Network security management method and system based on big data model

Abstract

The invention relates to the technical field of network security, and discloses a network security management method and system based on a big data model, and the method comprises the steps: 1, converting multi-source heterogeneous data into a graph node containing a device entity, an I P entity and a user entity, and an interaction edge containing a timestamp and a relation type; step 2, constructing an attack chain dynamic evolution equation based on graph nodes and interaction edges, wherein the equation comprises an attacker action parameter and a defender action parameter; and step 3, inputting a time fusion Transform model to obtain probability distribution of a future attack action sequence by using a state variable corresponding to the attack chain dynamic evolution equation. According to the method, the technical scheme of constructing an attack chain dynamic evolution equation based on a differential game model, predicting an attack action sequence through time fusion Transformer and dynamically updating a defense strategy through meta reinforcement learning is adopted, and the technical effects of accurately modeling an attack evolution path, predicting an attack behavior in advance and generating a self-adaptive defense strategy in real time are achieved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a network security management method and system based on a big data model. Background Art

[0002] With the widespread adoption of technologies like cloud computing and the Internet of Things, network boundaries are constantly expanding. Attack methods are constantly evolving, and single logs or rules are unable to fully capture the full picture. There is an urgent need for a network security management method and system based on big data models. This method can uniformly model multi-source, heterogeneous data, accurately depict the dynamic evolution of attack chains, and adjust defense strategies in real time to achieve an end-to-end closed-loop response.

[0003] Existing technologies face significant deficiencies when addressing complex network security threats, primarily in their inadequate ability to identify and respond to dynamic attack chains, as well as inefficient cross-domain data fusion and real-time modeling. First, existing solutions often rely on static rules and single time series models, which are unable to accurately capture the dynamic evolution of multi-stage attack chains. Furthermore, predictions lag, and defense strategies are typically initiated after an attack occurs, resulting in untimely responses. Second, cross-domain data fusion and real-time modeling capabilities are very weak, with multi-source heterogeneous data often isolated and lacking an effective unified modeling approach. Data preprocessing is time-consuming, severely impacting the real-time nature of threat detection and the accuracy of decision-making. Furthermore, the threat path modeling accuracy of a single graph model is insufficient, resulting in a high false alarm rate and a lack of automated feedback mechanisms with defense strategies, making the system unable to effectively respond to new threats and dynamic changes.

[0004] To this end, the present invention proposes a network security management method and system based on a big data model to solve the above-mentioned problems. Summary of the Invention

[0005] In view of the deficiencies of the existing technology, the present invention provides a network security management method and system based on a big data model to solve the problems raised in the above background technology.

[0006] To achieve the above objectives, the present invention is implemented through the following technical solutions: A network security management method based on a big data model, comprising:

[0007] Step 1: Convert multi-source heterogeneous data into graph nodes containing device entities, IP entities, user entities, and interaction edges containing timestamps and relationship types;

[0008] Step 2: Construct an attack chain dynamic evolution equation based on graph nodes and interaction edges. The equation includes attacker action parameters and defender action parameters.

[0009] Step 3: Use the state variables corresponding to the attack chain dynamic evolution equation and input them into the time fusion Transformer model to obtain the probability distribution of future attack action sequences;

[0010] Step 4: Adjust the defense strategy network parameters according to the probability distribution of future attack action sequences to generate a dynamic defense strategy;

[0011] Step 5: Based on the graph nodes and interaction edges, the streaming graph neural network calculates the dynamic associations between nodes and constructs the global threat propagation path in combination with the predefined rules of the security knowledge graph;

[0012] Step 6: Generate a threat propagation probability distribution according to the global threat propagation path, select and execute a defense action based on the threat propagation probability distribution.

[0013] Preferably, in step 1, converting multi-source heterogeneous data into graph nodes and interaction edges further includes:

[0014] Sub-step 1.1: Clean and standardize the original data for outliers. The formula is defined as:

[0015] For each data field f, calculate the Z-Score standardized value z f :

[0016] The filter conditions are:

[0017] Among them, z f is the value of the data field f after Z-Score standardization, x f is the value of the original data field f, μ f , σ f is the historical mean and standard deviation of field f, τ is the cleaning threshold;

[0018] Sub-step 1.2: Generate graph nodes and interaction edges based on the cleaned data. The formula is defined as:

[0019] Node generation rules: v i ={ID:Hash(d type ,d ID ),Type:d type ,Attrs:α i},

[0020] Edge generation rule: e ij ={src:v i .ID,dst:v j .ID,t:t event ,τ:r type},

[0021] Among them, vi is the generated graph node, ID is the unique identifier of the graph node, Hash is the hash function, d type is the entity type, d ID is the entity identifier in the original data, Type is the type label of the node, d type is the entity type field in the original data, Attrs is the attribute set of the node, α i is the node attribute vector,

[0022] e ij is the interaction relationship between nodes, src and dst are the starting and ending points of the edge, v i .ID and v j .ID is node v i and v j The unique identifier of t is the event timestamp, t event is the event timestamp, r type is the relationship type, τ is the cleaning threshold;

[0023] Sub-step 1.3, aggregate node and edge data through streaming time windows, the formula definition:

[0024] Data aggregation within a sliding window:

[0025]

[0026] Among them, G (k) is the graph data set within the k-th time window, is the dynamic state of node i in time window t, is the number of nodes v in the time window t i To node v j The dynamic interaction edge, ΔT is the time length of the sliding window, k is the index number of the time window, and t is the event timestamp;

[0027] Window output conditions:

[0028] Among them, N min is the minimum event count threshold that triggers data processing, is the total number of events in the k-th time window.

