label encoding;

[0020] 33) Use the Word2vec model to vectorize the attack types;

[0021] 34) Perform MinMax scaling on each column of the processed alarm data to ensure that all training data is normalized between 0 and 1, and merge multiple features of each alarm event into a single vector;

[0022] 35) Arrange all alarm events in ascending order by timestamp based on the DetectTime field to ensure causality of the time series;

[0023] 36) Construct a time series sample based on the time sliding window, and arrange the N events in each window in chronological order to form a sample .

[0024] The construction of the network multi-step attack prediction model includes the following steps:

[0025] 41) Replace the matrix multiplication in GRU with a dynamic graph convolution module and design a network structure composed of GRU units based on dynamic graph convolution, namely a network multi-step attack prediction model;

[0026] 411) Generate a dynamic adjacency matrix by fusing time period embedding with node features.

[0027] 412) Using graph convolution operations with decomposable parameter matrices to process spatial features;

[0028] 42) The spatiotemporal feature joint modeling is achieved through the reset gate, update gate and candidate state gate. , given an input sample and the hidden state at the previous moment ,The implementation of the network structure composed of GRU units based on dynamic graph convolution includes the following steps:

[0029] 421) Calculate the forgetting ratio by resetting the gate :

[0030] ,

[0031] in, Represents the sigmoid activation function, ensuring the nonlinear activation of the network, is used to calculate the reset gate The weight matrix, is a learnable parameter, is the bias term for the reset gate;

[0032] 422) Calculate the memory ratio through the update gate:

[0033] ,

[0034] in, It is used to calculate the update gate The weight matrix, is a learnable parameter, is the bias term of the update gate;

[0035] 423) Generate candidate status:

[0036] ,

[0037] in, is the activation function, represents element-wise multiplication, is a learnable parameter, The weight matrix representing the hidden state, represents the bias term of the hidden state, is a candidate state;

[0038] 424) Output spatiotemporal fusion features :

[0039] ;

[0040] 425) Temporal and spatial fusion features of dynamic graph convolution GRU output Mapped to the predicted target space through the fully connected layer, and generated probability distribution through the Softmax function to represent the possibility of the attack event belonging to each type at the next moment :

[0041] ,

[0042] in, and are learnable parameters.

[0043] The method of generating a dynamic adjacency matrix by fusing time period embedding and node features comprises the following steps:

[0044] 51) For any time step , the sample of the alarm node Concatenate with daily and weekly time embedding vectors to form input features ;

[0045] ,

[0046] in, , represents the feature dimension, B is the batch size, which represents the number of samples processed at a time, represents the sequence length, Indicates the splicing symbol, and represent the daily and weekly cycle embeddings at time t, is the input feature of the dynamic graph generation module, is a three-dimensional tensor representing the features of multiple nodes in a batch. is a matrix consisting of N rows and D columns;

[0047] 52) Input features after splicing Through a multi-layer perceptron processing, dynamic feature signals are obtained:

[0048] ,

[0049] in, Represents the dynamic characteristic signal after filtering;

[0050] 53) Use element-wise multiplication to and static, randomly initialized node embeddings Combined, node embedding The parameters of are learnable, generating dynamic filters for source and target node embeddings respectively:

[0051] ,

[0052] ,

[0053] in, represents element-wise multiplication, is the activation function, and denote the node embeddings of the source and target nodes respectively, is the source node dynamic filter, Target node dynamic filter, It is a hyperparameter that controls the saturation of the activation function and the strength of the filter;

[0054] 54) Dynamic adjacency matrix It is calculated by considering the similarity between nodes, which is based on node embeddings. and The product of is calculated as follows:

[0055] ,

[0056] Among them, ReLU and tanh are activation functions used to introduce nonlinearity; the final is the time step The dynamic adjacency matrix represents the dynamic dependency relationship between nodes.

