Information security analysis method and system based on big data

Abstract

The invention relates to the technical field of information security data processing, and discloses an information security analysis method and system based on big data, and the method comprises the steps: S1, collecting multi-source heterogeneous security related data which comprises a business log, a user behavior track, network traffic, an application program interface calling record, an identity authentication log and a real-time security data flow, preprocessing the collected data to obtain standardized data; and S2, performing entity identification, event extraction and relationship mining based on the standardized data, and constructing a cross-modal threat knowledge graph containing security entity nodes and associated edges. The method solves the problem of monitoring blind areas caused by lack of dynamic association mining capability among data in a traditional method, and particularly aims at distributed, low-frequency and multi-stage hidden attacks, the scheme can accurately recover an attack chain and identify high-risk threats through dynamic matching and path reasoning of a knowledge graph, and the method has a good application prospect. And the detection coverage rate and accuracy in a complex attack scene are remarkably improved.

Description

Technical Field

[0001] The present invention relates to the field of information security data processing technology, and specifically to an information security analysis method and system based on big data. Background Art

[0002] The importance of information security cannot be underestimated. Protecting data from unauthorized access and potential threats is a top priority for any organization. In today's digital and internet-connected world, information security is about robust protection of technical systems, respect for privacy and business confidentiality, and compliance with personal data protection laws.

[0003] For example, the Chinese invention application with publication number CN118862033B discloses an information security analysis method and system based on big data. Compared with the existing technology, the present invention uses user input information big data to train the input interval prediction neural network, uses the input interval prediction neural network to determine the interval time vector that the character string should have, and uses the interval time vector to verify the user, so that the method has accuracy and universality based on big data.

[0004] For example, the Chinese invention application with publication number CN118944971A discloses a network information security analysis and management system, which relates to the field of network security technology, including: an event sorting module is used to sort network security events, confirm the security threats obtained by the threat acquisition module, and determine whether they are real security events; when it is confirmed that a network device has encountered a network security event, the security event message of the network device is recorded.

[0005] The shortcomings of the above patents are:

[0006] On the one hand, information security analysis systems typically rely on fixed rules or static models to process security data. This approach can only analyze single data sources or independent events, and is unable to integrate data from multiple business systems or different sources for coordinated judgment. This is especially true when facing covert attacks using distributed deployments, low-frequency operations, and multi-stage latent tactics. Traditional systems, lacking the ability to dynamically mine relationships between data, often fail to construct a complete attack path. This results in some high-risk threats remaining undetected, creating serious monitoring blind spots.

[0007] On the other hand, while some existing technologies can identify complex threat patterns, their response still relies primarily on manual analysis and periodic policy updates, lacking the ability to automatically adjust defense strategies based on real-time security detection results. This approach is unable to adapt to the rapidly evolving nature of current attack methods, leading to delayed updates to defense strategies and the inability to establish a rapid and effective coordinated response mechanism, which in turn impacts the system's real-time protection capabilities and security operational efficiency.

[0008] To this end, the present invention proposes an information security analysis method and system based on big data to solve the above-mentioned problems. Summary of the Invention

[0009] In view of the deficiencies of the existing technology, the present invention provides an information security analysis method and system based on big data to solve the problems raised in the above background technology.

[0010] To achieve the above objectives, the present invention is implemented through the following technical solutions: a method for information security analysis based on big data, comprising:

[0011] S1, collects multi-source heterogeneous security-related data, including business logs, user behavior trajectories, network traffic, application interface call records, identity authentication logs, and real-time security data streams, and pre-processes the collected data to obtain standardized data;

[0012] S2, performing entity recognition, event extraction, and relationship mining based on the standardized data to construct a cross-modal threat knowledge graph containing security entity nodes and associated edges;

[0013] S3, updating the nodes and edges in the cross-modal threat knowledge graph according to the real-time security data stream to form a dynamically evolving knowledge graph;

[0014] S4, inputting the real-time security data stream into the dynamically evolving knowledge graph for dynamic matching, and identifying the threat evolution path through graph path traversal;

[0015] S5, generating a defense strategy based on the threat evolution path, wherein the defense strategy includes an access control adjustment strategy, a traffic isolation strategy, and an authentication mechanism adjustment strategy;

[0016] S6, sending the defense policy to the defense device to perform access control adjustment, traffic isolation and authentication mechanism adjustment;

[0017] S7: Adjust the entity extraction method and reinforcement learning reward mechanism of the cross-modal threat knowledge graph according to the execution results of the defense device to form system optimization parameters.

[0018] Preferably, the preprocessing of multi-source heterogeneous data in S1 includes data cleaning, format standardization and time alignment operations;

[0019] The defense devices in S6 include firewalls, network access control devices, application gateways and intrusion detection systems, and the policies are issued and executed through interfaces.

[0020] Preferably, in S1, collecting multi-source heterogeneous security-related data and preprocessing it further includes:

[0021] S1.1, collects raw data from business logs, user behavior trajectories, network traffic, application interface call records, identity authentication logs, and real-time security data streams, and synchronizes the timestamps of all data items to build a unified timeline;

[0022] For the original data source D i Perform time standardization and calculate the standardized timestamp T′ i :

[0023] T i ′=T i +Δt i ,

[0024] Among them, T i is the timestamp of the original record in the i-th data source, Δt i is the time offset between the i-th type data source and the master clock, T i ' is the timestamp after standardization;

[0025] If |Δt i |>θ t , where θ t If the maximum allowable deviation threshold is set, the data source record is recorded as a time anomaly record, marked as data to be verified, and does not enter the subsequent processing flow;

[0026] S1.2: Convert all types of raw data after timestamp alignment in S1.1 into a unified structured format, extract core fields, and normalize semantic labels;

[0027] Let the structured record in the i-th data source be R i :

[0028] R i ={src i ,dst i ,act i ,T i ′},

[0029] Among them, src i The source of the data record, dst i For the target subject, act i is the behavior type, T i ' is the timestamp after standardization;

[0030] For field act i Perform normalized mapping, let the original behavior semantic set be A, the normalized behavior label set be A′, and there exists a mapping function f a :A→A′,

[0031] When a behavior type And the similarity sim(a,a′ k )<θ s , where a′ k ∈A′, the behavior is classified as unknown behavior and marked;

[0032] S1.3, based on structured record R i Construct behavioral feature vectors and use density clustering methods to identify abnormal or low-frequency behavior patterns, eliminating data records that may interfere with analysis;

[0033] Construct a feature vector for each record:

[0034] x i =Embed(src i ,dst i ,act i ,T i ′),

[0035] Among them, Embed(·) is the multimodal semantic vector mapping function, x i is the behavioral feature vector of the i-th structured data;

[0036] A clustering algorithm based on local reachable density is used for anomaly identification, and the local anomaly factor is defined as follows:

[0037]

[0038] Among them, N k (x j ) is the eigenvector x j k-neighborhood, lrd(·) is the local reachability density, LOF(x j ) is the abnormality degree of the jth data record in the local neighborhood, x k is the eigenvector x j Neighborhood samples, x j is the behavioral feature vector of the jth structured data record;

[0039] When LOF(x j )>θ lof When , it is marked as abnormal data and removed, and the final standardized data set is generated after removal:

[0040] D std ={x j ∣LOF(x j )≤θ lof},

[0041] Among them, D std is the standardized data set, θ lof is the local anomaly factor determination threshold.

