Automatic sensing model method and system for illegal access in network security isolation area

Abstract

The invention provides an automatic perception model method and system for illegal access in a network security isolation area, and belongs to the technical field of computer systems based on specific calculation models.The method comprises the steps that firstly, a network topological graph matrix of the security isolation area is constructed, an equipment asset list is established, and then distributed flow collection nodes are deployed to obtain real-time network data; a deep packet detection technology is used for extracting features to establish an equipment behavior baseline library, a multi-target risk assessment function is used for carrying out risk grade division on equipment, a multi-layer perceptron and a time sequence anomaly detection algorithm are used for identifying abnormal communication, and an equipment fingerprint identification mechanism based on physical layer characteristics is established to verify the legality of the identity of the equipment. A security isolation intelligent sensing network model is utilized to analyze network behaviors, a multi-dimensional abnormal scoring system is constructed to calculate risk scores, a response mechanism based on a rule engine is realized, a federal learning technology can be selectively adopted to optimize the model, and an all-dimensional and multi-level illegal access automatic sensing protection system is formed.

Description

Technical Field

[0001] The present invention belongs to the technical field of computer systems based on specific computing models. Specifically, it relates to a method and system for an automatic perception model of illegal access in a network security isolation area. Background Art

[0002] The present invention relates to the field of network security, especially the internal network security monitoring technology of a security isolation area. Traditional security isolation areas usually establish regional boundary protection through physical isolation, logical isolation, etc., rely on static defense measures such as firewalls and intrusion detection systems to prevent external threats, and at the same time manage the communication permissions of internal devices through mechanisms such as access control lists and identity authentication to form a relatively closed security environment.

[0003] However, with the increasing complexity of attack means, traditional boundary protection and static detection methods are facing severe challenges. First, rule-based detection systems lack the ability to perceive unknown threats; second, traditional identity authentication mechanisms are vulnerable to credential theft attacks; third, existing anomaly detection systems mostly focus on communication protocol anomalies and ignore the analysis of device behavior patterns and temporal characteristics; finally, there is a lack of fine-grained real-time monitoring mechanisms inside the isolation area, resulting in difficulty in timely discovering illegal devices once they are connected.

[0004] These defects lead to blind spots in the detection of internal threats in the security isolation area. Especially when dealing with the access of illegal devices carefully disguised by professional attackers, existing technologies are difficult to achieve real-time perception and accurate identification, seriously threatening the overall security of the isolation area. There is an urgent need for an intelligent detection method that can automatically perceive illegal access behaviors. That is to say, there is a technical problem in the prior art that it is difficult for the network in the security isolation area to perceive the access of illegal devices in real time and accurately. Summary of the Invention

[0005] In view of this, the present invention provides a method and system for an automatic perception model of illegal access in a network security isolation area, which can solve the technical problem in the prior art that it is difficult for the network in the security isolation area to perceive the access of illegal devices in real time and accurately.

[0006] The present invention is implemented as follows: A method for automatically sensing an illegal access in a network security isolation area according to a first aspect of the present invention includes: constructing a network topology matrix of the security isolation area and establishing an equipment asset list; using distributed traffic collection nodes to capture network traffic in real time at key nodes of the isolation area network; using deep packet detection technology to extract features from the collected data to form an equipment behavior baseline library; applying a multi-objective risk assessment function to classify the risk levels of the collection terminal, transmission equipment, computing server, and operator terminal; using a multi-layer perceptron to construct an anomaly detection model; introducing a time series anomaly detection algorithm to generate a time series feature vector for the collection terminal; establishing an equipment fingerprint recognition mechanism to extract the unique identifier of the equipment based on the physical layer characteristics; using a pre-trained security isolation intelligent sensing network model to analyze network behavior; constructing a multi-dimensional anomaly scoring system, combining traffic characteristics, unique equipment identifier, behavior pattern, and time series feature vector, to calculate the risk score of a suspicious access behavior; implementing a response mechanism based on a rule engine to trigger a response strategy when the multi-dimensional anomaly scoring system detects an illegal access behavior.

[0007] Among them, the network traffic captured by the distributed traffic collection nodes is transmitted to the security audit server through an encrypted channel.

[0008] Among them, the anomaly detection model constructed by the multi-layer perceptron is trained through a supervised learning method and is used to identify abnormal communications that deviate from the behavior patterns recorded in the equipment behavior baseline library.

[0009] Among them, the network topology matrix of the security isolation area refers to an adjacency matrix used to describe the connection relationships between all devices in the isolation area. Each element in the matrix represents the connection status and communication permissions between two devices and is used to establish a mathematical representation model of the network structure.

[0010] Among them, the time series anomaly detection algorithm refers to analyzing the time series characteristics of the data collected by the collection terminal and using a long short-term memory network or an autoregressive model to identify time series anomalies in the data collection process and discover data anomalies caused by unauthorized device access.

[0011] Among them, the multi-dimensional anomaly scoring system refers to fusing and calculating multiple anomaly detection indicators, assigning a risk score to each potential abnormal behavior, and generating a comprehensive risk assessment result through weighted calculation to improve the accuracy of anomaly detection and reduce the false alarm rate.

[0012] Among them, the input parameters of the multi-objective risk assessment function include equipment importance weight, number of vulnerabilities, communication frequency, data sensitivity, and abnormal behavior history, and the output parameters of the multi-objective risk assessment function include equipment security risk score and risk level classification identifier.

[0013] Among them, the specific structure of the security isolation intelligent perception network model is an anomaly detection framework based on a graph neural network architecture, including a graph convolutional layer, a spatio-temporal attention mechanism layer, and a multi-task learning head. The graph convolutional layer is used to capture the relationship features between devices in the network topology graph matrix of the security isolation area, and the spatio-temporal attention mechanism layer models the temporal dependence in the communication mode of the acquisition terminal; the optimization of the parameters of the security isolation intelligent perception network model depends on the node density in the network topology graph matrix of the security isolation area, the traffic baseline threshold in the device behavior baseline library, and the device communication temporal characteristics.

[0014] Among them, it also includes optimizing the security isolation intelligent perception network model by using federated learning technology. After local training of each traffic acquisition node, the parameters of the security isolation intelligent perception network model are shared, avoiding cross-domain transmission of original data and improving the overall protection ability of the security isolation area.

[0015] The second aspect of the present invention provides an illegal access automatic perception model system in a network security isolation area. The system is any one of a server, a computer, or a computing center. A logic processor is set in the system, and the logic processor is used to execute the above-mentioned illegal access automatic perception model method in the network security isolation area.

[0016] Compared with the prior art, the present invention provides an illegal access automatic perception model method and system in a network security isolation area. The present invention proposes an illegal access automatic perception method and system based on multi-dimensional feature fusion. By constructing a network topology graph matrix, deploying distributed acquisition nodes, establishing a device behavior baseline library, and combining deep learning technology, an all-round security monitoring system is formed. This method not only monitors network traffic characteristics, but also analyzes device physical characteristics, behavior patterns, and communication temporal relationships to achieve multi-level anomaly detection.

[0017] The multi-objective risk assessment function adopted by the present invention is combined with the security isolation intelligent perception network model, overcoming the limitation of the traditional technology that only relies on a single dimension for judgment. The model captures the topological relationship between devices through a graph neural network, analyzes the temporal behavior characteristics through a spatio-temporal attention mechanism, and at the same time introduces a device fingerprint recognition mechanism to verify the physical identity of the device, forming a three-dimensional detection architecture. This multi-dimensional fusion detection method significantly improves the recognition accuracy of disguised access behavior.

[0018] By real-time analyzing the deviation between network behavior and the pre-established baseline, combined with device physical feature recognition, the present invention can real-time and accurately perceive the illegal device access behavior. Even if the attacker simulates normal communication characteristics, it is difficult to avoid physical layer feature detection, thus effectively solving the technical problem that it is difficult to real-time and accurately perceive illegal device access in the network of the security isolation area in the prior art, and greatly improving the internal security protection ability of the isolation area. Brief Description of the Drawings

[0019] Figure 1 This is a flowchart of the method of the present invention.

[0020] Figure 2 This is a schematic diagram of the composition of the system of the present invention. Specific implementation manners

[0021] To make the objectives, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention.

[0022] As Figure 1 shown, it is a flowchart of a method for an automatic perception model of illegal access in a network security isolation area provided by the first aspect of the present invention. The method includes the following steps:

[0023] S01. Construct a network topology matrix for the security isolation area and establish a device asset list, including the hardware characteristics and communication behavior patterns of the acquisition terminal, transmission device, computing server, and operator terminal;

[0024] S02. Deploy distributed traffic acquisition nodes to capture network traffic in real time at key nodes in the isolation area network and transmit it to the security audit server through an encrypted channel;

[0025] S03. Use deep packet inspection technology to extract features from the acquired data to form a device behavior baseline library, and record the communication protocol characteristics, traffic patterns, and timing characteristics of normal devices;

[0026] S04. Apply a multi-objective risk assessment function to classify the risk levels of the acquisition terminal, transmission device, computing server, and operator terminal. The input parameters of the multi-objective risk assessment function include device importance weights, the number of vulnerabilities, communication frequency, data sensitivity, and abnormal behavior history. The output parameters of the multi-objective risk assessment function include device security risk scores and risk level classification identifiers;

[0027] S05. Use a multi-layer perceptron to construct an anomaly detection model, and train the anomaly detection model through supervised learning to identify abnormal communications that deviate from the behavior patterns recorded in the device behavior baseline library;

[0028] S06. Introduce a timing anomaly detection algorithm to generate a timing feature vector for the acquisition terminal and identify non-expected device access behavior during the data transmission process;

[0029] S07. Establish a device fingerprint recognition mechanism to extract the unique identifier of the device based on physical layer characteristics for verifying the legitimacy of the device identity in the isolation area;

[0030] S08. Analyze network behavior using a pre-trained secure isolation intelligent perception network model. The parameter optimization of the secure isolation intelligent perception network model depends on the node density in the secure isolation area network topology matrix, the traffic baseline threshold in the device behavior baseline library, and the device communication timing characteristics.

