Security decision execution method and system based on adaptive feedback

Abstract

The invention belongs to the technical field of network security defense, and particularly discloses a multi-stage network security threat defense method and system based on adaptive feedback. A defense strategy is dynamically generated and optimized by performing multi-dimensional analysis on feature differences of historical security events and events to be processed and combining an adaptive feedback mechanism and an attack detection model for iterative training; when deviation or novel threats are detected, rollback and incremental training can be automatically triggered, and multi-round iterative closed-loop defense is formed. The method effectively deals with advanced persistent threats, zero-day vulnerabilities and multi-stage attacks, significantly improves threat detection accuracy and strategy response efficiency, reduces redundant feature interference, enhances expandability and adaptivity of the system, can be widely applied to environments such as the Internet of Things, cloud computing and enterprise intranets, and has wide application prospects. And the intelligence and flexibility of network protection are obviously improved.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a security decision execution method and system based on adaptive feedback. Background Art

[0002] With the rapid development of emerging technologies such as the Internet of Things, cloud computing, and big data, network security threats have taken on new characteristics such as multi-stage, high concealment, and complexity. Traditional network security defenses typically rely on fixed rules or static patterns (such as firewall rules and intrusion detection system rules). While these can protect against known threats to a certain extent, they often lack effective identification and precise defense against advanced persistent threats (APTs), zero-day exploits, and multi-stage coordinated attacks. The main reasons for this are:

[0003] Due to the lack of dynamic tracking and analysis capabilities, traditional methods are unable to conduct multi-level correlation analysis of the characteristics of each stage of security incidents, making it difficult to timely capture the attackers' constantly changing tactics and methods, resulting in insufficient adaptability of strategies in complex threat environments.

[0004] It is difficult to deeply explore the core characteristics of security incidents. Since multi-stage attacks may contain massive, multi-dimensional feature data, if there is a lack of effective identification and filtering of the differences between key dimensions and redundant information, a large amount of low-value or noise information will interfere with the overall analysis, reducing the accuracy of threat detection and defense strategy generation.

[0005] There is a lack of adaptive optimization mechanisms. Although some existing solutions can generate defense strategies based on historical event matching, if there is a lack of real-time feedback and iterative optimization capabilities for rapidly evolving network threats, it is easy to cause strategy lags or misjudgments, thereby extending the exposure time of important network assets.

[0006] How to target multi-stage network security threats, perform feature mining and dynamic correlation on massive heterogeneous security event data, and use adaptive feedback mechanisms to identify and optimize key features, thereby effectively eliminating redundant features and timely updating defense strategies, has become an important technical problem that needs to be urgently solved in the current network security field. Summary of the Invention

[0007] In order to solve the technical problem that the presence of some redundant dimensions reduces the effect of scenario matching between current network security events and historical security events, thereby leading to poor security policy generation, the purpose of the present invention is to provide a multi-stage network security threat defense method based on AI adaptive optimization. The technical solution adopted is as follows:

[0008] The present invention proposes a security decision execution method based on adaptive feedback, comprising the following steps:

[0009] Step 1: Data collection and preprocessing: real-time acquisition of security event data from network traffic, system logs, and alarm information. Formatting, deduplication, and noise reduction are performed on the security event data, and the processed feature data is stored in a database.

[0010] Step 2: Suspicious feature identification: Analyze the feature data using a trained attack detection model, and output the corresponding attack feature vector and credibility score, where the attack detection model is trained based on a historical security event dataset.

[0011] Step 3: Initial security decision generation: Based on the attack feature vector and credibility score, an algorithm is used to calculate defense priorities and output a defense solution set, where the defense solution set includes several executable security actions. The algorithm calculation process includes: multi-dimensional aggregation of the attack feature vector, generating a score for each security action based on threshold comparison and weighted calculation, and obtaining security actions with scores not less than a preset threshold to form the defense solution set;

[0012] Step 4: Security action execution and real-time monitoring: The defense solution set is sent to the security orchestration execution unit to invoke security actions sequentially or in parallel on the target network. Traffic, alarm, and system status data are continuously collected during the execution process to monitor the execution results of security actions and changes in attack behavior.

