An illegal access automatic sensing model method and system in a network security isolation area

Abstract

This invention provides an automatic detection model and system for unauthorized access within a network security isolation zone, belonging to the technical field of computer systems based on specific computational models. The invention first constructs a network topology matrix for the security isolation zone and establishes a device asset list. Then, it deploys distributed traffic acquisition nodes to obtain real-time network data. Deep packet inspection technology is used to extract features and establish a device behavior baseline library. A multi-objective risk assessment function is applied to classify devices by risk level. Multilayer perceptrons and temporal anomaly detection algorithms are used to identify abnormal communication. A device fingerprinting mechanism based on physical layer characteristics is established to verify the legitimacy of device identity. A secure isolation intelligent sensing network model is used to analyze network behavior. A multi-dimensional anomaly scoring system is constructed to calculate risk scores, implementing a rule-based response mechanism. Federated learning technology can be selectively used to optimize the model, forming a comprehensive, multi-layered automatic detection and protection system for unauthorized access.

Description

Technical Field

[0001] This invention belongs to the field of computer system technology based on specific computational models. Specifically, it relates to a method and system for automatically detecting unauthorized access within a network security isolation zone. Background Technology

[0002] This invention relates to the field of network security, particularly network security monitoring technology within secure isolation zones. Traditional secure isolation zones typically employ physical isolation, logical isolation, and other methods to establish regional boundary protection, relying on static defense measures such as firewalls and intrusion detection systems to prevent external threats. Simultaneously, they manage the communication permissions of internal devices through mechanisms such as access control lists and authentication, forming a relatively closed security environment.

[0003] However, with the increasing sophistication of attack methods, traditional perimeter protection and static detection methods face severe challenges. First, rule-based detection systems lack the ability to detect unknown threats; second, traditional authentication mechanisms are vulnerable to credential theft attacks; third, existing anomaly detection systems focus primarily on communication protocol anomalies, neglecting the analysis of device behavior patterns and timing characteristics; and finally, the lack of fine-grained real-time monitoring mechanisms within the isolated zone makes it difficult to detect unauthorized devices once they have accessed the system.

[0004] These shortcomings create blind spots in the detection of internal threats within secure isolation zones. Especially when dealing with the access of maliciously disguised devices by professional attackers, existing technologies struggle to achieve real-time detection and accurate identification, seriously threatening the overall security of the isolation zone. Therefore, there is an urgent need for an intelligent detection method capable of automatically detecting unauthorized access. In other words, existing technologies present a technical problem: secure isolation zone networks cannot accurately detect unauthorized device access in real time. Summary of the Invention

[0005] In view of this, the present invention provides an automatic detection model method and system for unauthorized access within a network security isolation zone, which can solve the technical problem in the prior art that it is difficult to detect unauthorized device access in real time and accurately in a secure isolation zone network.

[0006] The present invention is implemented as follows: The first aspect of the present invention provides an automatic detection model method for unauthorized access within a network security isolation zone, comprising: constructing a network topology matrix of the security isolation zone and establishing a device asset list; using distributed traffic collection nodes to capture network traffic in real time at key nodes of the isolation zone network; using deep packet inspection technology to extract features from the collected data to form a device behavior baseline library; applying a multi-objective risk assessment function to classify the risk levels of collection terminals, transmission equipment, computing servers, and operator terminals; using a multi-layer perceptron to construct an anomaly detection model; introducing a temporal anomaly detection algorithm to generate temporal feature vectors for collection terminals; establishing a device fingerprinting mechanism to extract unique device identifiers based on physical layer characteristics; using a pre-trained intelligent sensing network model for security isolation to analyze network behavior; constructing a multi-dimensional anomaly scoring system, combining traffic features, unique device identifiers, behavior patterns, and temporal feature vectors to calculate risk scores for suspicious access behavior; and implementing a rule engine-based response mechanism, triggering a response strategy when the multi-dimensional anomaly scoring system detects unauthorized access behavior.

[0007] The network traffic captured by the distributed traffic acquisition node is transmitted to the security audit server through an encrypted channel.

[0008] The anomaly detection model constructed by the multilayer perceptron is trained through supervised learning and is used to identify abnormal communications that deviate from the behavior patterns recorded in the device behavior baseline library.

[0009] The security isolation zone network topology matrix refers to the adjacency matrix used to describe the connection relationships between all devices in the isolation zone. Each element in the matrix represents the connection status and communication permissions between two devices, and is used to establish a mathematical representation model of the network structure.

[0010] The aforementioned time-series anomaly detection algorithm refers to analyzing the time-series characteristics of the data collected from the terminal, using long short-term memory networks or autoregressive models to identify time-series anomalies in the data collection process, and discovering data anomalies caused by unauthorized device access.

[0011] The multidimensional anomaly scoring system integrates multiple anomaly detection indicators, assigns a risk score to each potential abnormal behavior, and generates a comprehensive risk assessment result through weighted calculation, thereby improving the accuracy of anomaly detection and reducing the false alarm rate.

[0012] The input parameters of the multi-objective risk assessment function include device importance weight, number of vulnerabilities, communication frequency, data sensitivity, and history of abnormal behavior. The output parameters of the multi-objective risk assessment function include device security risk score and risk level classification identifier.

[0013] The specific structure of the secure isolation intelligent sensing network model is an anomaly detection framework based on a graph neural network architecture, which includes a graph convolutional layer, a spatiotemporal attention mechanism layer, and a multi-task learning head. The graph convolutional layer is used to capture the inter-device relationship features in the secure isolation zone network topology graph matrix, and the spatiotemporal attention mechanism layer models the temporal dependencies in the communication modes of the acquisition terminals. The parameter optimization of the secure isolation intelligent sensing network model depends on the node density in the secure isolation zone network topology graph matrix, the traffic baseline threshold in the device behavior baseline library, and the temporal characteristics of device communication.

[0014] This also includes using federated learning technology to optimize the security isolation intelligent sensing network model. Each traffic collection node trains locally and then shares the parameters of the security isolation intelligent sensing network model to avoid cross-domain transmission of raw data and improve the overall protection capability of the security isolation zone.

[0015] A second aspect of the present invention provides an automatic detection model system for unauthorized access within a network security isolation zone. The system is any one of a server, a computer, or a computing center. The system is equipped with a logic processor, which is used to execute the above-described automatic detection model method for unauthorized access within a network security isolation zone.

[0016] Compared with existing technologies, this invention provides an automatic detection model method and system for unauthorized access within a network security isolation zone. This invention proposes an automatic detection method and system for unauthorized access based on multi-dimensional feature fusion. By constructing a network topology matrix, deploying distributed collection nodes, establishing a device behavior baseline library, and combining deep learning technology, a comprehensive security monitoring system is formed. This method not only monitors network traffic characteristics but also analyzes device physical characteristics, behavioral patterns, and communication timing relationships, achieving multi-level anomaly detection.

[0017] This invention combines a multi-objective risk assessment function with a secure isolation intelligent sensing network model, overcoming the limitations of traditional technologies that rely solely on a single dimension for judgment. The model captures the topological relationships between devices through a graph neural network, analyzes temporal behavioral characteristics through a spatiotemporal attention mechanism, and introduces a device fingerprinting mechanism to verify the physical identity of devices, forming a three-dimensional detection architecture. This multi-dimensional fusion detection method significantly improves the accuracy of identifying spoofed access behaviors.

[0018] By analyzing the deviation between network behavior and pre-established baselines in real time and combining it with the identification of device physical characteristics, this invention can detect illegal device access behavior in real time and accurately. Even if attackers simulate normal communication characteristics, it is difficult to evade physical layer feature detection. This effectively solves the technical problem in the prior art that it is difficult to detect illegal device access in real time and accurately in the secure isolation zone network, and greatly improves the security protection capability inside the isolation zone. Attached Figure Description

[0019] Figure 1 This is a flowchart of the method of the present invention.

[0020] Figure 2 This is a schematic diagram of the system composition of the present invention. Detailed Implementation

[0021] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0022] like Figure 1 The diagram shown is a flowchart of an automatic detection model method for unauthorized access within a network security isolation zone, provided by the first aspect of this invention. This method includes the following steps:

[0023] S01. Construct a network topology matrix for the security isolation zone and establish a list of equipment assets, including the hardware characteristics and communication behavior patterns of data acquisition terminals, transmission equipment, computing servers, and operator terminals.

[0024] S02. Deploy distributed traffic collection nodes to capture network traffic in real time at key network nodes in the isolation zone and transmit it to the security audit server through an encrypted channel.

[0025] S03. Use deep packet inspection technology to extract features from the collected data to form a device behavior baseline library and record the communication protocol characteristics, traffic patterns and timing characteristics of normal devices.

[0026] S04. Apply a multi-objective risk assessment function to classify the risk levels of the data acquisition terminal, transmission equipment, computing server and operator terminal. The input parameters of the multi-objective risk assessment function include the importance weight of the equipment, the number of vulnerabilities, the communication frequency, the data sensitivity and the history of abnormal behavior. The output parameters of the multi-objective risk assessment function include the equipment security risk score and the risk level classification label.

[0027] S05. An anomaly detection model is constructed using a multilayer perceptron, and the model is trained through supervised learning to identify abnormal communications that deviate from the behavior patterns recorded in the equipment behavior baseline database.

[0028] S06. Introduce a timing anomaly detection algorithm to generate a timing feature vector for the acquisition terminal and identify unexpected device access behavior during data transmission.

[0029] S07. Establish a device fingerprint recognition mechanism to extract a unique device identifier based on physical layer characteristics, which is used to verify the legality of device identity within the isolation zone.