[0031] S09. Build a multi-dimensional anomaly scoring system. Combine traffic characteristics, device unique identifiers, behavior patterns, and timing feature vectors to calculate the risk score of suspicious access behavior.

[0032] S10. Implement a response mechanism based on a rule engine. When the multi-dimensional anomaly scoring system detects illegal access behavior, trigger response strategies, including alarm notification, automatic isolation, and forensic analysis.

[0033] S11. Optionally, it also includes using federated learning technology to optimize the secure isolation intelligent perception network model. After local training at each traffic collection node, share the parameters of the secure isolation intelligent perception network model to avoid cross-domain transmission of raw data and improve the overall protection ability of the secure isolation area.

[0034] Among them, the secure isolation area network topology matrix specifically refers to an adjacency matrix used to describe the connection relationships between all devices in the isolation area. Each element in the matrix represents the connection status and communication permissions between two devices, and is used to establish a mathematical representation model of the network structure.

[0035] Among them, the device behavior baseline library specifically refers to a reference standard data set established for multi-dimensional attributes such as the communication behavior, traffic characteristics, protocol characteristics, and active time window of legal devices in the isolation area, and is used to compare and identify abnormal device behaviors.

[0036] Among them, the deep packet inspection technology specifically refers to a technology that comprehensively analyzes the content of network packets. It not only checks the packet header information but also deeply analyzes the packet payload content to identify abnormal behaviors hidden in the application layer protocol.

[0037] Among them, the device fingerprint recognition mechanism specifically refers to generating unique signal characteristics by extracting the hardware characteristics of the device, such as physical layer characteristics like clock offset, radio frequency characteristics, and electromagnetic radiation patterns, to form a device unique identifier that is difficult to forge.

[0038] Among them, the timing anomaly detection algorithm specifically refers to analyzing the time series characteristics of the data collected by the acquisition terminal, and using long short-term memory networks or autoregressive models to identify timing anomalies in the data collection process and discover data anomalies caused by unauthorized device access.

[0039] Among them, the multi-dimensional anomaly scoring system specifically refers to fusing multiple anomaly detection indicators for calculation, assigning a risk score to each potential abnormal behavior, and generating a comprehensive risk assessment result through weighted calculation to improve the accuracy of anomaly detection and reduce the false alarm rate.

[0040] The multi-objective risk assessment function is used to accurately quantify and evaluate the risks of different types of devices in the isolation area. It comprehensively considers the importance and safety characteristics of the devices in the marine forecasting system. The inputs include the device importance weight factors extracted from the network topology matrix of the security isolation area, the cumulative number of known vulnerabilities obtained from the device asset inventory, the communication frequency per unit time obtained from the device behavior baseline library, the transmission data sensitivity coefficient obtained from the device asset inventory, and the number of historical abnormal behavior times obtained from the device behavior baseline library. The outputs are the device security risk scores for the anomaly detection model and the risk level classification identifiers for the security isolation intelligent perception network model.

[0041] The specific structure of the security isolation intelligent perception network model is an anomaly detection framework based on the graph neural network architecture, which includes a graph convolutional layer, a spatio-temporal attention mechanism layer, and a multi-task learning head. The graph convolutional layer is used to capture the relationship features between devices in the network topology matrix of the security isolation area. The spatio-temporal attention mechanism layer models the temporal dependence in the communication patterns of the acquisition terminals. The number of heads parameter in the attention mechanism is determined by the node density in the network topology matrix of the security isolation area. The attention weight threshold is determined by the traffic baseline standard deviation in the device behavior baseline library. The attention window length is determined by the device communication temporal periodicity features in the temporal feature vector. The multi-task learning head outputs both the device authentication result and the behavior anomaly degree score simultaneously.

[0042] The steps for establishing the training dataset of the security isolation intelligent perception network model specifically include collecting network traffic data from multiple security isolation area environments, cleaning and standardizing the collected data, constructing a balanced dataset containing normal communication patterns and various abnormal access behaviors, using data augmentation techniques to simulate the network traffic characteristics under attack scenarios, converting the communication relationships between devices into a structured representation through graph structure representation learning methods, generating self-supervised learning labels based on temporal prediction tasks, and finally forming a comprehensive training dataset that takes into account the structural features of the network topology matrix of the security isolation area and the temporal feature vector.

[0043] The steps of the secure isolation intelligent perception network model specifically include first performing self-supervised learning on large-scale general network environment data to learn the basic representation features of network communication, then performing supervised fine-tuning on the isolated area environment data of the ocean forecasting system to optimize the recognition ability of the secure isolation intelligent perception network model for the behavior characteristics of acquisition terminals, transmission devices, computing servers, and operator terminals. Next, a contrastive learning method is used to enhance the ability of the secure isolation intelligent perception network model to distinguish normal behavior and abnormal behavior. Then, knowledge distillation technology is used to compress the features learned by the large model into a lightweight model to adapt to resource-constrained environments. Finally, a continuous learning strategy is adopted to enable the secure isolation intelligent perception network model to adapt to the dynamic changes in the isolated area network environment.

[0044] The second aspect of the present invention provides an illegal access automatic perception model system in a network security isolation area. The system is any one of a server, a computer, or a computing center. A logic processor is provided in the system, and the logic processor is used to execute the above-mentioned illegal access automatic perception model method in the network security isolation area. As Figure 2 shown, the present system includes:

[0045] A distributed traffic acquisition module for capturing network traffic in real time at key nodes in the isolated area network and transmitting it through an encrypted channel;

[0046] A security audit server for receiving the network traffic data transmitted by the distributed traffic acquisition module;

[0047] A feature extraction module for using deep packet inspection technology to extract features from the collected data, forming a device behavior baseline library, and recording the communication protocol features, traffic patterns, and timing characteristics of normal devices;

[0048] A risk assessment module for applying a multi-objective risk assessment function to classify the risk levels of acquisition terminals, transmission devices, computing servers, and operator terminals;

[0049] An anomaly detection module including an anomaly detection model constructed by a multi-layer perceptron for identifying abnormal communications that deviate from the behavior patterns recorded in the device behavior baseline library;

[0050] A timing analysis module for executing a timing anomaly detection algorithm to generate a timing feature vector for the acquisition terminal and identify non-expected device access behavior during data transmission;

[0051] A device fingerprint recognition module for extracting the unique identifier of the device based on physical layer characteristics and verifying the legality of the device identity in the isolated area;

[0052] An intelligent perception module for executing the secure isolation intelligent perception network model to analyze network behavior;

[0053] Anomaly Scoring Module, used to build a multi-dimensional anomaly scoring system, which combines traffic characteristics, device unique identifiers, behavior patterns, and temporal feature vectors to calculate the risk score of suspicious access behavior;

[0054] Response Execution Module, used to implement a response mechanism based on a rule engine, which triggers a response strategy when the multi-dimensional anomaly scoring system detects an illegal access behavior.

[0055] Among them, the collection terminal: refers to the terminal devices in the isolated area network responsible for collecting and gathering data, such as sensors, data collectors, etc. These devices directly interact with the physical environment and obtain raw data.

[0056] Among them, the transmission device: refers to the devices responsible for transmitting data in the network, such as switches, routers, gateways, etc., to ensure the reliable transmission of data between various nodes in the isolated area network.

[0057] Among them, the computing server: refers to the high-performance computing device for data processing, analysis, and storage in the isolated area, which undertakes the main computing tasks and business logic processing.

[0058] Among them, the operator terminal: refers to the computer terminal used by the staff in the isolated area to monitor, manage, and operate the system, which is the main interface for human-computer interaction.

[0059] Furthermore, it also includes a topology construction module, used to build a security isolation area network topology matrix and establish a device asset list, including the hardware characteristics and communication behavior patterns of collection terminals, transmission devices, computing servers, and operator terminals.

[0060] Furthermore, it also includes a federated learning module, used to optimize the security isolation intelligent perception network model using federated learning technology, enabling each traffic collection node to share the parameters of the security isolation intelligent perception network model after local training, and avoiding cross-domain transmission of raw data.

[0061] Furthermore, the response strategies triggered by the Response Execution Module include alarm notification, automatic isolation, and forensic analysis.

[0062] Furthermore, the input parameters of the multi-objective risk assessment function in the Risk Assessment Module include device importance weight, number of vulnerabilities, communication frequency, data sensitivity, and abnormal behavior history, and the output parameters include device security risk score and risk level classification identifier.

[0063] Furthermore, the specific structure of the security isolation intelligent perception network model in the Intelligent Perception Module is an anomaly detection framework based on a graph neural network architecture, including a graph convolutional layer, a spatio-temporal attention mechanism layer, and a multi-task learning head.

[0064] Furthermore, in the spatio-temporal attention mechanism layer of the intelligent perception module, the number of heads parameter in the attention mechanism is determined by the node density in the security isolation area network topology graph matrix, the attention weight threshold is determined by the traffic baseline standard deviation in the device behavior baseline library, and the attention window length is determined by the device communication timing periodicity feature in the time series feature vector.