[0013] Step 5: Difference Analysis and Adaptive Feedback: The monitored execution results are compared with the defense solution set obtained in Step 3. If the actual execution effect of the security action is detected to be lower than the expected score or a new attack feature vector appears, difference feedback information is calculated. This difference feedback information includes the degree of deviation, suspicious new features, and possible correction suggestions for the current solution set.

[0014] Step 6: Dynamic correction and iterative update: The difference feedback information is input into the attack detection model or the strategy optimization module linked to the model, and the defense solution set is recalculated through incremental training or parameter update. If a major conflict or invalid blocking of the current security action is detected, a rollback operation is triggered and the rollback reason and the new solution set are recorded in the database. The rollback operation includes: automatically closing the current abnormal action and enabling a new action sequence for experimental blocking based on the previously saved security status snapshot;

[0015] Step 7: Results archiving and loop execution: The monitoring data, difference feedback information, and adjusted defense solution set of the execution process are archived and updated to the security knowledge database; the effective blocking strategies obtained during this round of execution are labeled and stored so that they can be quickly queried and reused when similar attack scenarios are encountered in the future, and then enter the next round of loop execution.

[0016] Furthermore, in the data collection and preprocessing of step 1, the method for deduplicating and reducing noise in the security event data includes: using a hash fingerprint algorithm to generate unique fingerprint information for network traffic segments or log entries, and determining duplicate fingerprint information as duplicate data and deleting it; comparing the frequency of occurrence of the same-source alarm within a preset time window, and if the frequency exceeds a set threshold, determining it as a noise alarm and downgrading or eliminating it. By using the hash fingerprint algorithm and frequency comparison, on the one hand, repeated or frequently occurring noise data is accurately removed, preventing low-value alarms from occupying detection resources; on the other hand, the features extracted in subsequent analysis are made purer, improving the overall judgment accuracy and efficiency.

[0017] Furthermore, the attack detection model used in step 2 of identifying suspicious features includes: supervised training using feature vectors and corresponding labels from multiple historical attack events; solidifying the model parameters that perform best during training to output a credibility score for real-time security event data during the deployment phase; and determining a suspicious feature when the credibility score is above a set threshold, and a normal or low-risk feature when it is below the set threshold. Through supervised training of historical attack events and solidifying the optimal model parameters, suspicious behavior features in the current environment can be quickly and accurately identified, enabling timely labeling of potential high-risk threats, thereby reducing the chance of missed or false positives and improving overall detection efficiency.

[0018] Furthermore, in step 3, generating the initial security decision, generating the defense solution set includes: assigning weights and penalty coefficients to the suspicious features according to different hazard levels or feature types; accumulating a weighted score based on the weights and penalty coefficients; if the score exceeds a first threshold, the corresponding defense action is included in the security solution; if the score falls below a second threshold, the action is removed; and combining the selected multiple security actions to form a defense solution set. By assigning weights and penalty coefficients to suspicious features according to different levels or types, and using threshold judgment to select more targeted and necessary security actions, irrelevant or redundant operations can be effectively reduced, improving the efficiency and relevance of defense solution execution.

[0019] Furthermore, during the security action execution and real-time monitoring in step 4, an execution monitoring agent module is deployed within the security orchestration execution unit to periodically poll the execution status of actions such as firewall rule updates, endpoint process blocking, or network connection termination. When the execution monitoring agent module detects that the execution success rate or blocking rate is continuously below a set ratio threshold, it marks this information as a policy failure and issues a difference feedback message. Polling and comparing the execution status during actual defense policy execution can promptly identify situations where policy execution is ineffective or blocking capabilities are insufficient, and automatically issues difference feedback messages, providing data support for subsequent adaptive policy optimization, thereby ensuring the consistency and real-time nature of network security protection.

[0020] Furthermore, during the policy revision and dynamic optimization process in step 6, the rollback operation includes: based on the system security status snapshot automatically generated upon completion of the key step, triggering a rollback to the most recent security status snapshot upon detecting that the current action has caused a significant increase in device anomalies or false positives; recording the type of action, triggering reason, and impact on the system of the rollback for subsequent audits and incremental training. By generating a system security status snapshot after the completion of the key step, if an execution anomaly or an increase in false positives occurs, the system can be quickly restored to the previous stable state, effectively preventing further risk spread; and retaining rollback information to facilitate subsequent model fine-tuning and audit compliance.