[0029] Preferably, in step 2, constructing the attack chain dynamic evolution equation based on the graph nodes and interaction edges generated in step 1 further includes:

[0030] Sub-step 2.1, based on the graph nodes and interaction edges, calculate the adjacency matrix A and degree matrix D to obtain the Laplace matrix L = DA, define the attack chain state vector S(t), the attacker action parameter vector u A (t) and the defender's action parameter vector uD (t);

[0031] Sub-step 2.2, based on S(t) and u defined in sub-step 2.1 A (t),u D (t) Construct state evolution function:

[0032] f(S(t),u A (t),u D (t))=-αLS(t)+βu A (t)-γu D (t),

[0033] Get the dynamic equation

[0034]

[0035] in, is the instantaneous rate of change of the state vector with respect to time, f(·) is the state evolution function, α is the state diffusion coefficient, β is the attack gain coefficient, and γ is the defense damping coefficient;

[0036] In sub-step 2.3, the discrete evolution is calculated using the explicit Euler method based on the dynamic equations obtained in sub-step 2.2. The formula is as follows:

[0037] S(t+Δt)=S(t)+Δt·f(S(t),u A (t),u D (t)),

[0038] And output S(t+Δt) to step 3,

[0039] Among them, Δt is the discrete time step, and S(t+Δt) is the state vector at the time after the discrete step.

[0040] Preferably, in step 3, using the state variables corresponding to the attack chain dynamic evolution equation to input the time fusion Transformer model to obtain the probability distribution of the future attack action sequence further includes:

[0041] Sub-step 3.1, perform time window interception on the state variable output in step 2, and extract the time window data from the continuous state variable S(t):

[0042] X(t)=[S(t-KΔt),S(t-(K-1)Δt),…,S(t)],

[0043] Where K is the time window length, Δt is the discrete time step, S(t-KΔt) is the state vector at time t-KΔt, and X(t) is the time window state matrix;

[0044] Sub-step 3.2, calculate the temporal association weight through the multi-head attention mechanism of the time fusion Transformer, multi-head attention weight calculation:

[0045]

[0046] Among them, Attention(Q,K,V) is the result of multi-head attention calculation, Q h is the h-th head query matrix, K h is the h-th head key matrix, V h is the h-th head value matrix, H is the number of attention heads, d h is a single-head hidden dimension, Q is the query matrix, K is the key matrix, and V is the value matrix;

[0047] Sub-step 3.3, generate the probability distribution of future attack action sequences, and output the action probability through the fully connected layer and Softmax:

[0048]

[0049] in, is the probability distribution of the attack action sequence in the future M time steps under the condition of given time window data X(t), M is the prediction step size, and MLP is a fully connected network.

[0050] Preferably, in step 4, adjusting the defense strategy network parameters according to the probability distribution of the future attack action sequence output in step 3 further includes:

[0051] Sub-step 4.1, calculate the advantage function of the defensive action based on the probability distribution of the attack action, and for each defensive action u d , calculate the advantage value relative to the attack action:

[0052]

[0053] Among them, A(u d ) is the advantage function of the defensive action, P(u a ) is the probability distribution of attack action, R d (u d ,u a ) is the defensive action u d Attack action u a The suppression benefit, Cost(u d ) is the resource consumption of the defense action, λ is the benefit-cost balance coefficient, U a Action set for defenders;

[0054] In sub-step 4.2, the meta-reinforcement learning framework is used to update the meta-parameters of the defense strategy network. The meta-objective function is the multi-task expected loss:

[0055]

[0056] Among them, L meta is the meta-loss function, For the task The loss function is is the meta-task, θ is the defense strategy network parameter, D meta is the meta-training task set, η inner is the inner loop learning rate, μ is the L2 regularization coefficient, is the gradient operator;

[0057] Sub-step 4.3, perform online policy network gradient update based on real-time attack data, online gradient descent update:

[0058]

[0059] Among them, π θ (u d ) is the defense action u output by the policy network d The probability of η outer is the outer loop learning rate, θ new are the updated defense strategy network parameters, and θ are the original defense strategy network parameters.

