A network security management method and system based on big data models

Abstract

This invention relates to the field of network security technology and discloses a network security management method and system based on a big data model, comprising: Step 1, converting multi-source heterogeneous data into graph nodes containing device entities, IP entities, and user entities, as well as interaction edges containing timestamps and relationship types; Step 2, constructing a dynamic evolution equation for an attack chain based on the graph nodes and interaction edges, wherein the equation includes attacker action parameters and defender action parameters; Step 3, using the state variables corresponding to the dynamic evolution equation of the attack chain, inputting them into a time fusion Transformer model to obtain the probability distribution of future attack action sequences. This invention employs a technical solution based on a differential game model to construct a dynamic evolution equation for the attack chain, a time fusion Transformer to predict attack action sequences, and meta-reinforcement learning to dynamically update defense strategies, achieving the technical effects of accurately modeling attack evolution paths, predicting attack behavior in advance, and generating adaptive defense strategies in real time.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a network security management method and system based on a big data model. Background Technology

[0002] The widespread adoption of technologies such as cloud computing and the Internet of Things is constantly expanding network boundaries. Attack methods are constantly evolving, and single logs or rules cannot cover the overall situation. There is an urgent need for a network security management method and system based on big data models to uniformly model multi-source heterogeneous data, accurately depict the dynamic evolution of attack chains, and adjust defense strategies in real time to achieve end-to-end closed-loop response.

[0003] Existing technologies face significant shortcomings in addressing complex cybersecurity threats, primarily in their insufficient ability to identify and respond to dynamic attack chains, and their low efficiency in cross-domain data fusion and real-time modeling. First, existing solutions largely rely on static rules and single time-series models, failing to accurately capture the dynamic evolution of multi-stage attack chains and exhibiting predictive lag. Defense strategies are typically activated only after an attack occurs, leading to untimely responses. Second, their cross-domain data fusion and real-time modeling capabilities are very weak. Multi-source heterogeneous data often remains isolated, lacking an effective unified modeling approach. Data preprocessing is time-consuming, severely impacting the real-time performance of threat detection and the accuracy of decision-making. Furthermore, single graph models suffer from insufficient threat path modeling accuracy, high false positive rates, and a lack of automated feedback mechanisms with defense strategies, rendering the system ineffective in responding to new threats and dynamic changes.

[0004] To address these issues, this invention proposes a network security management method and system based on a big data model. Summary of the Invention

[0005] To address the shortcomings of existing technologies, this invention provides a network security management method and system based on a big data model, in order to solve the problems mentioned in the background.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a network security management method based on a big data model, comprising:

[0007] Step 1: Convert multi-source heterogeneous data into graph nodes containing device entities, IP entities, and user entities, as well as interaction edges containing timestamps and relationship types;

[0008] Step 2: Construct a dynamic evolution equation for the attack chain based on graph nodes and interaction edges. The equation includes attacker action parameters and defender action parameters.

[0009] Step 2, in which the dynamic evolution equation of the attack chain is constructed based on the graph nodes and interaction edges generated in step 1, further includes:

[0010] Sub-step 2.1: Calculate the adjacency matrix A and degree matrix D based on graph nodes and interaction edges to obtain the Laplacian matrix L = DA. Define the attack chain state vector S(t) and the attacker action parameter vector u. A (t) and the defender's motion parameter vector u D (t);

[0011] Sub-step 2.2, based on S(t) and u defined in sub-step 2.1 A (t), u D (t) Construct the state evolution function:

[0012] f(S(t),u A (t),u D (t))=-αLS(t)+βu A (t)-γu D (t),

[0013] The dynamic equations are obtained

[0014]

[0015] in, Let f(·) be the instantaneous rate of change of the state vector with respect to time, f(·) be the state evolution function, α be the state diffusion coefficient, β be the attack gain coefficient, and γ be the defense damping coefficient.

[0016] Sub-step 2.3: Based on the dynamic equations obtained in sub-step 2.2, the discrete evolution is calculated using the explicit Euler method, as shown in the following formula:

[0017] S(t+Δt)=S(t)+Δt·f(S(t),u A (t),u D (t)),

[0018] And output S(t+Δt) to step 3.

[0019] Where Δt is the discrete time step, and S(t+Δt) is the state vector at the time step after the discrete time step;

[0020] Step 3: Using the state variables corresponding to the dynamic evolution equation of the attack chain, input the time fusion Transformer model to obtain the probability distribution of future attack action sequences;

[0021] Step 4: Adjust the network parameters of the defense strategy according to the probability distribution of future attack action sequences to generate a dynamic defense strategy;

[0022] Step 5: Based on graph nodes and interaction edges, calculate the dynamic associations between nodes using a streaming graph neural network, and construct a global threat propagation path by combining the predefined rules of the security knowledge graph;

[0023] Step 6: Generate a threat propagation probability distribution based on the global threat propagation path, and select and execute defensive actions based on the threat propagation probability distribution.