[0021] Furthermore, in step 5, the difference analysis and adaptive feedback are performed by comparing the execution monitoring results with the expected blocking indicators of the initial defense plan. If the difference is greater than a set threshold, the corresponding suspicious features are extracted and generated as difference feedback information. A check is then performed to see if new attack feature vectors or unknown risk types appear. If the similarity is less than a preset value, the threat is marked as an unknown threat. The difference feedback information is sent along with the unknown threat features to the adaptive feedback module, triggering a new policy revision or rollback decision. By comparing the differences between the execution monitoring results and the expected indicators, deviations in policy execution can be quickly identified. When new high-risk or unknown features appear, they are automatically flagged and incorporated into the feedback analysis, significantly improving the ability to respond to sudden threats. Furthermore, the next round of policy revisions or rollbacks can be triggered in conjunction, forming an adaptive closed loop.

[0022] As a preferred option, in the strategy correction and dynamic optimization of step 6, the following steps are included: adding the difference feedback information and the corresponding monitoring data to the training set, and using incremental training to update some weights of the attack detection model; if the detection accuracy of the new model is higher than that of the original model after verification, the new model is activated and the defense plan is recalculated; otherwise, the parameters of the original model are rolled back and the reason for the verification failure is recorded; after the correction strategy is successfully adopted, execution and real-time monitoring are performed again, forming a multi-round iterative closed loop. Updating the attack detection model through incremental training can enable it to quickly adapt to the latest threat characteristics; verifying the training effect and conditionally activating the new model to ensure the effectiveness of real-time defense while maintaining model stability; and continuously optimizing the strategy in multiple rounds of closed loops to adapt to dynamically changing attack methods.

[0023] As a preferred option, during the archiving and loop execution of the results of step 7, the logs, difference feedback information, and rollback operations during each strategy generation, execution, and revision process are written into the audit and knowledge base; tags are added to typical scenarios that are successfully blocked to facilitate rapid retrieval and invocation of similar scenarios in the future; when encountering similar security incidents in the next round, the proven effective defense action combination can be directly reused to reduce the delay in model recalculation and deployment configuration. By auditing the entire execution process and archiving the knowledge base and adding tags to the successfully blocked scenarios, existing experience can be quickly retrieved and invoked when similar attacks occur in the future, significantly reducing the overhead of model recalculation and device reconfiguration, improving the efficiency of responding to repeated or similar security incidents, and forming a sustainable and iterative security knowledge system.

[0024] The present invention also requests protection for a security decision execution system based on adaptive feedback, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the method steps described in any one of claims 1 to 9 are completed.

[0025] The present invention has the following beneficial effects:

[0026] In response to the problems in the background technology such as difficulty in dynamically identifying and defending against multi-stage complex threats, difficulty in effectively extracting key features, and lack of adaptive optimization mechanisms, this paper proposes a multi-stage network security defense method based on adaptive feedback, which has the following beneficial effects:

[0027] (1) Significantly enhance the dynamic tracking and linkage protection of multi-stage complex threats. After acquiring security event characteristics, the present invention can perform multi-dimensional correlation analysis on attack characteristics at each stage, and achieve real-time monitoring and feedback optimization of defense strategies during execution. This overcomes the limitations of traditional static rules in adapting to advanced persistent threats (APTs), zero-day vulnerabilities, and linkage multi-stage attacks, and effectively improves the ability to capture and defend against diverse attack scenarios.

[0028] (2) Accurately identify key features and eliminate redundancy or noise interference. This invention enhances the focus of threat detection by deeply mining and dynamically screening key dimensions within a large amount of heterogeneous security event data to eliminate redundant feature data that is irrelevant to the actual threat or highly interfering. Compared with existing solutions, this feature identification mechanism enables more accurate generation of defense strategies and reduces misjudgments or strategy lags caused by noise or low-value information.

[0029] (3) The adaptive optimization mechanism enables efficient and flexible policy iteration. Compared to some traditional defense solutions that rely on historical event matching or preset rules, the adaptive feedback-based design of this invention enables timely differential analysis of policy execution effects and makes iterative corrections. Once a new threat or execution deviation is identified, the system can automatically adjust defense measures to avoid policy lags and misjudgments. This process shortens the time window for critical asset exposure and significantly improves the effectiveness and accuracy of the network defense system.