[0057] The graph convolution operation using the decomposable parameter matrix to process spatial features includes the following steps:

[0058] 61) The obtained adjacency matrix Normalization is performed to ensure the stability of the graph convolution operation:

[0059] ,

[0060] in, It is the output of the graph convolution layer, which represents the new feature representation of the node after fusing its own features and neighbor features. is the identity matrix, is the node degree matrix, which is a diagonal matrix representing the number of connections for each node. and are all learnable parameters. is the sample feature of the alarm node;

[0061] 62) To prevent overfitting and improve the performance of the model, graph convolution is further optimized to reduce the computational complexity through the linear combination of three learnable parameter matrices:

[0062] ,

[0063] in, 、 and are three different learnable parameters, Used to map node features from the original dimension to the new dimension, For further feature mapping, is the bias vector, is the time step Dynamic adjacency matrix.

[0064] A computer-readable storage medium stores a computer program. When the computer program is executed by a processor, a network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution is implemented.

[0065] A computer device includes a memory, a processor, and a computer program stored in the memory and executable on the processor. When executed by the processor, a network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution is implemented.

[0066] A network security defense system integrates a network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution. The network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution is linked with firewalls and intrusion defense devices to dynamically adjust the defense strategy according to the prediction results.

[0067] Beneficial effects

[0068] Compared with the existing technology, the network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution of the present invention can not only predict the probability of attack, but also predict the specific parameters of the expected attack (such as its type and target), thereby enabling the application of better network defense measures.

[0069] The present invention constructs a dynamic graph structure to model the spatiotemporal interaction between security alarm nodes, uses a graph convolutional network to extract topological features, and combines it with a gated recurrent unit (GRU) to learn the temporal evolution of attack behaviors. This method innovatively adopts a spatiotemporal fusion mechanism to dynamically aggregate the state information of neighboring nodes with the temporal dependency features extracted by the GRU to achieve accurate modeling of complex attack links. It can mine the spatiotemporal correlation of attack behaviors from massive amounts of heterogeneous security data, use the GRU to capture long-term dependencies, and combine dynamic graph convolution to infer the attacker's potential mobility strategy. By fusing spatiotemporal features, the model can accurately predict potential network attack trends, achieve early warning of attack behaviors, provide more comprehensive predictive support for network defense systems, and provide a data basis for real-time defense decisions, thereby improving the intelligence and proactiveness of network protection.

[0070] The present invention obtains alarm data from different intrusion defense systems and extracts important alarm attributes, thereby ensuring the comprehensiveness and representativeness of the data; secondly, by pre-processing the alarm data, including cleaning, format unification and normalization operations, the data quality is effectively improved, laying a solid foundation for subsequent analysis; then, a multi-step attack prediction model based on a spatiotemporal fusion dynamic graph convolutional recurrent network is constructed, the spatial correlation of security alarm nodes is modeled by dynamic graphs, and the temporal evolution law of attack behavior is captured using GRU, thereby realizing the prediction of multi-step attack behavior; finally, by formulating rules for attack prediction accuracy estimation, the performance of the model is further optimized to ensure the reliability and practicality of the prediction results. The present invention can provide threat warnings for security teams and improve the overall efficiency and effectiveness of network security defense. Through this method, network security managers can take more targeted defense measures before an attack occurs, such as optimizing firewall rules, setting rate limits and login attempt limits, etc., thereby effectively reducing the losses of attacks and improving network security. BRIEF DESCRIPTION OF THE DRAWINGS

[0071] Figure 1 is a method sequence diagram of the present invention;

[0072] Figure 2 This is a diagram of the network multi-step attack prediction model architecture involved in the present invention;

[0073] Figure 3This is a diagram of the architecture of the dynamic graph-based gated recurrent unit involved in the present invention;

[0074] Figure 4 This is a diagram of the network attack prediction accuracy estimation process involved in the present invention. DETAILED DESCRIPTION

[0075] In order to provide a further understanding and appreciation of the structural features and effects achieved by the present invention, a detailed description is provided with reference to preferred embodiments and accompanying drawings as follows:

[0076] like Figure 1 As shown, the network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution described in the present invention includes the following steps:

[0077] The first step is to extract network alarm attributes: obtain security alarm data generated by different network intrusion prevention systems and extract alarm attribute data in IDEA format.