[0065] Furthermore, the unique signal features generated by the device hardware characteristics extracted by the device fingerprint recognition module include physical layer features such as clock offset, radio frequency characteristics, and electromagnetic radiation patterns, forming a unique device identifier that is difficult to forge.

[0066] Furthermore, the parameter optimization of the intelligent perception module depends on the node density in the security isolation area network topology graph matrix, the traffic baseline threshold in the device behavior baseline library, and the device communication timing characteristics.

[0067] Furthermore, the anomaly scoring module fuses and calculates multiple anomaly detection metrics, assigns a risk score to each potential abnormal behavior, and generates a comprehensive risk assessment result through weighted calculation, improving the accuracy of anomaly detection and reducing the false alarm rate.

[0068] The following describes in detail the specific implementation manners of the steps of the above method.

[0069] The specific implementation manner of step S01 is to construct a security isolation area network topology graph matrix and establish a detailed device asset list through network scanning and device discovery technologies. First, all network devices in the isolation area are discovered by combining active detection and passive listening. The ICMP protocol is used for liveness detection, and the TCP / UDP port scanning technology is used to identify open services. Then, an n×n adjacency matrix A is constructed, where n is the total number of devices, and the matrix element A ij represents the connection state and communication permission between device i and device j, and the value range is 0-3, where 0 means no connection, 1 means one-way connection, 2 means two-way connection with limited permission, and 3 means two-way connection with full permission. Next, device hardware feature information is collected, including MAC address, operating system type, firmware version, CPU model, memory capacity, etc., and communication behavior patterns are recorded, including parameters such as communication protocol type, average data transmission volume, communication frequency, and typical time window. Finally, all information is integrated into a unified asset management database to complete the construction of the network topology graph matrix and the device asset list. This step establishes a mathematical representation model of the network structure, providing basic data support for subsequent risk assessment and anomaly detection.

[0070] The specific implementation of step S02 is to deploy a distributed traffic collection node system at key nodes in the isolated area network. First, determine the strategic locations of traffic collection points, including gateway entrances and exits, core switching nodes, fronts of important servers, and access points of key business systems. Then, deploy high-performance network probes at each collection point, and use network splitter (TAP) or switch port mirroring (SPAN) technology to achieve traffic replication, ensuring that normal network operations are not disturbed. Next, configure traffic collection tools such as Zeek or Suricata, set filtering rules to optimize the data collection scope, and focus on capturing key information such as TCP / IP connection establishment processes, HTTP / HTTPS requests, DNS queries, and encrypted communication handshakes. Then, preprocess the collected data, including operations such as deduplication, timestamp unification, protocol identification, and session recombination. Finally, build a secure channel through the TLS protocol and use the AES-256 encryption algorithm to protect the data transmission process, ensuring that traffic data is securely and reliably transmitted to the security audit server. This step realizes the comprehensive monitoring of network activities in the isolated area and provides the original data source for abnormal behavior detection.

[0071] The specific implementation of step S03 is to use deep packet inspection technology to extract features from the collected data and form a device behavior baseline library. First, parse the protocols of the collected data packets, support full protocol stack analysis from the physical layer to the application layer, and pay special attention to industrial control protocols such as Modbus and DNP3, which are commonly used professional protocols in the marine forecasting system. Then, extract communication features, including key features such as connection establishment patterns, session duration, communication periodicity, load size distribution, and protocol fingerprints. Next, perform statistical analysis on the extracted features, calculate the traffic distribution histogram, average communication rate, standard deviation (the reference value is ±15% of the historical average) of each device, and typical time patterns. Then, apply clustering algorithms such as K-means clustering or DBSCAN to group the device behavior patterns, determine the boundary threshold of normal behavior, and set the threshold to 2 times the standard deviation of the cluster center distance. Finally, build a multi-dimensional baseline library, record the normal behavior feature intervals of each device at different time periods and different working states, and form a reference standard data set. This step establishes a reference model for normal device behavior and provides a comparison benchmark for abnormal detection.

[0072] The specific implementation of step S04 is to apply a multi-objective risk assessment function to classify the risk levels of various devices in the isolated area. First, extract the device importance weight factor W i from the network topology matrix of the security isolation area, which is calculated according to the centrality and connection criticality of the device in the network, and the value range is 0.1-1.0. Then, obtain the cumulative number of known vulnerabilities V i, including operating system vulnerabilities, application software vulnerabilities, and firmware vulnerabilities, and weighting the severity of vulnerabilities according to the CVSS score. Then obtain the communication frequency F per unit time from the device behavior baseline library i , which represents the standardized value of the number of communications per minute of the device, and the value range is 0 - 1. Then obtain the transmission data sensitivity coefficient S from the device asset inventory i , determined according to the data classification and grading standard, and the value range is 0.2 - 1.0. Finally, obtain the historical number of abnormal behaviors H from the device behavior baseline library i , which records the frequency of the device behavior deviating from the baseline in the past 30 days. The risk assessment function is defined as Risk i = 0.3×W + 0.25×V i + 0.15×F i + 0.2×S i + 0.1×H i , and output the device security risk score Risk i (the value range is 0 - 1) and the corresponding risk level classification identifier (low risk: 0 - 0.3; medium risk: 0.3 - 0.6; high risk: 0.6 - 0.8; extremely high risk: 0.8 - 1.0). This step realizes the precise quantitative assessment of device risks and provides risk priority guidance for the subsequent anomaly detection model.

[0073] The specific implementation of step S05 is to use a multi-layer perceptron to build an anomaly detection model to identify abnormal communications that deviate from the behavior baseline. First, design the multi-layer perceptron network structure, including an input layer (the number of nodes is the feature dimension, usually 50 - 200 features), two hidden layers (the number of nodes is 128 and 64 respectively, and the activation function is ReLU), and an output layer (the number of nodes is 2, representing normal and abnormal categories). Then prepare the training data set, collect labeled normal communication samples and abnormal communication samples. The normal samples come from the device behavior baseline library, and the abnormal samples are generated by security experts' labeling or simulating attack scenarios. Then perform feature engineering, standardize the original features, apply principal component analysis (PCA) for dimensionality reduction, and retain the principal components required to explain 95% of the variance. Then use the cross-entropy loss function and the Adam optimizer to train the model. The initial value of the learning rate is set to 0.001, and a learning rate decay strategy is adopted, decaying to 90% of the original every 50 epochs. Finally, use the F1 score to evaluate the model performance, set a threshold (usually 0.7 - 0.8) to determine anomalies, and implement an online update mechanism to update the model with newly collected data every 24 hours. This step realizes the precise identification of behaviors deviating from the baseline and improves the accuracy of abnormal communication detection.

[0074] The specific implementation of step S06 is to introduce a time series anomaly detection algorithm to identify unexpected device access behaviors during data transmission. First, perform time series preprocessing on the data collected by the terminal, including data cleaning, denoising, and resampling, and uniformly convert the data into a sequence with a fixed time interval. The typical sampling frequency is 1 - 10 times per second. Then extract time series features, including statistical features (mean, variance, kurtosis, skewness, etc.), frequency domain features (extract frequency components through fast Fourier transform), and time domain features (autocorrelation coefficient, trend index, etc.). Next, construct a long short-term memory network (LSTM) model. The network structure includes an input layer, two LSTM layers (each with 128 units), a fully connected layer (64 neurons), and an output layer. Use the mean squared error loss function to train the model to predict the normal time series pattern. Then calculate the prediction deviation, standardize the difference between the actual observed value and the model prediction value to form an anomaly score. Finally, set an adaptive threshold, which is determined based on the statistical distribution of historical data, usually set as the mean plus 3 times the standard deviation. If it exceeds the threshold, it is determined as a time series anomaly, which may indicate unexpected device access. This step effectively identifies time series anomalies in the data collection process and discovers data anomalies caused by unauthorized device access by analyzing time series features.

[0075] The specific implementation of step S07 is to establish a device fingerprint recognition mechanism based on physical layer characteristics to verify the legitimacy of device identities in the isolation area. First, extract device physical features, including clock offset (by analyzing the TCP timestamp option field, with a precision of up to microseconds), radio frequency characteristics (for wireless devices, analyze the amplitude, phase, and frequency offset of the transmitted signal), electromagnetic radiation pattern (use a dedicated detector to capture the electromagnetic signal characteristics generated during device operation), and hardware response time characteristics (analyze the response time distribution of the device to specific requests). Then preprocess the extracted features, including noise filtering, normalization, and dimensionality reduction operations, and retain the most distinguishable feature combinations. Next, construct a fingerprint feature vector, combine multiple physical features into a unique identification vector according to weights, and the typical vector dimension is 128 - 256. Then establish a device fingerprint database to store the fingerprint vectors of all legitimate devices and the corresponding confidence thresholds, and the threshold is usually set as 0.85 - 0.95. Finally, implement a real-time verification mechanism to calculate the similarity between the newly captured device features and the fingerprints stored in the database, using cosine similarity or Mahalanobis distance metrics. If the similarity is lower than the threshold, it is determined as an illegal device. This step realizes reliable verification of device identities and effectively identifies disguised devices by analyzing physical layer features that are difficult to forge.