[0030] (4) Efficient protection for multi-dimensional, large-scale security data. This invention utilizes comprehensive multi-source data processing and dynamic correlation analysis technology to support the rapid processing and feature extraction of massive security events in the Internet of Things, cloud computing, and big data environments. By automatically analyzing key features in large-scale data and updating models in a timely manner, the system is more stable and scalable in responding to multi-scenario threats, providing a highly scalable, integrated solution for current network security operations.

[0031] (5) The overall defense system changes from passive response to active prediction. By continuously accumulating and updating defense strategies, the present invention can not only quickly respond to real-time security incidents, but also perform forward-looking optimization based on adaptive feedback results, and establish an early prevention mechanism for potential attack risks. Compared with the traditional passive detection-blocking mode, the present invention injects self-learning and self-evolution capabilities into the decision-making link of network security strategies, making the network security system more intelligent and proactive. In summary, compared with the existing technology, the method of the present invention has more accurate threat identification capabilities, higher scene matching accuracy, faster strategy generation response efficiency, and intelligent and adaptive strategy optimization advantages, which comprehensively solves the shortcomings faced by the background technology and embodies obvious innovation and advancement. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] In order to more clearly illustrate the technical solutions and advantages of the embodiments of the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the prior art descriptions. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0033] Figure 1 A flowchart of a multi-stage network security threat defense method based on AI adaptive optimization provided by one embodiment of the present invention. DETAILED DESCRIPTION

[0034] In order to further illustrate the technical means and effects adopted by the present invention to achieve the predetermined purpose of the invention, the following, in conjunction with the accompanying drawings and preferred embodiments, describes in detail the specific implementation method, structure, features and effects of a multi-stage network security threat defense method based on AI adaptive optimization proposed by the present invention. In the following description, different "one embodiment" or "another embodiment" does not necessarily refer to the same embodiment. In addition, specific features, structures or characteristics of one or more embodiments may be combined in any suitable form.

[0035] Unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention belongs.

[0036] The following describes in detail a specific solution of a security decision execution method based on adaptive feedback provided by the present invention with reference to the accompanying drawings.

[0037] A security decision execution method based on adaptive feedback includes the following steps:

[0038] Step 1: Data collection and preprocessing, real-time acquisition of security event data from network traffic, system logs, and alarm information, formatting, deduplication, and noise reduction operations on the security event data, and storing the processed feature data in a database; in data collection and preprocessing, the method for deduplication and noise reduction of the security event data includes: using a hash fingerprint algorithm to generate unique fingerprint information for network traffic segments or log entries, and determining duplicate fingerprint information as duplicate data and deleting it; comparing the frequency of occurrence of the same source alarm within a preset time window, if the frequency exceeds the set threshold, it is determined to be a noise alarm and downgraded or eliminated. By using the hash fingerprint algorithm and frequency comparison, on the one hand, repeated or frequently occurring noise data can be accurately removed to prevent low-value alarms from occupying detection resources; on the other hand, the features extracted in subsequent analysis are made purer, improving the overall judgment accuracy and efficiency.

[0039] Step 2: Suspicious feature identification: Analyze the feature data through a trained attack detection model and output the corresponding attack feature vector and credibility score, wherein the attack detection model is trained based on a historical security event data set. The attack detection model used in suspicious feature identification includes: supervised training using the feature vectors and corresponding labels of multiple historical attack events; solidifying the model parameters that perform best during the training process to output a credibility score for real-time security event data during the deployment phase; when the credibility score is higher than the set threshold, it is determined to be a suspicious feature, and when it is lower than the set threshold, it is determined to be a normal or low-risk feature. Through supervised training of historical attack events and solidification of optimal model parameters, suspicious behavior features in the current environment can be quickly and accurately identified, and potential high-risk threats can be timely marked, thereby reducing the chance of missed or false positives and improving overall detection efficiency.

[0040] Step 3: Initial security decision generation. Based on the attack feature vector and credibility score, an algorithm is used to calculate defense priorities and output a set of defense solutions, which includes several executable security actions. The algorithm calculation process includes: multi-dimensional aggregation of the attack feature vector, generating a score for each security action based on threshold comparison and weighted calculation, and obtaining security actions with scores no less than a preset threshold to form the set of defense solutions. During the initial security decision generation, generating the set of defense solutions includes: assigning weights and penalty coefficients to the suspicious features according to different hazard levels or feature types; weightedly adding the weights and penalty coefficients to obtain a comprehensive score. If the comprehensive score exceeds a first threshold, the corresponding defense action is included in the security solution; if it falls below a second threshold, the action is eliminated; and the selected multiple security actions are combined to form the set of defense solutions. By assigning weights and penalty coefficients to suspicious features according to different levels or types, and using threshold judgment to select more targeted and necessary security actions, irrelevant or redundant operations can be effectively reduced, improving the efficiency and effectiveness of defense solution execution.