[0024] Preferably, in step 1, converting multi-source heterogeneous data into graph nodes and interaction edges further includes:

[0025] Sub-step 1.1 involves cleaning and standardizing the original data for outliers. The formula is defined as follows:

[0026] For each data field f, calculate the Z-Score standardized value z. f :

[0027] The filtering conditions are: Discard the data entry.

[0028] Among them, z f The value of the data field f after Z-Score standardization, x f For the value of the original data field f, μ f σ f Let f be the historical mean and standard deviation of field f, and τ be the washing threshold.

[0029] Sub-step 1.2: Generate graph nodes and interaction edges based on the cleaned data. The formula is defined as follows:

[0030] Node generation rule: v i ={ID:Hash(d type ,d ID ),Type:d type Attrs:α i},

[0031] Edge generation rule: e ij ={src:v i .ID,dst:v j .ID,t:t event ,τ:r type},

[0032] Among them, v i For the generated graph nodes, ID is the unique identifier of the graph node, Hash is the hash function, and d type For entity type, d ID Here, α represents the entity identifier in the original data, Type represents the node's type label, Attrs represents the node's attribute set, and α represents the entity identifier in the original data. i e is a vector of node attributes ij This represents the interaction relationships between nodes, where src and dst are the start and end points of the edge, and v... i .ID and v j.ID is node v i and v j A unique identifier, where t is the event timestamp. event For event timestamps, r type The relation type is τ, and the cleaning threshold is τ.

[0033] Sub-step 1.3 aggregates node and edge data using a streaming time window, with the following formula defined:

[0034] Data aggregation within a sliding window:

[0035]

[0036] Among them, G (k) The set of graph data within the k-th time window. Let i be the dynamic state of node i within the time window t. To determine the time window t by node v i to node v j The dynamic interaction edge, where ΔT is the time length of the sliding window, k is the index number of the time window, and t is the event timestamp;

[0037] Window output conditions: Up to step 2,

[0038] Where, N min The minimum number of events required to trigger data processing. This represents the total number of events within the k-th time window.

[0039] Preferably, in step 3, obtaining the probability distribution of the future attack action sequence by inputting the state variables corresponding to the attack chain dynamic evolution equation into the time fusion Transformer model further includes:

[0040] Sub-step 3.1 involves extracting time window data from the continuous state variable S(t) by extracting the time window data from the output state variable S(t).

[0041] X(t)=[S(t-KΔt),S(t-(K-1)Δt),…,S(t)],

[0042] Where K is the time window length, Δt is the discrete time step, S(t-KΔt) is the state vector at time t-KΔt, and X(t) is the time window state matrix;

[0043] Sub-step 3.2: Calculate the temporal correlation weights using the multi-head attention mechanism of the temporal fusion Transformer. Multi-head attention weight calculation:

[0044]

[0045] Where Attention(Q,K,V) is the result of multi-head attention calculation, Q h Let K be the h-th head query matrix. h Let V be the h-th head key matrix. h Let H be the head value matrix for the h-th head, where H is the number of attention heads, and d is the number of heads. h For a single-head hidden dimension, Q is the query matrix, K is the key matrix, and V is the value matrix;

[0046] Sub-step 3.3 generates the probability distribution of future attack action sequences, outputting action probabilities through a fully connected layer and Softmax:

[0047]

[0048] in, Let M be the probability distribution of the attack action sequence in the future M time steps given the time window data X(t), where M is the prediction step size and MLP is a fully connected network.

[0049] Preferably, in step 4, adjusting the defense strategy network parameters based on the probability distribution of the future attack action sequence output in step 3 further includes:

[0050] Sub-step 4.1: Calculate the defensive action advantage function based on the attack action probability distribution, and apply this function to each defensive action u. d Calculate the advantage value relative to the attack action:

[0051]

[0052] Among them, A(u d P(u) is the defensive action advantage function. a Let R be the probability distribution of the attack actions. d (u d ,u a ) is a defensive action u d attack action u a Suppressed returns, Cost(u) d ) represents the resource consumption of defensive actions, λ represents the benefit-cost balance coefficient, and U a For the defender's action set;

[0053] Sub-step 4.2 updates the meta-parameters of the defense policy network using the meta-reinforcement learning framework, with the meta-objective function being the multi-task expected loss:

[0054]

[0055] Among them, L meta For the meta-loss function, For the task loss function, For the meta-task, θ represents the network parameters of the defense strategy, and D... meta For the meta-training task set, η inner The learning rate is denoted as μ, and the L2 regularization coefficient is denoted as μ. For gradient operators;

[0056] Sub-step 4.3: Perform online policy network gradient update and online gradient descent update based on real-time attack data.

[0057]

[0058] Where, π θ (u d ) outputs defensive actions to the policy network. d The probability, η outer Let θ be the learning rate for the outer loop. new Here are the updated defense strategy network parameters, and θ represents the original defense strategy network parameters.