[0030] S08. Analyze network behavior using a pre-trained secure isolation intelligent sensing network model. The optimization of the parameters of the secure isolation intelligent sensing network model depends on the node density in the secure isolation zone network topology matrix, the traffic baseline threshold in the device behavior baseline library, and the device communication timing characteristics.

[0031] S09. Construct a multi-dimensional anomaly scoring system, combining traffic characteristics, unique device identifiers, behavioral patterns, and time-series feature vectors to calculate the risk score of suspicious access behavior.

[0032] S10. Implement a rule engine-based response mechanism. When the multi-dimensional anomaly scoring system detects unauthorized access behavior, it triggers response strategies, including alarm notification, automatic isolation, and evidence analysis.

[0033] S11. Optionally, it also includes using federated learning technology to optimize the security isolation intelligent sensing network model. Each traffic collection node shares the parameters of the security isolation intelligent sensing network model after local training, avoiding cross-domain transmission of raw data and improving the overall protection capability of the security isolation zone.

[0034] Specifically, the secure isolation zone network topology matrix refers to the adjacency matrix used to describe the connection relationships between all devices within the isolation zone. Each element in the matrix represents the connection status and communication permissions between two devices, and is used to establish a mathematical representation model of the network structure.

[0035] Specifically, the device behavior baseline database refers to a reference standard dataset established for the communication behavior, traffic characteristics, protocol characteristics, activity time windows, and other multi-dimensional attributes of legitimate devices within the isolation zone, which is used to compare and identify abnormal device behavior.

[0036] Deep packet inspection technology specifically refers to a technology that comprehensively analyzes the content of network data packets. It not only examines the header information of data packets, but also deeply analyzes the payload content of data packets to identify abnormal behaviors hidden in application layer protocols.

[0037] Specifically, the device fingerprint recognition mechanism refers to extracting unique signal features generated by the device's hardware characteristics, such as clock offset, radio frequency characteristics, and electromagnetic radiation patterns, to form a unique device identifier that is difficult to forge.

[0038] Specifically, the time-series anomaly detection algorithm refers to analyzing the time-series characteristics of the data collected from the terminal, using long short-term memory networks or autoregressive models to identify time-series anomalies in the data collection process, and discovering data anomalies caused by unauthorized device access.

[0039] The multidimensional anomaly scoring system specifically refers to the fusion and calculation of multiple anomaly detection indicators, assigning a risk score to each potential abnormal behavior, and generating a comprehensive risk assessment result through weighted calculation, thereby improving the accuracy of anomaly detection and reducing the false alarm rate.

[0040] The multi-objective risk assessment function is used to accurately quantify the risks of different types of equipment within the isolation zone. It comprehensively considers the importance and security characteristics of the equipment in the marine forecasting system. The inputs include the equipment importance weight factor extracted from the network topology matrix of the security isolation zone, the cumulative number of known vulnerabilities obtained from the equipment asset list, the communication frequency per unit time obtained from the equipment behavior baseline library, the transmission data sensitivity coefficient obtained from the equipment asset list, and the number of historical abnormal behaviors obtained from the equipment behavior baseline library. The outputs are the equipment security risk score used by the anomaly detection model and the risk level classification identifier used by the security isolation intelligent sensing network model.

[0041] The specific structure of the secure isolation intelligent sensing network model is an anomaly detection framework based on a graph neural network architecture, including a graph convolutional layer, a spatiotemporal attention mechanism layer, and a multi-task learning head. The graph convolutional layer is used to capture the inter-device relationship features in the secure isolation zone network topology graph matrix. The spatiotemporal attention mechanism layer models the temporal dependencies in the communication patterns of the acquisition terminals. The number of heads in the attention mechanism is determined by the node density in the secure isolation zone network topology graph matrix. The attention weight threshold is determined by the standard deviation of the traffic baseline in the device behavior baseline library. The attention window length is determined by the periodicity of device communication time in the temporal feature vector. The multi-task learning head simultaneously outputs the device authentication result and the score of the degree of behavior anomaly.

[0042] The steps for establishing the training dataset of the secure isolation intelligent sensing network model specifically include: collecting network traffic data from multiple secure isolation zone environments; cleaning and standardizing the collected data; constructing a balanced dataset containing normal communication modes and various abnormal access behaviors; using data augmentation techniques to simulate network traffic characteristics under attack scenarios; transforming inter-device communication relationships into structured representations through graph structure representation learning methods; generating self-supervised learning labels based on time-series prediction tasks; and finally forming a comprehensive training dataset that takes into account the network topology graph matrix structure features and time-series feature vectors of the secure isolation zone.

[0043] The steps of the security isolation intelligent sensing network model specifically include: first, performing self-supervised learning on large-scale general network environment data to learn the basic representation features of network communication; then, performing supervised fine-tuning on the environmental data of the marine forecasting system's isolation zone to optimize the security isolation intelligent sensing network model's ability to identify the behavioral characteristics of acquisition terminals, transmission equipment, computing servers, and operator terminals; next, using a contrastive learning method to enhance the security isolation intelligent sensing network model's ability to distinguish between normal and abnormal behaviors; then, using knowledge distillation technology to compress the features learned by the large model into a lightweight model to adapt to resource-constrained environments; and finally, employing a continuous learning strategy to enable the security isolation intelligent sensing network model to adapt to the dynamic changes in the isolation zone network environment.

[0044] A second aspect of this invention provides an automatic detection model system for unauthorized access within a network security isolation zone. The system can be any one of a server, computer, or computing center. The system includes a logic processor for executing the aforementioned automatic detection model method for unauthorized access within a network security isolation zone. Figure 2 As shown, this system includes:

[0045] The distributed traffic acquisition module is used to capture network traffic in real time at key nodes of the isolated network and transmit it through an encrypted channel;

[0046] A security audit server is used to receive network traffic data transmitted by the distributed traffic acquisition module.

[0047] The feature extraction module is used to extract features from the collected data using deep packet inspection technology, forming a baseline library of device behavior and recording the communication protocol characteristics, traffic patterns, and timing characteristics of normal devices.

[0048] The risk assessment module is used to classify the risk levels of data acquisition terminals, transmission equipment, computing servers, and operator terminals using a multi-objective risk assessment function.

[0049] An anomaly detection module, including an anomaly detection model built from a multilayer perceptron, is used to identify abnormal communications that deviate from the behavioral patterns recorded in the device behavior baseline library;

[0050] The timing analysis module is used to execute timing anomaly detection algorithms, generate timing feature vectors for the acquisition terminal, and identify unexpected device access behaviors during data transmission.

[0051] The device fingerprint recognition module is used to extract the unique identifier of the device based on physical layer characteristics and verify the legitimacy of the device's identity within the isolation zone;

[0052] The intelligent sensing module is used to execute a secure isolation intelligent sensing network model to analyze network behavior;

[0053] The anomaly scoring module is used to build a multi-dimensional anomaly scoring system, which combines traffic characteristics, unique device identifiers, behavioral patterns and time-series feature vectors to calculate risk scores for suspicious access behaviors.

[0054] The response execution module is used to implement a rule engine-based response mechanism, which triggers a response strategy when the multidimensional anomaly scoring system detects unauthorized access behavior.

[0055] Among them, the data acquisition terminal refers to the terminal equipment responsible for collecting and acquiring data in the isolated network, such as sensors and data acquisition devices. These devices directly interact with the physical environment and acquire raw data.

[0056] Transmission equipment refers to devices responsible for transmitting data in the network, such as switches, routers, and gateways, to ensure reliable data transmission between nodes within the isolated network.

[0057] Among them, computing servers refer to high-performance computing devices that perform data processing, analysis, and storage within an isolated area, undertaking the main computing tasks and business logic processing.

[0058] Among them, the operator terminal refers to the computer terminal used by staff in the isolation area for monitoring, management and operating the system, and is the main interface for human-computer interaction.

[0059] Furthermore, it also includes a topology building module, which is used to construct a network topology matrix for the security isolation zone and establish a list of equipment assets, including the hardware characteristics and communication behavior patterns of data acquisition terminals, transmission equipment, computing servers, and operator terminals.

[0060] Furthermore, it also includes a federated learning module, which uses federated learning technology to optimize the secure isolation intelligent sensing network model, so that each traffic collection node can share the parameters of the secure isolation intelligent sensing network model after local training, thus avoiding cross-domain transmission of raw data.

[0061] Furthermore, the response strategies triggered by the response execution module include alarm notification, automatic isolation, and forensic analysis.

[0062] Furthermore, the input parameters of the multi-objective risk assessment function in the risk assessment module include device importance weight, number of vulnerabilities, communication frequency, data sensitivity, and abnormal behavior history, while the output parameters include device security risk score and risk level classification identifier.

[0063] Furthermore, the specific structure of the security isolation intelligent perception network model in the intelligent perception module is an anomaly detection framework based on a graph neural network architecture, which includes a graph convolutional layer, a spatiotemporal attention mechanism layer, and a multi-task learning head.

[0064] Furthermore, in the spatiotemporal attention mechanism layer of the intelligent sensing module, the number of heads in the attention mechanism is determined by the node density in the network topology matrix of the security isolation zone, the attention weight threshold is determined by the standard deviation of the traffic baseline in the device behavior baseline library, and the attention window length is determined by the periodicity of device communication timing in the timing feature vector.

[0065] Furthermore, the unique signal features generated by the device's hardware characteristics extracted by the device fingerprint recognition module include physical layer features such as clock offset, radio frequency characteristics, and electromagnetic radiation patterns, forming a unique device identifier that is difficult to forge.