[0041] Step 4: Security action execution and real-time monitoring: the defense solution set is sent to the security orchestration execution unit to call security actions sequentially or in parallel in the target network; at the same time, traffic, alarm and system status data are continuously collected during the execution process to monitor the execution results of security actions and changes in attack behaviors; in the step of security action execution and real-time monitoring, by deploying an execution monitoring agent module in the security orchestration execution unit, the execution status of actions such as firewall rule updates, endpoint process blocking or network connection termination is regularly polled; when the execution monitoring agent module detects that the execution success rate or blocking rate is continuously lower than the set ratio threshold, the information is marked as policy failure and difference feedback information is issued. Polling and comparing the execution status during the actual defense strategy execution process can timely discover situations where the strategy execution effect is poor or the blocking capability is insufficient, and automatically issue difference feedback information to provide data support for subsequent adaptive strategy optimization, thereby ensuring the consistency and real-time nature of network security protection.

[0042] Step 5: Difference Analysis and Adaptive Feedback: The monitored execution results are compared with the defense solution set obtained in Step 3. If the actual execution effect of the security action is detected to be lower than the expected score or a new attack feature vector emerges, difference feedback information is calculated. This difference feedback information includes the degree of deviation, suspicious new features, and possible correction suggestions for the current solution set. In this difference analysis and adaptive feedback, the execution monitoring results are compared with the expected blocking indicators of the initial defense solution. If the difference exceeds a set threshold, the corresponding suspicious features are extracted and generated as difference feedback information. The system then checks for new attack feature vectors or unknown risk types. If the similarity is less than a preset value, the threat is marked as an unknown threat. This difference feedback information, along with the unknown threat features, is sent to the adaptive feedback module, triggering new policy revisions or rollbacks. By comparing the execution monitoring results with the expected indicators, deviations in policy execution can be quickly identified. New high-risk or unknown features are automatically flagged and incorporated into the feedback analysis, significantly improving the ability to respond to sudden threats. This can also trigger the next round of policy revisions or rollbacks, forming an adaptive closed loop.

[0043] Step 6: Dynamic Revision and Iterative Update: The difference feedback information is input into the attack detection model or the policy optimization module associated with it, and the defense solution set is recalculated through incremental training or parameter updates. If a significant conflict or invalid blocking of the current security action is detected, a rollback operation is triggered and the rollback reason and the new solution set are recorded in the database. The rollback operation includes automatically disabling the current abnormal action and enabling a new action sequence for experimental blocking based on a previously saved security status snapshot. During the policy revision and dynamic optimization process, the rollback operation includes: based on the system security status snapshot automatically generated upon key step completion, triggering a rollback to the most recent security status snapshot if the current action causes a significant increase in device anomalies or false positives. The action type, triggering reason, and impact on the system of the rollback are recorded for subsequent audits and incremental training. By generating a system security status snapshot after key steps are completed, the system can quickly restore to the previous stable state in the event of execution anomalies or an increase in false positives, effectively preventing further risk spread. The rollback information is also retained to facilitate subsequent model fine-tuning and audit compliance. Strategy revision and dynamic optimization include: adding differential feedback information and corresponding monitoring data to the training set, and using incremental training to update some of the weights of the attack detection model; if the new model's detection accuracy is higher than the original model after verification, the new model is activated and the defense plan is recalculated; otherwise, the original model parameters are rolled back and the reason for the verification failure is recorded; after successfully adopting the revised strategy, it is executed again and monitored in real time, forming a multi-round iterative closed loop. Updating the attack detection model through incremental training allows it to quickly adapt to the latest threat signatures; verifying the training results and conditionally enabling the new model to ensure real-time defense effectiveness while maintaining model stability; and continuously optimizing the strategy in multiple closed loops to adapt to dynamically changing attack methods.