[0059] Preferably, in step 5, the dynamic association between nodes is calculated using a streaming graph neural network based on the graph nodes and interaction edges generated in step 1, and the global threat propagation path is constructed in conjunction with predefined rules of the security knowledge graph, further including:

[0060] Sub-step 5.1 involves performing time-decay weighted aggregation on the streaming interaction edges, and exponentially decaying the edge weights within the time window Δt:

[0061]

[0062] in, Let be the initial weight of the original interaction edge at time t0. ρ represents the initial weight of the original interaction edge at time t, and ρ is the time decay coefficient.

[0063] Sub-step 5.2 updates the node embeddings using a time-graph attention network. The node embedding update equation is as follows:

[0064]

[0065] in, Let be the embedding vector of node i at time t. Let be the embedding vector of node i at time t-1. Let W1 be the embedding vector of node j at time t-1. Let r be a trainable parameter matrix, and r be a relation type.

[0066] Attention weight calculation:

[0067]

[0068] Among them, v r Let r be the attention parameter vector of relation type r. h represents the attention weight between node i and node j under relation type r. i and h j Let W be the embedding vectors of node i and node j. s and W d It is a trainable parameter matrix;

[0069] Sub-step 5.3: Enhance the weight of abnormal edges based on the rules of the security knowledge graph. If the node pair (v i ,v j To satisfy the knowledge graph rule R, adjust the edge weights:

[0070] s ij ←s ij +δ·Confidence(R),

[0071] Among them, s ij Here, δ represents the original edge anomaly score, and δ is the rule confidence enhancement coefficient.

[0072] Confidence(R) is the predefined confidence level of rule R.

[0073] Preferably, in step 6, generating a threat propagation probability distribution based on the global threat propagation path constructed in step 5 and selecting defensive actions further includes:

[0074] Sub-step 6.1: Calculate the node threat propagation probability distribution based on the improved PageRank algorithm, and iteratively update the node threat value: s (k) =d·A T s (k-1) +(1-d)·b,

[0075] Where A is the global threat propagation path adjacency matrix, d is the damping factor, b is the node initial threat vector, and s (k) Let s be the threat probability distribution vector after the k-th iteration. (k-1) This is the threat probability distribution vector after the (k-1)th iteration;

[0076] Sub-step 6.2 involves constructing a multi-objective optimization function to solve for the Pareto optimal defense action, maximizing threat coverage and minimizing operational costs.

[0077]

[0078] Constraint: TimeLimit ≤ 50ms

[0079] Among them, s v The threat propagation probability value for node v, Coverage(ud ) is a defensive action u d The set of nodes that can be effectively protected, α1 is the threat coverage weight, β1 is the operational cost penalty coefficient, δ1(·) is the indicator function, C max Cost(u) is the system resource budget threshold. d To execute defensive actions u d The required system resource cost; TimeLimit is the maximum allowable time for the defense action decision optimization process.

[0080] Sub-step 6.3: Execute defensive actions and update the threat propagation model, verify the defense effectiveness, and update the model.

[0081]

[0082] Where ∈ represents the threat change threshold; exceeding this threshold indicates that the defensive action has failed. (t) For threat distribution before defensive actions are executed, s (t+1) This refers to the distribution of new threats during the monitoring period following the execution of the measure.

[0083] A network security management system based on a big data model, the network security management system comprising:

[0084] The data acquisition module is configured to access network traffic logs, terminal behavior data, and threat intelligence in real time.

[0085] The attack chain analysis module is configured to perform differential game model calculations and time-fusion Transformer predictions.

[0086] The defense strategy module is configured to run a meta-reinforcement learning framework to generate dynamic response strategies.

[0087] The graph computing engine is configured for streaming graph neural network reasoning and knowledge graph fusion.

[0088] The automated response module is configured to trigger blocking, isolation, and alarm actions based on the probability of threat propagation.

[0089] A terminal device includes a processor and a memory, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements the network security management method based on a big data model.

[0090] A storage medium for storing a computer program, which, when executed by a processor, implements the network security management method based on a big data model.

[0091] This invention provides a network security management method and system based on a big data model. It has the following beneficial effects:

[0092] 1. This invention employs a technical solution based on a differential game model to construct a dynamic evolution equation for the attack chain, a time-fusion Transformer to predict attack action sequences, and meta-reinforcement learning to dynamically update defense strategies. This achieves the technical effects of accurately modeling attack evolution paths, predicting attack behavior in advance, and generating adaptive defense strategies in real time. Compared with existing technologies that rely on static rule bases or single time-series models to passively respond to attacks, this invention addresses the shortcomings of traditional methods, such as the inability to quantify the dynamics of attack and defense games, strong prediction lag, and the failure of defenses against novel attacks due to policy rigidity.

[0093] 2. This invention employs a technical solution of multi-source heterogeneous data graph node modeling, streaming graph neural network real-time correlation analysis, and security knowledge graph rule enhancement to achieve the technical effects of efficiently integrating cross-domain data, accurately constructing threat propagation paths, and quickly executing end-to-end defense responses. Compared with the technical solutions of existing technologies that use isolated data preprocessing or single graph model static modeling, this invention solves the shortcomings of traditional methods such as missing threat correlations due to data silos, static rules being unable to adapt to dynamic topologies, and excessively long response delays. Attached Figure Description

[0094] Figure 1 This is a flowchart of the present invention;

[0095] Figure 2 This is a system diagram of the present invention. Detailed Implementation

[0096] To enable those skilled in the art to understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are some, but not all, of the embodiments of the present invention. Other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort should fall within the scope of protection of the present invention.