[0066] Furthermore, the optimization of the intelligent sensing module parameters depends on the node density in the secure isolation zone network topology matrix, the traffic baseline threshold in the device behavior baseline library, and the device communication timing characteristics.

[0067] Furthermore, the anomaly scoring module integrates and calculates multiple anomaly detection indicators, assigns a risk score to each potential abnormal behavior, and generates a comprehensive risk assessment result through weighted calculation, thereby improving the accuracy of anomaly detection and reducing the false alarm rate.

[0068] The specific implementation steps of the above method are described in detail below.

[0069] The specific implementation of step S01 involves constructing a network topology matrix for the security isolation zone and establishing a detailed device asset list through network scanning and device discovery technologies. First, a combination of active probing and passive monitoring is used to discover all network devices within the isolation zone. ICMP protocol is used for liveness detection, and TCP / UDP port scanning technology is used to identify open services. Then, an n×n adjacency matrix A is constructed, where n is the total number of devices, and matrix elements A... ij This represents the connection status and communication permissions between device i and device j, with values ​​ranging from 0 to 3, where 0 indicates no connection, 1 indicates a one-way connection, 2 indicates a two-way connection with limited permissions, and 3 indicates a two-way connection with full permissions. Next, device hardware characteristic information is collected, including MAC address, operating system type, firmware version, CPU model, and memory capacity, and communication behavior patterns are recorded, including communication protocol type, average data transmission volume, communication frequency, and typical time windows. Finally, all information is integrated into a unified asset management database to complete the construction of the network topology matrix and device asset list. This step establishes a mathematical representation model of the network structure, providing basic data support for subsequent risk assessment and anomaly detection.

[0070] The specific implementation of step S02 involves deploying a distributed traffic acquisition node system at key nodes of the isolated network. First, the strategic locations of the traffic acquisition points are determined, including gateway ingress / egress points, core switching nodes, important server front-ends, and access points for critical business systems. Then, high-performance network probes are deployed at each acquisition point, using network traffic splitters (TAPs) or switch port mirroring (SPAN) technology to replicate traffic and ensure no interference with normal network operation. Next, traffic acquisition tools such as Zeek or Suricata are configured, and filtering rules are set to optimize the data acquisition scope, focusing on capturing key information such as TCP / IP connection establishment processes, HTTP / HTTPS requests, DNS queries, and encrypted communication handshakes. The acquired data is then preprocessed, including deduplication, timestamp unification, protocol identification, and session reassembly. Finally, a secure channel is established using the TLS protocol, and AES-256 encryption is used to protect the data transmission process, ensuring that traffic data is securely and reliably transmitted to the security audit server. This step achieves comprehensive monitoring of network activity within the isolated area, providing a raw data source for anomaly detection.

[0071] The specific implementation of step S03 involves using deep packet inspection (DPI) technology to extract features from the collected data and form a baseline library of device behavior. First, the collected data packets are parsed, supporting full protocol stack analysis from the physical layer to the application layer, with particular attention to industrial control protocols such as Modbus and DNP3, commonly used in marine forecasting systems. Then, communication features are extracted, including key features such as connection establishment patterns, session duration, communication periodicity, load distribution, and protocol fingerprints. Next, statistical analysis is performed on the extracted features, calculating the traffic distribution histogram, average communication rate, standard deviation (reference value ±15% of the historical average), and typical time patterns for each device. Then, clustering algorithms such as K-means clustering or DBSCAN are applied to group the device behavior patterns, determining the boundary threshold for normal behavior, set at twice the standard deviation of the cluster center distance. Finally, a multi-dimensional baseline library is constructed, recording the normal behavior feature intervals of each device in different time periods and under different operating conditions, forming a standard dataset for reference. This step establishes a reference model for normal device behavior, providing a comparison benchmark for anomaly detection.

[0072] The specific implementation of step S04 involves applying a multi-objective risk assessment function to classify the risk levels of various devices within the isolation zone. First, the device importance weighting factor W is extracted from the network topology matrix of the security isolation zone. i The value is calculated based on the device's centrality and criticality in the network, ranging from 0.1 to 1.0. Then, the cumulative number of known vulnerabilities V is obtained from the device asset list. iThis includes operating system vulnerabilities, application software vulnerabilities, and firmware vulnerabilities, with the severity of vulnerabilities weighted according to CVSS scores. Next, the communication frequency F per unit time is obtained from the device behavior baseline library. i , representing the standardized value of the number of communications per minute by the device, ranging from 0 to 1. Then, the data transmission sensitivity coefficient S is obtained from the device asset list. i The value is determined according to the data classification and grading standards, and ranges from 0.2 to 1.0. Finally, the number of historical abnormal behaviors H is obtained from the equipment behavior baseline library. i Record the frequency of device behavior deviating from the baseline over the past 30 days. The risk assessment function is defined as Risk. i =0.3×W + 0.25×V i +0.15×F i +0.2×S i +0.1×H i Output device security risk score i (Values ​​range from 0 to 1) and corresponding risk level classification indicators (low risk: 0-0.3; medium risk: 0.3-0.6; high risk: 0.6-0.8; very high risk: 0.8-1.0). This step achieves accurate quantitative assessment of equipment risk, providing risk prioritization guidance for subsequent anomaly detection models.

[0073] The specific implementation of step S05 involves using a multilayer perceptron to construct an anomaly detection model to identify abnormal communications that deviate from the behavioral baseline. First, a multilayer perceptron network structure is designed, including an input layer (the number of nodes equals the feature dimension, typically 50-200 features), two hidden layers (128 and 64 nodes respectively, with ReLU activation function), and an output layer (2 nodes, representing normal and abnormal classes). Next, a training dataset is prepared, collecting labeled normal and abnormal communication samples. Normal samples are obtained from a device behavior baseline library, while abnormal samples are generated through security expert labeling or simulated attack scenarios. Feature engineering is then performed, standardizing the original features and applying Principal Component Analysis (PCA) for dimensionality reduction, retaining the principal components necessary to explain 95% of the variance. The model is then trained using a cross-entropy loss function and the Adam optimizer, with an initial learning rate of 0.001. A learning rate decay strategy is adopted, reducing the learning rate to 90% of its original value every 50 cycles. Finally, the model performance is evaluated using the F1 score, a threshold (typically 0.7-0.8) is set to determine anomalies, and an online update mechanism is implemented, updating the model every 24 hours with newly collected data. This step enables accurate identification of deviations from the baseline, improving the accuracy of abnormal communication detection.

[0074] The specific implementation of step S06 involves introducing a time-series anomaly detection algorithm to identify unexpected device access behavior during data transmission. First, the collected terminal data undergoes time-series preprocessing, including data cleaning, denoising, and resampling, converting the data into sequences with fixed time intervals, typically at a sampling frequency of 1-10 times per second. Then, time-series features are extracted, including statistical features (mean, variance, kurtosis, skewness, etc.), frequency domain features (frequency components extracted via Fast Fourier Transform), and time domain features (autocorrelation coefficient, trend indicators, etc.). Next, a Long Short-Term Memory (LSTM) network model is constructed. The network structure includes an input layer, two LSTM layers (128 units each), a fully connected layer (64 neurons), and an output layer. The mean squared error loss function is used to train the model to predict normal time-series patterns. Then, the prediction bias is calculated, and the difference between the actual observed values ​​and the model's predicted values ​​is standardized to form an anomaly score. Finally, an adaptive threshold is set, determined based on the statistical distribution of historical data, typically set to the mean plus three times the standard deviation. Values ​​exceeding this threshold are considered time-series anomalies, potentially indicating unexpected device access. This step effectively identifies timing anomalies in the data acquisition process by analyzing time series characteristics, and discovers data anomalies caused by unauthorized device access.

[0075] The specific implementation of step S07 involves establishing a device fingerprinting mechanism based on physical layer characteristics to verify the legitimacy of devices within the isolation zone. First, physical features of the device are extracted, including clock offset (analyzed using the TCP timestamp option field with microsecond-level accuracy), radio frequency characteristics (for wireless devices, analyzing the amplitude, phase, and frequency offset of the transmitted signal), electromagnetic radiation patterns (capturing the electromagnetic signal characteristics generated during device operation using a dedicated detector), and hardware response time characteristics (analyzing the device's response time distribution to specific requests). Then, the extracted features are preprocessed, including noise filtering, normalization, and dimensionality reduction, retaining the most distinctive feature combinations. Next, a fingerprint feature vector is constructed, combining multiple physical features according to weights into a unique identifier vector, typically with a vector dimension of 128-256. Then, a device fingerprint database is established, storing the fingerprint vectors of all legitimate devices and their corresponding confidence thresholds, typically set between 0.85 and 0.95. Finally, a real-time verification mechanism is implemented, calculating the similarity between newly captured device features and the fingerprints stored in the database using cosine similarity or Mahalanobis distance. If the similarity is below the threshold, the device is determined to be an illegal device. This step achieves reliable verification of device identity by analyzing physical layer features that are difficult to forge, effectively identifying spoofed devices.