[0042] Preferably, in S2, constructing a cross-modal threat knowledge graph based on standardized data further includes:

[0043] S2.1, performing named entity recognition on each record in the standardized data, extracting and classifying security entities, and generating an initial entity list;

[0044] An entity recognition model based on bidirectional long short-term memory network and conditional random field is used to define the entity recognition probability:

[0045]

[0046] Where P(y|x) is the conditional probability of outputting entity tag sequence y given input sequence x, x is the character embedding vector of the input sequence, h t is the hidden state of the output at time step t, W lstm is the LSTM layer weight matrix, b crf is the CFR layer bias term, y is the predicted entity label sequence, h′ t is the hidden state vector of the tth time step after processing by the bidirectional long short-term memory network;

[0047] If entity confidence conf(e)=max(P(y|x))≤θ c , where θ c is the entity confidence threshold, add the entity to the entity list E = {e1, e2, ..., e n}, otherwise it is marked as an entity to be verified;

[0048] S2.2, based on the entity list in S2.1, extract security events and establish association relationships between entities to generate a set of relationship triples;

[0049] Use graph attention network to calculate the relationship weights between entities:

[0050]

[0051] Among them, e i 、e j is the embedding vector of entity i and j, W is the trainable weight matrix, a is the attention mechanism parameter vector, α ij is the relationship weight between entities i and j, k∈N(i) is the node k in the neighbor node set N(i) of entity i, LeakyReLU(·) is the linear rectification activation function, e k is the embedding vector of entity k;

[0052] If α ij ≥θ r , where θ r is the relationship weight threshold, and the relationship triple r is establishedij =(e i ,rel ij ,e j ), add the relation set R = {r 11 ,r 12 ,...,r mn};

[0053] S2.3, based on the entity list E and the relationship set R, construct the initial threat knowledge graph and verify the graph structure consistency through subgraph isomorphism detection;

[0054] Define the subgraph similarity calculation function:

[0055]

[0056] Among them, G s is the subgraph currently constructed, G t is the historical threat pattern subgraph template, match(v,V t ) is the semantic matching degree between node v and template node set, match(e,E t ) is the semantic matching degree between edge e and template edge set, sim(G s ,G t ) is the subgraph G s and the historical threat pattern template subgraph G t The similarity of V s For subgraph G s The node set, E s For subgraph G s The edge set of

[0057] v∈V s For subgraph G s The node set V s Node V in s , e∈E s For subgraph G s The edge set E s The edge e in

[0058] If sim(G s ,G t )≥θ g ,θ g is the subgraph similarity determination threshold, and G s The subgraph is merged into the knowledge graph; otherwise, it is marked as a new subgraph and stored independently, triggering the manual review process.

[0059] Preferably, in S3, updating the cross-modal threat knowledge graph according to the real-time security data stream further includes:

[0060] S3.1, performing sliding window event detection on the real-time security data stream, extracting newly added entities, events, and relationships, and generating an incremental update dataset;

[0061] Adopt the event similarity detection algorithm based on time window and define the data similarity within the window:

[0062]

[0063] Among them, sim(D t ,D t-Δt ) is, D t is the real-time data in the current time window, D t-Δt For, v t is the characteristic vector of the data in the current window, Δt is the sliding window time interval, v t-Δt for;

[0064] If sim(D t ,D t-Δt )<θ e , where θ e is the event difference threshold, marked as the newly added event set E new ={e′1,e′2,…,e′ k};

[0065] S3.2, incremental event set E based on S3.1 new , update the nodes and edges in the knowledge graph, and calculate the node embedding vectors and edge weights;

[0066] For the newly added entity e′ i ∈E new , using the graph embedding update algorithm:

[0067]

[0068] in, For node e′ i The embedding vector at layer l+1, For node e′ i The embedding vector at layer l, For node e j The embedding vector at layer l, j∈N(i) is the node e′ i The set of neighbor nodes, α ij For node e′ i With e j The attention weight, σ is the activation function, W (l) is the trainable weight matrix of layer l in the graph neural network;

[0069] Add edge r′ ij =(e′ i,rel′ ij ,e′ j ) Among them, θ w is the edge weight threshold, adding the edge to the graph;

[0070] S3.3, verify the structural consistency of the updated knowledge graph and eliminate redundant or conflicting nodes and edges;

[0071] Define the subgraph conflict detection function:

[0072]

[0073] Among them, G′ is the updated knowledge graph, R′ is the set of newly added or updated edges, and h i 、h j is the embedding vector of node i and node j in layer l, w ij is the weight of edge (i, j);

[0074] If Conflict(G′)>θ c , where θ c is the conflict threshold, triggering the conflict resolution strategy.

[0075] Preferably, in S4, the step of inputting the real-time security data stream into the dynamically evolving knowledge graph for dynamic matching further includes:

[0076] S4.1, based on the event feature vectors in the real-time security data stream, similarity calculation is performed with the knowledge graph node embedding to filter the matching node set;

[0077] Define the real-time event feature vector x t With graph node embedding h i Cosine similarity of:

[0078]

[0079] Among them, sim(x t ,h i ) is the real-time event feature vector x t and knowledge graph node embedding h i The cosine similarity of x t is the feature vector of the real-time event, h i is the node e in the knowledge graph i Embedding vector of

[0080] If sim(x t ,h i )≥θ m , where θ m is the matching threshold, marking node e iFor matching nodes, generate matching node set M = {e1, e2, ..., e k};

[0081] S4.2, starting from the matching node set M, traverse the paths along the knowledge graph edge, calculate the path weights and screen potential threat paths;

[0082] Defining Paths The cumulative weight of:

[0083]

[0084] Where W(P) is the cumulative weight of path P, n is the number of nodes in path P, For the edge The weight of , γ is the path attenuation factor;

[0085] If W(P)≥θ p , where θ p is the path weight threshold, and the retained paths are the candidate threat path set P cand ;

[0086] S4.3, for the candidate path set P cand Perform pattern matching and threat scoring to identify high-risk threat evolution paths;

[0087] Define the threat score function:

[0088]

[0089] Where risk(e) is the historical risk level of node e, threat(r) is the threat correlation strength of edge r, α and β are the weight coefficients of node risk and edge threat, and P is the path in the knowledge graph;

[0090] If Score(P)≥θ s , where θ s is the threat score threshold, P is determined to be the threat evolution path, and is added to the final result set P threat .

[0091] Preferably, in S5, generating a defense strategy according to the threat evolution path further includes:

[0092] S5.1, Evolution path of identified threats P threat Extract path features and determine the type of defense strategy required;

[0093] Define the path eigenvector:

[0094]

[0095] Among them, f pis the path feature vector, Score(P) is the path threat score, len(P) is the path length, risk(e) is the node risk level, and P is the path in the knowledge graph;

[0096] Determine the defense type based on the feature vector:

[0097]

[0098] Among them, θ a ,θ r ,θ l ,θ b is the judgment threshold, which is trained based on historical attack patterns;

[0099] S5.2, generate specific policy parameters based on the defense type to ensure that the policy matches the threat path characteristics;

[0100] Access control adjusts policy parameters and generates permission attenuation coefficients based on the risk level of the target node in the path:

[0101]

[0102] Among them, α perm is the authority attenuation coefficient, risk max The maximum risk level preset for the system;

[0103] Final permission level: Perm new =α perm Perm orig , among which, Perm new is the new permission level, α perm is the authority attenuation coefficient, Perm orig is the original permission level;

[0104] Traffic isolation policy parameters generate traffic feature rules based on the path source and destination nodes:

[0105] R isolate ={src ip ∈S p ,dst ip ∈D p ,proto=TCP},

[0106] Among them, R isolate is the traffic characteristic rule, S p and D p is the IP set of the source node and the target node in the path p, src ip is the source IP address, dst ip is the target IP address, TCP is the transmission control protocol;

[0107] Authentication adjustment policy parameters generate authentication strength coefficients based on path behavior frequency:

[0108]

[0109] Among them, β auth is the authentication strength coefficient, freq(P) is the triggering frequency of path association events per unit time, θ f is the frequency threshold;

[0110] The authentication interval is adjusted to: T auth =T base / β auth ,

[0111] Among them, T auth is the authentication interval, T base For basic certification intervals;

[0112] S5.3, perform conflict detection on the generated defense strategies and assign execution priorities according to threat levels;

[0113] Define the policy conflict detection function:

[0114]

[0115] For the conflicting strategy set S conflict , assign priorities by path score:

[0116] Priority(s i )=Score(P i )·w p +len(P i )·w l ,

[0117] Among them, Priority(s i ) is the strategy priority, Score(P i ) is the path threat score, len(P i ) is the path length, w p 、w l is the weight coefficient of score and path length.

[0118] Preferably, in S6, sending the defense strategy to the defense device for execution further includes:

[0119] S6.1, converting the generated defense policy parameters into configuration instructions executable by the defense device to generate a device instruction set;

[0120] Define the mapping function from policy parameters to device instructions:

[0121] C k =fmap (s k ,D j ),

[0122] Among them, s k is the kth defense strategy parameter, D j is the target defense device type, f map is the instruction mapping rule, C k Configure instructions for the generated device;

[0123] If the policy parameter s k Contains dynamic adjustment coefficients, and the command must include normalization parameters:

[0124] c param =clip(s k ,param,0,1),

[0125] Among them, c param is the normalized strategy parameter, clip is the parameter truncation function, and param is the original strategy parameter;

[0126] S6.2, calculate the instruction issuance priority and control the execution amount based on the current load status of the defense device;

[0127] Define device D j Load evaluation function:

[0128]

[0129] Among them, L j For defense equipment D j Comprehensive load evaluation index, Q j For device D j The length of the pending instruction queue, Q max is the maximum queue capacity of the device, T proc is the average single instruction processing time of the device, T base is the benchmark processing time, λ is the weight coefficient;

[0130] If L j <θ L , where θ L is the load threshold, and the instruction C k Send to D j ;

[0131] Otherwise, C k Add to the buffer queue, according to the priority Priority (C k )=Score(P k ) waiting to be issued, among which, Priority (C k ) is the instruction issuing priority, Score(Pk ) score the threat path;

[0132] S6.3, Detection of Defense Devices Against Instruction C k The execution result verifies the effectiveness of the strategy and generates a feedback signal;

[0133] Define execution result verification indicators:

[0134]

[0135] Among them, SuccessRate(C k ) is the strategy execution success rate, I(·) is the indicator function, and T is the length of the verification time window;

[0136] When the device state t Meet the target state S target Take 1 when it is, otherwise take 0;

[0137] If SuccessRate(C k )≥θ s , where θ s The execution success rate threshold is marked as successful; otherwise, the instruction resend or manual intervention process is triggered.

[0138] Preferably, in S7, adjusting the knowledge graph construction and reinforcement learning mechanism according to the execution result of the defense device further includes:

[0139] S7.1, based on the verification data of the execution results of S6, calculate the actual effect indicators of the defense strategy and generate feedback signals;

[0140] Define the comprehensive rating of defense effect:

[0141] Effect=ω1·Success+ω2·(1-FalsePositive)+ω3·Response,

[0142] Among them, Success is the strategy execution success rate, FalsePositive is the false blocking rate, ω1, ω2, ω3 are weight coefficients, T exec is the time taken to execute the strategy, T max is the maximum allowed time;

[0143] If Effect<θ e , where θ e is the effect threshold, generating a negative feedback signal F=-1; otherwise, generating a positive feedback signal F=1;

[0144] S7.2, adjust the entity recognition and relationship mining parameters in S2 according to the feedback signal F, and optimize the knowledge graph construction logic;

[0145] Define the entity recognition model parameter update rules:

[0146]

[0147] in, is the parameter set of the entity recognition model at the t+1th iteration, is the parameter set of the entity recognition model at the tth iteration, η is the learning rate, Precision (θ) is the accuracy of entity recognition, and gradient Calculated through historical data;

[0148] If N consecutive negative feedbacks trigger the entity tag library expansion process, a new E new Class Entity;

[0149] S7.3, based on the feedback signal F, adjust the reward function of the reinforcement learning model in S5 to optimize the strategy generation logic;

[0150] Define the reward function update formula:

[0151] R new (s,a)=R(s,a)+γ·F·Impact(a),

[0152] Among them, R new (s,a) is the optimized reinforcement learning reward function, R(s,a) is the original reward function, γ is the feedback attenuation factor, s is the state of the reinforcement learning model, and a is the action;

[0153] Impact(a) is the impact factor of action a, which is calculated as the product of the number of threat paths covered by the policy and the path score;

[0154] If the updated reward function causes the strategy success rate to drop by more than δ, δ is the reward function rollback threshold, and the reward function is rolled back to the previous version.

[0155] An information security analysis system based on big data, the information security analysis system comprising:

[0156] Data acquisition module, used to collect and pre-process multi-source heterogeneous security-related data;

[0157] A graph construction module is used to construct and dynamically update a cross-modal threat knowledge graph;

[0158] The threat identification module is used to perform graph reasoning on real-time data based on the knowledge graph to identify threat evolution paths;

[0159] A strategy optimization module, which is used to train the defense strategy model based on online reinforcement learning and output the defense strategy;

[0160] The policy execution module is used to send defense policies to defense devices and control their execution;

[0161] The system optimization module is used to evaluate the effectiveness of the map and strategy and provide feedback to adjust parameters to achieve system adaptive optimization.

[0162] The present invention provides a method and system for information security analysis based on big data. It has the following beneficial effects:

[0163] 1. The present invention adopts a cross-modal threat knowledge graph construction and dynamic update technology solution. By real-time integration of multi-source heterogeneous data, it constructs a dynamic knowledge graph that reflects the relationship between security entities, and identifies threat evolution paths based on graph path traversal. Compared with the existing solutions that rely on fixed rules or single data source analysis, this solution solves the monitoring blind spot problem caused by the lack of dynamic correlation mining capabilities between data in traditional methods. In particular, for distributed, low-frequency, multi-stage covert attacks, this solution can accurately restore the attack chain and identify high-risk threats through dynamic matching and path reasoning of the knowledge graph, significantly improving the detection coverage and accuracy in complex attack scenarios.