[0044] Step 7: Results Archiving and Loop Execution: Monitoring data, differential feedback information, and adjusted defense solution sets from the execution process are archived and updated to the security knowledge database. Effective blocking strategies obtained during this round of execution are tagged and stored for rapid query and reuse in subsequent similar attack scenarios, allowing for the next round of loop execution. During the results archiving and loop execution process, logs, differential feedback information, and rollback operations from each strategy generation, execution, and revision process are written to the audit and knowledge base. Typical scenarios that were successfully blocked are tagged for rapid retrieval and recall of similar scenarios. When encountering similar security incidents in the next round, proven effective defense action combinations can be directly reused, reducing model recalculation and deployment latency. By auditing the entire execution process and archiving them in the knowledge base, and by tagging successfully blocked scenarios, existing experience can be quickly retrieved and recalled in subsequent similar attacks, significantly reducing the overhead of model recalculation and device reconfiguration, improving the efficiency of responding to repeated or similar security incidents, and forming a continuously iterative security knowledge system.

[0045] Example 1:

[0046] See also Figure 1 , which shows a flow chart of a multi-stage network security threat defense method based on adaptive feedback provided by an embodiment of the present invention, the method comprising:

[0047] Step S1: Data acquisition and preprocessing.

[0048] First, load the scenario library, policy library, and pending security events. The system loads the scenario library and policy library at startup. The scenario library contains data features from multiple historical security events, while the policy library stores the defense strategies for resolving each historical security event. The network continuously receives new security events (pending security events), which contain multi-dimensional features (numerical, textual, and other).

[0049] Then, deduplication and noise reduction are performed. Through hash fingerprint detection, unique fingerprint information is generated for network traffic segments or log entries. If the same fingerprint appears repeatedly, it is considered duplicate data and deleted. Through frequency detection, the number of times the same-source alarm appears within a preset time window (such as 30 seconds) is counted. If the frequency exceeds a certain threshold (such as 5 times), it is determined to be noise and downgraded or eliminated. Finally, the cleaned feature data is output and stored in the database.

[0050] Step 2: Identify suspicious features.

[0051] First, develop an attack detection model. This embodiment uses a trained AI model (such as a deep learning classifier, random forest, or Bert-BiLSTM-CRF) to infer the feature data output in step 1. The model is supervised and trained based on historical attack event data, and the optimal model parameters are fixed during deployment.

[0052] Then, the suspicious feature vector and credibility score are calculated. Assume that the feature of the input security event is vector x=(x1,x2,…,x n ), the model outputs an attack feature vector f=(f1,f2,…,f m ) and a credibility score S.

[0053] The calculation formula of the credibility score S is:

[0054] S=σ(W·x+b)

[0055] Where: σ(·) represents the activation function (such as Sigmoid); W and b are the weight matrix and bias term obtained from model training.

[0056] When S ≥ θ (e.g., 0.7), the event is judged to contain “suspicious features”; otherwise, it is considered normal or low risk.

[0057] Step 3: Initial security decision generation.

[0058] First, calculate the multi-dimensional aggregation and security action score. For the suspicious feature vector f=(f1,f2,…,f m ), in this embodiment, each feature f i Assign a weight w i .

[0059] Then a certain safety action A j The comprehensive score can be expressed as:

[0060]

[0061] where w i is the weight, when f i The larger the w i The higher the weight, the higher the priority of the action.

[0062] Then, threshold determination and solution set formation are performed. Set two thresholds: τ1 (such as 0.6) and τ2 (such as 0.2). If an action A j If the Score of the action is ≥ τ1, it will be included in the “defense solution set”; if the Score is ≤ τ2, it will be directly eliminated; the remaining actions in the middle range can be further confirmed by the system or administrator.

[0063] Finally, the result is output. This step obtains a "defense solution set" formed by combining several security actions.

[0064] Step 4: Execution of safety actions and real-time monitoring.

[0065] First, security orchestration is executed. The system sends the "defense plan set" to the security orchestration execution unit. Each security action (such as blocking IP addresses, isolating hosts, and terminating processes) is invoked sequentially or in parallel on the firewall, IDS, or endpoint agent.

[0066] Then, the monitoring agent module is executed. The execution process is polled or monitored based on event callbacks. If the execution success rate or blocking rate is detected to be lower than a certain threshold (such as 50%) for multiple consecutive times, the current strategy is judged to be at risk of "failure" and difference information is generated.