[0076] The specific implementation of step S08 involves using a pre-trained secure isolation intelligent perception network model to analyze network behavior and achieve accurate identification of unauthorized access. First, the model parameters are initialized, including setting the graph convolutional layer kernel size to 3×3 and the number of channels to 32-64-128 (three-layer structure). The graph convolution operation is approximated using Chebyshev polynomials with a polynomial order of 2. Then, the spatiotemporal attention mechanism layer is configured, with the number of attention heads set to... Where n is the number of nodes in the network topology matrix of the security isolation zone, the attention weight threshold is set to twice the standard deviation of the traffic baseline in the device behavior baseline library, and the attention window length is set to 1.5 times the device communication cycle in the time-series feature vector. Next, the multi-task learning head is adjusted, including a device authentication task (binary classification, legal / illegal) and a behavior anomaly scoring task (regression, score range 0-1), with the weight ratio of the two tasks set to 6:4. Then, the model training parameters are loaded and initialized using pre-trained weights; the weight file size is approximately 50-100MB. Finally, real-time analysis is performed, inputting the current network traffic characteristics into the model to generate device authentication results (confidence not less than 0.9) and behavior anomaly scores (anomaly threshold set to 0.7). This step, through an optimized security isolation intelligent sensing network model, achieves in-depth analysis of network behavior and timely detection of unauthorized access behavior.

[0077] The specific implementation of step S09 involves constructing a multi-dimensional anomaly scoring system to calculate the comprehensive risk score of suspicious access behavior. First, multi-dimensional feature data is collected, including traffic characteristics (protocol anomaly degree, data volume mutation rate, connection establishment mode anomaly degree), device unique identifiers (fingerprint matching degree, authentication confidence degree), behavioral patterns (deviation from baseline database, communication mode change rate), and time-series feature vectors (prediction error magnitude, periodic disruption degree). Then, each dimension of features is standardized, converting indicators of different dimensions into standard scores within the 0-1 range using Z-score or Min-Max standardization methods. Next, weight coefficients are set for each dimension: traffic characteristics have a weight of 0.3, device unique identifiers have a weight of 0.25, behavioral patterns have a weight of 0.25, and time-series features have a weight of 0.2. These weight coefficients can be dynamically adjusted according to specific application scenarios. Finally, the comprehensive risk score is calculated. Where w i f is the weight of the i-th feature. i Let be the standardized score of the i-th feature, and n be the total number of features. Finally, risk levels are set based on the comprehensive risk score: low risk (0-0.4), medium risk (0.4-0.7), high risk (0.7-0.9), and very high risk (0.9-1.0). This step, by integrating multi-dimensional anomaly indicators, achieves accurate assessment of suspicious access behavior, improves detection accuracy, and reduces false alarm rate.

[0078] Step S10 is implemented by establishing a rule-based response mechanism that triggers corresponding policies when unauthorized access is detected. First, a tiered response rule base is designed, defining corresponding processing policies for different risk levels: low risk (logging and increasing monitoring frequency), medium risk (generating alarms and notifying the security team), high risk (triggering automatic isolation measures and initiating emergency response), and extremely high risk (performing a complete network shutdown and immediately notifying the highest management level). Next, a real-time alarm notification system is built, supporting multiple notification channels, including the system console, email, SMS, and instant messaging tools, with different alarm priorities and escalation mechanisms set according to risk levels. Then, a network isolation control module is implemented, capable of restricting suspicious devices to isolated areas by issuing ACL (Access Control List) rules or VLAN isolation measures, preventing threat spread. Next, digital forensic analysis tools are deployed to automatically capture network traffic, log records, and system status before and after abnormal events, saving them as encrypted evidence files for subsequent security analysis. Finally, a closed-loop response management mechanism is established, recording the processing results and effectiveness evaluation of each response process, and periodically optimizing response policies. This step enables timely response to unauthorized access, reduces the impact of security incidents, and accelerates the threat handling process.

[0079] The specific implementation of optional step S11 involves optimizing the secure isolation intelligent sensing network model using federated learning technology. First, a lightweight learning client is deployed at each traffic collection node, including a local model training module, a parameter encryption module, and a communication module, ensuring that model training tasks can be executed under limited computing resources. Then, a federated learning protocol is designed, using the FedAvg (federated averaging) algorithm for parameter aggregation, setting the communication rounds to once every 24 hours, and the local training rounds to 10 rounds per communication interval. Next, a differential privacy protection mechanism is implemented, adding Gaussian noise to the shared parameters, with a noise level σ set to 0.01-0.05, achieving ε-differential privacy protection, with ε values ​​set to 1-5. Then, a secure aggregation protocol is used, encrypting the parameters based on homomorphic encryption technology before aggregation to prevent the central server from retrieving the original data from the parameters. Finally, a global model update is performed, distributing the aggregated parameters to each node, enabling the sharing and transfer of model knowledge across different environments. This step optimizes the secure isolation intelligent sensing network model through federated learning technology, avoiding cross-domain transmission of original data and improving overall protection capabilities.

[0080] The detailed structure of the secure isolation intelligent perception network model is an anomaly detection framework based on a graph neural network architecture. This model consists of four main components: an input layer, a graph convolutional layer, a spatiotemporal attention mechanism layer, and a multi-task learning head. The input layer receives two types of data: a secure isolation zone network topology graph matrix and a node feature matrix. The network topology graph matrix is ​​represented as G = (V, W, A), where V is the set of nodes, E is the set of edges, and A is the adjacency matrix; the node feature matrix is ​​represented as X ∈ R. n×d Where n is the number of nodes and d is the feature dimension. The graph convolutional layer employs a multi-layer graph convolutional network (GCN) structure to achieve feature propagation and aggregation on the graph structure. The convolution operation is defined as... in To add the adjacency matrix after adding self-loops, Let W be the corresponding degree matrix. (l) Let be the weight matrix of the l-th layer, and σ be the ReLU activation function. The spatiotemporal attention mechanism layer combines spatial and temporal attention. Spatial attention calculates the dynamic importance between nodes, while temporal attention captures the temporal dependencies of node behavior. The attention score is calculated using the following formula: Where a is the attention vector, W is the weight matrix, and h i and h j For node features, || denotes the concatenation operation. The multi-task learning head contains two parallel task branches: a device authentication branch and a behavior anomaly scoring branch. The former uses the cross-entropy loss function, and the latter uses the mean squared error loss function. The total loss function is L. total =λ1L identity +λ2L anomaly , where λ1 and λ2 are weighting coefficients used to balance the two tasks.

[0081] The detailed steps for establishing the training dataset for the secure isolation intelligent sensing network model include five stages: data acquisition, data preprocessing, data labeling, data augmentation, and feature engineering. In the data acquisition stage, real network traffic data is first collected from multiple secure isolation environments, including baseline traffic during normal operation and abnormal traffic under simulated attack scenarios. The collection period is no less than 30 days, covering different working periods and load conditions. In the data preprocessing stage, the raw data is cleaned, invalid records are removed, outliers are corrected, timestamp formats are standardized, and session reassembly is performed to organize discrete data packets into complete communication sessions. Then, standardization is performed, using the Z-score method to convert features of different dimensions into a standard normal distribution. In the data labeling stage, the dataset is labeled using expert knowledge and automatic labeling technology, with normal samples accounting for 70% and abnormal samples accounting for 30% to ensure dataset balance. Abnormal samples are further subdivided into four categories: protocol abnormalities, traffic abnormalities, timing abnormalities, and identity abnormalities, each accounting for 25% of the abnormal samples. In the data augmentation stage, the training set is expanded through transformation, combination, and synthesis techniques, especially oversampling rare anomaly types to generate a sufficient number of variant samples. Generative Adversarial Networks (GANs) are used to simulate network traffic characteristics under different attack scenarios, enhancing the model's ability to identify unknown attacks. In the feature engineering stage, graph structure representation learning methods are used to transform inter-device communication relationships into structured representations, constructing node feature vectors and edge feature vectors. Self-supervised learning labels are generated based on the time-series prediction task, and a sliding window method is used to extract time-series features, with the window size set to twice the typical communication cycle. The final training dataset includes node feature matrices, adjacency matrices, time-series feature matrices, and corresponding labels, with a total sample size of no less than 1 million, ensuring the effectiveness and generalization ability of the model training.

[0082] The mathematical model or calculation process involved in this invention will be described in detail below.

[0083] The mathematical expression for constructing the network topology matrix of the security isolation zone in step S01 is as follows:

[0084]

[0085] In the formula, A is the adjacency matrix; n is the total number of devices in the isolation zone; a ij This indicates the connection status and communication permissions between device i and device j, with values ​​of {0, 1, 2, 3}, where 0 represents no connection, 1 represents a one-way connection, 2 represents a two-way connection with limited permissions, and 3 represents a two-way connection with full permissions.

[0086] The parameter acquisition methods are as follows: the total number of devices n is obtained through network scanning and the asset management system; the connection status a ijThe data is obtained through a combination of active probing and passive monitoring. Active probing uses the ICMP protocol and TCP / UDP port scanning, while passive monitoring uses network traffic analysis. By analyzing the source address, destination address, and protocol type in the network traffic, the connection relationship between devices is determined, and the permission level is determined by analyzing the communication content and access control lists.

[0087] The mathematical expression of the multi-objective risk assessment function in step S04 is as follows:

[0088]

[0089] In the formula, Risk i W represents the safety risk score for device i, with a value range of [0, 1]. i V represents the equipment importance weighting factor, with a value range of [0.1, 1.0]; i F is a standardized value representing the cumulative number of known vulnerabilities, ranging from [0, 1]. i S is the communication frequency per unit time, representing a standardized value of the number of communications per minute by the device, with a value range of [0, 1]. i H represents the sensitivity coefficient for transmitted data, with a value range of [0.2, 1.0]. i λ is the standardized value of the number of historical abnormal behaviors, with a value range of [0, 1]; α, β, γ, δ, ∈ are the basic weight coefficients, with values ​​of 0.3, 0.25, 0.15, 0.2, and 0.1, respectively; θ is the interaction term weight, with a value of 0.05, used to enhance risk assessment when important equipment processes sensitive data; λ is the nonlinear adjustment term weight, with a value of 0.05, used to strengthen risk assessment when high vulnerabilities and high anomaly histories coexist.