[0097] The present invention will now be described in detail with reference to the accompanying drawings:

[0098] Example:

[0099] Please see the appendix Figure 1 This invention provides a network security management method based on a big data model, comprising:

[0100] Step 1: Convert multi-source heterogeneous data into graph nodes containing device entities, IP entities, and user entities, as well as interaction edges containing timestamps and relationship types;

[0101] Sub-step 1.1 involves cleaning and standardizing the original data for outliers. The formula is defined as follows:

[0102] For each data field f, calculate the Z-Score standardized value z. f :

[0103] The filtering conditions are:

[0104] Among them, z f The value of the data field f after Z-Score standardization, x f For the value of the original data field f, μ f σ f Let f be the historical mean and standard deviation of field f, and τ be the washing threshold.

[0105] Sub-step 1.2: Generate graph nodes and interaction edges based on the cleaned data. The formula is defined as follows:

[0106] Node generation rule: v i ={ID:Hash(d type ,d ID ),Type:d type Attrs:α i},

[0107] Edge generation rule: e ij ={src:v i .ID,dst:v j .ID,t:t event ,τ:r type},

[0108] Among them, v i For the generated graph nodes, ID is the unique identifier of the graph node, Hash is the hash function, and d type For entity type, d ID Here, α represents the entity identifier in the original data, Type represents the node's type label, Attrs represents the node's attribute set, and α represents the entity identifier in the original data. i e is a vector of node attributes ij This represents the interaction relationships between nodes, where src and dst are the start and end points of the edge, and v... i .ID and v j .ID is node v i and v j A unique identifier, where t is the event timestamp. event For event timestamps, r type The relation type is τ, and the cleaning threshold is τ.

[0109] Sub-step 1.3 aggregates node and edge data using a streaming time window, with the following formula defined:

[0110] Data aggregation within a sliding window:

[0111]

[0112] Among them, G (k) The set of graph data within the k-th time window. Let i be the dynamic state of node i within the time window t. To determine the time window t by node v i to node v j The dynamic interaction edge, where ΔT is the time length of the sliding window, k is the index number of the time window, and t is the event timestamp;

[0113] Window output conditions:

[0114] Where, N min The minimum number of events required to trigger data processing. The total number of events within the k-th time window;

[0115] Step 2: Construct a dynamic evolution equation for the attack chain based on graph nodes and interaction edges. The equation includes attacker action parameters and defender action parameters.

[0116] Sub-step 2.1: Calculate the adjacency matrix A and degree matrix D based on graph nodes and interaction edges to obtain the Laplacian matrix L = DA. Define the attack chain state vector S(t) and the attacker action parameter vector u. A (t) and the defender's motion parameter vector u D (t);

[0117] Sub-step 2.2, based on S(t) and u defined in sub-step 2.1 A (t), u D (t) Construct the state evolution function:

[0118] f(S(t),u A (t),u D (t))=-αLS(t)+βu A (t)-γu D (t),

[0119] The dynamic equations are obtained

[0120]

[0121] in, Let f(·) be the instantaneous rate of change of the state vector with respect to time, f(·) be the state evolution function, α be the state diffusion coefficient, β be the attack gain coefficient, and γ be the defense damping coefficient.

[0122] Sub-step 2.3: Based on the dynamic equations obtained in sub-step 2.2, the discrete evolution is calculated using the explicit Euler method, as shown in the following formula:

[0123] S(t+Δt)=S(t)+Δt·f(S(t),u A (t),u D (t)),

[0124] And output S(t+Δt) to step 3.

[0125] Where Δt is the discrete time step, and S(t+Δt) is the state vector at the time step after the discrete time step;

[0126] Step 3: Using the state variables corresponding to the dynamic evolution equation of the attack chain, input the time fusion Transformer model to obtain the probability distribution of future attack action sequences;

[0127] Sub-step 3.1 involves extracting time window data from the continuous state variable S(t) by extracting the time window data from the output state variable S(t).

[0128] X(t)=[S(t-KΔt),S(t-(K-1)Δt),…,S(t)],

[0129] Where K is the time window length, Δt is the discrete time step, S(t-KΔt) is the state vector at time t-KΔt, and X(t) is the time window state matrix;

[0130] Sub-step 3.2: Calculate the temporal correlation weights using the multi-head attention mechanism of the temporal fusion Transformer. Multi-head attention weight calculation:

[0131]

[0132] Where Attention(Q,K,V) is the result of multi-head attention calculation, Q h Let K be the h-th head query matrix. h Let V be the h-th head key matrix. h Let H be the head value matrix for the h-th head, where H is the number of attention heads, and d is the number of heads. h For a single-head hidden dimension, Q is the query matrix, K is the key matrix, and V is the value matrix;

[0133] Sub-step 3.3 generates the probability distribution of future attack action sequences, outputting action probabilities through a fully connected layer and Softmax:

[0134]

[0135] in, Let M be the probability distribution of the attack action sequence in the future M time steps given the data X(t) in the time window, where M is the prediction step size and MLP is a fully connected network.