[0164] 2. The present invention adopts a technical solution of automatic generation of defense strategies and system self-optimization based on reinforcement learning. It automatically generates defense strategies for access control and traffic isolation according to the threat paths identified in real time, and dynamically adjusts the knowledge graph construction parameters and strategy reward mechanism through feedback from execution results. Compared with the solutions in the prior art that rely on manual analysis or periodic strategy updates, this solution solves the problems of delayed response and inefficient strategy updates of traditional methods. Through the closed-loop linkage mechanism of strategy generation-execution-optimization, this solution can quickly adapt to changes in attack methods, realize minute-level strategy adjustments and system adaptive evolution, and greatly improve the real-time performance and operational efficiency of security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0165] Figure 1 is a flow chart of the present invention;

[0166] Figure 2 It is a system diagram of the present invention. DETAILED DESCRIPTION

[0167] To help those skilled in the art understand the present invention, the following will provide a clear and complete description of the technical solutions in the embodiments of the present invention, in conjunction with the accompanying drawings. Obviously, the described embodiments are only partial embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0168] The present invention is described in detail below with reference to the accompanying drawings:

[0169] Example:

[0170] Please see the attached Figure 1 , an embodiment of the present invention provides an information security analysis method based on big data, comprising:

[0171] S1, collects multi-source heterogeneous security-related data, including business logs, user behavior trajectories, network traffic, application interface call records, identity authentication logs, and real-time security data streams, and pre-processes the collected data to obtain standardized data;

[0172] S1.1, collects raw data from business logs, user behavior trajectories, network traffic, application interface call records, identity authentication logs, and real-time security data streams, and synchronizes the timestamps of all data items to build a unified timeline;

[0173] For the original data source D i Perform time standardization and calculate the standardized timestamp T′ i :

[0174] T i ′=T i +Δt i ,

[0175] Among them, T i is the timestamp of the original record in the i-th data source, Δt i is the time offset between the i-th type data source and the master clock, T i ' is the timestamp after standardization;

[0176] If |Δt i |>θ t , where θ t If the maximum allowable deviation threshold is set, the data source record is recorded as a time anomaly record, marked as data to be verified, and does not enter the subsequent processing flow;

[0177] S1.2: Convert all types of raw data after timestamp alignment in S1.1 into a unified structured format, extract core fields, and normalize semantic labels;

[0178] Let the structured record in the i-th data source be R i :

[0179] R i ={src i ,dst i ,act i ,T i ′},

[0180] Among them, src i The source of the data record, dst i For the target subject, act i is the behavior type, T i ' is the timestamp after standardization;

[0181] For field act i Perform normalized mapping, let the original behavior semantic set be A, the normalized behavior label set be A′, and there exists a mapping function f a :A→A′,

[0182] When a behavior type And the similarity sim(a,a′ k )<θ s , where a′ k ∈A′, the behavior is classified as unknown behavior and marked;

[0183] S1.3, based on structured record R i Construct behavioral feature vectors and use density clustering methods to identify abnormal or low-frequency behavior patterns, eliminating data records that may interfere with analysis;

[0184] Construct a feature vector for each record:

[0185] x i =Embed(src i ,dst i ,act i ,T i ′),

[0186] Among them, Embed(·) is the multimodal semantic vector mapping function, x i is the behavioral feature vector of the i-th structured data;

[0187] A clustering algorithm based on local reachable density is used for anomaly identification, and the local anomaly factor is defined as follows:

[0188]

[0189] Among them, N k (x j ) is the eigenvector x j k-neighborhood, lrd(·) is the local reachability density, LOF(x j ) is the abnormality degree of the jth data record in the local neighborhood, x k is the eigenvector x j Neighborhood samples, x j is the behavioral feature vector of the jth structured data record;

[0190] When LOF(x j )>θ lof When , it is marked as abnormal data and removed, and the final standardized data set is generated after removal:

[0191] D std ={x j ∣LOF(x j )≤θ lof},

[0192] Among them, D std is the standardized data set, θ lof is the local abnormal factor determination threshold;

[0193] S2, performs entity recognition, event extraction, and relationship mining based on standardized data to build a cross-modal threat knowledge graph containing security entity nodes and associated edges;

[0194] S2.1, perform named entity recognition on each record in the standardized data, extract and classify security entities, and generate an initial entity list;

[0195] An entity recognition model based on bidirectional long short-term memory network and conditional random field is used to define the entity recognition probability:

[0196]

[0197] Where P(y|x) is the conditional probability of outputting entity tag sequence y given input sequence x, x is the character embedding vector of the input sequence, h t is the hidden state of the output at time step t, W lstm is the LSTM layer weight matrix, b crf is the CFR layer bias term, y is the predicted entity label sequence, h′ t is the hidden state vector of the tth time step after processing by the bidirectional long short-term memory network;

[0198] If entity confidence conf(e)=max(P(y|x))≤θ c , where θ c is the entity confidence threshold, add the entity to the entity list E = {e1, e2, ..., e n}, otherwise it is marked as an entity to be verified;

[0199] S2.2, based on the entity list in S2.1, extract security events and establish association relationships between entities to generate a set of relationship triples;

[0200] Use graph attention network to calculate the relationship weights between entities:

[0201]

[0202] Among them, e i 、e j is the embedding vector of entity i and j, W is the trainable weight matrix, a is the attention mechanism parameter vector, α ij is the relationship weight between entities i and j, k∈N(i) is the node k in the neighbor node set N(i) of entity i, LeakyReLU(·) is the linear rectification activation function, e k is the embedding vector of entity k;

[0203] If α ij ≥θ r , where θ r is the relationship weight threshold, and the relationship triple r is established ij =(e i ,rel ij ,e j ), add the relation set R = {r 11 ,r 12 ,...,r mn};

[0204] S2.3, based on the entity list E and the relationship set R, construct the initial threat knowledge graph and verify the graph structure consistency through subgraph isomorphism detection;

[0205] Define the subgraph similarity calculation function:

[0206]

[0207] Among them, G s is the subgraph currently constructed, G t is the historical threat pattern subgraph template, match(v,V t ) is the semantic matching degree between node v and template node set, match(e,E t ) is the semantic matching degree between edge e and template edge set, sim(G s ,G t ) is the subgraph G s and the historical threat pattern template subgraph G t The similarity of V s For subgraph G s The node set, E s For subgraph G s The edge set of

[0208] v∈V s For subgraph G s The node set V s Node V in s , e∈E s For subgraph G s The edge set E sThe edge e in

[0209] If sim(G s ,G t )≥θ g ,θ g is the subgraph similarity determination threshold, and G s Merge into the knowledge graph; otherwise, mark it as a new subgraph, store it independently, and trigger the manual review process;

[0210] S3, updates the nodes and edges in the cross-modal threat knowledge graph based on real-time security data streams to form a dynamically evolving knowledge graph;

[0211] S3.1, performs sliding window event detection on real-time security data streams, extracts new entities, events, and relationships, and generates incremental update datasets;

[0212] Adopt the event similarity detection algorithm based on time window and define the data similarity within the window:

[0213]

[0214] Among them, sim(D t ,D t-Δt ) is, D t is the real-time data in the current time window, D t-Δt For, v t is the characteristic vector of the data in the current window, Δt is the sliding window time interval, v t-Δt for;

[0215] If sim(D t ,D t-Δt )<θ e , where θ e is the event difference threshold, marked as the newly added event set E new ={e′1,e′2,…,e′ k};

[0216] S3.2, incremental event set E based on S3.1 new , update the nodes and edges in the knowledge graph, and calculate the node embedding vectors and edge weights;

[0217] For the newly added entity e′ i ∈E new , using the graph embedding update algorithm:

[0218]

[0219] in, For node e′ i The embedding vector at layer l+1, For node e′i The embedding vector at layer l, For node e j The embedding vector at layer l, j∈N(i) is the node e′ i The set of neighbor nodes, α ij For node e′ i With e j The attention weight, σ is the activation function, W (l) is the trainable weight matrix of layer l in the graph neural network;

[0220] Add edge r′ ij =(e′ i ,rel′ ij ,e′ j ) Among them, θ w is the edge weight threshold, adding the edge to the graph;