[0060] Preferably, in step 5, the dynamic association between the graph nodes and the interaction edges generated in step 1 is calculated through a streaming graph neural network, and the global threat propagation path is constructed in combination with predefined rules of the security knowledge graph, further comprising:

[0061] Sub-step 5.1, perform time-decay weighted aggregation on the streaming interaction edges, and perform exponential decay on the edge weights within the time window Δt:

[0062]

[0063] in, is the initial weight of the original interaction edge at time t0, is the initial weight of the original interaction edge at time t, and ρ is the time decay coefficient;

[0064] Sub-step 5.2, update the node embedding through the temporal graph attention network, the node embedding update equation is:

[0065]

[0066] in, is the embedding vector of node i at time t, is the embedding vector of node i at time t-1, is the embedding vector of node j at time t-1, W1 and is the trainable parameter matrix, r is the relationship type

[0067] Attention weight calculation:

[0068]

[0069] Among them, v r is the attention parameter vector of relation type r, is the attention weight between node i and node j under relationship type r, h i and h j is the embedding vector of node i and node j, W s and W d is the trainable parameter matrix;

[0070] Sub-step 5.3, based on the security knowledge graph rules, enhance the abnormal edge weights. If the node pair (v i ,v j ) satisfies the knowledge graph rule R and modifies the edge weight:

[0071] s ij ←s ij +δ·Confidence(R),

[0072] Among them, s ij is the original edge anomaly score, δ is the rule confidence enhancement coefficient,

[0073] Confidence(R) is the predefined confidence level of rule R.

[0074] Preferably, in step 6, generating a threat propagation probability distribution based on the global threat propagation path constructed in step 5 and selecting a defense action further includes:

[0075] Sub-step 6.1, calculate the node threat propagation probability distribution based on the improved PageRank algorithm, and iteratively update the node threat value: s (k) =d·A T s (k-1) +(1-d)·b,

[0076] Among them, A is the global threat propagation path adjacency matrix, d is the damping factor, b is the node initial threat vector, s (k) is the threat probability distribution vector after the kth iteration, s (k-1) is the threat probability distribution vector after the k-1th iteration;

[0077] Sub-step 6.2: Construct a multi-objective optimization function to solve the Pareto optimal defense action, maximizing threat coverage and minimizing operation cost:

[0078]

[0079] Constraints: TimeLimit≤50ms,

[0080] Among them, s v is the threat propagation probability value of node v, Coverage(u d ) is the defensive action u d The set of nodes that can be effectively protected, α1 is the threat coverage weight, β1 is the operation cost penalty coefficient, δ1(·) is the indicator function, C max is the system resource budget threshold, Cost(u d ) is to execute the defensive action u d The system resource cost required, TimeLimit is the maximum allowable time for the defense action decision optimization process;

[0081] Sub-step 6.3: Execute defense actions and provide feedback to update the threat propagation model, verify defense effectiveness, and update the model:

[0082]

[0083] Among them, ∈ is the threat change threshold, if it exceeds, the defense action is considered invalid, s (t) is the threat distribution before the defense action is executed, s (t+1) The distribution of new threats during the post-execution monitoring cycle.

[0084] A network security management system based on a big data model, the network security management system comprising:

[0085] A data collection module configured to access network traffic logs, endpoint behavior data, and threat intelligence in real time;

[0086] The attack chain analysis module is configured to perform differential game model calculations and time-fused Transformer predictions;

[0087] A defense strategy module, configured to run a meta-reinforcement learning framework to generate dynamic response strategies;

[0088] Graph computing engine, configured for streaming graph neural network reasoning and knowledge graph fusion;

[0089] An automated response module is configured to trigger blocking, isolation, and alerting actions based on the probability of threat propagation.

[0090] A terminal device includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, the network security management method based on the big data model is implemented.

[0091] A storage medium stores a computer program, which, when executed by a processor, implements a network security management method based on a big data model.

[0092] The present invention provides a network security management method and system based on big data model.

[0093] Beneficial effects:

[0094] 1. The present invention adopts a technical solution based on the differential game model to construct the dynamic evolution equation of the attack chain, the time-fused Transformer to predict the attack action sequence, and the meta-reinforcement learning to dynamically update the defense strategy, so as to achieve the technical effects of accurately modeling the attack evolution path, predicting the attack behavior in advance, and generating an adaptive defense strategy in real time. Compared with the technical solutions in the prior art that rely on static rule bases or single time series models to passively respond to attacks, this solution solves the shortcomings of traditional methods that cannot quantify the dynamics of attack and defense games, have strong prediction lags, and have rigid strategies that lead to the failure of new attack defenses.