[0078] Because the alerts generated by different network intrusion prevention systems vary in structure and content, it is necessary to convert this heterogeneous alert data into a unified standard format for further analysis and processing. Alerts from different security devices are provided in IDEA format, a simple JSON-based format for describing various security events. It is designed to be easy for humans to read and understand, and can be directly parsed and generated by computers.

[0079] (1) The entries in the IDEA format alarm attribute data that match the preset alarm tuple are retained, and all irrelevant data columns are removed. The extracted alarm attributes include: DetectTime: alarm generation time, numeric type; SourceIP: source IP address of the attack, numeric type; TargetIP: target IP address of the attack, numeric type; Port: the port of the target system accessed (such as port 80, port 5600, etc.), category value; Protocol: the protocol used when executing the attack (such as TCP, UDP, etc.), category value; Category: attack category (such as reconnaissance, scanning, attack attempt, etc.), category value; Node: name of the detector that issued the alarm, category value; Node Type: type of detector that issued the alarm (such as honeypot, IDS, traffic monitor, etc.), category value.

[0080] (2) For alerts on missing categorical values, create a new dummy category “other column names” for each column.

[0081] (3) The Port field is divided into 16 categories. In all historical alarm sequences, the 15 port numbers with the highest frequency are considered as independent categories, and the remaining port numbers are classified as "other ports" category.

[0082] (4) For alerts where the TargetIP field is missing, insert a dummy address 0.0.0.0.

[0083] The second step is to preprocess the alarm data.

[0084] While having an end-to-end learning system is ideal, it is not feasible to directly input complex IDEA-formatted alerts into a deep learning model. Therefore, appropriate data transformation and preprocessing are prerequisites for effectively utilizing the model.

[0085] First, only entries corresponding to the selected alert tuples are retained in the security alert dataset, and all other irrelevant columns are removed. Next, missing values ​​in the dataset are addressed. For alerts with missing categorical values ​​(such as protocol, detector type, etc.), a new dummy category, "Other Column Name," is created for each column (e.g., "Other Protocol," "Other Detector," etc.). Furthermore, although the Port field contains numbers, it should be treated as a categorical variable because the port number serves only as a label and does not represent an actual numeric value. Therefore, the Port field is divided into 16 categories. The 15 most frequently occurring port numbers across all historical alert sequences are considered separate categories, while the remaining less frequently occurring port numbers are grouped into the "Other Ports" category. For alerts with a missing TargetIP field, a dummy address, 0.0.0.0, is inserted. After all missing values ​​are addressed, data preprocessing is performed.

[0086] During preprocessing, SourceIP and TargetIP entries are pruned to their / 24 prefixes. Because deep learning algorithms require numerical data rather than textual information, all categorical variables (such as protocol, detector, and type) are converted to numerical values ​​through label encoding, a process that essentially assigns numerical labels to categorical data. Furthermore, to ensure the semantic integrity of attack types, a Word2vec model is used to vectorize the attack types. Finally, each column in the dataset is subjected to MinMax scaling to ensure that all training data is normalized between 0 and 1, preventing large values ​​from adversely affecting the training process.

[0087] Perform MinMax scaling on each column of the processed alarm data to ensure that all training data is normalized between 0 and 1, and merge multiple features of each alarm event into a single vector. Arrange all alarm events in ascending order of timestamps based on the DetectTime field to ensure the causality of the time series. Construct a time series sample based on the time sliding window, and arrange the N events in each window in chronological order to form a sample. .

[0088] The third step is to build a network multi-step attack prediction model: use the spatiotemporal fusion dynamic graph convolutional recurrent network to build a network multi-step attack prediction model.

[0089] The multi-step attack prediction architecture proposed by the present invention is as follows Figure 2 As shown in Figure 1, its core is a dynamic graph convolutional recurrent network based on spatiotemporal fusion. This network uses the dynamic graph-based gated recurrent unit (DGGRU) as its basic building block. It innovatively replaces the matrix multiplication operation in the traditional GRU with a dynamic graph convolution operation, thereby achieving collaborative modeling of the spatiotemporal characteristics of network attack behavior, such as Figure 3 By integrating spatiotemporal features, the model can accurately predict potential cyberattack trends, provide early warning of attack behaviors, provide more comprehensive forecasting support for network defense systems, and provide data basis for real-time defense decision-making, thereby improving the intelligence and proactiveness of network protection.