[0221] S3.3, verify the structural consistency of the updated knowledge graph and eliminate redundant or conflicting nodes and edges;

[0222] Define the subgraph conflict detection function:

[0223]

[0224] Among them, G′ is the updated knowledge graph, R′ is the set of newly added or updated edges, and h i 、h j is the embedding vector of node i and node j in layer l, w ij is the weight of edge (i, j);

[0225] If Conflict(G′)>θ c , where θ c is the conflict threshold, triggering the conflict resolution strategy;

[0226] S4 inputs real-time security data streams into the dynamically evolving knowledge graph for dynamic matching, and identifies threat evolution paths through graph path traversal;

[0227] S4.1, based on the event feature vectors in the real-time security data stream, similarity calculation is performed with the knowledge graph node embedding to filter the matching node set;

[0228] Define the real-time event feature vector x t With graph node embedding h i Cosine similarity of:

[0229]

[0230] Among them, sim(x t ,hi ) is the real-time event feature vector x t and knowledge graph node embedding h i The cosine similarity of x t is the feature vector of the real-time event, h i is the node e in the knowledge graph i Embedding vector of

[0231] If sim(x t ,h i )≥θ m , where θ m is the matching threshold, marking node e i For matching nodes, generate matching node set M = {e1, e2, ..., e k};

[0232] S4.2, starting from the matching node set M, traverse the paths along the knowledge graph edge, calculate the path weights and screen potential threat paths;

[0233] Defining Paths The cumulative weight of:

[0234]

[0235] Where W(P) is the cumulative weight of path P, n is the number of nodes in path P, For the edge The weight of , γ is the path attenuation factor;

[0236] If W(P)≥θ p , where θ p is the path weight threshold, and the retained paths are the candidate threat path set P cand ;

[0237] S4.3, for the candidate path set P cand Perform pattern matching and threat scoring to identify high-risk threat evolution paths;

[0238] Define the threat score function:

[0239]

[0240] Where risk(e) is the historical risk level of node e, threat(r) is the threat correlation strength of edge r, α and β are the weight coefficients of node risk and edge threat, and P is the path in the knowledge graph;

[0241] If Score(P)≥θ s , where θ s is the threat score threshold, P is determined to be the threat evolution path, and is added to the final result set P threat;

[0242] S5: Generate a defense strategy based on the threat evolution path. The defense strategy includes access control adjustment strategy, traffic isolation strategy, and authentication mechanism adjustment strategy.

[0243] S5.1, Evolution path of identified threats P threat Extract path features and determine the type of defense strategy required;

[0244] Define the path eigenvector:

[0245]

[0246] Among them, f p is the path feature vector, Score(P) is the path threat score, len(P) is the path length, risk(e) is the node risk level, and P is the path in the knowledge graph;

[0247] Determine the defense type based on the feature vector:

[0248]

[0249] Among them, θ a ,θ r ,θ l ,θ b is the judgment threshold, which is trained based on historical attack patterns;

[0250] S5.2, generate specific policy parameters based on the defense type to ensure that the policy matches the threat path characteristics;

[0251] Access control adjusts policy parameters and generates permission attenuation coefficients based on the risk level of the target node in the path:

[0252]

[0253] Among them, α perm is the authority attenuation coefficient, risk max The maximum risk level preset for the system;

[0254] Final permission level: Perm new =α perm Perm orig , among which, Perm new is the new permission level, α perm is the authority attenuation coefficient, Perm orig is the original permission level;

[0255] Traffic isolation policy parameters generate traffic feature rules based on the path source and destination nodes:

[0256] Risolate ={src ip ∈S p ,dst ip ∈D p ,proto=TCP},

[0257] Among them, R isolate is the traffic characteristic rule, S p and D p is the IP set of the source node and the target node in the path p, src ip is the source IP address, dst ip is the target IP address, TCP is the transmission control protocol;

[0258] Authentication adjustment policy parameters generate authentication strength coefficients based on path behavior frequency:

[0259]

[0260] Among them, β auth is the authentication strength coefficient, freq(P) is the triggering frequency of path association events per unit time, θ f is the frequency threshold;

[0261] The authentication interval is adjusted to: T auth =T base / β auth ,

[0262] Among them, T auth is the authentication interval, T base For basic certification intervals;

[0263] S5.3, perform conflict detection on the generated defense strategies and assign execution priorities according to threat levels;

[0264] Define the policy conflict detection function:

[0265]

[0266] For the conflicting strategy set S conflict , assign priorities by path score:

[0267] Priority(s i )=Score(P i )·w p +len(P i )·w l ,

[0268] Among them, Priority(s i ) is the strategy priority, Score(P i ) is the path threat score, len(Pi ) is the path length, w p 、w l is the weight coefficient of score and path length;

[0269] S6: Deliver the defense policy to the defense device to perform access control adjustments, traffic isolation, and authentication mechanism adjustments.

[0270] S6.1, converting the generated defense policy parameters into configuration instructions executable by the defense device to generate a device instruction set;

[0271] Define the mapping function from policy parameters to device instructions:

[0272] C k =f map (s k ,D j ),

[0273] Among them, s k is the kth defense strategy parameter, D j is the target defense device type, f map is the instruction mapping rule, C k Configure instructions for the generated device;

[0274] If the policy parameter s k Contains dynamic adjustment coefficients, and the command must include normalization parameters:

[0275] c param =clip(s k ,param,0,1),

[0276] Among them, c param is the normalized strategy parameter, clip is the parameter truncation function, and param is the original strategy parameter;

[0277] S6.2, calculate the instruction issuance priority and control the execution amount based on the current load status of the defense device;

[0278] Define device D j Load evaluation function:

[0279]

[0280] Among them, L j For defense equipment D j Comprehensive load evaluation index, Q j For device D j The length of the pending instruction queue, Q max is the maximum queue capacity of the device, T proc is the average single instruction processing time of the device, T baseis the benchmark processing time, λ is the weight coefficient;

[0281] If L j <θ L , where θ L is the load threshold, and the instruction C k Send to D j ;

[0282] Otherwise, C k Add to the buffer queue, according to the priority Priority (C k )=Score(P k ) waiting to be issued, among which, Priority (C k ) is the instruction issuing priority, Score(P k ) score the threat path;

[0283] S6.3, Detection of Defense Devices Against Instruction C k The execution result verifies the effectiveness of the strategy and generates a feedback signal;

[0284] Define execution result verification indicators:

[0285]

[0286] Among them, SuccessRate(C k ) is the strategy execution success rate, I(·) is the indicator function, and T is the length of the verification time window;

[0287] When the device state t Meet the target state S target Take 1 when it is, otherwise take 0;

[0288] If SuccessRate(C k )≥θ s , where θ s The execution success rate threshold is marked as successful; otherwise, the command resend or manual intervention process is triggered;

[0289] S7, adjusts the entity extraction method and reinforcement learning reward mechanism of the cross-modal threat knowledge graph based on the execution results of the defense device to form system optimization parameters;

[0290] S7.1, based on the verification data of the execution results of S6, calculate the actual effect indicators of the defense strategy and generate feedback signals;

[0291] Define the comprehensive rating of defense effect:

[0292] Effect=ω1·Success+ω2·(1-FalsePositive)+ω3·Response,

[0293] Among them, Success is the strategy execution success rate, FalsePositive is the false blocking rate, ω1, ω2, ω3 are weight coefficients, T exec is the time taken to execute the strategy, T max is the maximum allowed time;