[0095] 2. The present invention adopts the technical solutions of multi-source heterogeneous data graph node modeling, streaming graph neural network real-time correlation analysis, and security knowledge graph rule enhancement to achieve the technical effects of efficiently integrating cross-domain data, accurately constructing threat propagation paths, and quickly executing end-to-end defense responses. Compared with the existing technology that adopts isolated data preprocessing or single graph model static modeling, it solves the shortcomings of traditional methods such as lack of threat association due to data islands, inability of static rules to adapt to dynamic topology, and excessive response delay. BRIEF DESCRIPTION OF THE DRAWINGS

[0096] Figure 1 is a flow chart of the present invention;

[0097] Figure 2 It is a system diagram of the present invention. DETAILED DESCRIPTION

[0098] To help those skilled in the art understand the present invention, the following will provide a clear and complete description of the technical solutions in the embodiments of the present invention, in conjunction with the accompanying drawings. Obviously, the described embodiments are only partial embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0099] The present invention is described in detail below with reference to the accompanying drawings:

[0100] Example:

[0101] Please see the attached Figure 1 The embodiment of the present invention provides a network security management method based on a big data model, comprising:

[0102] Step 1: Convert multi-source heterogeneous data into graph nodes containing device entities, IP entities, user entities, and interaction edges containing timestamps and relationship types;

[0103] Sub-step 1.1: Clean and standardize the original data for outliers. The formula is defined as:

[0104] For each data field f, calculate the Z-Score standardized value z f :

[0105] The filter conditions are:

[0106] Among them, z f is the value of the data field f after Z-Score standardization, x f is the value of the original data field f, μ f , σ f is the historical mean and standard deviation of field f, τ is the cleaning threshold;

[0107] Sub-step 1.2: Generate graph nodes and interaction edges based on the cleaned data. The formula is defined as:

[0108] Node generation rules: v i ={ID:Hash(d type ,d ID ),Type:d type ,Attrs:α i},

[0109] Edge generation rule: e ij ={src:v i .ID,dst:v j .ID,t:t event ,τ:r type},

[0110] Among them, v i is the generated graph node, ID is the unique identifier of the graph node, Hash is the hash function, d type is the entity type, d ID is the entity identifier in the original data, Type is the type label of the node, d type is the entity type field in the original data, Attrs is the attribute set of the node, α i is the node attribute vector,

[0111] e ij is the interaction relationship between nodes, src and dst are the starting and ending points of the edge, v i .ID and v j .ID is node vi and v j The unique identifier of t is the event timestamp, t event is the event timestamp, r type is the relationship type, τ is the cleaning threshold;

[0112] Sub-step 1.3, aggregate node and edge data through streaming time windows, the formula definition:

[0113] Data aggregation within a sliding window:

[0114]

[0115] Among them, G (k) is the graph data set within the k-th time window, is the dynamic state of node i in time window t, is the number of nodes v in the time window t i To node v j The dynamic interaction edge, ΔT is the time length of the sliding window, k is the index number of the time window, and t is the event timestamp;

[0116] Window output conditions:

[0117] Among them, N min is the minimum event count threshold that triggers data processing, is the total number of events in the k-th time window;

[0118] Step 2: Construct the attack chain dynamic evolution equation based on the graph nodes and interaction edges. The equation includes the attacker action parameters and the defender action parameters.

[0119] Sub-step 2.1, based on the graph nodes and interaction edges, calculate the adjacency matrix A and degree matrix D to obtain the Laplace matrix L = DA, define the attack chain state vector S(t), the attacker action parameter vector u A (t) and the defender's action parameter vector u D (t);

[0120] Sub-step 2.2, based on S(t) and u defined in sub-step 2.1 A (t),u D (t) Construct state evolution function:

[0121] f(S(t),u A (t),u D (t))=-αLS(t)+βu A (t)-γu D (t),

[0122] Get the dynamic equation

[0123]

[0124] in, is the instantaneous rate of change of the state vector with respect to time, f(·) is the state evolution function, α is the state diffusion coefficient, β is the attack gain coefficient, and γ is the defense damping coefficient;

[0125] In sub-step 2.3, the discrete evolution is calculated using the explicit Euler method based on the dynamic equations obtained in sub-step 2.2. The formula is as follows:

[0126] S(t+Δt)=S(t)+Δt·f(S(t),u A (t),u D (t)),

[0127] And output S(t+Δt) to step 3,

[0128] Where Δt is the discrete time step, S(t+Δt) is the state vector at the time after the discrete step;

[0129] Step 3: Use the state variables corresponding to the attack chain dynamic evolution equation and input them into the time fusion Transformer model to obtain the probability distribution of future attack action sequences;

[0130] Sub-step 3.1, perform time window interception on the state variable output in step 2, and extract the time window data from the continuous state variable S(t):

[0131] X(t)=[S(t-KΔt),S(t-(K-1)Δt),…,S(t)],

[0132] Where K is the time window length, Δt is the discrete time step, S(t-KΔt) is the state vector at time t-KΔt, and X(t) is the time window state matrix;

[0133] Sub-step 3.2, calculate the temporal association weight through the multi-head attention mechanism of the time fusion Transformer, multi-head attention weight calculation:

[0134]

[0135] Among them, Attention(Q,K,V) is the result of multi-head attention calculation, Q h is the h-th head query matrix, K h is the h-th head key matrix, V h is the h-th head value matrix, H is the number of attention heads, d h is a single-head hidden dimension, Q is the query matrix, K is the key matrix, and V is the value matrix;