[0136] Step 4: Adjust the network parameters of the defense strategy according to the probability distribution of future attack action sequences to generate a dynamic defense strategy;

[0137] Sub-step 4.1: Calculate the defensive action advantage function based on the attack action probability distribution, and apply this function to each defensive action u. d Calculate the advantage value relative to the attack action:

[0138]

[0139] Among them, A(u d P(u) is the defensive action advantage function. a Let R be the probability distribution of the attack actions. d (u d ,u a ) is a defensive action u d attack action u a Suppressed returns, Cost(u) d ) represents the resource consumption of defensive actions, λ represents the benefit-cost balance coefficient, and U a For the defender's action set;

[0140] Sub-step 4.2 updates the meta-parameters of the defense policy network using the meta-reinforcement learning framework, with the meta-objective function being the multi-task expected loss:

[0141]

[0142] Among them, L meta For the meta-loss function, For the task loss function, For the meta-task, θ represents the network parameters of the defense strategy, and D... meta For the meta-training task set, η inner The learning rate is denoted as μ, and the L2 regularization coefficient is denoted as μ. For gradient operators;

[0143] Sub-step 4.3: Perform online policy network gradient update and online gradient descent update based on real-time attack data.

[0144]

[0145] Where, π θ (u d ) outputs defensive actions to the policy network. d The probability, η outer Let θ be the learning rate for the outer loop. new Here are the updated defense strategy network parameters, and θ represents the original defense strategy network parameters.

[0146] Step 5: Based on graph nodes and interaction edges, calculate the dynamic associations between nodes using a streaming graph neural network, and construct a global threat propagation path by combining the predefined rules of the security knowledge graph;

[0147] Sub-step 5.1 involves performing time-decay weighted aggregation on the streaming interaction edges, and exponentially decaying the edge weights within the time window Δt:

[0148]

[0149] in, Let be the initial weight of the original interaction edge at time t0. ρ represents the initial weight of the original interaction edge at time t, and ρ is the time decay coefficient.

[0150] Sub-step 5.2 updates the node embeddings using a time-graph attention network. The node embedding update equation is as follows:

[0151]

[0152] in, Let be the embedding vector of node i at time t. Let be the embedding vector of node i at time t-1. Let W1 be the embedding vector of node j at time t-1. Let r be a trainable parameter matrix, and r be a relation type.

[0153] Attention weight calculation:

[0154]

[0155] Among them, v r Let r be the attention parameter vector of relation type r. h represents the attention weight between node i and node j under relation type r. i and h j Let W be the embedding vectors of node i and node j. s and W d It is a trainable parameter matrix;

[0156] Sub-step 5.3: Enhance the weight of abnormal edges based on the rules of the security knowledge graph. If the node pair (v i ,v j To satisfy the knowledge graph rule R, adjust the edge weights:

[0157] s ij ←s ij +δ·Confidence(R),

[0158] Among them, s ij Here, δ represents the original edge anomaly score, and δ is the rule confidence enhancement coefficient.

[0159] Confidence(R) is the predefined confidence level of rule R;

[0160] Step 6: Generate a threat propagation probability distribution based on the global threat propagation path, and select and execute defensive actions based on the threat propagation probability distribution;

[0161] Sub-step 6.1: Calculate the node threat propagation probability distribution based on the improved PageRank algorithm, and iteratively update the node threat value: s (k) =d·A T s (k-1) +(1-d)·b,

[0162] Where A is the global threat propagation path adjacency matrix, d is the damping factor, b is the node initial threat vector, and s (k) Let s be the threat probability distribution vector after the k-th iteration. (k-1) This is the threat probability distribution vector after the (k-1)th iteration;

[0163] Sub-step 6.2 involves constructing a multi-objective optimization function to solve for the Pareto optimal defense action, maximizing threat coverage and minimizing operational costs.

[0164]

[0165] Constraints:

[0166] Among them, s v The threat propagation probability value for node v, Coverage(u d ) is a defensive action u d The set of nodes that can be effectively protected, α1 is the threat coverage weight, β1 is the operational cost penalty coefficient, δ1(·) is the indicator function, C max Cost(u) is the system resource budget threshold. d To execute defensive actions u d The required system resource cost; TimeLimit is the maximum allowable time for the defense action decision optimization process.

[0167] Sub-step 6.3: Execute defensive actions and update the threat propagation model, verify the defense effectiveness, and update the model.

[0168]

[0169] Where ∈ represents the threat change threshold; exceeding this threshold indicates that the defensive action has failed. (t) For threat distribution before defensive actions are executed, s (t+1) This refers to the distribution of new threats during the monitoring period following the execution of the measure.