[0090] The parameter acquisition method is as follows: W i The eigenvector centrality is calculated using the following formula: Where v is the principal eigenvector of the network adjacency matrix A; V i The number of vulnerabilities is obtained by scanning devices and then standardized for calculation, using the following formula: Among them CVSS j The CVSS score for the j-th vulnerability is given, where m is the total number of vulnerabilities, m0 is the baseline number of vulnerabilities, and its value is 10; F i Calculated by monitoring the communication behavior of the device over 30 days, the formula is: where f i f is the average number of communications per minute for device i. min and f max These are the minimum and maximum communication frequencies among all devices. Rate; S iBased on data classification and grading standards, the values ​​are as follows: general data 0.2, internal data 0.4, confidential data 0.6, classified data 0.8, and top secret data 1.0; H i The calculation is based on the number of times the device behavior deviates from the baseline, using the following formula: Where h i h0 represents the number of abnormal behaviors of device i in the past 30 days, and h0 is a threshold constant with a value of 20.

[0091] This risk assessment function combines linear weighting terms with nonlinear adjustment terms, taking into account the interactions between parameters. The linear weighting part reflects the basic contribution of each risk factor, and the interaction term θ·(W) i ·S i This highlights the additional risks associated with critical equipment processing sensitive data, and the non-linear adjustment term. This enhances the risk amplification effect when vulnerabilities and abnormal histories coexist through an exponential function. This function considers both the independent risk contribution of each factor and the synergistic effect between factors, providing a more accurate risk assessment result than a simple weighted average.

[0092] The forward propagation calculation process of the multilayer perceptron anomaly detection model in step S05 is as follows:

[0093] Z (1) =X·W (1) +b (1) ;

[0094] A (1) =ReLU(Z) (1) ) = max(0, Z (1) );

[0095] Z (2) =A (1) ·W (2) +b (2) ;

[0096] A (2) =ReLU(Z) (2) ) = max(0, Z (2) );

[0097] Z (3) =A (2) ·W (3) +b (3) ;

[0098]

[0099] In the formula, The input feature vector is d, where d is the feature dimension, typically 50-200. These are the weight matrices for the first, second, and third layers, respectively. These are the bias vectors for the first, second, and third layers, respectively; Z (1) Z (2) Z (3) The linear outputs of the first, second, and third layers are respectively; A (1) A (2) These are the outputs of the first and second layers after the activation function, respectively. The final output represents the probability distribution of a sample belonging to the normal and abnormal categories.

[0100] The parameter acquisition method is as follows: weight matrix W (1) W (2) W (3) and bias vector b (1) b (2) b (3) It is obtained through training using the backpropagation algorithm, specifically using the cross-entropy loss function. Where y ij For real labels, To predict probabilities, the Adam optimizer is used to update parameters, with an initial learning rate of 0.001 that decays to 90% of its original value every 50 epochs.

[0101] The anomaly detection decision-making process is as follows:

[0102] Anomaly_Score = Y1;

[0103]

[0104] In the formula, Y1 is the probability that the sample belongs to the abnormal category, which is the second element of the Y vector; τ is the anomaly detection threshold, which ranges from [0.7, 0.8] and is usually set to 0.75; Decision is the final decision, where 1 indicates anomaly and 0 indicates normal.

[0105] This multilayer perceptron model employs the ReLU activation function to achieve nonlinear feature transformation. ReLU was chosen over Sigmoid or Tanh because it alleviates the vanishing gradient problem and accelerates convergence. The output layer uses the Softmax function to convert the linear output into a probability distribution, facilitating probabilistic interpretation and threshold adjustment. The model learns complex features of device communication behavior through multilayer nonlinear transformations, automatically extracting high-dimensional patterns to distinguish between normal and abnormal behavior. Compared to traditional rule-based methods, it exhibits stronger generalization ability and adaptability.

[0106] The calculation process of the Long Short-Term Memory Network prediction model for temporal anomaly detection in step S06 is as follows:

[0107] ft =σ(W f ·[h t-1 x t ]+b f );

[0108] i t =σ(W i ·[h t-1 x t ]+b i );

[0109]

[0110] o t =σ(W o ·[h t-1 x t ]+b o );

[0111] h t =o t ⊙tanh(C t );

[0112]

[0113] In the formula, Let d be the input feature vector at time step t, and d be the feature dimension. The hidden state vector; This represents the cell state vector; Forget gate vector; The input gate vector; This is the output gate vector; This represents the candidate cell state vector; W is the predicted feature vector for the next time step. f W i W C , These are the weight matrices for the forget gate, input gate, candidate cell state, and output gate, respectively; b f b i b C , This is the corresponding bias vector; and These represent the weight matrix and bias vector of the prediction layer, respectively; σ represents the Sigmoid activation function; tanh represents the hyperbolic tangent activation function; and ⊙ represents the Hadamard product (element-wise multiplication).

[0114] The time-series anomaly score is calculated based on the LSTM prediction model as follows:

[0115]

[0116]

[0117] τ t =μ AS +β·σ AS ;

[0118] In the formula, This is the prediction error vector; To standardize the prediction error vector; and These are the mean and standard deviation vectors of the historical prediction errors, respectively; w i The importance weight of the i-th feature is determined through feature importance analysis; AnomalyScore t The anomaly score for time step t; TimeSeriesAnomaly t For the anomaly determination result, 1 indicates an anomaly, and 0 indicates a normal result; τ t For adaptive threshold; μ AS and σ AS These are the mean and standard deviation of historical outlier scores, respectively; β is the threshold coefficient, usually set to 3.

[0119] The parameter acquisition method is as follows: LSTM network parameters W f W i W C W o b f b i b C b o W p b p Obtained through training on a time series prediction task, using the mean squared error loss function. Historical prediction error statistic μ e and σ e The feature importance weights w are obtained through statistical analysis of the model's prediction errors on normal data. i The contribution of each feature to anomaly detection is determined by evaluating the random forest or permutation importance method; the anomaly score statistic μ is also used. AS and σ AS This was obtained through statistical analysis of the abnormal score sequence during normal operation.

[0120] This time-series anomaly detection method combines the time-series modeling capabilities of LSTM with the robustness of statistical anomaly detection. The LSTM model can capture long-term dependencies and nonlinear patterns in time-series data. By predicting the normal behavior at the next time step and comparing it with actual observations, it can effectively identify anomalous patterns deviating from expectations. The adaptive threshold mechanism considers the statistical distribution characteristics of anomaly scores, adapting to different operating environments and load conditions, and reducing the false alarm rate. Weight vector w i The introduction of this feature allows the model to focus on more important feature dimensions, improving detection sensitivity.

[0121] The mathematical expression of the device fingerprint recognition mechanism in step S07 is as follows:

[0122]

[0123] In the formula, F j f is the fingerprint feature vector of device j; ji Let g be the i-th physical characteristic value of device j; i (·) is the extraction function for the i-th feature; r ji ε is the i-th original physical characteristic measurement value of device j; ji The measurement error follows a mean of 0 and a standard deviation of σ. i The distribution is Gaussian; m is the total number of features, typically 4-8.

[0124] The extraction functions for each physical feature are defined as follows:

[0125] Clock skew characteristics: Where Δt jk Let $\mathbf{k}$ be the deviation between the $k$-th TCP timestamp sample of device $j$ and the reference clock.

[0126] RF characteristics: f j2 =g2(r j2 ) = FFT(s j (t)), where s j (t) represents the waveform of the radio frequency signal emitted by device j;

[0127] Electromagnetic radiation characteristics: Where P j (f) represents the electromagnetic power spectral density of device j in the frequency range [f1, f2];

[0128] Hardware response time characteristics: Where t req，k and t resp，k These represent the time when the k-th request was sent and the time when the response was received, respectively.

[0129] Device fingerprint similarity is calculated as follows:

[0130]

[0131] In the formula, Sim(F j F k ) represents the fingerprint similarity between device j and device k, with a value ranging from [-1, 1]; w i Let i be the weight of the i-th feature.

[0132] The device authentication process is as follows:

[0133]

[0134] In the formula, Identity(j) is the authentication result of device j; D is the set of registered legitimate device fingerprints; τ F This is the authentication threshold, with a value range of [0.85, 0.95], and is usually set to 0.9.

[0135] The parameter acquisition method is as follows: the original physical property measurement value r ji Data was collected using dedicated measurement equipment; clock offset was obtained by analyzing the TCP timestamp option field; RF characteristics were collected using a dedicated RF signal analyzer; electromagnetic radiation was collected using an electromagnetic detector; and hardware response time was measured by sending a specific request and recording the response time. Feature weights w i The algorithm is determined by maximizing the recognition rate of legitimate devices and minimizing the false recognition rate of spoofed devices.

[0136] This device fingerprint recognition mechanism leverages the uniqueness and forgery resistance of the device's physical layer characteristics, improving accuracy and robustness through multi-dimensional feature fusion. Cosine similarity is used to measure the similarity between device fingerprints. Compared to Euclidean distance, cosine similarity is insensitive to feature vector length and can better handle differences in the magnitude of feature values ​​between different devices. By setting an appropriate threshold τ... F This allows for a balance between recognition accuracy and false recognition rate. A measurement error term ε is introduced. ji This makes the model more consistent with real-world application scenarios and enhances the system's robustness.