[0136] Sub-step 3.3, generate the probability distribution of future attack action sequences, and output the action probability through the fully connected layer and Softmax:

[0137]

[0138] in, is the probability distribution of the attack action sequence in the future M time steps under the condition of given time window data X(t), M is the prediction step size, and MLP is a fully connected network;

[0139] Step 4: Adjust the defense strategy network parameters according to the probability distribution of future attack action sequences to generate a dynamic defense strategy;

[0140] Sub-step 4.1, calculate the advantage function of the defensive action based on the probability distribution of the attack action, and for each defensive action u d , calculate the advantage value relative to the attack action:

[0141]

[0142] Among them, A(u d ) is the advantage function of the defensive action, P(u a ) is the probability distribution of attack action, R d (u d ,u a ) is the defensive action u d Attack action u a The suppression benefit, Cost(u d ) is the resource consumption of the defense action, λ is the benefit-cost balance coefficient, U a Action set for defenders;

[0143] In sub-step 4.2, the meta-reinforcement learning framework is used to update the meta-parameters of the defense strategy network. The meta-objective function is the multi-task expected loss:

[0144]

[0145] Among them, L meta is the meta-loss function, For the task The loss function is is the meta-task, θ is the defense strategy network parameter, D meta is the meta-training task set, η inner is the inner loop learning rate, μ is the L2 regularization coefficient, is the gradient operator;

[0146] Sub-step 4.3, perform online policy network gradient update based on real-time attack data, online gradient descent update:

[0147]

[0148] Among them, π θ (u d ) is the defense action u output by the policy network d The probability of η outer is the outer loop learning rate, θ new is the updated defense strategy network parameter, θ is the original defense strategy network parameter;

[0149] Step 5: Based on the graph nodes and interaction edges, the streaming graph neural network calculates the dynamic associations between nodes and constructs the global threat propagation path in combination with the predefined rules of the security knowledge graph;

[0150] Sub-step 5.1, perform time-decay weighted aggregation on the streaming interaction edges, and perform exponential decay on the edge weights within the time window Δt:

[0151]

[0152] in, is the initial weight of the original interaction edge at time t0, is the initial weight of the original interaction edge at time t, and ρ is the time decay coefficient;

[0153] Sub-step 5.2, update the node embedding through the temporal graph attention network, the node embedding update equation is:

[0154]

[0155] in, is the embedding vector of node i at time t, is the embedding vector of node i at time t-1, is the embedding vector of node j at time t-1, W1 and is the trainable parameter matrix, r is the relationship type

[0156] Attention weight calculation:

[0157]

[0158] Among them, v r is the attention parameter vector of relation type r, is the attention weight between node i and node j under relationship type r, h i and h j is the embedding vector of node i and node j, W s and W d is the trainable parameter matrix;

[0159] Sub-step 5.3, based on the security knowledge graph rules, enhance the abnormal edge weights. If the node pair (vi ,v j ) satisfies the knowledge graph rule R and modifies the edge weight:

[0160] s ij ←s ij +δ·Confidence(R),

[0161] Among them, s ij is the original edge anomaly score, δ is the rule confidence enhancement coefficient,

[0162] Confidence(R) is the predefined confidence level of rule R;

[0163] Step 6: Generate a threat propagation probability distribution based on the global threat propagation path, select and execute a defense action based on the threat propagation probability distribution;

[0164] Sub-step 6.1, calculate the node threat propagation probability distribution based on the improved PageRank algorithm, and iteratively update the node threat value: s (k) =d·A T s (k-1) +(1-d)·b,

[0165] Among them, A is the global threat propagation path adjacency matrix, d is the damping factor, b is the node initial threat vector, s (k) is the threat probability distribution vector after the kth iteration, s (k-1) is the threat probability distribution vector after the k-1th iteration;

[0166] Sub-step 6.2: Construct a multi-objective optimization function to solve the Pareto optimal defense action, maximizing threat coverage and minimizing operation cost:

[0167]

[0168] Constraints: TimeLimit≤50ms,

[0169] Among them, s v is the threat propagation probability value of node v, Coverage(u d ) is the defensive action u d The set of nodes that can be effectively protected, α1 is the threat coverage weight, β1 is the operation cost penalty coefficient, δ1(·) is the indicator function, C max is the system resource budget threshold, Cost(u d ) is to execute the defensive action u d The system resource cost required, TimeLimit is the maximum allowable time for the defense action decision optimization process;

[0170] Sub-step 6.3: Execute defense actions and provide feedback to update the threat propagation model, verify defense effectiveness, and update the model:

[0171]

[0172] Among them, ∈ is the threat change threshold, if it exceeds, the defense action is considered invalid, s (t) is the threat distribution before the defense action is executed, s (t+1) The distribution of new threats during the post-execution monitoring cycle.