[0170] The benefits of step 1 are that by cleaning outliers and standardizing Z-Scores, noise in the original data is effectively removed, ensuring high quality for subsequent graph model inputs; the generation rules for nodes and interaction edges map multi-source heterogeneous information onto the same graph, completely breaking down data silos, and enabling real-time display of relationships between any device, IP, and user, laying a solid foundation for global situational awareness.

[0171] The benefits of step 2 are that the dynamic evolution equation constructed based on the Laplace matrix accurately quantifies the game process between the attacker and the defender, captures nonlinear propagation characteristics, and provides real-time state change rates; after explicit Euler discretization, the evolution process can be calculated online, enabling the system to "see and calculate" the evolution of potential attacks, greatly improving the scientific nature and interpretability of the early warning.

[0172] The benefits of step 3: The temporal fusion Transformer can simultaneously take into account both short-term pulse attacks and long-term latent behaviors, integrating temporal features of different granularities into multi-head attention to achieve high-precision probability distribution prediction of future attack actions; forward-looking prediction shortens response latency, allowing defense strategies to be deployed in advance.

[0173] The benefits of step 4 are that, with the help of the meta-reinforcement learning framework, the system can calculate the benefit-cost advantage of each defense action based on the prediction results within seconds. Through dual gradient updates of the outer and inner loops, the policy network can be fine-tuned online. This reduces the manual review process and can quickly adapt to new and zero-day threats, keeping the defense strategy in optimal condition at all times.

[0174] The benefit of step 5 is that the streaming graph neural network applies time-decay weighting to the interaction edges, and combines it with predefined rules in the knowledge graph to accurately characterize the dynamic relationships and abnormal signals between nodes; the global threat propagation path constructed based on this can reflect the spread of the attack chain in real time, suppress false alarms by relying on domain rules, and provide analysts with a threat context.

[0175] The benefits of step 6 are that by using the node threat distribution calculated by the improved PageRank algorithm and combining it with multi-objective optimization to solve the Pareto optimal defense action, a dynamic balance between threat coverage and resource consumption can be achieved. After the strategy is implemented, the system will automatically monitor the defense effect and update the model accordingly, ensuring that each defense decision can be continuously iterated and optimized in the actual environment, forming a closed-loop adaptive system.

[0176] Please see the appendix Figure 2 A network security management system based on a big data model, comprising:

[0177] The data acquisition module is configured to access network traffic logs, terminal behavior data, and threat intelligence in real time.

[0178] The attack chain analysis module is configured to perform differential game model calculations and time-fusion Transformer predictions.

[0179] The defense strategy module is configured to run a meta-reinforcement learning framework to generate dynamic response strategies.

[0180] The graph computing engine is configured for streaming graph neural network reasoning and knowledge graph fusion.

[0181] The automated response module is configured to trigger blocking, isolation, and alarm actions based on the probability of threat propagation.

[0182] This system forms an end-to-end closed loop from data acquisition to automatic response, encompassing perception, decision-making, and execution. Each module has a clear division of labor and collaborates efficiently. The combination of dynamic modeling and real-time prediction, along with the parallel implementation of adaptive strategies and automated responses, improves the accuracy of threat identification and significantly reduces response time, providing robust and reliable "big data + intelligence" support for network security defense.

[0183] A terminal device includes a processor and a memory, the memory storing a computer program, which, when executed by the processor, implements a network security management method based on a big data model.

[0184] A storage medium for storing computer programs, which, when executed by a processor, implement a network security management method based on a big data model.

[0185] Terminal devices directly embed the security management methods of big data models into an integrated hardware and software platform, enabling detection and defense logic to run locally, greatly reducing network transmission latency and the risk of relying on central nodes; with the computing power of local processors and memory, they can respond in real time and execute dynamic defense strategies, achieving instant interception of sudden attacks; at the same time, localized deployment reduces the exposure of external communication links, improving the overall system's anti-interference and security.

[0186] The storage medium encapsulates the complete security management program in a portable form, supporting batch copying and online distribution, facilitating rapid deployment in different terminals or virtual environments. Due to the separation of program and data, the medium can achieve self-service upgrades and version rollbacks, reducing operation and maintenance costs and improving system maintainability. In addition, the medium's built-in verification mechanism ensures program integrity and effectively prevents tampering and virus implantation.