[0090] In the attack prediction method proposed in this paper, the generation of dynamic graphs is crucial. This method uses a dynamic adjacency matrix to model spatial dependencies. It is independent of the predefined adjacency matrix and can be applied to any situation without prior knowledge. For each time step, , characteristics of the alarm node and time information and Connect to form the input of the dynamic graph generation module:

[0091] ,

[0092] in, , Represents feature dimension; and Represent the daily and weekly cycle embeddings at time t, respectively, and the symbol represents the concatenation operation. The dynamic feature signal is obtained by multi-layer perceptron (MLP) processing:

[0093] ,

[0094] in, Represents the dynamic characteristic signal after filtering, and is multiplied by element Compared with randomly initialized static node embedding features Combined ( The parameters are learnable parameters). In actual implementation, the system will generate two sets of dynamic filters for the source node and the target node respectively, and their expressions are:

[0095] ,

[0096] ,

[0097] in Represents element-wise multiplication. Dynamic adjacency matrix It is obtained by calculating the similarity between alarm nodes, as follows:

[0098] ,

[0099] in, Is a hyperparameter that determines the saturation level of the activation function; is the time step The obtained dynamic adjacency matrix is ​​normalized and input into the graph convolution module:

[0100] ,

[0101] in and is a learnable parameter matrix. In order to prevent overfitting due to too many parameters, the graph convolution is optimized. The optimization formula is as follows:

[0102] ,

[0103] in 、 and are three different learnable parameters. , and the computational complexity is significantly reduced through matrix decomposition.

[0104] The multi-step attack prediction task faces the challenge of complex spatiotemporal correlation. In order to effectively capture these features, the present invention first explores spatial and short-term temporal correlations by generating dynamic graphs, and then introduces GRU to solve the dependency problem in long-term time series. The matrix multiplication in GRU is creatively replaced with a dynamic graph convolution module, and a network structure composed of GRU units based on dynamic graph convolution is constructed. In the proposed method, the GRU operation acts independently on each alarm node, and all nodes share the same GRU parameters. This design strategy not only enhances the generalization ability of the model, enabling it to process graph data of different scales and structures, but also improves parameter efficiency and reduces the risk of overfitting. Specifically, for any time step , given input and the hidden state at the previous moment , the implementation of DGGRU can be described by the following formula:

[0105] ,

[0106] ,

[0107] ,

[0108] ,

[0109] in Represents the sigmoid activation function, ensuring the nonlinear activation of the network, and It's time The reset and update gates, 、 and is a learnable parameter of DGGRU. This method can simultaneously capture the spatial and temporal correlations in traffic networks within a unified framework, significantly improving the performance and interpretability of the multi-step attack prediction model.

[0110] The fourth step is to conduct multi-step attack prediction: monitor network traffic data, obtain security alarm data and pre-process it, input the pre-processed alarm data into the network multi-step attack prediction model to predict potential attack events.

[0111] The prediction accuracy estimate is evaluated by comparing the prediction results of all test vectors with the corresponding true value warning. The difference measure (error value) between the actual warning and the prediction result is calculated by the weighted sum of the differences of each field. The comparison method for each field is described below and is Figure 4 It was displayed in .

[0112] Categorical fields, such as category, port, and protocol, are used to directly compare predicted results with actual (ground-truth) alerts. If a match occurs, the error component for that field is set to 0; otherwise, it is set to 1. Furthermore, given that some ground-truth samples have port and protocol values ​​of "other port number" and "other protocol," respectively, meaning that the field is empty in the original reported alert (labeled "other" during preprocessing), any predictions in this case are considered correct, and the error component is counted as 0.

[0113] TargetIP Field: The three octets in the TargetIP field are compared as follows. The first and second octets must match exactly, as any mismatch in these octets means that the predicted and actual TargetIPs are significantly different, potentially on completely different networks. Therefore, if the first or second octets do not match, the error component of the TargetIP is set to 1.0, and the third octet is not compared. If the first and second octets of the predicted and actual alerts match, the third octet is compared by calculating the number of the common leftmost digits, n (i.e., the length of the common prefix, expressed in binary).