[0173] The benefit of step 1 is that through outlier cleaning and Z-Score standardization, the noise of the original data is effectively eliminated, ensuring the high quality of subsequent graph model input; the generation rules of nodes and interaction edges uniformly map multi-source heterogeneous information to the same graph, completely breaking down data silos. The relationship between any device, IP address, and user can be displayed in real time, laying a solid foundation for global situational awareness.

[0174] The benefit of step 2 is that the dynamic evolution equation constructed based on the Laplace matrix accurately quantifies the game process between the attacker and the defender, can capture nonlinear propagation characteristics, and provide real-time state change rate; after discretization using the explicit Euler method, the evolution process can be calculated online, enabling the system to "see and calculate" the evolution of potential attacks, greatly improving the scientific nature and explainability of the early warning.

[0175] The benefit of step 3 is that the temporal fusion Transformer can take into account both short-term pulse attacks and long-term latent behaviors, integrating temporal features of different granularities in multi-head attention to achieve high-precision probability distribution prediction of future attack actions; forward-looking prediction shortens response delays, allowing for early deployment of defense strategies.

[0176] Benefits of Step 4: With the help of the meta-reinforcement learning framework, the system can calculate the benefit-cost advantages of each defense action based on the prediction results within seconds. Through dual gradient updates of the outer and inner loops, it can achieve online fine-tuning of the policy network, reduce manual review steps, and can quickly adapt to new and zero-day threats, so that the defense strategy is always in the optimal state.

[0177] The benefits of step 5 are as follows: The streaming graph neural network performs time-attenuated weighting on the interaction edges, and combined with the predefined rule enhancements in the knowledge graph, accurately depicts the dynamic associations and abnormal signals between nodes; the global threat propagation path constructed based on this can reflect the spread of the attack chain in real time, rely on domain rules to suppress false alarms, and provide analysts with threat context.

[0178] The benefit of step 6 is that the node threat distribution calculated by the improved PageRank algorithm is combined with multi-objective optimization to solve the Pareto optimal defense action, achieving a dynamic balance between threat coverage and resource consumption. After the strategy is implemented, the system automatically monitors the defense effect and provides feedback to update the model, ensuring that each defense decision can be continuously iterated and optimized in the actual environment, forming a closed-loop adaptation.

[0179] Please see the attached Figure 2 , a network security management system based on a big data model, the network security management system includes:

[0180] A data collection module configured to access network traffic logs, endpoint behavior data, and threat intelligence in real time;

[0181] The attack chain analysis module is configured to perform differential game model calculations and time-fused Transformer predictions;

[0182] A defense strategy module, configured to run a meta-reinforcement learning framework to generate dynamic response strategies;

[0183] Graph computing engine, configured for streaming graph neural network reasoning and knowledge graph fusion;

[0184] An automated response module is configured to trigger blocking, isolation, and alerting actions based on the probability of threat propagation.

[0185] This system forms an end-to-end closed loop, from data collection to automated response, from perception to decision-making and execution. Each module has a clear division of labor and efficient collaboration. The combination of dynamic modeling and real-time prediction, along with adaptive strategies and automated response, improves the accuracy of threat identification and significantly shortens response time, providing a solid and reliable "big data + intelligence" foundation for network security defense.

[0186] A terminal device includes a processor and a memory. The memory stores a computer program. When the computer program is executed by the processor, a network security management method based on a big data model is implemented.

[0187] A storage medium stores a computer program, which, when executed by a processor, implements a network security management method based on a big data model.

[0188] Terminal devices embed the security management methods of big data models directly into an integrated hardware and software platform, allowing detection and defense logic to run locally, greatly reducing network transmission delays and the risk of dependence on central nodes; leveraging the parallel computing capabilities of local processors and memory, they can respond and execute dynamic defense strategies in real time, achieving instant interception of sudden attacks; at the same time, localized deployment reduces the exposure of external communication links and improves the overall system's anti-interference and security.

[0189] The storage medium encapsulates a complete security management program in a portable form, supports batch copying and online distribution, and facilitates rapid deployment on different terminals or virtual environments. Since the program and data are separated, the medium can realize self-service upgrades and version rollbacks, reducing operation and maintenance costs and improving system maintainability. In addition, the medium's built-in verification mechanism can ensure program integrity and effectively prevent tampering and virus implantation.

[0190] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A network security management method based on a big data model, characterized in that: include: Step 1: Convert multi-source heterogeneous data into graph nodes containing device entities, IP entities, user entities, and interaction edges containing timestamps and relationship types; Step 2: Construct an attack chain dynamic evolution equation based on graph nodes and interaction edges. The equation includes attacker action parameters and defender action parameters. Step 3: Use the state variables corresponding to the attack chain dynamic evolution equation and input them into the time fusion Transformer model to obtain the probability distribution of future attack action sequences; Step 4: Adjust the defense strategy network parameters according to the probability distribution of future attack action sequences to generate a dynamic defense strategy; Step 5: Based on the graph nodes and interaction edges, the streaming graph neural network calculates the dynamic associations between nodes and constructs the global threat propagation path in combination with the predefined rules of the security knowledge graph; Step 6: Generate a threat propagation probability distribution according to the global threat propagation path, select and execute a defense action based on the threat propagation probability distribution.