[0187] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A network security management method based on a big data model, characterized in that, include: Step 1: Convert multi-source heterogeneous data into graph nodes containing device entities, IP entities, and user entities, as well as interaction edges containing timestamps and relationship types; Step 2: Construct a dynamic evolution equation for the attack chain based on graph nodes and interaction edges. The equation includes attacker action parameters and defender action parameters. Step 2, in which the dynamic evolution equation of the attack chain is constructed based on the graph nodes and interaction edges generated in step 1, further includes: Sub-step 2.1: Calculate the adjacency matrix A and degree matrix D based on graph nodes and interaction edges to obtain the Laplacian matrix L = DA. Define the attack chain state vector S(t) and the attacker action parameter vector u. A (t) and the defender's motion parameter vector u D (t); Sub-step 2.2, based on S(t) and u defined in sub-step 2.1 A (t), u D (t) Construct the state evolution function: f(S(t),u A (t),u D (t))=-αLS(t)+βu A (t)-γu D (t), The dynamic equations are obtained in, Let f(·) be the instantaneous rate of change of the state vector with respect to time, f(·) be the state evolution function, α be the state diffusion coefficient, β be the attack gain coefficient, and γ be the defense damping coefficient. Sub-step 2.3: Based on the dynamic equations obtained in sub-step 2.2, the discrete evolution is calculated using the explicit Euler method, as shown in the following formula: S(t+Δt)=S(t)+Δt·f(S(t),u A (t),u D (t)), And output S(t+Δt) to step 3. Where Δt is the discrete time step, and S(t+Δt) is the state vector at the time step after the discrete time step; Step 3: Using the state variables corresponding to the dynamic evolution equation of the attack chain, input the time fusion Transformer model to obtain the probability distribution of future attack action sequences; Step 4: Adjust the network parameters of the defense strategy according to the probability distribution of future attack action sequences to generate a dynamic defense strategy; Step 5: Based on graph nodes and interaction edges, calculate the dynamic associations between nodes using a streaming graph neural network, and construct a global threat propagation path by combining the predefined rules of the security knowledge graph; Step 6: Generate a threat propagation probability distribution based on the global threat propagation path, and select and execute defensive actions based on the threat propagation probability distribution.

2. The network security management method based on a big data model according to claim 1, characterized in that, In step 1, converting multi-source heterogeneous data into graph nodes and interaction edges further includes: Sub-step 1.1 involves cleaning and standardizing the original data for outliers. The formula is defined as follows: For each data field f, calculate the Z-Score standardized value z. f : The filtering conditions are: Discard the data entry. Among them, z f The value of the data field f after Z-Score standardization, x f For the value of the original data field f, μ f σ f Let f be the historical mean and standard deviation of field f, and τ be the washing threshold. Sub-step 1.2: Generate graph nodes and interaction edges based on the cleaned data. The formula is defined as follows: Node generation rule: v i ={ID:Hash(d type ,d ID ),Type:d type Attrs:α i }, Edge generation rule: e ij ={src:v i .ID,dst:v j .ID,t:t event ,τ:r type }, Among them, v i For the generated graph nodes, ID is the unique identifier of the graph node, Hash is the hash function, and d type For entity type, d ID Here, α represents the entity identifier in the original data, Type represents the node's type label, Attrs represents the node's attribute set, and α represents the entity identifier in the original data. i e is a vector of node attributes ij This represents the interaction relationships between nodes, where src and dst are the start and end points of the edge, and v... i .ID and v j .ID is node v i and v j A unique identifier, where t is the event timestamp. event For event timestamps, r type The relation type is τ, and the cleaning threshold is τ. Sub-step 1.3 aggregates node and edge data using a streaming time window, with the following formula defined: Data aggregation within a sliding window: Among them, G (k) The set of graph data within the k-th time window. Let i be the dynamic state of node i within the time window t. To determine the time window t by node v i to node v j The dynamic interaction edge, where ΔT is the time length of the sliding window, k is the index number of the time window, and t is the event timestamp; Window output conditions: Send G (k) Up to step 2, Where, N min The minimum number of events required to trigger data processing. This represents the total number of events within the k-th time window.

3. The network security management method based on a big data model according to claim 1, characterized in that, Step 3, which uses the state variables corresponding to the dynamic evolution equation of the attack chain as input to the time fusion Transformer model to obtain the probability distribution of the future attack action sequence, further includes: Sub-step 3.1 involves extracting time window data from the continuous state variable S(t) by truncating the state variable output in step 2. X(t)=[S(t-KΔt),S(t-(K-1)Δt),…,S(t)], Where K is the time window length, Δt is the discrete time step, S(t-KΔt) is the state vector at time t-KΔt, and X(t) is the time window state matrix; Sub-step 3.2 calculates the temporal correlation weights using the multi-head attention mechanism of the temporal fusion Transformer. The multi-head attention weight calculation is as follows: Where Attention(Q,K,V) is the result of multi-head attention calculation, Q h Let K be the h-th head query matrix. h Let V be the h-th head key matrix. h Let H be the head value matrix for the h-th head, where H is the number of attention heads, and d is the number of heads. h For a single-head hidden dimension, Q is the query matrix, K is the key matrix, and V is the value matrix; Sub-step 3.3 generates the probability distribution of future attack action sequences, outputting action probabilities through a fully connected layer and Softmax: in, Let M be the probability distribution of the attack action sequence in the future M time steps given the time window data X(t), where M is the prediction step size and MLP is a fully connected network.