[0137] The calculation of the comprehensive risk score of the multidimensional anomaly scoring system in step S09 is as follows:

[0138]

[0139] In the formula, R is the comprehensive risk score, which ranges from [0, 1]; f i w is the standardized score of the i-th feature, with a value range of [0, 1]. i Let be the weight coefficient of the i-th feature, satisfying α ijThe interaction weights for features i and j range from -0.1 to 0.1. β is the weighted average eigenvalue; β is the variance adjustment coefficient, with a value of 0.1; n is the total number of features, typically 12-15.

[0140] The main feature classifications and their weights are as follows:

[0141] Traffic characteristics: w1 = 0.3, including protocol anomaly degree f 11 Data volume mutation rate f 12 Connection establishment mode anomaly degree f 13 The internal weights are 0.4, 0.3, and 0.3, respectively;

[0142] Device unique identifier: w2 = 0.25, including fingerprint matching score f 21 Authentication confidence level f 22 The internal weights are 0.5 and 0.5 respectively;

[0143] Behavioral pattern: w3 = 0.25, including the degree of deviation from the baseline library f 31 Communication mode change rate f 32 The internal weights are 0.6 and 0.4 respectively;

[0144] Time series characteristics: w4 = 0.2, including prediction error magnitude f 41 Degree of periodic damage f 42 The internal weights are 0.5 and 0.5 respectively.

[0145] The feature standardization process is as follows:

[0146] $f_i =

[0147] $;

[0148] In the formula, x i The original eigenvalues; μ i and σ i These are the historical mean and standard deviation of feature i, respectively; min(x i ) and max(x i ) are the minimum and maximum values ​​of feature i, respectively.

[0149] The risk level classification rules are as follows:

[0150]

[0151] The parameter acquisition method is as follows: the original feature values ​​are obtained through corresponding detection modules, such as the traffic analysis module, device fingerprint recognition module, behavior analysis module, and time series analysis module; the feature weight w iInitial settings are established based on expert experience, followed by optimization using machine learning methods such as random forest feature importance or genetic algorithms; interaction weight α ij This is determined by analyzing the correlations and interaction effects between features in historical data.

[0152] This multidimensional anomaly scoring system combines three components: linear weighting, feature interaction, and variance adjustment. The linear weighting component... This reflects the basic contribution of each feature to risk assessment; the feature interaction section. It captures the synergistic or offsetting effects between different features, such as the risk amplification when traffic anomalies and device identity anomalies occur simultaneously; variance adjustment part The system enhances the sensitivity to anomaly detection, improving risk scores when certain features significantly deviate from the average level. A hierarchical structure is employed to process features across different categories, maintaining the overall consistency of the scoring while allowing for fine-tuning within each category. By comprehensively considering multi-dimensional anomaly indicators, the system significantly improves the accuracy of anomaly detection and reduces the false positive rate.

[0153] Optionally, the mathematical expression of the secure isolation intelligent sensing network model (based on graph neural network architecture) is as follows:

[0154] H (0) =X;

[0155]

[0156] In the formula, Let be the node feature matrix of the l-th layer, n be the number of nodes, and d be the node feature matrix of the l-th layer. l Let l be the feature dimension of the l-th layer; This is the initial node feature matrix; The adjacency matrix of the network topology of the security isolation zone; It is the identity matrix; The adjacency matrix after adding self-loops; for The corresponding degree matrix; σ is the weight matrix of the l-th layer; σ is the ReLU activation function.

[0157] The computational process of the spatiotemporal attention mechanism is as follows:

[0158]

[0159] In the formula, The attention score of node i to node j; This is the attention vector; Let i be the feature vector of node i in the l-th layer; These are the normalized attention weights; Let i be the set of neighbors of node i; || denotes the vector concatenation operation; LeakyReLU is the ReLU activation function with leakage.

[0160] The calculation process of the multi-head attention mechanism is as follows:

[0161]

[0162] In the formula, K is the number of attention heads, set to The attention weights calculated for the k-th attention head; W (l，k) Let be the weight matrix of the k-th attention head.

[0163] The calculation process for temporal attention is as follows:

[0164] q t =W Q h t ;

[0165] k s =W K h s ;

[0166] v s =W V h s ;

[0167]

[0168] In the formula, The hidden state at time step t; For query vector; and These are the key vector and value vector at time step s, respectively; Transformation matrices for query, key, and value, respectively; β ts is the attention weight of time step t to time step s; w is the attention window length, set to 1.5 times the device communication cycle in the time-series feature vector; This is the context vector for time step t.

[0169] The objective function for multi-task learning is defined as follows:

[0170] L total =λ1L identity +λ2L anomaly ;

[0171]

[0172] In the formula, L total L is the total loss function; identity Cross-entropy loss for device authentication tasks; L anomalyλ1 and λ2 are the mean squared error loss for the behavioral anomaly scoring task; λ1 and λ2 are weighting coefficients, set to 0.6 and 0.4 respectively; y i and These represent the true identity label and predicted probability of device i, respectively; s i and These are the actual anomaly score and the predicted anomaly score for device i, respectively.

[0173] The parameter acquisition method is as follows: the initial node feature matrix X is constructed by feature engineering based on information such as device communication behavior characteristics and hardware characteristics; the network topology graph adjacency matrix A is obtained from step S01; and the model weight parameter W... (l) a (l) W Q W K W V The model is learned through a training process, which uses the method described in step S08, including self-supervised learning on large-scale general network environment data and then supervised fine-tuning on marine forecasting system isolation zone environment data.

[0174] This secure and isolated intelligent sensing network model combines the structure-aware capabilities of graph convolutional networks with the dynamic feature extraction capabilities of attention mechanisms. Graph convolutional layers effectively capture node relationships within the network topology, integrating neighbor node information through message passing to form a node representation that considers the network structure. Spatial attention allows the model to dynamically adjust the importance of different neighbor nodes, focusing on more relevant connections. Temporal attention captures long-term dependencies in time-series data, identifying the changing characteristics of device communication patterns over time. Multi-head attention design enhances the model's expressive power, allowing simultaneous attention to patterns in different feature subspaces. A multi-task learning framework simultaneously optimizes two related tasks: device authentication and anomaly detection, improving the model's generalization ability and efficiency through shared representation learning.

[0175] Specifically, the principle of this invention is as follows: The core technology of this invention is based on an anomaly detection framework of "multi-dimensional feature fusion + deep learning." By comprehensively utilizing network topology features, communication behavior features, device physical features, and time-series features, a comprehensive unauthorized access detection mechanism is constructed. This method can solve the unauthorized access detection problem faced by traditional security isolation zones. The main principles are as follows:

[0176] First, the network topology matrix of the security isolation zone provides a mathematical representation of the connections between all devices within the isolation zone, providing a network structure foundation for anomaly detection. This graph-based representation accurately models the complex communication relationships between devices, helping to identify abnormal connections that violate the topology. By establishing a device asset inventory, the system obtains benchmark data on the hardware characteristics and communication behavior patterns of the devices, providing a comparison standard for subsequent anomaly detection.

[0177] Secondly, deep packet inspection technology analyzes data packet content in depth, extracts fine-grained communication features, and records normal communication patterns through a device behavior baseline library. A multi-objective risk assessment function quantifies device risk from multiple dimensions, classifying different risk levels for different device types, enabling the detection system to prioritize high-risk devices and improve detection efficiency. The combination of multilayer perceptron and temporal anomaly detection algorithms allows the system to simultaneously focus on the spatial and temporal characteristics of device behavior, improving the ability to identify hidden anomalies.

[0178] Most importantly, the secure isolation intelligent sensing network model of this invention adopts a graph neural network architecture. It captures network topology features through graph convolutional layers, models temporal dependencies through a spatiotemporal attention mechanism, and simultaneously completes device authentication and behavioral anomaly assessment through multi-task learning. This structural design enables the model to comprehensively consider the correlation between devices and the temporal characteristics of behavior. It is this multi-dimensional information fusion mechanism that allows the model to identify complex abnormal behaviors that are difficult to detect with single-dimensional detection.

[0179] Furthermore, the device fingerprinting mechanism extracts a unique identifier that is difficult to forge based on the physical layer characteristics of the device, providing physical layer protection for device authentication. The multi-dimensional anomaly scoring system integrates various features to calculate and assign a comprehensive risk score to potential anomalies, effectively reducing the false alarm rate. The introduction of federated learning optimizes model performance while protecting the security of the original data, adapting to the special security requirements of isolated network environments.

[0180] In summary, this invention forms a complete automatic detection technology system for unauthorized access through multi-dimensional feature extraction, deep learning model construction, and multi-level anomaly assessment, thereby effectively solving the technical problem of real-time detection of unauthorized device access in secure isolation zone networks.

[0181] The following provides a specific embodiment 1 of the present invention, and the specific implementation of each step in this embodiment 1 is described in detail below.

[0182] The specific implementation of step S01 involves constructing a network topology matrix for the security isolation zone and establishing a detailed device asset list through network scanning and device discovery technologies. First, all network devices within the isolation zone are discovered using a combination of active probing and passive monitoring. ICMP protocol is used for liveness detection, and TCP / UDP port scanning technology is used to identify open services. Then, an adjacency matrix is ​​constructed, represented as follows:

[0183]

[0184] In the formula, A is the adjacency matrix; n is the total number of devices in the isolation zone; a ijThis represents the connection status and communication permissions between device i and device j, with values ​​{0, 1, 2, 3}, where 0 indicates no connection, 1 indicates a one-way connection, 2 indicates a two-way connection with limited permissions, and 3 indicates a two-way connection with full permissions. Next, device hardware characteristic information is collected, including MAC address, operating system type, firmware version, CPU model, and memory capacity, and communication behavior patterns are recorded, including communication protocol type, average data transmission volume, communication frequency, and typical time windows. Finally, all information is integrated into a unified asset management database to complete the construction of the network topology matrix and device asset list. This step establishes a mathematical representation model of the network structure, providing basic data support for subsequent risk assessment and anomaly detection.