[0076] The specific implementation of step S08 is to use a pre-trained secure isolation intelligent perception network model to analyze network behavior and achieve accurate identification of illegal access behavior. First, initialize the model parameters, including setting the convolution kernel size of the graph convolution layer to 3×3, the number of channels to 32-64-128 (three-layer structure), and approximating the graph convolution operation using Chebyshev polynomials with a polynomial order of 2. Then configure the spatio-temporal attention mechanism layer, setting the number of attention heads parameter to where n is the number of nodes in the network topology graph matrix of the secure isolation area, the attention weight threshold is set to 2 times the standard deviation of the traffic baseline in the device behavior baseline library, and the attention window length is set to 1.5 times the device communication cycle in the time series feature vector. Next, adjust the multi-task learning head, including the device authentication task (binary classification, legal / illegal) and the behavior anomaly scoring task (regression, score range 0-1), with the weight ratio of the two tasks set to 6:4. Then load the model training parameters, initialize with pre-trained weights, and the weight file size is approximately 50-100MB. Finally, perform real-time analysis, input the current network traffic characteristics into the model, and generate the device authentication result (confidence level not less than 0.9) and the behavior anomaly degree score (the anomaly threshold is set to 0.7). This step realizes in-depth analysis of network behavior through an optimized secure isolation intelligent perception network model and timely discovers illegal access behavior.

[0077] The specific implementation of step S09 is to construct a multi-dimensional anomaly scoring system and calculate the comprehensive risk score of suspicious access behavior. First, collect multi-dimensional feature data, including traffic characteristics (protocol anomaly degree, data volume mutation rate, connection establishment mode anomaly degree), device unique identifier (fingerprint matching degree, authentication confidence level), behavior pattern (degree of deviation from the baseline library, communication mode change rate), and time series feature vector (prediction error amplitude, periodic disruption degree). Then standardize each dimension of the features, uniformly convert the indicators with different dimensions into standard scores within the range of 0-1, using the Z-score or Min-Max standardization method. Next, set the weight coefficients for each dimension, with the traffic characteristic weight being 0.3, the device unique identifier weight being 0.25, the behavior pattern weight being 0.25, and the time series feature weight being 0.2. The weight coefficients can be dynamically adjusted according to the specific application scenario. Then calculate the comprehensive risk score where w i is the weight of the i-th feature, f i is the standardized score of the i-th feature, and n is the total number of features. Finally, set the risk level according to the comprehensive risk score: low risk (0-0.4), medium risk (0.4-0.7), high risk (0.7-0.9), and extremely high risk (0.9-1.0). This step realizes accurate evaluation of suspicious access behavior by integrating multi-dimensional anomaly indicators, improves the detection accuracy, and reduces the false alarm rate.

[0078] The specific implementation of step S10 is to implement a response mechanism based on a rule engine, which triggers corresponding policies when illegal access behaviors are detected. First, design a hierarchical response rule library, define corresponding handling policies for different risk levels, including low risk (recording logs and increasing monitoring frequency), medium risk (generating alarms and notifying the security team), high risk (triggering automatic isolation measures and starting an emergency response), and extremely high risk (executing a complete network disconnection and immediately notifying the top management). Then, build a real-time alarm notification system that supports multiple notification methods, including the system console, email, SMS, and instant messaging tools, and set different alarm priorities and escalation mechanisms according to the risk level. Next, implement a network isolation control module that can restrict suspicious devices to an isolated area by issuing ACL (Access Control List) rules or VLAN isolation measures to prevent the spread of threats. Then, deploy digital forensics analysis tools to automatically capture network traffic, log records, and system status before and after abnormal events, save them as encrypted evidence files, and support subsequent security analysis. Finally, establish a response closed-loop management mechanism to record the processing results and effectiveness evaluation of each response process and regularly optimize the response strategy. This step realizes the timely response to illegal access behaviors, reduces the impact scope of security incidents, and accelerates the threat disposal process.

[0079] The specific implementation of the optional step S11 is to optimize the security isolation intelligent perception network model using federated learning technology. First, deploy lightweight learning clients at each traffic collection node, including a local model training module, a parameter encryption module, and a communication module, to ensure that model training tasks can be executed with limited computing resources. Then, design a federated learning protocol, use the FedAvg (Federated Averaging) algorithm for parameter aggregation, set the communication round to once every 24 hours, and the local training round to 10 rounds for each communication interval. Next, implement a differential privacy protection mechanism, add Gaussian noise to the shared parameters, set the noise level σ to 0.01 - 0.05 to achieve ε-differential privacy protection, and set the ε value to 1 - 5. Then, use a secure aggregation protocol to encrypt the parameters based on homomorphic encryption technology and then aggregate them to prevent the central server from reverse-inferring the original data from the parameters. Finally, perform global model updates, distribute the aggregated parameters to each node, and realize the sharing and migration of model knowledge between different environments. This step optimizes the security isolation intelligent perception network model through federated learning technology, avoids cross-domain transmission of raw data, and improves the overall protection ability at the same time.

[0080] The detailed structure of the secure isolation intelligent perception network model is an anomaly detection framework based on the graph neural network architecture. This model consists of four main components: an input layer, a graph convolutional layer, a spatio-temporal attention mechanism layer, and a multi-task learning head. The input layer receives two types of data: the secure isolation area network topology graph matrix and the node feature matrix. The network topology graph matrix is represented as G=(V, E, A), where V is the set of nodes, E is the set of edges, and A is the adjacency matrix; the node feature matrix is represented as X∈R n×d , n is the number of nodes, and d is the feature dimension. The graph convolutional layer adopts a multi-layer graph convolutional network (GCN) structure to achieve the propagation and aggregation of features on the graph structure. The convolutional operation is defined as where is the adjacency matrix after adding self-loops, is the corresponding degree matrix, W (l) is the weight matrix of the l-th layer, and σ is the ReLU activation function. The spatio-temporal attention mechanism layer combines spatial attention and temporal attention. Spatial attention calculates the dynamic importance between nodes, and temporal attention captures the temporal dependence of node behaviors. The attention score calculation formula is where a is the attention vector, W is the weight matrix, h i and h j are node features, and || represents the concatenation operation. The multi-task learning head contains two parallel task branches: the device authentication branch and the behavior anomaly scoring branch. The former uses the cross-entropy loss function, and the latter uses the mean squared error loss function. The total loss function is L total =λ1L identity +λ2L anomaly , where λ1 and λ2 are weight coefficients used to balance the two tasks.

[0081] The detailed steps for establishing the training data set of the security isolation intelligent perception network model include five links: data collection, data preprocessing, data labeling, data enhancement and feature engineering. In the data collection link, first collect real network traffic data from multiple security isolation zone environments, including baseline traffic during normal operation and abnormal traffic under simulated attack scenarios. The collection period is no less than 30 days, covering different working hours and load conditions. In the data preprocessing link, the original data is cleaned, invalid records are removed, outliers are corrected, the timestamp format is unified, and the session is reorganized to organize discrete data packets into complete communication sessions; then standardization is performed, and the Z-score method is used to convert different dimensional features into a standard normal distribution. In the data labeling link, the data set is labeled by combining expert knowledge and automatic labeling technology, with normal samples accounting for 70% and abnormal samples accounting for 30% to ensure the balance of the data set; abnormal samples are subdivided into four categories: protocol anomalies, traffic anomalies, timing anomalies and identity anomalies, each accounting for 25% of abnormal samples. In the data enhancement phase, the training set is expanded through transformation, combination and synthesis techniques, especially oversampling of rare anomaly types to generate enough variant samples; the generative adversarial network (GAN) is used to simulate the network traffic characteristics under different attack scenarios to enhance the model's ability to identify unknown attacks. In the feature engineering phase, the communication relationship between devices is converted into a structured representation through the graph structure representation learning method, and the node feature vector and edge feature vector are constructed; self-supervised learning labels are generated based on the time series prediction task, and the sliding window method is used to extract time series features, and the window size is set to twice the typical communication cycle. The final training data set contains node feature matrix, adjacency matrix, time series feature matrix and corresponding labels, with a total sample size of no less than 1 million, to ensure the effectiveness and generalization ability of model training.

[0082] The mathematical model or calculation process involved in the present invention is described in detail below.

[0083] The mathematical expression of constructing the network topology matrix of the security isolation zone in step S01 is as follows:

[0084]

[0085] Where A is the adjacency matrix; n is the total number of devices in the isolation area; a ij Indicates the connection status and communication permissions between device i and device j. The value is {0, 1, 2, 3}, where 0 indicates no connection, 1 indicates a unidirectional connection, 2 indicates a bidirectional connection with limited permissions, and 3 indicates a bidirectional connection with full permissions.

[0086] The parameter acquisition method is as follows: the total number of devices n is obtained through network scanning and asset management system; the connection status a ijObtained by combining active detection and passive monitoring. Active detection uses the ICMP protocol and TCP / UDP port scanning, and passive monitoring uses network traffic analysis. The connection relationship between devices is determined by analyzing the source address, destination address, and protocol type in the network traffic, and the permission level is determined by analyzing the communication content and access control list.

[0087] In step S04, the mathematical expression of the multi-target risk assessment function is specifically as follows:

[0088]

[0089] In the formula, Risk i is the security risk score of device i, and the value range is [0, 1]; W i is the device importance weight factor, and the value range is [0.1, 1.0]; V i is the standardized value of the cumulative number of known vulnerabilities, and the value range is [0, 1]; F i is the communication frequency per unit time, representing the standardized value of the number of communications per minute of the device, and the value range is [0, 1]; S i is the transmission data sensitivity coefficient, and the value range is [0.2, 1.0]; H i is the standardized value of the number of historical abnormal behaviors, and the value range is [0, 1]; α, β, γ, δ, ∈ are basic weight coefficients, and the values are 0.3, 0.25, 0.15, 0.2, 0.1 respectively; θ is the interaction term weight, and the value is 0.05, which is used to enhance the risk assessment when important devices process sensitive data; λ is the non-linear adjustment term weight, and the value is 0.05, which is used to strengthen the risk assessment when high vulnerabilities and high abnormal histories coexist.