[0294] If Effect<θ e , where θ e is the effect threshold, generating a negative feedback signal F=-1; otherwise, generating a positive feedback signal F=1;

[0295] S7.2, adjust the entity recognition and relationship mining parameters in S2 according to the feedback signal F, and optimize the knowledge graph construction logic;

[0296] Define the entity recognition model parameter update rules:

[0297]

[0298] in, is the parameter set of the entity recognition model at the t+1th iteration, is the parameter set of the entity recognition model at the tth iteration, η is the learning rate, Precision (θ) is the accuracy of entity recognition, and gradient Calculated through historical data;

[0299] If N consecutive negative feedbacks trigger the entity tag library expansion process, a new E new Class Entity;

[0300] S7.3, based on the feedback signal F, adjust the reward function of the reinforcement learning model in S5 to optimize the strategy generation logic;

[0301] Define the reward function update formula:

[0302] R new (s,a)=R(s,a)+γ·F·Impact(a),

[0303] Among them, R new (s,a) is the optimized reinforcement learning reward function, R(s,a) is the original reward function, γ is the feedback attenuation factor, s is the state of the reinforcement learning model, and a is the action;

[0304] Impact(a) is the impact factor of action a, which is calculated as the product of the number of threat paths covered by the policy and the path score;

[0305] If the updated reward function causes the strategy success rate to drop by more than δ, δ is the reward function rollback threshold, and the reward function is rolled back to the previous version.

[0306] S1 integrates multi-source heterogeneous data and implements timestamp synchronization, structured conversion, and anomaly detection to build a unified and standardized data foundation. This solution effectively addresses the difficulties in correlation analysis caused by traditional methods due to dispersed data sources and inconsistent formats. It eliminates misjudgments of time series events caused by timeline misalignment. It also improves data quality through semantic normalization and noise filtering, providing a highly reliable input source for subsequent threat analysis and avoiding false positives and negatives caused by dirty data or low-frequency anomalies.

[0307] S2 utilizes entity recognition, relationship modeling, and graph verification technologies to transform standardized data into a structured knowledge network that reflects the relationships between security entities. This solution breaks away from the traditional rule engine's reliance on fixed patterns. By dynamically mining potential connections between data, it constructs an interpretable threat evolution logic framework. It is particularly adept at identifying covert attacks that exploit a combination of vulnerabilities across multiple systems, providing a visual analytical foundation for reconstructing complex attack chains and significantly enhancing the associative reasoning capabilities of threat intelligence.

[0308] S3 enables the continuous evolution of the threat knowledge graph through event detection and incremental updates in real-time data streams. This solution overcomes the protection strategy failure caused by data lag in static graph models, ensuring that the knowledge base always reflects the latest threat landscape. It also maintains graph structural consistency through a conflict resolution mechanism, avoiding analytical bias caused by redundant or contradictory information and providing a dynamically evolving reasoning foundation for real-time threat detection.

[0309] S4 combines dynamic graph node matching with path weight analysis to locate high-risk attack chains from massive associations. This solution accurately identifies low-frequency, long-duration attack behaviors through feature similarity calculation and attenuated path traversal, addressing the blind spots of traditional threshold alarm mechanisms for slow penetration attacks. It also quantifies threat levels based on a multi-dimensional scoring model, providing actionable prioritization for defense strategy generation.

[0310] S5 automatically generates fine-grained protection strategies based on threat path characteristics, ensuring their effectiveness through parameter optimization and conflict detection. This solution replaces manual policy configuration and achieves minute-level response speeds. It automatically coordinates multi-dimensional protection measures such as access control and traffic isolation for cross-system nodes involved in distributed attacks, forming a three-dimensional defense system that significantly reduces the risk of secondary penetration caused by delayed manual intervention.

[0311] S6 ensures efficient and reliable execution of defense strategies through device command conversion and load balancing mechanisms. This solution addresses the difficulty of implementing policies due to protocol differences in traditional security devices, enabling command coordination between heterogeneous devices. Furthermore, through real-time monitoring and feedback of execution status, it dynamically adjusts the pace of policy delivery, avoiding system stability issues caused by device overload and ensuring the continued operational effectiveness of the protection system.

[0312] S7 dynamically optimizes the knowledge graph based on defense effectiveness feedback, building a logic and strategy generation mechanism to form a self-evolving security analysis system. This solution overcomes the limitations of traditional systems that rely on fixed models. By adaptively adjusting detection and response strategies through a reinforcement learning reward mechanism, it continuously improves adaptability to new attack methods, achieving a complete closed loop from threat discovery to defense optimization, and building an intelligent security protection ecosystem with continuous evolutionary capabilities.

[0313] Please see the attached Figure 2 , an information security analysis system based on big data, the information security analysis system includes:

[0314] Data acquisition module, used to collect and pre-process multi-source heterogeneous security-related data;

[0315] A graph construction module is used to construct and dynamically update a cross-modal threat knowledge graph;

[0316] The threat identification module is used to perform graph reasoning on real-time data based on the knowledge graph to identify threat evolution paths;

[0317] A strategy optimization module, which is used to train the defense strategy model based on online reinforcement learning and output the defense strategy;

[0318] The policy execution module is used to send defense policies to defense devices and control their execution;

[0319] The system optimization module is used to evaluate the effectiveness of the map and strategy and provide feedback to adjust parameters to achieve system adaptive optimization.

[0320] This system utilizes an innovative architecture combining multi-source data fusion, dynamic knowledge building, and an intelligent closed-loop strategy to systematically address the data silos, delayed responses, and rigid policies inherent in traditional security analysis. Modules work together to intelligently manage the entire threat process, from perception and analysis to response and optimization. This significantly enhances protection against emerging threats such as APTs and supply chain attacks, building a next-generation proactive defense system for enterprises with real-time perception, precise decision-making, and self-evolution.

[0321] While embodiments of the present invention have been shown and described, it will be appreciated by those skilled in the art that various changes, modifications, substitutions and variations may be made to these embodiments without departing from the principles and spirit of the invention, and that the scope of the invention is defined by the appended claims and their equivalents.

Claims

1. A method for information security analysis based on big data, characterized in that: include: S1, collects multi-source heterogeneous security-related data, including business logs, user behavior trajectories, network traffic, application interface call records, identity authentication logs, and real-time security data streams, and pre-processes the collected data to obtain standardized data; S2, performing entity recognition, event extraction, and relationship mining based on the standardized data to construct a cross-modal threat knowledge graph containing security entity nodes and associated edges; S3, updating the nodes and edges in the cross-modal threat knowledge graph according to the real-time security data stream to form a dynamically evolving knowledge graph; S4, inputting the real-time security data stream into the dynamically evolving knowledge graph for dynamic matching, and identifying the threat evolution path through graph path traversal; S5, generating a defense strategy based on the threat evolution path, wherein the defense strategy includes an access control adjustment strategy, a traffic isolation strategy, and an authentication mechanism adjustment strategy; S6, sending the defense policy to the defense device to perform access control adjustment, traffic isolation and authentication mechanism adjustment; S7: Adjust the entity extraction method and reinforcement learning reward mechanism of the cross-modal threat knowledge graph according to the execution results of the defense device to form system optimization parameters.

2. The information security analysis method based on big data according to claim 1, characterized in that: The preprocessing of multi-source heterogeneous data in S1 includes data cleaning, format standardization and time alignment operations; The defense devices in S6 include firewalls, network access control devices, application gateways and intrusion detection systems, and the policies are issued and executed through interfaces.