2. A network security management method based on a big data model according to claim 1, characterized in that: In step 1, converting multi-source heterogeneous data into graph nodes and interaction edges further includes: Sub-step 1.1: Clean and standardize the original data for outliers. The formula is defined as: For each data field f, calculate the Z-Score standardized value z f : The filter conditions are: Among them, z f is the value of the data field f after Z-Score standardization, x f is the value of the original data field f, μ f , σ f is the historical mean and standard deviation of field f, τ is the cleaning threshold; Sub-step 1.2: Generate graph nodes and interaction edges based on the cleaned data. The formula is defined as: Node generation rules: v i ={ID:Hash(d type ,d ID ),Type:d type ,Attrs:α i }, Edge generation rule: e ij ={src:v i .ID,dst:v j .ID,t:t event ,τ:r type }, Among them, v i is the generated graph node, ID is the unique identifier of the graph node, Hash is the hash function, d type is the entity type, d ID is the entity identifier in the original data, Type is the type label of the node, d type is the entity type field in the original data, Attrs is the attribute set of the node, α i is the node attribute vector, e ij is the interaction relationship between nodes, src and dst are the starting and ending points of the edge, v i .ID and v j .ID is node v i and v j The unique identifier of t is the event timestamp, t event is the event timestamp, r type is the relationship type, τ is the cleaning threshold; Sub-step 1.3, aggregate node and edge data through streaming time windows, the formula definition: Data aggregation within a sliding window: Among them, G (k) is the graph data set within the k-th time window, is the dynamic state of node i in time window t, is the number of nodes v in the time window t i To node v j The dynamic interaction edge, ΔT is the time length of the sliding window, k is the index number of the time window, and t is the event timestamp; Window output conditions: Among them, N min is the minimum event count threshold that triggers data processing, is the total number of events in the k-th time window.

3. A network security management method based on a big data model according to claim 1, characterized in that: In step 2, constructing the attack chain dynamic evolution equation based on the graph nodes and interaction edges generated in step 1 further includes: Sub-step 2.1, based on the graph nodes and interaction edges, calculate the adjacency matrix A and degree matrix D to obtain the Laplace matrix L = DA, define the attack chain state vector S(t), the attacker action parameter vector u A (t) and the defender's action parameter vector u D (t); Sub-step 2.2, based on S(t) and u defined in sub-step 2.1 A (t),u D (t) Construct state evolution function: f(S(t),u A (t),u D (t))=-αLS(t)+βu A (t)-γu D (t), Get the dynamic equation in, is the instantaneous rate of change of the state vector with respect to time, f(·) is the state evolution function, α is the state diffusion coefficient, β is the attack gain coefficient, and γ is the defense damping coefficient; In sub-step 2.3, the discrete evolution is calculated using the explicit Euler method based on the dynamic equations obtained in sub-step 2.

2. The formula is as follows: S(t+Δt)=S(t)+Δt·f(S(t),u A (t),u D (t)), And output S(t+Δt) to step 3, Among them, Δt is the discrete time step, and S(t+Δt) is the state vector at the time after the discrete step.

4. A network security management method based on a big data model according to claim 1, characterized in that: In step 3, the state variables corresponding to the attack chain dynamic evolution equation are input into the time-fused Transformer model to obtain the probability distribution of the future attack action sequence, which further includes: Sub-step 3.1, perform time window interception on the state variable output in step 2, and extract the time window data from the continuous state variable S(t): X(t)=[S(t-KΔt),S(t-(K-1)Δt),…,S(t)], Where K is the time window length, Δt is the discrete time step, S(t-KΔt) is the state vector at time t-KΔt, and X(t) is the time window state matrix; Sub-step 3.2, calculate the temporal association weight through the multi-head attention mechanism of the time fusion Transformer, multi-head attention weight calculation: Among them, Attention(Q,K,V) is the result of multi-head attention calculation, Q h is the h-th head query matrix, K h is the h-th head key matrix, V h is the h-th head value matrix, H is the number of attention heads, d h is a single-head hidden dimension, Q is the query matrix, K is the key matrix, and V is the value matrix; Sub-step 3.3, generate the probability distribution of future attack action sequences, and output the action probability through the fully connected layer and Softmax: in, is the probability distribution of the attack action sequence in the future M time steps under the condition of given time window data X(t), M is the prediction step size, and MLP is a fully connected network.