[0090] Among them, the parameter acquisition method is: W i Calculated by eigenvector centrality, and the specific calculation formula is where v is the principal eigenvector of the network adjacency matrix A; V i After obtaining the number of vulnerabilities by scanning the device, it is calculated by standardization, and the formula is where CVSS j is the CVSS score of the jth vulnerability, m is the total number of vulnerabilities, m0 is the benchmark number of vulnerabilities, and the value is 10; F i Calculated by monitoring the communication behavior of the device for 30 days, and the formula is where f i is the average number of communications per minute of device i, f min and f max are the minimum and maximum communication frequencies among all devices respectively; S ; S iDetermined according to the data classification and grading standard, the general data takes the value of 0.2, the internal data takes the value of 0.4, the confidential data takes the value of 0.6, the secret data takes the value of 0.8, and the top-secret data takes the value of 1.0; H i Calculated by recording the number of times the device behavior deviates from the baseline, the formula is where h i is the number of abnormal behaviors of device i in the past 30 days, and h0 is the threshold constant with a value of 20.

[0091] This risk assessment function combines a linear weighted term and a non-linear adjustment term, considering the interaction between parameters. The linear weighted part reflects the basic contribution of each risk factor, and the interaction term θ·(W i ·S i ) emphasizes the additional risk when important devices process sensitive data. The non-linear adjustment term enhances the risk amplification effect when vulnerabilities and abnormal history coexist through an exponential function. This function not only considers the independent risk contributions of each factor but also reflects the synergistic effect between factors, providing a more accurate risk assessment result than simple weighted average.

[0092] The forward propagation calculation process of the multi-layer perceptron anomaly detection model in step S05 is specifically as follows:

[0093] Z (1) = X·W (1) + b (1) ;

[0094] A (1) = ReLU(Z (1) ) = max(0, Z (1) );

[0095] Z (2) = A (1) ·W (2) + b (2) ;

[0096] A (2) = ReLU(Z (2) ) = max(0, Z (2) );

[0097] Z (3) = A (2) ·W (3) + b (3) ;

[0098]

[0099] In the formula, is the input feature vector, d is the feature dimension, usually 50 - 200; The weight matrices of the first, second, and third layers respectively; The bias vectors of the first, second, and third layers respectively; Z (1) , Z (2) , Z (3) The linear outputs of the first, second, and third layers respectively; A (1) , A (2) The outputs of the first and second layers after passing through the activation function respectively; is the final output, representing the probability distribution of the sample belonging to the normal class and the abnormal class.

[0100] Among them, the parameter acquisition method is: the weight matrices W (1) , W (2) , W (3) and the bias vectors b (1) , b (2) , b (3) are obtained by training with the backpropagation algorithm, specifically using the cross-entropy loss function where y ij is the true label, is the predicted probability, and the Adam optimizer is used to update the parameters. The initial value of the learning rate is 0.001, and it decays to 90% of the original value every 50 epochs.

[0101] The anomaly detection decision process is as follows:

[0102] Anomaly_Score = Y1;

[0103]

[0104] In the formula, Y1 is the probability that the sample belongs to the abnormal class, that is, the second element of the Y vector; τ is the anomaly detection threshold, and its value range is [0.7, 0.8], usually set to 0.75; Decision is the final decision, 1 indicates anomaly, and 0 indicates normal.

[0105] This multi-layer perceptron model uses the ReLU activation function to achieve non-linear feature transformation. The ReLU function is selected instead of the Sigmoid or Tanh because ReLU can alleviate the vanishing gradient problem and accelerate convergence. The output layer uses the Softmax function to convert the linear output into a probability distribution, which is convenient for probability interpretation and threshold adjustment. The model learns the complex features of the device communication behavior through multi-layer non-linear transformations, automatically extracts high-dimensional patterns for distinguishing normal and abnormal behaviors, and has stronger generalization ability and adaptability compared with traditional rule-based methods.

[0106] The calculation process of the long short-term memory network prediction model for time series anomaly detection in step S06 is as follows:

[0107] ft = σ(W f · [h t-1 , x t + b f );

[0108] i t = σ(W i · [h t-1 , x t + b i );

[0109]

[0110] o t = σ(W o · [h t-1 , x t + b o );

[0111] h t = o t ⊙ tanh(C t );

[0112]

[0113] Wherein, is the input feature vector at time step t, d is the feature dimension; is the hidden state vector; is the cell state vector; is the forget gate vector; is the input gate vector; is the output gate vector; is the candidate cell state vector; is the predicted feature vector for the next time step; W f , W i , W C , are the weight matrices for the forget gate, input gate, candidate cell state, and output gate respectively; b f , b i , b C , are the corresponding bias vectors; and are the weight matrix and bias vector of the prediction layer respectively; σ represents the Sigmoid activation function; tanh represents the hyperbolic tangent activation function; ⊙ represents the Hadamard product (element-wise multiplication).

[0114] The time series anomaly score based on the LSTM prediction model is calculated as follows:

[0115]

[0116]

[0117] τ t = μ AS + β·σ AS ;

[0118] where is the prediction error vector; is the standardized prediction error vector; and are the mean and standard deviation vectors of historical prediction errors respectively; w i is the importance weight of the i-th feature, determined by feature importance analysis; AnomalyScore t is the anomaly score at time step t; TimeSeriesAnomaly t is the anomaly determination result, 1 indicates anomaly, 0 indicates normal; τ t is the adaptive threshold; μ AS and σ AS are the mean and standard deviation of historical anomaly scores respectively; β is the threshold coefficient, usually set to 3.

[0119] Among them, the parameter acquisition method is: the LSTM network parameters W f 、W i 、W C 、W o 、b f 、b i 、b C 、b o 、W p 、b p are obtained through training on time series prediction tasks, using the mean squared error loss function The historical prediction error statistic μ e and σ e are obtained through statistical analysis of the prediction errors of the model on normal data; the feature importance weight w i is determined by evaluating the contribution of each feature to anomaly detection through random forest or permutation importance methods; the anomaly score statistic μ AS and σ AS are obtained through statistical analysis of the anomaly score sequence during normal operation.

[0120] This time series anomaly detection method combines the time series modeling ability of LSTM and the robustness of statistical anomaly detection. The LSTM model can capture the long-term dependencies and non-linear patterns in time series data. By predicting the normal behavior of the next time step and comparing it with the actual observed values, it can effectively identify the anomaly patterns that deviate from the expectations. The adaptive threshold mechanism takes into account the statistical distribution characteristics of the anomaly scores, can adapt to different operating environments and load conditions, and reduce the false alarm rate. The introduction of the weight vector w i allows the model to focus on more important feature dimensions and improve the detection sensitivity.

[0121] The mathematical expression of the device fingerprint recognition mechanism in step S07 is specifically as follows:

[0122]

[0123] In the formula, F j is the fingerprint feature vector of device j; f ji is the i-th physical feature value of device j; g i (·) is the extraction function of the i-th feature; r ji is the i-th original physical characteristic measurement value of device j; ε ji is the measurement error, following a Gaussian distribution with a mean of 0 and a standard deviation of σ i ; m is the total number of features, and the typical value is 4 - 8.

[0124] The extraction functions of each physical feature are defined as follows:

[0125] Clock offset feature: where Δt jk is the deviation of the k-th TCP timestamp sample of device j from the reference clock;

[0126] Radio frequency characteristic feature: f j2 = g2(r j2 ) = FFT(s j (t)), where s j (t) is the radio frequency signal waveform emitted by device j;

[0127] Electromagnetic radiation feature: where P j (f) is the electromagnetic power spectral density of device j in the frequency range [f1, f2];

[0128] Hardware response time feature: where t req，k and t resp，k are the k-th request sending time and response receiving time respectively.

[0129] The calculation of the device fingerprint similarity is as follows:

[0130]

[0131] Wherein, Sim(F j , F k ) is the fingerprint similarity between device j and device k, and its value range is [-1, 1]; w i is the weight of the i-th feature,

[0132] The device authentication process is as follows:

[0133]

[0134] Wherein, Identity(j) is the authentication result of device j; D is the set of fingerprints of registered legal devices; τ F is the authentication threshold, and its value range is [0.85, 0.95], usually set to 0.9.

[0135] Among them, the method for obtaining parameters is as follows: the original physical characteristic measurement value r ji is collected by a dedicated measurement device, the clock offset is obtained by analyzing the TCP timestamp option field, the radio frequency characteristics are collected by a dedicated radio frequency signal analyzer, the electromagnetic radiation is collected by an electromagnetic detector, and the hardware response time is measured by sending a specific request and recording the response time; the feature weight w i is determined by an optimization algorithm that maximizes the recognition rate of legal devices and minimizes the misrecognition rate of disguised devices.

[0136] This device fingerprint recognition mechanism utilizes the uniqueness and difficulty of forgery of the device physical layer characteristics, and improves the accuracy and robustness of recognition through multi-dimensional feature fusion. The cosine similarity is used to measure the similarity between device fingerprints. Compared with the Euclidean distance, the cosine similarity is insensitive to the length of the feature vector and can better handle the magnitude difference of different device feature values. By setting an appropriate threshold τ F , a balance can be achieved between the recognition accuracy and the misrecognition rate. The measurement error term ε ji is introduced to make the model more in line with the actual application scenario and enhance the robustness of the system.