3. The information security analysis method based on big data according to claim 1, characterized in that: In S1, collecting multi-source heterogeneous security-related data and pre-processing it further includes: S1.1, collects raw data from business logs, user behavior trajectories, network traffic, application interface call records, identity authentication logs, and real-time security data streams, and synchronizes the timestamps of all data items to build a unified timeline; For the original data source D i Perform time standardization and calculate the standardized timestamp T i ′ : T i ′=T i +Δt i , Among them, T i is the timestamp of the original record in the i-th data source, Δt i is the time offset between the i-th type data source and the master clock, T i ' is the timestamp after standardization; If |Δt i |>θ t , where θ t If the maximum allowable deviation threshold is set, the data source record is recorded as a time anomaly record, marked as data to be verified, and does not enter the subsequent processing flow; S1.2: Convert all types of raw data after timestamp alignment in S1.1 into a unified structured format, extract core fields, and normalize semantic labels; Let the structured record in the i-th data source be R i : R i ={src i ,dst i ,act i ,T i ′}, Among them, src i The source of the data record, dst i For the target subject, act i is the behavior type, T i ' is the timestamp after standardization; For field act i Perform normalized mapping, let the original behavior semantic set be A, the normalized behavior label set be A′, and there exists a mapping function f a :A→A′, When a behavior type And the similarity sim(a,a′ k )<θ s , where a′ k ∈A′, the behavior is classified as unknown behavior and marked; S1.3, based on structured record R i Construct behavioral feature vectors and use density clustering methods to identify abnormal or low-frequency behavior patterns, eliminating data records that may interfere with analysis; Construct a feature vector for each record: x i =Embed(src i ,dst i ,act i ,T i ′), Among them, Embed(·) is the multimodal semantic vector mapping function, x i is the behavioral feature vector of the i-th structured data; A clustering algorithm based on local reachable density is used for anomaly identification, and the local anomaly factor is defined as follows: Among them, N k (x j ) is the eigenvector x j k-neighborhood, lrd(·) is the local reachability density, LOF(x j ) is the abnormality degree of the jth data record in the local neighborhood, x k is the eigenvector x j Neighborhood samples, x j is the behavioral feature vector of the jth structured data record; When LOF(x j )>θ lof When , it is marked as abnormal data and removed, and the final standardized data set is generated after removal: D std ={x j ∣LOF(x j )≤θ lof }, Among them, D std is the standardized data set, θ lof is the local anomaly factor determination threshold.

4. The information security analysis method based on big data according to claim 1, characterized in that: In S2, constructing a cross-modal threat knowledge graph based on standardized data further includes: S2.1, performing named entity recognition on each record in the standardized data, extracting and classifying security entities, and generating an initial entity list; An entity recognition model based on bidirectional long short-term memory network and conditional random field is used to define the entity recognition probability: Where P(y|x) is the conditional probability of outputting entity tag sequence y given input sequence x, x is the character embedding vector of the input sequence, h t is the hidden state of the output at time step t, W lstm is the LSTM layer weight matrix, b crf is the CFR layer bias term, y is the predicted entity label sequence, h′ t is the hidden state vector of the tth time step after bidirectional long short-term memory network processing; If entity confidence conf(e)=max(P(y|x))≤θ c , where θ c is the entity confidence threshold, add the entity to the entity list E = {e1, e2, ..., e n }, otherwise it is marked as an entity to be verified; S2.2, based on the entity list in S2.1, extract security events and establish association relationships between entities to generate a set of relationship triples; Use graph attention network to calculate the relationship weights between entities: Among them, e i 、e j is the embedding vector of entity i and j, W is the trainable weight matrix, a is the attention mechanism parameter vector, α ij is the relationship weight between entities i and j, k∈N(i) is the node k in the neighbor node set N(i) of entity i, LeakyReLU(·) is the linear rectification activation function, e k is the embedding vector of entity k; If α ij ≥θ r , where θ r is the relationship weight threshold, and the relationship triple r is established ij =(e i ,rel ij ,e j ), add the relation set R = {r 11 ,r 12 ,...,r mn }; S2.3, based on the entity list E and the relationship set R, construct the initial threat knowledge graph and verify the graph structure consistency through subgraph isomorphism detection; Define the subgraph similarity calculation function: Among them, G s is the subgraph currently constructed, G t is the historical threat pattern subgraph template, match(v,V t ) is the semantic matching degree between node v and template node set, match(e,E t ) is the semantic matching degree between edge e and template edge set, sim(G s ,G t ) is the subgraph G s and the historical threat pattern template subgraph G t The similarity of V s For subgraph G s The node set, E s For subgraph G s The edge set of v∈V s For subgraph G s The node set V s Node V in s , e∈E s For subgraph G s The edge set E s The edge e in If sim(G s ,G t )≥θ g ,θ g is the subgraph similarity determination threshold, and G s The subgraph is merged into the knowledge graph; otherwise, it is marked as a new subgraph and stored independently, triggering the manual review process.

5. The information security analysis method based on big data according to claim 1, characterized in that: In S3, updating the cross-modal threat knowledge graph based on the real-time security data stream further includes: S3.1, performing sliding window event detection on the real-time security data stream, extracting newly added entities, events, and relationships, and generating an incremental update dataset; Adopt the event similarity detection algorithm based on time window and define the data similarity within the window: Among them, sim(D t ,D t-Δt ) is, D t is the real-time data in the current time window, D t-Δt For, v t is the characteristic vector of the data in the current window, Δt is the sliding window time interval, v t-Δt for; If sim(D t ,D t-Δt )<θ e , where θ e is the event difference threshold, marked as the newly added event set E new ={e′1,e′2,…,e′ k }; S3.2, incremental event set E based on S3.1 new , update the nodes and edges in the knowledge graph, and calculate the node embedding vectors and edge weights; For the newly added entity e′ i ∈E new , using the graph embedding update algorithm: in, For node e′ i The embedding vector at layer l+1, For node e′ i The embedding vector at layer l, For node e j The embedding vector at layer l, j∈N(i) is the node e′ i The set of neighbor nodes, α ij For node e′ i With e j The attention weight, σ is the activation function, W (l) is the trainable weight matrix of layer l in the graph neural network; Add edge r′ ij =(e′ i ,rel′ ij ,e′ j ) Among them, θ w is the edge weight threshold, adding the edge to the graph; S3.3, verify the structural consistency of the updated knowledge graph and eliminate redundant or conflicting nodes and edges; Define the subgraph conflict detection function: Among them, G′ is the updated knowledge graph, R′ is the set of newly added or updated edges, and h i 、h j is the embedding vector of node i and node j in layer l, w ij is the weight of edge (i, j); If Conflict(G′)>θ c , where θ c is the conflict threshold, triggering the conflict resolution strategy.