[0185] The specific implementation methods for steps S02-S03 are the same as those described above, and will not be repeated in detail here.

[0186] The specific implementation of step S04 involves applying a multi-objective risk assessment function to classify the risk levels of various types of equipment within the isolation zone. The mathematical expression of the multi-objective risk assessment function is:

[0187]

[0188] In the formula, Risk i W represents the safety risk score for device i, with a value range of [0, 1]. i V represents the equipment importance weighting factor, with a value range of [0.1, 1.0]; i F is a standardized value representing the cumulative number of known vulnerabilities, ranging from [0, 1]. i S is the communication frequency per unit time, representing a standardized value of the number of communications per minute by the device, with a value range of [0, 1]. i H represents the sensitivity coefficient for transmitted data, with a value range of [0.2, 1.0]. i λ is the standardized value of the number of historical abnormal behaviors, ranging from [0, 1]; α, β, γ, δ, ∈ are the basic weight coefficients, with values ​​of 0.3, 0.25, 0.15, 0.2, and 0.1 respectively; θ is the interaction term weight, with a value of 0.05, used to enhance risk assessment when important equipment processes sensitive data; λ is the nonlinear adjustment term weight, with a value of 0.05, used to strengthen risk assessment when high vulnerabilities and high anomaly histories coexist. Based on the calculation results, the equipment risk level is divided into: low risk (Risk... i ∈[0, 0.3)), medium risk (Risk) i ∈[0.3, 0.6)), high risk (Risk) i ∈[0.6, 0.8)), extremely high risk (Risk) i(∈[0.8, 1.0]). This risk assessment function combines linear weighting with nonlinear adjustment terms, taking into account the interaction and synergistic effect between parameters, and provides risk prioritization guidance for subsequent anomaly detection models.

[0189] The specific implementation of step S05 involves using a multilayer perceptron to construct an anomaly detection model to identify anomalous communications that deviate from the behavioral baseline. The forward propagation calculation process of the multilayer perceptron model is as follows:

[0190] Z (1) =X·W (1) +b (1) ;

[0191] A (1) =ReLU(Z) (1) ) = max(0, Z (1) );

[0192] Z (2) =A (1) ·W (2) +b (2) ;

[0193] A (2) =ReLU(Z) (2) ) = max(0, Z (2) );

[0194] Z (3) =A (2) ·W (3) +b (3) ;

[0195]

[0196] In the formula, The input feature vector is d, where d is the feature dimension (50-200). These are the weight matrices for each layer; These are the bias vectors for each layer; Z (l) For the linear output of the l-th layer; A (l) Y is the activation output of the l-th layer; Y is the final output, representing the probability that a sample belongs to either the normal or abnormal class. The anomaly detection decision process is as follows:

[0197] Anomaly_Score = Y1;

[0198]

[0199] In the formula, Y1 represents the probability that a sample belongs to the abnormal class; τ is the anomaly detection threshold, typically set to 0.75; and Decision is the final decision, where 1 indicates anomaly and 0 indicates normal. Model training employs the cross-entropy loss function and the Adam optimizer, with an initial learning rate of 0.001, decaying to 90% of its original value every 50 epochs. This step automatically extracts high-dimensional feature patterns using deep learning methods, exhibiting stronger generalization ability and adaptability compared to traditional rule-based methods.

[0200] The specific implementation of step S06 involves introducing a timing anomaly detection algorithm to identify unexpected device access behavior during data transmission. First, a timing prediction model based on a Long Short-Term Memory (LSTM) network is constructed, and the calculation process is as follows:

[0201] f t =σ(W f ·[h t-1 x t ]+b f );

[0202] i t =σ(W i ·[h t-1 x t ]+b i );

[0203]

[0204] o t =σ(W o ·[h t-1 x t ]+b o );

[0205] h t =o t ⊙tanh(C t );

[0206]

[0207] In the formula, x t h is the input feature vector at time step t; t C is the hidden state vector; t f is the cell state vector; t i t o t These are the forget gate, input gate, and output gate vectors, respectively. Candidate cell state; Let be the predicted feature vector for the next time step; W and b are the corresponding weight matrix and bias vector, respectively. The time-series anomaly score based on the prediction model is calculated as follows:

[0208]

[0209] τ t =μ AS +β·σ AS ;

[0210] In the formula, e t z is the prediction error vector; t μ is the standardized error vector. e and σ e The mean and standard deviation of historical prediction errors; w i AnomalyScore represents the feature importance weights. t The comprehensive abnormal score; τ t β is the adaptive threshold; β is the threshold coefficient, typically 3. This step effectively identifies temporal anomalies in the data acquisition process by analyzing time series characteristics and prediction errors, and discovers data anomalies caused by unauthorized device access.

[0211] The specific implementation of step S07 involves establishing a device fingerprint recognition mechanism based on physical layer characteristics to verify the legitimacy of device identities within the isolation zone. The mathematical expression of the device fingerprint feature vector is:

[0212] F j ={f j1 f j2 , ..., f jm};

[0213] f ji =g i (r ji )+ε ji ;

[0214] In the formula, F j f is the fingerprint feature vector of device j; ji Let g be the i-th physical characteristic value of device j; i (·) represents the feature extraction function; r ji These are the original physical property measurements; ε ji To account for measurement error, the fingerprints follow a Gaussian distribution. Device fingerprint similarity is calculated as follows:

[0215]

[0216] In the formula, Sim(F j F k ) represents the fingerprint similarity between device j and device k; w i These are the feature weights. The device authentication process is as follows:

[0217]

[0218] In the formula, Identity(j) is the authentication result of device j; D is the set of legitimate device fingerprints; τ F This is the authentication threshold, typically 0.9. This step achieves reliable verification of the device's identity by analyzing physical layer features that are difficult to forge, effectively identifying spoofed devices.

[0219] The specific implementation of step S08 involves analyzing network behavior using a pre-trained secure isolation intelligent perception network model. This model is based on a graph neural network architecture, and its core computational process includes:

[0220] H (0) =X;

[0221]

[0222] In the formula, H (l) X is the feature matrix of the nodes in the l-th layer; A is the initial node feature matrix; I is the network topology adjacency matrix; and I is the identity matrix. The adjacency matrix after adding self-loops; W is the degree of correspondence matrix. (l) Let be the weight matrix; σ be the activation function. The spatiotemporal attention mechanism is calculated as follows:

[0223]

[0224] The calculation of the multi-head attention mechanism is as follows:

[0225]

[0226] In the formula, K is the number of attention heads, set to W represents the attention weight of the k-th attention head. (l，k) Here are the corresponding weight matrices. The multi-task learning objective function of the model is:

[0227] L total =λ1L identity +λ2L anomaly ;

[0228] In the formula, L identity Cross-entropy loss for device authentication tasks; L anomaly λ1 and λ2 are the mean squared error loss for the behavior anomaly scoring task; λ1 and λ2 are weight coefficients, set to 0.6 and 0.4, respectively. Through this model analysis, the device authentication result (confidence not less than 0.9) and the behavior anomaly score (anomaly threshold set to 0.7) can be output simultaneously. This step uses a graph neural network combined with a spatiotemporal attention mechanism to achieve in-depth analysis of network behavior and timely detection of unauthorized access behavior.

[0229] The specific implementation of step S09 involves constructing a multi-dimensional anomaly scoring system to calculate the comprehensive risk score of suspicious access behavior. The formula for calculating the comprehensive risk score is as follows:

[0230]

[0231] In the formula, R is the comprehensive risk score; f i w is the standardized score of the i-th feature; i The feature weights; α ij For feature interaction weights; The weighted average eigenvalues ​​are represented by β, which is the variance adjustment coefficient with a value of 0.1. The main feature classifications and weights are: traffic characteristics (w1 = 0.3), unique device identifier (w2 = 0.25), behavioral patterns (w3 = 0.25), and time-series characteristics (w4 = 0.2). Risk levels are categorized based on the calculation results: low risk (R ∈ [0, 0.4]), medium risk (R ∈ [0.4, 0.7]), high risk (R ∈ [0.7, 0.9]), and extremely high risk (R ∈ [0.9, 1.0]). This step, by integrating multi-dimensional anomaly indicators, achieves accurate assessment of suspicious access behavior, improving detection accuracy and reducing false alarm rates.

[0232] The specific implementation methods of steps S10-S11 are the same as those described above, and will not be repeated here.

[0233] To better understand and implement this invention, Example 2, a specific application scenario, is provided below: Researchers at a marine forecasting data center are responsible for building and maintaining a secure isolation zone network for a marine forecasting system. This system comprises several key subsystems, such as data acquisition terminals, transmission equipment, computing servers, and operator terminals, which collect, transmit, calculate, and analyze marine environmental monitoring data. Because the data processed by the system is of great importance to national maritime security, the researchers decided to deploy an automatic detection model method for unauthorized access within a secure network isolation zone to improve system security.

[0234] First, the researchers conducted a comprehensive scan of the secure isolation zone network, using ICMP protocol and TCP / UDP port scanning techniques to identify all network devices and construct a network topology matrix containing 42 device nodes. (See Table 1.)

[0235] Table 1. Partial Network Topology Matrix of Security Isolation Zones

[0236]

[0237]

[0238] In the matrix, 0 represents no connection, 1 represents a unidirectional connection, 2 represents a bidirectional connection with limited permissions, and 3 represents a bidirectional connection with full permissions. A device asset list was also established, recording the hardware characteristics and communication behavior patterns of the devices.