[0137] The calculation of the comprehensive risk score of the multi-dimensional anomaly scoring system in step S09 is as follows:

[0138]

[0139] Wherein, R is the comprehensive risk score, and its value range is [0, 1]; f i is the standardized score of the i-th feature, and its value range is [0, 1]; w i is the weight coefficient of the i-th feature, satisfying α ijis the interaction weight between feature i and feature j, with a value range of [-0.1, 0.1]; is the weighted average eigenvalue; β is the variance adjustment coefficient, with a value of 0.1; n is the total number of features, and the typical value is 12 - 15.

[0140] The main feature classifications and their weights are as follows:

[0141] Traffic feature: w1 = 0.3, including protocol anomaly degree f 11 and data volume mutation rate f 12 and connection establishment mode anomaly degree f 13 , and the internal weights are 0.4, 0.3, and 0.3 respectively;

[0142] Device unique identifier: w2 = 0.25, including fingerprint matching degree f 21 and authentication confidence degree f 22 , and the internal weights are 0.5 and 0.5 respectively;

[0143] Behavior pattern: w3 = 0.25, including the degree of deviation from the baseline library f 31 and communication mode change rate f 32 , and the internal weights are 0.6 and 0.4 respectively;

[0144] Time series feature: w4 = 0.2, including prediction error amplitude f 41 and degree of periodicity disruption f 42 , and the internal weights are 0.5 and 0.5 respectively.

[0145] The feature standardization process is as follows:

[0146] $f_i = $;

[0148] In the formula, x i is the original feature value; μ i and σ i are the historical mean and standard deviation of feature i respectively; min(x i ) and max(x i ) are the minimum and maximum values of feature i respectively.

[0149] The risk level classification rules are as follows:

[0150]

[0151] Among them, the parameter acquisition method is: the original feature values are obtained through corresponding detection modules, such as traffic analysis module, device fingerprint recognition module, behavior analysis module and time series analysis module; the feature weight w i is initially set through expert experience and is optimized later using machine learning methods such as random forest feature importance or genetic algorithm; the interaction weight α ijDetermined by analyzing the correlation and interaction effects among features in historical data.

[0152] This multi-dimensional anomaly scoring system combines three components: linear weighting, feature interaction, and variance adjustment. The linear weighting part reflects the basic contribution of each feature to risk assessment; the feature interaction part captures the synergistic or offsetting effects among different features, such as the risk amplification when traffic anomalies and device identity anomalies occur simultaneously; the variance adjustment part enhances the detection sensitivity of anomaly features and increases the risk score when certain features deviate significantly from the average level. A hierarchical structure is adopted to process different categories of features, which not only maintains the integrity of the scoring but also allows for fine-tuning within each category. By comprehensively considering multi-dimensional anomaly metrics, this system significantly improves the accuracy of anomaly detection and reduces the false alarm rate.

[0153] Optionally, the mathematical expression of the secure isolation intelligent perception network model (based on the graph neural network architecture) is specifically as follows:

[0154] H (0) = X;

[0155]

[0156] In the formula, is the node feature matrix of the l-th layer, n is the number of nodes, and d l is the feature dimension of the l-th layer; is the initial node feature matrix; is the adjacency matrix of the secure isolation area network topology graph; is the identity matrix; is the adjacency matrix after adding self-loops; is the corresponding degree matrix; is the weight matrix of the l-th layer; σ is the ReLU activation function.

[0157] The calculation process of the spatio-temporal attention mechanism is as follows:

[0158]

[0159] In the formula, is the attention score of node i to node j; is the attention vector; is the feature vector of node i at the l-th layer; is the normalized attention weight; is the neighbor set of node i; || represents the vector concatenation operation; LeakyReLU is the leaky ReLU activation function.

[0160] The calculation process of the multi-head attention mechanism is as follows:

[0161]

[0162] In the formula, K is the number of attention heads, set to is the attention weight calculated by the k-th attention head; W (l，k) is the weight matrix of the k-th attention head.

[0163] The calculation process of the temporal attention is as follows:

[0164] q t = W Q h t ;

[0165] k s = W K h s ;

[0166] v s = W V h s ;

[0167]

[0168] In the formula, is the hidden state at time step t; is the query vector; and are the key vector and value vector at time step s respectively; are the transformation matrices of the query, key, and value respectively; β ts is the attention weight of time step t to time step s; w is the attention window length, set to 1.5 times the device communication period in the temporal feature vector; is the context vector at time step t.

[0169] The multi-task learning objective function is defined as follows:

[0170] L total = λ1L identity + λ2L anomaly ;

[0171]

[0172] In the formula, L total is the total loss function; L identity is the cross-entropy loss of the device authentication task; L anomaly is the mean squared error loss of the behavior anomaly scoring task; λ1 and λ2 are weight coefficients, set to 0.6 and 0.4; y i and are the true identity tag and predicted probability of device i; s i and are the true anomaly score and predicted anomaly score of device i, respectively.

[0173] Among them, the parameter acquisition method is as follows: The initial node feature matrix X is constructed through feature engineering on information such as device communication behavior characteristics and hardware characteristics; the network topology graph adjacency matrix A is obtained from step S01; the model weight parameters W (l) , a (l) , W Q , W K , W V etc. are obtained through the model training process. The training uses the method described in step S08, including self-supervised learning on large-scale general network environment data, and then supervised fine-tuning on the ocean forecasting system isolation area environment data.

[0174] This secure isolation intelligent perception network model combines the structure perception ability of the graph convolutional network and the dynamic feature extraction ability of the attention mechanism. The graph convolutional layer can effectively capture the node relationships in the network topology structure, integrate the neighbor node information through the message passing mechanism, and form a node representation considering the network structure. The spatial attention mechanism allows the model to dynamically adjust the importance of different neighbor nodes and focus on more relevant connection relationships. The temporal attention mechanism captures the long-term dependencies in the time series data and identifies the changing characteristics of the device communication patterns over time. The multi-head attention design enhances the model's expressive ability and allows simultaneous attention to patterns in different feature subspaces. The multi-task learning framework simultaneously optimizes two related tasks of device authentication and behavior anomaly detection, and improves the generalization ability and efficiency of the model through shared representation learning.

[0175] Specifically, the principle of the present invention is as follows: The core technical principle of the present invention is based on an anomaly detection framework of "multi-dimensional feature fusion + deep learning". By comprehensively utilizing network topology features, communication behavior features, device physical features, and time series features, a comprehensive illegal access perception mechanism is constructed. This method can solve the illegal access detection problem faced by traditional security isolation areas. The main principles are as follows:

[0176] First, the security isolation area network topology graph matrix provides a mathematical representation of the connection relationships between all devices in the isolation area, providing a network structure basis for anomaly detection. This graph-based representation method can accurately model the complex communication relationships between devices and helps identify abnormal connections that violate the topology structure. By establishing a device asset inventory, the system obtains the benchmark data of the hardware characteristics and communication behavior patterns of the devices, providing a comparison standard for subsequent anomaly detection.

[0177] Secondly, the deep packet inspection technology deeply analyzes the content of data packets, extracts fine-grained communication features, and records normal communication patterns through the device behavior baseline library. The multi-objective risk assessment function quantifies device risks from multiple dimensions, assigns differentiated risk levels to different device types, enabling the detection system to prioritize high-risk devices and improve detection efficiency. The combination of the multi-layer perceptron and the time-series anomaly detection algorithm enables the system to simultaneously focus on the spatial and temporal features of device behavior, enhancing the ability to identify hidden anomalies.

[0178] Most importantly, the security isolation intelligent perception network model of the present invention adopts a graph neural network architecture, captures network topology relationship features through graph convolutional layers, models temporal dependencies through spatio-temporal attention mechanisms, and simultaneously completes device authentication and behavior anomaly assessment through multi-task learning. This structural design enables the model to comprehensively consider the correlation relationships between devices and behavioral temporal features. It is precisely this multi-dimensional information fusion mechanism that enables the model to identify complex abnormal behaviors that are difficult to detect by single-dimensional detection.

[0179] In addition, the device fingerprint recognition mechanism extracts unique identifiers that are difficult to forge based on device physical layer characteristics, providing physical layer protection for device authentication. The multi-dimensional anomaly scoring system fuses various features for calculation, assigns comprehensive risk scores to potential anomalies, and effectively reduces the false alarm rate. The introduction of federated learning realizes the optimization of model performance while protecting the security of the original data, meeting the special security requirements of the isolated area network environment.

[0180] In summary, the present invention forms a complete set of automatic perception technologies for illegal access through multi-dimensional feature extraction, deep learning model construction, and multi-level anomaly assessment, thus effectively solving the technical problem of real-time perception of illegal device access in the security isolation area network.

[0181] A specific Embodiment 1 of the present invention is provided below. The specific implementation of each step in this Embodiment 1 is described in detail as follows.

[0182] The specific implementation of step S01 is to construct a security isolation area network topology graph matrix and establish a detailed device asset list through network scanning and device discovery technologies. First, all network devices in the isolation area are discovered by combining active detection and passive listening. The ICMP protocol is used for liveness detection, and the TCP / UDP port scanning technology is used to identify open services. Then, an adjacency matrix is constructed, expressed as:

[0183]

[0184] In the formula, A is the adjacency matrix; n is the total number of devices in the isolation area; a ijIndicates the connection status and communication permissions between device i and device j, with values in {0, 1, 2, 3}, where 0 indicates no connection, 1 indicates one-way connection, 2 indicates two-way connection with restricted permissions, and 3 indicates two-way connection with full permissions. Then, collect device hardware feature information, including MAC address, operating system type, firmware version, CPU model, and memory capacity, etc., and record communication behavior patterns, including parameters such as communication protocol type, average data transmission volume, communication frequency, and typical time window. Finally, integrate all information into a unified asset management database to complete the construction of the network topology matrix and device asset inventory. This step establishes a mathematical representation model of the network structure, providing basic data support for subsequent risk assessment and anomaly detection.