6. The information security analysis method based on big data according to claim 1, characterized in that: In S4, the real-time security data stream is input into the dynamically evolving knowledge graph for dynamic matching, further comprising: S4.1, based on the event feature vectors in the real-time security data stream, similarity calculation is performed with the knowledge graph node embedding to filter the matching node set; Define the real-time event feature vector x t With graph node embedding h i Cosine similarity of: Among them, sim(x t ,h i ) is the real-time event feature vector x t and knowledge graph node embedding h i The cosine similarity of x t is the feature vector of the real-time event, h i is the node e in the knowledge graph i Embedding vector of If sim(x t ,h i )≥θ m , where θ m is the matching threshold, marking node e i For matching nodes, generate matching node set M = {e1, e2, ..., e k }; S4.2, starting from the matching node set M, traverse the paths along the knowledge graph edge, calculate the path weights and screen potential threat paths; Defining Paths The cumulative weight of: Where W(P) is the cumulative weight of path P, n is the number of nodes in path P, For the edge The weight of , γ is the path attenuation factor; If W(P)≥θ p , where θ p is the path weight threshold, and the retained paths are the candidate threat path set P cand ; S4.3, for the candidate path set P cand Perform pattern matching and threat scoring to identify high-risk threat evolution paths; Define the threat score function: Where risk(e) is the historical risk level of node e, threat(r) is the threat correlation strength of edge r, α and β are the weight coefficients of node risk and edge threat, and P is the path in the knowledge graph; If Score(P)≥θ s , where θ s is the threat score threshold, P is determined to be the threat evolution path, and is added to the final result set P threat .

7. The information security analysis method based on big data according to claim 1, characterized in that: In S5, generating a defense strategy according to the threat evolution path further includes: S5.1, Evolution path of identified threats P threat Extract path features and determine the type of defense strategy required; Define the path eigenvector: Among them, f p is the path feature vector, Score(P) is the path threat score, len(P) is the path length, risk(e) is the node risk level, and P is the path in the knowledge graph; Determine the defense type based on the feature vector: Among them, θ a ,θ r ,θ l ,θ b is the judgment threshold, which is trained based on historical attack patterns; S5.2, generate specific policy parameters based on the defense type to ensure that the policy matches the threat path characteristics; Access control adjusts policy parameters and generates permission attenuation coefficients based on the risk level of the target node in the path: Among them, α perm is the authority attenuation coefficient, risk max The maximum risk level preset for the system; Final permission level: Perm new =α perm Perm orig , among which, Perm new is the new permission level, α perm is the authority attenuation coefficient, Perm orig is the original permission level; Traffic isolation policy parameters generate traffic feature rules based on the path source and destination nodes: R isolate ={src ip ∈S p ,dst ip ∈D p ,proto=TCP}, Among them, R isolate is the traffic characteristic rule, S p and D p is the IP set of the source node and the target node in the path p, src ip is the source IP address, dst ip is the target IP address, TCP is the transmission control protocol; Authentication adjustment policy parameters generate authentication strength coefficients based on path behavior frequency: Among them, β auth is the authentication strength coefficient, freq(P) is the triggering frequency of path association events per unit time, θ f is the frequency threshold; The authentication interval is adjusted to: T auth =T base / β auth , Among them, T auth is the authentication interval, T base For basic certification intervals; S5.3, perform conflict detection on the generated defense strategies and assign execution priorities according to threat levels; Define the policy conflict detection function: For the conflicting strategy set S conflict , assign priorities by path score: Priority(s i )=Score(P i )·w p +len(P i )·w l , Among them, Priority(s i ) is the strategy priority, Score(P i ) is the path threat score, len(P i ) is the path length, w p 、w l is the weight coefficient of score and path length.

8. The information security analysis method based on big data according to claim 1 is characterized in that: In S6, the defense strategy is sent to the defense device for execution, further comprising: S6.1, converting the generated defense policy parameters into configuration instructions executable by the defense device to generate a device instruction set; Define the mapping function from policy parameters to device instructions: C k =f map (s k ,D j ), Among them, s k is the kth defense strategy parameter, D j is the target defense device type, f map is the instruction mapping rule, C k Configure instructions for the generated device; If the policy parameter s k Contains dynamic adjustment coefficients, and the command must include normalization parameters: c param =clip(s k ,param,0,1), Among them, c param is the normalized strategy parameter, clip is the parameter truncation function, and param is the original strategy parameter; S6.2, calculate the instruction issuance priority and control the execution amount based on the current load status of the defense device; Define device D j Load evaluation function: Among them, L j For defense equipment D j Comprehensive load evaluation index, Q j For device D j The length of the pending instruction queue, Q max is the maximum queue capacity of the device, T proc is the average single instruction processing time of the device, T base is the benchmark processing time, λ is the weight coefficient; If L j <θ L , where θ L is the load threshold, and the instruction C k Send to D j ; Otherwise, C k Add to the buffer queue, according to the priority Priority (C k )=Score(P k ) waiting to be issued, among which, Priority (C k ) is the instruction issuing priority, Score(P k ) score the threat path; S6.3, Detection of Defense Devices Against Instruction C k The execution result verifies the effectiveness of the strategy and generates a feedback signal; Define execution result verification indicators: Among them, SuccessRate(C k ) is the strategy execution success rate, I(·) is the indicator function, and T is the length of the verification time window; When the device state t Meet the target state S target Take 1 when it is, otherwise take 0; If SuccessRate(C k )≥θ s , where θ s The execution success rate threshold is marked as successful; otherwise, the instruction resend or manual intervention process is triggered.

9. The information security analysis method based on big data according to claim 1, characterized in that: In S7, adjusting the knowledge graph construction and reinforcement learning mechanism according to the execution results of the defense device further includes: S7.1, based on the verification data of the execution results of S6, calculate the actual effect indicators of the defense strategy and generate feedback signals; Define the comprehensive rating of defense effect: Effect=ω1·Success+ω2·(1-FalsePositive)+ω3·Response, Among them, Success is the strategy execution success rate, FalsePositive is the false blocking rate, ω1, ω2, ω3 are weight coefficients, T exec is the time taken to execute the strategy, T max is the maximum allowed time; If Effect<θ e , where θ e is the effect threshold, generating a negative feedback signal F=-1; otherwise, generating a positive feedback signal F=1; S7.2, adjust the entity recognition and relationship mining parameters in S2 according to the feedback signal F, and optimize the knowledge graph construction logic; Define the entity recognition model parameter update rules: in, is the parameter set of the entity recognition model at the t+1th iteration, is the parameter set of the entity recognition model at the tth iteration, η is the learning rate, Precision (θ) is the accuracy of entity recognition, and gradient Calculated through historical data; If N consecutive negative feedbacks trigger the entity tag library expansion process, a new E new Class Entity; S7.3, based on the feedback signal F, adjust the reward function of the reinforcement learning model in S5 to optimize the strategy generation logic; Define the reward function update formula: R new (s,a)=R(s,a)+γ·F·Impact(a), Among them, R new (s,a) is the optimized reinforcement learning reward function, R(s,a) is the original reward function, γ is the feedback attenuation factor, s is the state of the reinforcement learning model, and a is the action; Impact(a) is the impact factor of action a, which is calculated as the product of the number of threat paths covered by the policy and the path score; If the updated reward function causes the strategy success rate to drop by more than δ, δ is the reward function rollback threshold, and the reward function is rolled back to the previous version.

10. An information security analysis system based on big data, according to the information security analysis method based on big data according to any one of claims 1 to 9, characterized in that: The information security analysis system includes: Data acquisition module, used to collect and pre-process multi-source heterogeneous security-related data; A graph construction module, used to construct and dynamically update a cross-modal threat knowledge graph; The threat identification module is used to perform graph reasoning on real-time data based on the knowledge graph to identify threat evolution paths; A strategy optimization module, which is used to train the defense strategy model based on online reinforcement learning and output the defense strategy; The policy execution module is used to send defense policies to defense devices and control their execution; The system optimization module is used to evaluate the effectiveness of the map and strategy and provide feedback to adjust parameters to achieve system adaptive optimization.

Images