[0239] The researchers then deployed 12 distributed traffic collection nodes at key network nodes, including gateway ingress / egress points, core switches, and critical server front-ends. These collection nodes replicated network traffic using switch port mirroring technology and transmitted it to a security audit server via a secure channel using AES-256 encryption. The average daily collected traffic data reached 62GB.

[0240] Using deep packet inspection technology, researchers extracted device communication features and established a baseline database of device behavior. For a typical data acquisition terminal (DEV008), its communication feature baseline is shown in Table 2:

[0241] Table 2. Communication characteristics baseline of data acquisition terminal DEV008

[0242] Feature indicators Normal range mean Standard deviation Connection establishment frequency (times / minute) 2.1-3.5 2.8 0.23 Session duration (seconds) 8.5-15.2 12.6 1.15 Data transfer volume (KB / hour) 425-580 503 25.8 Communication period (hours) 06:00-22:00 - - TCP connection percentage (%) 82-91 86.5 1.8 UDP connection percentage 9-18 13.5 1.8 Number of target IP addresses 4-6 5 0.5

[0243] Based on the established asset inventory and baseline database, researchers used a multi-objective risk assessment function to classify the risk levels of the equipment. Taking five key pieces of equipment as an example, the calculated risk assessment results are shown in Table 3:

[0244] Table 3. Risk Assessment Results for Key Equipment

[0245]

[0246] Next, the researchers constructed an anomaly detection model using a multilayer perceptron. The model consists of an input layer (152 feature nodes), two hidden layers (128 and 64 nodes respectively), and an output layer (2 nodes). It was trained using a dataset containing 100,000 normal samples and 20,000 anomaly samples, with an anomaly detection threshold set to 0.75. After training, the model achieved a detection accuracy of 95.8% and a false positive rate of 2.3% on the test set.

[0247] To identify unexpected device access behavior during data transmission, researchers introduced a temporal anomaly detection algorithm based on Long Short-Term Memory (LSTM) networks. This algorithm performs temporal analysis on the data generated by the acquisition terminal, predicts normal behavior at the next time step, and identifies anomalies by calculating the prediction error. In actual deployment, the system successfully captured one instance of abnormal device access behavior, achieving a temporal anomaly score of 4.82 (threshold 3.2), thus triggering an alarm in a timely manner.

[0248] Researchers also established a device fingerprinting mechanism, extracting physical characteristics of the device to form a unique identifier. Taking a critical server as an example, its fingerprint characteristics are shown in Table 4:

[0249] Table 4 Physical fingerprint characteristics of server DEV013

[0250]

[0251]

[0252] A pre-trained secure isolation intelligent perception network model is used to analyze network behavior. This model is based on a graph neural network architecture and includes three graph convolutional layers, two spatiotemporal attention mechanism layers, and a multi-task learning head. The number of attention heads is set to... The attention window length is 18 (1.5 times the typical communication cycle of 12 minutes for the data acquisition terminal). The model achieved a 98.2% detection rate for unauthorized access in offline testing.

[0253] A multi-dimensional anomaly scoring system was constructed, combining traffic characteristics, unique device identifiers, behavioral patterns, and time-series characteristics to calculate the risk score of suspicious access behavior. In an experimental simulation, researchers discovered a suspicious device accessing the network, and the system calculated a comprehensive risk score of 0.83. Detailed scores are shown in Table 5.

[0254] Table 5 Multidimensional Anomaly Scoring of Suspicious Devices

[0255] Anomaly Dimension Weight Eigenvalues Weighted score Flow characteristics 0.30 0.78 0.234 Unique Device Identifier 0.25 0.95 0.238 behavioral patterns 0.25 0.82 0.205 Temporal characteristics 0.20 0.72 0.144 Feature interaction items - - 0.009 Total Score - - 0.830

[0256] Finally, a rule-based response mechanism was implemented. Corresponding processing strategies are automatically triggered based on different risk levels. Taking the aforementioned suspicious device as an example (risk score 0.83, high risk), the system automatically executed the following response measures: generating a high-priority alarm, notifying the security operations team, automatically isolating the suspicious device, and saving network traffic data for 30 minutes before and after the event for forensic analysis. The security team confirmed that the device was indeed an unauthorized test device.

[0257] This embodiment also employs federated learning technology to optimize the secure isolation intelligent sensing network model. Twelve traffic collection nodes are organized into a federated learning network, with parameter aggregation performed every 24 hours. Each node undergoes 10 rounds of local training during communication intervals. Parameter transmission security is protected through differential privacy protection (noise level σ = 0.03, ε = 3) and homomorphic encryption. After three months of federated learning optimization, the model's detection rate for novel unauthorized access behaviors increased from 94.5% to 98.7%, while the false alarm rate decreased from 3.8% to 1.2%.

[0258] Traditional methods for detecting unauthorized access to network security isolation zones primarily rely on static rules and simple anomaly detection algorithms, which suffer from the following problems: First, they depend on predefined rules, making them ill-equipped to handle unknown threats; second, they fail to adequately consider the physical characteristics of devices, making them vulnerable to feature spoofing; third, they lack temporal characteristic analysis, hindering the detection of advanced persistent threats; and finally, the detection modules operate independently, lacking overall coordination. This invention constructs a multi-dimensional security awareness model by integrating network topology, device physical characteristics, communication behavior patterns, and temporal characteristics. It employs graph neural networks and spatiotemporal attention mechanisms to achieve deep learning of complex relationships between devices. Federated learning technology is introduced to continuously optimize the model while protecting data privacy.

[0259] It should be noted that the variables involved in this invention are explained in detail in Tables 6 and 7 below.

[0260] Table 6. Variable Explanation Table (Part 1)

[0261]

[0262]

[0263] Table 7. Variable Explanation Table (Part Two)

[0264]

[0265]

[0266] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A method for automatically detecting unauthorized access within a network security isolation zone, characterized in that, include: Construct a network topology matrix for the security isolation zone and establish a device asset list; Distributed traffic acquisition nodes are used to capture network traffic in real time at key nodes in the isolated network area. Deep packet inspection technology is used to extract features from the collected data to form a baseline library of device behavior; a multi-objective risk assessment function is applied to classify the risk levels of the acquisition terminal, transmission equipment, computing server, and operator terminal; an anomaly detection model is constructed using a multilayer perceptron; a temporal anomaly detection algorithm is introduced to generate temporal feature vectors for the acquisition terminal; a device fingerprinting mechanism is established to extract the unique identifier of the device based on physical layer characteristics; and a pre-trained secure isolation intelligent sensing network model is used to analyze network behavior. Construct a multi-dimensional anomaly scoring system that combines traffic characteristics, unique device identifiers, behavioral patterns, and time-series feature vectors to calculate risk scores for suspicious access behaviors; Implement a rule engine-based response mechanism that triggers a response strategy when the multi-dimensional anomaly scoring system detects unauthorized access behavior; The input parameters of the multi-objective risk assessment function include device importance weight, number of vulnerabilities, communication frequency, data sensitivity and abnormal behavior history, and the output parameters of the multi-objective risk assessment function include device security risk score and risk level classification identifier. The specific structure of the secure isolation intelligent sensing network model is an anomaly detection framework based on a graph neural network architecture, which includes a graph convolutional layer, a spatiotemporal attention mechanism layer, and a multi-task learning head. The graph convolutional layer is used to capture the inter-device relationship features in the secure isolation zone network topology graph matrix, and the spatiotemporal attention mechanism layer models the temporal dependencies in the communication modes of the acquisition terminals. The parameter optimization of the secure isolation intelligent sensing network model depends on the node density in the secure isolation zone network topology graph matrix, the traffic baseline threshold in the device behavior baseline library, and the temporal characteristics of device communication.

2. The method according to claim 1, characterized in that, The network traffic captured by the distributed traffic acquisition nodes is transmitted to the security audit server through an encrypted channel.

3. The method according to claim 2, characterized in that, The anomaly detection model constructed by the multilayer perceptron is trained through supervised learning and is used to identify abnormal communications that deviate from the behavioral patterns recorded in the device behavior baseline library.

4. The method according to claim 3, characterized in that, The secure isolation zone network topology matrix refers to the adjacency matrix used to describe the connection relationships between all devices within the isolation zone. Each element in the matrix represents the connection status and communication permissions between two devices, and is used to establish a mathematical representation model of the network structure.

5. The method according to claim 4, characterized in that, The aforementioned time-series anomaly detection algorithm refers to analyzing the time-series characteristics of the data collected from the terminal, using long short-term memory networks or autoregressive models to identify time-series anomalies in the data collection process, and discovering data anomalies caused by unauthorized device access.

6. The method according to claim 5, characterized in that, The multidimensional anomaly scoring system integrates and calculates multiple anomaly detection indicators, assigns a risk score to each potential abnormal behavior, and generates a comprehensive risk assessment result through weighted calculation, thereby improving the accuracy of anomaly detection and reducing the false alarm rate.

7. The method according to claim 6, characterized in that, It also includes using federated learning technology to optimize the security isolation intelligent sensing network model. Each traffic collection node trains locally and then shares the parameters of the security isolation intelligent sensing network model to avoid cross-domain transmission of raw data and improve the overall protection capability of the security isolation zone.

8. An automatic detection model system for unauthorized access within a network security isolation zone, characterized in that, The system is any one of a server, computer, or computing center, and the system is equipped with a logic processor, which is used to execute the automatic detection model method for unauthorized access in a network security isolation zone as described in any one of claims 1-7.

Images