[0114] DetectTime: Calculated as the difference between the logarithm (base 10) of the actual and predicted DetectTime values. Using logarithms ensures that alerts very close to the expected time have higher precision, while alerts further into the future are given lower precision. To do this, the absolute timestamp is first recalculated to be relative to the last alert in the history window, Figure 4 In Chinese and , so they indicate how close or far away the warning is now. After that, the error of DetectTime is calculated as and The absolute value of the difference between the logarithms.

[0115] The error component of each field is multiplied by a corresponding weight based on the importance of each field in the warning prediction. For example, the error component of the Category field is given the highest weight (2.0) because the attack type is considered the most important feature. Approximate time and target (DetectTime and TargetIP fields) can also be quite important, so their weight is medium (1.0). The Port and Protocol fields contain similar types of information (i.e., the attacked service) and are highly correlated. A mismatch in one usually means a mismatch in the other. Therefore, we assign a weight of 0.5 to each field, and the total weight of the two added together is 1.0. Finally, each error component is multiplied by the corresponding (normalized) weight and summed.

[0116] The above shows and describes the basic principles, main features, and advantages of the present invention. Those skilled in the art should understand that the present invention is not limited to the above embodiments. The above embodiments and descriptions merely illustrate the principles of the present invention. Various changes and modifications may be made to the present invention without departing from the spirit and scope of the present invention. Such changes and modifications are intended to fall within the scope of the present invention. The scope of protection claimed by the present invention is defined by the appended claims and their equivalents.

Claims

1. A network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution, characterized by: The following steps are involved: 11) Extraction of network alarm attributes: Obtain security alarm data from different network intrusion prevention systems and extract alarm attribute data in IDEA format; 12) Preprocess the alarm attribute data; 13) Constructing a network-based multi-step attack prediction model: Utilizing a spatiotemporal fusion dynamic graph convolutional recurrent network to construct a network-based multi-step attack prediction model; The construction of the network multi-step attack prediction model includes the following steps: 131) Replace the matrix multiplication in GRU with a dynamic graph convolution module and design a network structure composed of GRU units based on dynamic graph convolution, namely a network multi-step attack prediction model; 1311) Generating a dynamic adjacency matrix by fusing time period embedding with node features includes the following steps: 13111) For any time step , the sample of the alarm node Concatenate with daily and weekly time embedding vectors to form input features ; ， in, , represents the feature dimension, B is the batch size, which represents the number of samples processed at a time, represents the sequence length, Indicates the splicing symbol, and represent the daily and weekly cycle embeddings at time t, is the input feature of the dynamic graph generation module, is a three-dimensional tensor representing the features of multiple nodes in a batch. is a matrix consisting of N rows and D columns; 13112) Input features after splicing Through a multi-layer perceptron processing, dynamic feature signals are obtained: ， in, Represents the dynamic characteristic signal after filtering; 13113) Use element-wise multiplication to and static, randomly initialized node embeddings Combined, node embedding The parameters of are learnable, generating dynamic filters for source and target node embeddings respectively: ， ， in, represents element-wise multiplication, is the activation function, and denote the node embeddings of the source and target nodes respectively, is the source node dynamic filter, Target node dynamic filter, It is a hyperparameter that controls the saturation of the activation function and the strength of the filter; 13114) Dynamic adjacency matrix It is calculated by considering the similarity between nodes, which is based on and The product of is calculated as follows: ， Among them, ReLU and tanh are activation functions used to introduce nonlinearity; the final is the time step The dynamic adjacency matrix represents the dynamic dependency relationship between nodes; 1312) Using graph convolution operations with decomposable parameter matrices to process spatial features; 132) Joint modeling of spatiotemporal features is achieved through reset gate, update gate and candidate state gate; 14) Perform multi-step attack prediction: Monitor network traffic data, obtain security alert data and pre-process it, input the security alert data into the network multi-step attack prediction model to predict potential attack events.