[0067] Step 5: Gap analysis and adaptive feedback.

[0068] First, we establish a difference evaluation formula. If we define an action A j The expected score is Score exp (A j ), and the effectiveness (such as blocking rate) actually monitored during implementation is Score obs (Aj), the calculation formula of the difference Δ can be defined as:

[0069] △(A j )=|Score obs (A j )-Score exp (A j )|

[0070] If Δ(A j ) exceeds a certain threshold (such as 0.1), then A j It is believed that the execution deviation is too large, resulting in "differential feedback information".

[0071] Then, the unknown threat is marked. For a newly added suspicious feature vector f′, if its similarity (e.g., cosine similarity) with the existing feature database is less than 0.5, it is marked as an “unknown threat” and sent to the adaptive feedback module along with the difference information.

[0072] Step 6: Dynamic correction and iterative update.

[0073] First, incremental training is performed. The difference information (Δ(A j )) and the new suspicious feature f′ are combined into the training set; the incremental training method is used to update some weights of the attack detection model:

[0074]

[0075] η is the learning rate; Represents the gradient direction based on difference feedback.

[0076] If the accuracy of the new model is better than that of the old model after verification, the new model will be enabled; otherwise, the model will be reverted to the original model and the reason for the failure will be recorded.

[0077] Finally, perform a rollback operation. If the system detects that the current security action has caused a major false alarm or conflict, a rollback can be called:

[0078] Immediately revoke abnormal actions based on the previously saved security status snapshot; enable a new action sequence for re-experimental blocking; record rollback details for auditing and subsequent incremental training.

[0079] Step 7: Result archiving and loop execution.

[0080] First, an audit and knowledge base update are performed. The execution data for this round (including the defense solution set, execution logs, difference feedback information, rollback details, incremental training results, etc.) is written to the audit and knowledge base. If this round successfully blocks an attack and is effective, a tag is added to the scenario and action combination to facilitate subsequent rapid retrieval and recall.

[0081] Then, the system executes in a loop. When the system receives a new security incident or a similar scenario recurs, it can directly reference proven strategies from the audit and knowledge base to reduce repeated calculations and configurations. If this is still insufficient to address the new threat, steps 1-6 are repeated, forming a multi-round, adaptive security defense closed loop.

[0082] Example 2:

[0083] The present invention provides a safety decision execution system based on adaptive feedback, which includes a memory, a processor and a computer program, wherein the memory is used to store the corresponding computer program, and the processor is used to run the corresponding computer program. When the computer program runs in the processor, it can implement the method described in steps S1 to S7.

[0084] It should be noted that the order in which the embodiments of the present invention are described above is for illustrative purposes only and does not necessarily represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0085] The various embodiments in this specification are described in a progressive manner, and the same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on the differences from other embodiments.

Claims

1. A security decision execution method based on adaptive feedback, characterized in that: The following steps are involved: Step 1: Data collection and preprocessing: real-time acquisition of security event data from network traffic, system logs, and alarm information. Formatting, deduplication, and noise reduction are performed on the security event data, and the processed feature data is stored in a database. Step 2: Suspicious feature identification: Analyze the feature data using a trained attack detection model, and output the corresponding attack feature vector and credibility score, where the attack detection model is trained based on a historical security event dataset. Step 3: Initial security decision generation: Based on the attack feature vector and credibility score, an algorithm is used to calculate the defense priority and output a defense solution set, where the defense solution set includes several executable security actions. The algorithm calculation process includes: performing multi-dimensional aggregation on the attack feature vector, generating a score for each security action based on threshold comparison and weighted calculation, and obtaining security actions with scores not lower than a preset threshold to form the defense solution set; Step 4: Security action execution and real-time monitoring: The defense solution set is sent to the security orchestration execution unit to invoke security actions sequentially or in parallel on the target network. Traffic, alarm, and system status data are continuously collected during the execution process to monitor the execution results of security actions and changes in attack behavior. Step 5: Difference Analysis and Adaptive Feedback: The monitored execution results are compared with the defense solution set obtained in Step 3. If the actual execution effect of the security action is detected to be lower than the expected score or a new attack feature vector appears, difference feedback information is calculated. This difference feedback information includes the degree of deviation, suspicious new features, and possible correction suggestions for the current solution set. Step 6: Dynamic correction and iterative update: The difference feedback information is input into the attack detection model or the strategy optimization module linked to the model, and the defense solution set is recalculated through incremental training or parameter update. If a major conflict or invalid blocking of the current security action is detected, a rollback operation is triggered and the rollback reason and the new solution set are recorded in the database. The rollback operation includes: automatically closing the current abnormal action and enabling a new action sequence for experimental blocking based on the previously saved security status snapshot; Step 7: Results archiving and loop execution: The monitoring data, difference feedback information, and adjusted defense solution set of the execution process are archived and updated to the security knowledge database; the effective blocking strategies obtained during this round of execution are labeled and stored so that they can be quickly queried and reused when similar attack scenarios are encountered in the future, and then enter the next round of loop execution.