5. The network security management method based on big data model according to claim 1 is characterized in that: In step 4, adjusting the defense strategy network parameters according to the probability distribution of the future attack action sequence output in step 3 further includes: Sub-step 4.1, calculate the advantage function of the defensive action based on the probability distribution of the attack action, and for each defensive action u d , calculate the advantage value relative to the attack action: Among them, A(u d ) is the advantage function of the defensive action, P(u a ) is the probability distribution of attack action, R d (u d ,u a ) is the defensive action u d Attack action u a The suppression benefit, Cost(u d ) is the resource consumption of the defense action, λ is the benefit-cost balance coefficient, U a Action set for defenders; In sub-step 4.2, the meta-reinforcement learning framework is used to update the meta-parameters of the defense strategy network. The meta-objective function is the multi-task expected loss: Among them, L meta is the meta-loss function, For the task The loss function is is the meta-task, θ is the defense strategy network parameter, D meta is the meta-training task set, η inner is the inner loop learning rate, μ is the L2 regularization coefficient, is the gradient operator; Sub-step 4.3, perform online policy network gradient update based on real-time attack data, online gradient descent update: Among them, π θ (u d ) is the defense action u output by the policy network d The probability of η outer is the outer loop learning rate, θ new are the updated defense strategy network parameters, and θ are the original defense strategy network parameters.

6. A network security management method based on a big data model according to claim 1, characterized in that: In step 5, the dynamic association between the graph nodes and the interaction edges generated in step 1 is calculated through the streaming graph neural network, and the global threat propagation path is constructed in combination with the predefined rules of the security knowledge graph, further including: Sub-step 5.1, perform time-decay weighted aggregation on the streaming interaction edges, and perform exponential decay on the edge weights within the time window Δt: in, is the initial weight of the original interaction edge at time t0, is the initial weight of the original interaction edge at time t, and ρ is the time decay coefficient; Sub-step 5.2, update the node embedding through the temporal graph attention network, the node embedding update equation is: in, is the embedding vector of node i at time t, is the embedding vector of node i at time t-1, is the embedding vector of node j at time t-1, W1 and is the trainable parameter matrix, r is the relationship type Attention weight calculation: Among them, v r is the attention parameter vector of relation type r, is the attention weight between node i and node j under relationship type r, h i and h j is the embedding vector of node i and node j, W s and W d is the trainable parameter matrix; Sub-step 5.3, based on the security knowledge graph rules, enhance the abnormal edge weights. If the node pair (v i ,v j ) satisfies the knowledge graph rule R and modifies the edge weight: s ij ←s ij +δ·Confidence(R), Among them, s ij is the original edge anomaly score, δ is the rule confidence enhancement coefficient, Confidence(R) is the predefined confidence level of rule R.

7. The network security management method based on big data model according to claim 1 is characterized in that: In step 6, generating a threat propagation probability distribution based on the global threat propagation path constructed in step 5 and selecting a defense action further includes: Sub-step 6.1, calculate the node threat propagation probability distribution based on the improved PageRank algorithm, and iteratively update the node threat value: s (k) =d·A T s (k-1) +(1-d)·b, Among them, A is the global threat propagation path adjacency matrix, d is the damping factor, b is the node initial threat vector, s (k) is the threat probability distribution vector after the kth iteration, s (k-1) is the threat probability distribution vector after the k-1th iteration; Sub-step 6.2: Construct a multi-objective optimization function to solve the Pareto optimal defense action, maximizing threat coverage and minimizing operation cost: Constraints: TimeLimit≤50ms, Among them, s v is the threat propagation probability value of node v, Coverage(u d ) is the defensive action u d The set of nodes that can be effectively protected, α1 is the threat coverage weight, β1 is the operation cost penalty coefficient, δ1(·) is the indicator function, C max is the system resource budget threshold, Cost(u d ) is to execute the defensive action u d The system resource cost required, TimeLimit is the maximum allowable time for the defense action decision optimization process; Sub-step 6.3: Execute defense actions and provide feedback to update the threat propagation model, verify defense effectiveness, and update the model: Among them, ∈ is the threat change threshold, if it exceeds, the defense action is considered invalid, s (t) is the threat distribution before the defense action is executed, s (t+1) The distribution of new threats during the post-execution monitoring cycle.

8. A network security management system based on a big data model, according to the method according to any one of claims 1 to 7, characterized in that: The network security management system includes: A data collection module configured to access network traffic logs, endpoint behavior data, and threat intelligence in real time; The attack chain analysis module is configured to perform differential game model calculations and time-fused Transformer predictions; A defense strategy module, configured to run a meta-reinforcement learning framework to generate dynamic response strategies; Graph computing engine, configured for streaming graph neural network reasoning and knowledge graph fusion; An automated response module is configured to trigger blocking, isolation, and alerting actions based on the probability of threat propagation.

9. A terminal device, characterized in that: It includes a processor and a memory, the memory stores a computer program, and when the computer program is executed by the processor, it implements the network security management method based on the big data model as described in any one of claims 1 to 7.

10. A storage medium, characterized in that: A computer program is stored, and when the computer program is executed by a processor, it implements the network security management method based on a big data model as described in any one of claims 1 to 7.

Images