4. The network security management method based on a big data model according to claim 1, characterized in that, In step 4, adjusting the defense strategy network parameters based on the probability distribution of the future attack action sequence output in step 3 further includes: Sub-step 4.1: Calculate the defensive action advantage function based on the attack action probability distribution, and apply this function to each defensive action u. d Calculate the advantage value relative to the attack action: Among them, A(u d P(u) is the defensive action advantage function. a Let R be the probability distribution of the attack actions. d (u d ,u a ) is a defensive action u d attack action u a Suppressed returns, Cost(u) d ) represents the resource consumption of defensive actions, λ represents the benefit-cost balance coefficient, and U a For the defender's action set; Sub-step 4.2 updates the meta-parameters of the defense policy network using the meta-reinforcement learning framework, with the meta-objective function being the multi-task expected loss: Among them, L meta For the meta-loss function, For the task loss function, For the meta-task, θ represents the network parameters of the defense strategy, and D... meta For the meta-training task set, η inner The learning rate is denoted as μ, and the L2 regularization coefficient is denoted as μ. For gradient operators; Sub-step 4.3: Perform online policy network gradient update and online gradient descent update based on real-time attack data. Where, π θ (u d ) outputs defensive actions to the policy network. d The probability, η outer Let θ be the learning rate for the outer loop. new Here are the updated defense strategy network parameters, and θ represents the original defense strategy network parameters.

5. The network security management method based on a big data model according to claim 1, characterized in that, In step 5, the dynamic relationships between the graph nodes and interaction edges generated in step 1 are calculated using a streaming graph neural network, and the global threat propagation path is constructed by combining predefined rules of the security knowledge graph. This further includes: Sub-step 5.1 involves performing time-decay weighted aggregation on the streaming interaction edges, and exponentially decaying the edge weights within the time window Δt: in, Let be the initial weight of the original interaction edge at time t0. ρ represents the initial weight of the original interaction edge at time t, and ρ is the time decay coefficient. Sub-step 5.2 updates the node embeddings using a time-graph attention network. The node embedding update equation is as follows: in, Let be the embedding vector of node i at time t. Let be the embedding vector of node i at time t-1. Let W1 be the embedding vector of node j at time t-1. Let r be a trainable parameter matrix, and r be a relation type. Attention weight calculation: Among them, v r Let r be the attention parameter vector of relation type r. h represents the attention weight between node i and node j under relation type r. i and h j Let W be the embedding vectors of node i and node j. s and W d It is a trainable parameter matrix; Sub-step 5.3: Enhance the weight of abnormal edges based on the rules of the security knowledge graph. If the node pair (v i ,v j To satisfy the knowledge graph rule R, adjust the edge weights: s ij ←s ij +δ·Confidence(R), Among them, s ij Here, δ represents the original edge anomaly score, and δ is the rule confidence enhancement coefficient. Confidence(R) is the predefined confidence level of rule R.

6. The network security management method based on a big data model according to claim 1, characterized in that, In step 6, generating a threat propagation probability distribution based on the global threat propagation path constructed in step 5 and selecting defensive actions further includes: Sub-step 6.1: Calculate the node threat propagation probability distribution based on the improved PageRank algorithm, and iteratively update the node threat value: s (k) =d·A T s (k-1) +(1-d)·b, Where A is the global threat propagation path adjacency matrix, d is the damping factor, b is the node initial threat vector, and s (k) Let s be the threat probability distribution vector after the k-th iteration. (k-1) This is the threat probability distribution vector after the (k-1)th iteration; Sub-step 6.2 involves constructing a multi-objective optimization function to solve for the Pareto optimal defense action, maximizing threat coverage and minimizing operational costs. Constraint: TimeLimit ≤ 50ms Among them, s v The threat propagation probability value for node v, Coverage(u d ) is a defensive action u d The set of nodes that can be effectively protected, α1 is the threat coverage weight, β1 is the operational cost penalty coefficient, δ1(·) is the indicator function, C max Cost(u) is the system resource budget threshold. d To execute defensive actions u d The required system resource cost; TimeLimit is the maximum allowable time for the defense action decision optimization process. Sub-step 6.3: Execute defensive actions and update the threat propagation model, verify the defense effectiveness, and update the model. Triggering the recomputation of the streaming graph neural network in step 5, Where ∈ represents the threat change threshold; exceeding this threshold indicates that the defensive action has failed. (t) For threat distribution before defensive actions are executed, s (t+1) This refers to the distribution of new threats during the monitoring period following the execution of the measure.

7. A network security management system based on a big data model, comprising the method according to any one of claims 1-6, characterized in that, The network security management system includes: The data acquisition module is configured to access network traffic logs, terminal behavior data, and threat intelligence in real time. The attack chain analysis module is configured to perform differential game model calculations and time-fusion Transformer predictions. The defense strategy module is configured to run a meta-reinforcement learning framework to generate dynamic response strategies. The graph computing engine is configured for streaming graph neural network reasoning and knowledge graph fusion. The automated response module is configured to trigger blocking, isolation, and alarm actions based on the probability of threat propagation.

8. A terminal device, characterized in that, It includes a processor and a memory, wherein the memory stores a computer program, and when the computer program is executed by the processor, it implements the network security management method based on a big data model as described in any one of claims 1-6.

9. A storage medium, characterized in that, The computer program is stored, and when executed by a processor, the computer program implements the network security management method based on a big data model as described in any one of claims 1-6.

Images