[0185] The specific implementation manners of steps S02 - S03 are the same as those described above and will not be elaborated here in detail.

[0186] The specific implementation manner of step S04 is to apply a multi-objective risk assessment function to classify the risk levels of various devices in the isolation area. The mathematical expression of the multi-objective risk assessment function is:

[0187]

[0188] In the formula, Risk i is the security risk score of device i, with a value range of [0, 1]; W i is the device importance weight factor, with a value range of [0.1, 1.0]; V i is the standardized value of the cumulative number of known vulnerabilities, with a value range of [0, 1]; F i is the communication frequency per unit time, representing the standardized value of the number of communications per minute of the device, with a value range of [0, 1]; S i is the transmission data sensitivity coefficient, with a value range of [0.2, 1.0]; H i is the standardized value of the number of historical abnormal behavior times, with a value range of [0, 1]; α, β, γ, δ, ∈ are basic weight coefficients, with values of 0.3, 0.25, 0.15, 0.2, 0.1 respectively; θ is the interaction term weight, with a value of 0.05, used to enhance the risk assessment when important devices process sensitive data; λ is the non-linear adjustment term weight, with a value of 0.05, used to strengthen the risk assessment when high vulnerabilities and high abnormal histories coexist. According to the calculation results, the device risk levels are classified as: low risk (Risk i ∈[0, 0.3)), medium risk (Risk i ∈[0.3, 0.6)), high risk (Risk i ∈[0.6, 0.8)), extremely high risk (Risk i∈[0.8, 1.0]). This risk assessment function combines linear weighting and a non - linear adjustment term, taking into account the interaction and synergy among parameters, providing guidance on risk priorities for the subsequent anomaly detection model.

[0189] The specific implementation of step S05 is to use a multi - layer perceptron to build an anomaly detection model to identify abnormal communications that deviate from the behavior baseline. The forward propagation calculation process of the multi - layer perceptron model is as follows:

[0190] Z (1) = X·W (1) + b (1) ;

[0191] A (1) = ReLU(Z (1) ) = max(0, Z (1) );

[0192] Z (2) = A (1) ·W (2) + b (2) ;

[0193] A (2) = ReLU(Z (2) ) = max(0, Z (2) );

[0194] Z (3) = A (2) ·W (3) + b (3) ;

[0195]

[0196] In the formula, is the input feature vector, d is the feature dimension (50 - 200); are the weight matrices of each layer respectively; are the bias vectors of each layer respectively; Z (l) is the linear output of the l - th layer; A (l) is the activation output of the l - th layer; Y is the final output, representing the probabilities that the sample belongs to the normal and abnormal classes. The anomaly detection decision process is as follows:

[0197] Anomaly_Score = Y1;

[0198]

[0199] Where Y1 is the probability that the sample belongs to the abnormal class; τ is the anomaly detection threshold, usually taken as 0.75; Decision is the final decision, 1 indicates abnormality, and 0 indicates normality. The model is trained using the cross-entropy loss function and the Adam optimizer, with an initial learning rate of 0.001, decaying to 90% of the original every 50 epochs. This step automatically extracts high-dimensional feature patterns through deep learning methods, with stronger generalization ability and adaptability compared to traditional rule-based methods.

[0200] The specific implementation of step S06 is to introduce a time-series anomaly detection algorithm to identify unexpected device access behaviors during data transmission. First, a time-series prediction model based on a long short-term memory network is constructed, and the calculation process is as follows:

[0201] f t =σ(W f ·[h t-1 ,x t +b f );

[0202] i t =σ(W i ·[h t-1 ,x t +b i );

[0203]

[0204] o t =σ(W o ·[h t-1 ,x t +b o );

[0205] h t =o t ⊙tanh(C t );

[0206]

[0207] In the formula, x t is the input feature vector at time step t; h t is the hidden state vector; C t is the cell state vector; f t 、i t 、o t are the forget gate, input gate, and output gate vectors respectively; is the candidate cell state; is the predicted feature vector for the next time step; W and b are the corresponding weight matrix and bias vector. The time-series anomaly score based on the prediction model is calculated as:

[0208]

[0209] τ t = μ AS + β·σ AS ;

[0210] In the formula, e t is the prediction error vector; z t is the standardized error vector; μ e and σ e are the mean and standard deviation of historical prediction errors; w i is the feature importance weight; AnomalyScore t is the comprehensive anomaly score; τ t is the adaptive threshold; β is the threshold coefficient, usually 3. This step effectively identifies temporal anomalies in the data acquisition process and discovers data anomalies caused by unauthorized device access by analyzing time series features and prediction errors.

[0211] The specific implementation of step S07 is to establish a device fingerprint recognition mechanism based on physical layer characteristics to verify the legitimacy of device identities in the isolation area. The mathematical expression of the device fingerprint feature vector is:

[0212] F j = {f j1 , f j2 ,..., f jm};

[0213] f ji = g i (r ji ) + ε ji ;

[0214] In the formula, F j is the fingerprint feature vector of device j; f ji is the i-th physical feature value of device j; g i (·) is the feature extraction function; r ji is the original physical characteristic measurement value; ε ji is the measurement error, following a Gaussian distribution. The calculation of device fingerprint similarity is:

[0215]

[0216] In the formula, Sim(F j , F k ) is the fingerprint similarity between device j and device k; w i is the feature weight. The device identity verification process is:

[0217]

[0218] Where Identity(j) is the authentication result of device j; D is the set of legitimate device fingerprints; τ F is the authentication threshold, usually 0.9. This step realizes reliable verification of device identity by analyzing physical layer features that are difficult to forge, and effectively identifies disguised devices.

[0219] The specific implementation of step S08 is to analyze network behavior using a pre-trained secure isolation intelligent perception network model. This model is based on the graph neural network architecture, and the core calculation process includes:

[0220] H (0) = X;

[0221]

[0222] Where H (l) is the node feature matrix of the l-th layer; X is the initial node feature matrix; A is the network topology adjacency matrix; I is the identity matrix; is the adjacency matrix after adding self-loops; is the corresponding degree matrix; W (l) is the weight matrix; σ is the activation function. The calculation of the spatio-temporal attention mechanism is:

[0223]

[0224] The calculation of the multi-head attention mechanism is:

[0225]

[0226] Where K is the number of attention heads, set to is the attention weight of the k-th attention head; W (l，k) is the corresponding weight matrix. The multi-task learning objective function of the model is:

[0227] L total = λ1L identity + λ2L anomaly ;

[0228] Where L identity is the cross-entropy loss of the device identity authentication task; L anomaly is the mean squared error loss of the behavior anomaly scoring task; λ1 and λ2 are weight coefficients, set to 0.6 and 0.4. Through the analysis of this model, the device identity authentication result (confidence level not less than 0.9) and the behavior anomaly degree score (anomaly threshold set to 0.7) can be output simultaneously. This step realizes in-depth analysis of network behavior through the graph neural network combined with the spatio-temporal attention mechanism, and timely discovers illegal access behaviors.

[0229] The specific implementation of step S09 is to construct a multi-dimensional anomaly scoring system and calculate the comprehensive risk score of suspicious access behavior. The formula for calculating the comprehensive risk score is as follows:

[0230]

[0231] In the formula, R is the comprehensive risk score; f i is the standardized score of the i-th feature; w i is the feature weight; α ij is the feature interaction weight; is the weighted average eigenvalue; β is the variance adjustment coefficient, and its value is 0.1. The main feature classifications and weights are: traffic feature (w1 = 0.3), device unique identifier (w2 = 0.25), behavior pattern (w3 = 0.25), time series feature (w4 = 0.2). According to the calculation results, the risk levels are classified as follows: low risk (R ∈ [0, 0.4)), medium risk (R ∈ [0.4, 0.7)), high risk (R ∈ [0.7, 0.9)), and extremely high risk (R ∈ [0.9, 1.0]). This step realizes the accurate evaluation of suspicious access behavior by integrating multi-dimensional anomaly indicators, improves the detection accuracy and reduces the false alarm rate.

[0232] The specific implementation of steps S10 - S11 is the same as the foregoing and will not be elaborated here.

[0233] To better understand and implement the present invention, the following provides an embodiment 2 of a specific application scenario of the present invention: Researchers in a certain marine forecast data center are responsible for building and maintaining the secure isolation area network of the marine forecast system. This system includes multiple key subsystems, such as data acquisition terminals, transmission devices, computing servers, and operator terminals, etc., which collect, transmit, calculate, and analyze marine environmental monitoring data. Since the data processed by the system is of great significance to national marine security, the researchers decided to deploy a method for automatically sensing illegal access in the network security isolation area to improve the system security.

[0234] First, the researchers conducted a comprehensive scan of the secure isolation area network, used ICMP protocol and TCP / UDP port scanning technologies to identify all network devices, and constructed a network topology matrix containing 42 device nodes. As shown in Table 1:

[0235] Table 1 Network topology matrix of the secure isolation area network (partial)

[0236]

[0237]

[0238] In the matrix, 0 indicates no connection, 1 indicates unidirectional connection, 2 indicates bidirectional connection with restricted permissions, and 3 indicates bidirectional connection with full permissions. At the same time, an equipment asset inventory is established to record the hardware characteristics and communication behavior patterns of the equipment.