2. The network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution according to claim 1 is characterized in that: Extracting the network alarm attributes includes the following steps: 21) Retain the entries in the IDEA format alarm attribute data that match the preset alarm tuple, and remove all irrelevant data columns. The extracted alarm attributes include: DetectTime: alarm generation time, numeric type; SourceIP: source IP address of the attack, numeric type; TargetIP: target IP address of the attack, numeric type; Port: port of the target system accessed, category value; Protocol: protocol used when executing the attack, category value; Category: attack category, category value; Node: name of the detector that issued the alarm, category value; Node Type: type of detector that issued the alarm, category value; 22) For alerts on missing categorical values, create a new dummy category "other column name" for each column; 23) The Port field is divided into 16 categories. The 15 most frequently occurring port numbers in all historical alarm sequences are considered as independent categories, and the remaining frequent port numbers are classified as "other ports"; 24) For alerts where the TargetIP field is missing, a dummy address 0.0.0.0 is inserted.

3. The network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution according to claim 1 is characterized in that: The data preprocessing of the alarm attribute data comprises the following steps: 31) Prune SourceIP and TargetIP to / 24 prefix; 32) Convert all categorical variables into numerical values ​​through label encoding; 33) Use the Word2vec model to vectorize the attack types; 34) Perform MinMax scaling on each column of the processed alarm data to ensure that all training data is normalized between 0 and 1, and merge multiple features of each alarm event into a single vector; 35) Arrange all alarm events in ascending order by timestamp based on the DetectTime field to ensure causality of the time series; 36) Construct a time series sample based on the time sliding window, and arrange the N events in each window in chronological order to form a sample .

4. The network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution according to claim 1 is characterized in that: The spatiotemporal feature joint modeling is achieved by resetting the gate, updating the gate and the candidate state gate. , given an input sample and the hidden state at the previous moment ,The implementation of the network structure composed of GRU units based on dynamic graph convolution includes the following steps: 41) Calculate the forgetting ratio by resetting the gate : ， in, Represents the sigmoid activation function, ensuring the nonlinear activation of the network, is used to calculate the reset gate The weight matrix, is a learnable parameter, is the bias term for the reset gate; 42) Calculate the memory ratio through the update gate: ， in, It is used to calculate the update gate The weight matrix, is a learnable parameter, is the bias term of the update gate; 43) Generate candidate states: ， in, is the activation function, represents element-wise multiplication, is a learnable parameter, The weight matrix representing the hidden state, represents the bias term of the hidden state, is a candidate state; 44) Output spatiotemporal fusion features : ； 45) Combine the spatiotemporal features of the dynamic graph convolution GRU output Mapped to the predicted target space through the fully connected layer, and generated probability distribution through the Softmax function to represent the possibility of the attack event belonging to each type at the next moment : ， in, and are learnable parameters.

5. The network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution according to claim 1 is characterized in that: The graph convolution operation using the decomposable parameter matrix to process spatial features includes the following steps: 51) The obtained adjacency matrix Normalization is performed to ensure the stability of the graph convolution operation: ， in, It is the output of the graph convolution layer, which represents the new feature representation of the node after fusing its own features and neighbor features. is the identity matrix, is the node degree matrix, which is a diagonal matrix representing the number of connections for each node. and are all learnable parameters. is the sample feature of the alarm node; 52) To prevent overfitting and improve the performance of the model, graph convolution is further optimized to reduce computational complexity through the linear combination of three learnable parameter matrices: ， in, 、 and are three different learnable parameters, Used to map node features from the original dimension to the new dimension, For further feature mapping, is the bias vector, is the time step Dynamic adjacency matrix.

6. A computer-readable storage medium, characterized in that The storage medium stores a computer program. When the computer program is executed by the processor, the network multi-step attack prediction method based on spatiotemporal fusion dynamic graph convolution described in any one of claims 1 to 5 is implemented.

7. A computer device, characterized in that: The invention comprises a memory, a processor and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method for predicting multi-step attacks based on spatiotemporal fusion dynamic graph convolution described in any one of claims 1 to 5 is realized.

8. A network security defense system, characterized in that: The invention integrates a network multi-step attack prediction method according to any one of claims 1 to 5, and the method is linked with a firewall and an intrusion prevention device to dynamically adjust the defense strategy according to the prediction results.

Images