[0239] Then, the researchers deployed 12 distributed traffic collection nodes at the key nodes of the network, including gateway entrances and exits, core switches, and the front ends of key servers. The collection nodes replicate network traffic through the switch port mirroring technology and transmit it to the security audit server through a secure channel using the AES-256 encryption algorithm. The collected traffic data reaches 62GB per day on average.

[0240] Using the deep packet inspection technology, the researchers extracted the communication characteristics of the equipment and established an equipment behavior baseline library. For a typical data collection terminal (DEV008), its communication characteristic baseline is shown in Table 2:

[0241] Table 2 Communication Characteristic Baseline of Data Collection Terminal DEV008

[0242] Characteristic index Normal value range Mean value Standard deviation Connection establishment frequency (times / minute) 2.1-3.5 2.8 0.23 Session duration (seconds) 8.5-15.2 12.6 1.15 Transmitted data volume (KB / hour) 425-580 503 25.8 Communication period (hours) 06:00-22:00 - - Proportion of TCP connections (%) 82-91 86.5 1.8 Proportion of UDP connections (%) 9-18 13.5 1.8 Number of destination IP addresses 4-6 5 0.5

[0243] Based on the established asset inventory and baseline library, the researchers used a multi-objective risk assessment function to classify the risk levels of the equipment. Taking five key equipment as examples, the calculated risk assessment results are shown in Table 3:

[0244] Table 3 Risk Assessment Results of Key Equipment

[0245]

[0246] Next, the researchers used a multi-layer perceptron to build an anomaly detection model. The model includes an input layer (152 feature nodes), two hidden layers (128 and 64 nodes respectively), and an output layer (2 nodes). It is trained using a dataset containing 100,000 normal samples and 20,000 abnormal samples, and the anomaly detection threshold is set to 0.75. After training, the model achieved a detection accuracy of 95.8% and a false alarm rate of 2.3% on the test set.

[0247] To identify the unexpected device access behavior during data transmission, the researchers introduced a time series anomaly detection algorithm based on the long short-term memory network. This algorithm performs time series analysis on the data generated by the collection terminal, predicts the normal behavior at the next time step, and identifies anomalies by calculating the prediction error. In the actual deployment, the system successfully captured an abnormal device access behavior, and the time series anomaly score reached 4.82 (the threshold is 3.2), triggering an alarm in a timely manner.

[0248] The researchers also established a device fingerprint recognition mechanism to extract the physical characteristics of the device to form a unique identifier. Taking a key server as an example, its fingerprint features are shown in Table 4:

[0249] Table 4 Physical fingerprint features of server DEV013

[0250]

[0251]

[0252] Use a pre-trained secure isolation intelligent perception network model to analyze network behavior. This model is based on a graph neural network architecture and includes 3 graph convolutional layers, 2 spatio-temporal attention mechanism layers, and a multi-task learning head. The number of attention heads is set to The attention window length is 18 (1.5 times the typical communication cycle of 12 minutes for data collection terminals). The detection rate of illegal access behavior by the model in offline tests reaches 98.2%.

[0253] Construct a multi-dimensional anomaly scoring system. Combine traffic characteristics, device unique identifier, behavior pattern, and temporal characteristics to calculate the risk score of suspicious access behavior. In an experimental simulation, the researchers found a suspicious device accessing. The comprehensive risk score calculated by the system is 0.83, and the detailed scoring is shown in Table 5:

[0254] Table 5 Multi-dimensional anomaly scoring of suspicious devices

[0255] Abnormal dimension Weight Characteristic value Weighted score Traffic characteristics 0.30 0.78 0.234 Unique device identifier 0.25 0.95 0.238 Behavior pattern 0.25 0.82 0.205 Time series characteristics 0.20 0.72 0.144 Characteristic interaction term - - 0.009 Total score - - 0.830

[0256] Finally, a response mechanism based on a rule engine is implemented. Automatically trigger corresponding processing strategies according to different risk levels. Taking the above-mentioned suspicious device as an example (risk score 0.83, high risk), the system automatically executed the following response measures: generating high-priority alarms, notifying the security operation and maintenance team, automatically isolating the suspicious device, and saving the network traffic data 30 minutes before and after the event for forensic analysis. After confirmation by the security team, this device is indeed an unauthorized test device for access.

[0257] This embodiment also uses federated learning technology to optimize the secure isolation intelligent perception network model. Organize 12 traffic collection nodes into a federated learning network, perform parameter aggregation once every 24 hours, and each node performs 10 rounds of local training during the communication interval. Protect the security of parameter transmission through differential privacy protection (noise level σ = 0.03, ε = 3) and homomorphic encryption. After 3 months of federated learning optimization, the detection rate of the model for new illegal access behaviors has increased from 94.5% to 98.7%, and the false alarm rate has decreased from 3.8% to 1.2%.

[0258] Traditional detection of illegal access to a traditional network security isolation area mainly relies on static rules and simple anomaly detection algorithms, and has the following problems: First, relying on predefined rules, it is difficult to cope with unknown threats; second, insufficient consideration of the physical characteristics of devices makes it easy to be bypassed by feature disguise; third, the lack of analysis of temporal characteristics makes it difficult to detect advanced persistent threats; finally, each detection module is independent of each other and lacks overall coordination. The present invention constructs a multi-dimensional security perception model by integrating network topology structure, device physical characteristics, communication behavior patterns, and temporal characteristics. By using a graph neural network and a spatio-temporal attention mechanism, deep learning of complex relationships between devices is realized. The federated learning technology is introduced to continuously optimize the model while protecting data privacy.

[0259] It should be noted that the detailed explanations of the variables involved in the present invention are shown in Tables 6 and 7 below.

[0260] Table 6 Variable Explanation Table (First Part)

[0261]

[0262]

[0263] Table 7 Variable Explanation Table (Second Part)

[0264]

[0265]

[0266] The above is only the specific implementation manner of the present invention, but the protection scope of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present invention can easily think of changes or substitutions, which should all be covered by the protection scope of the present invention.

Claims

1. An automatic sensing model method for illegal access in a network security isolation area, characterized in that, Including: Construct a network topology matrix for the security isolation area and establish a device asset inventory; Use distributed traffic collection nodes to capture network traffic in real time at key nodes in the isolation area network; Utilize deep packet inspection technology to extract features from the collected data to form a device behavior baseline library; apply a multi-objective risk assessment function to classify the risk levels of collection terminals, transmission devices, computing servers, and operator terminals; use a multi-layer perceptron to construct an anomaly detection model; introduce a time-series anomaly detection algorithm to generate time-series feature vectors for the collection terminals; establish a device fingerprint recognition mechanism to extract the unique identifier of the device based on the physical layer characteristics; use a pre-trained security isolation intelligent perception network model to analyze network behavior; Construct a multi-dimensional anomaly scoring system, and combine traffic characteristics, device unique identifier, behavior pattern, and time-series feature vector to calculate the risk score of suspicious access behavior; Implement a response mechanism based on a rule engine, and trigger a response strategy when the multi-dimensional anomaly scoring system detects an illegal access behavior.

2. The method according to claim 1, wherein The network traffic captured by the distributed traffic collection nodes is transmitted to the security audit server through an encrypted channel.

3. The method according to claim 2, wherein The anomaly detection model constructed by the multi-layer perceptron is trained through a supervised learning method, and is used to identify abnormal communications that deviate from the behavior patterns recorded in the device behavior baseline library.

4. The method according to claim 3, wherein The network topology matrix of the security isolation area refers to an adjacency matrix used to describe the connection relationships between all devices in the isolation area. Each element in the matrix represents the connection status and communication permission between two devices, and is used to establish a mathematical representation model of the network structure.

5. The method according to claim 4, wherein The time-series anomaly detection algorithm refers to analyzing the time-series characteristics of the data collected by the collection terminals, and using a long short-term memory network or an autoregressive model to identify time-series anomalies in the data collection process and discover data anomalies caused by unauthorized device access.

6. The method according to claim 5, characterized in that, The multi-dimensional anomaly scoring system refers to fusing and calculating multiple anomaly detection indicators, assigning a risk score to each potential abnormal behavior, and generating a comprehensive risk assessment result through weighted calculation to improve the accuracy of anomaly detection and reduce the false alarm rate.

7. The method according to claim 6, wherein The input parameters of the multi-objective risk assessment function include device importance weight, number of vulnerabilities, communication frequency, data sensitivity, and abnormal behavior history. The output parameters of the multi-objective risk assessment function include device security risk score and risk level classification identifier.

8. The method according to claim 7, wherein The specific structure of the security isolation intelligent perception network model is an anomaly detection framework based on a graph neural network architecture, including a graph convolutional layer, a spatio-temporal attention mechanism layer, and a multi-task learning head. The graph convolutional layer is used to capture the relationship features between devices in the network topology matrix of the security isolation area. The spatio-temporal attention mechanism layer models the time-series dependence in the communication mode of the collection terminals; the parameter optimization of the security isolation intelligent perception network model depends on the node density in the network topology matrix of the security isolation area, the traffic baseline threshold in the device behavior baseline library, and the device communication time-series characteristics.

9. The method according to claim 8, wherein It also includes using federated learning technology to optimize the security isolation intelligent perception network model. After local training, each traffic collection node shares the parameters of the security isolation intelligent perception network model, avoiding cross-domain transmission of raw data and enhancing the overall protection ability of the security isolation area.

10. An illegal access automatic perception model system in a network security isolation area, characterized in that, The system is any one of a server, a computer, or a computing center, and a logic processor is provided in the system, and the logic processor is used to execute the method for automatically sensing an illegal access in the network security isolation area according to any one of claims 1-9.

Images