2. The method for executing security decisions based on adaptive feedback according to claim 1, characterized in that: In the data collection and preprocessing of step 1, the method for deduplicating and reducing noise of the security event data includes: using a hash fingerprint algorithm to generate unique fingerprint information for network traffic segments or log entries, and determining duplicate fingerprint information as duplicate data and deleting it; comparing the frequency of occurrence of homologous alarms within a preset time window, and if the frequency exceeds a set threshold, it is determined to be a noise alarm and is downgraded or eliminated.

3. The method for executing security decisions based on adaptive feedback according to claim 1, characterized in that: In step 2, the attack detection model used in the suspicious feature identification includes: using the feature vectors and corresponding labels of multiple historical attack events for supervised training; solidifying the model parameters that perform best during the training process to output a credibility score for real-time security event data during the deployment phase; when the credibility score is higher than the set threshold, it is determined to be a suspicious feature; when it is lower than the set threshold, it is determined to be a normal or low-risk feature.

4. The method for executing security decisions based on adaptive feedback according to claim 1, characterized in that: In step 3, in the generation of the initial security decision, generating the defense plan set includes: configuring corresponding weights and penalty coefficients for the suspicious features according to different hazard levels or feature types; obtaining a comprehensive score based on weighted accumulation of weights and penalty coefficients; if the comprehensive score exceeds a first threshold, the corresponding defense action is included in the security plan; if it is lower than a second threshold, the action is eliminated; and combining multiple screened security actions to form a defense plan set.

5. The method for executing security decisions based on adaptive feedback according to claim 1, characterized in that: In step 4, during the execution and real-time monitoring of the security actions, an execution monitoring agent module is deployed in the security orchestration execution unit to periodically poll the execution status of actions such as firewall rule updates, endpoint process blocking, or network connection termination. When the execution monitoring agent module detects that the execution success rate or blocking rate is continuously lower than the set ratio threshold, the information is marked as a policy failure and difference feedback information is issued.

6. The method for executing security decisions based on adaptive feedback according to claim 1, characterized in that: In step 6, during the policy revision and dynamic optimization process, the rollback operation includes: based on the system security status snapshot automatically generated when the key steps are completed, triggering a rollback to the most recent security status snapshot when it is detected that the current action causes a significant increase in device abnormalities or false alarms; recording the action type, triggering reason, and impact on the system of this rollback for subsequent auditing and incremental training.

7. The method for executing security decisions based on adaptive feedback according to claim 1, characterized in that: In step 5, in the difference analysis and adaptive feedback, by comparing the gap between the execution monitoring results and the expected blocking indicators of the initial defense plan, if the gap is greater than the set threshold, the corresponding suspicious features are extracted and difference feedback information is formed, and it is checked whether new attack feature vectors or unknown risk types appear. If the similarity is less than the preset value, it is marked as an unknown threat; the difference feedback information and the unknown threat features are sent to the adaptive feedback module together to trigger a new policy correction or rollback judgment.

8. The method for executing security decisions based on adaptive feedback according to claim 1, characterized in that: In step 6, the strategy correction and dynamic optimization include: adding the difference feedback information and the corresponding monitoring data to the training set, and using incremental training to update some weights of the attack detection model; if the detection accuracy of the new model is higher than that of the original model after verification, the new model is enabled and the defense plan is recalculated; otherwise, the original model parameters are rolled back and the reason for the verification failure is recorded; after the correction strategy is successfully adopted, it is executed again and monitored in real time to form a multi-round iterative closed loop.

9. A security decision execution method based on adaptive feedback according to any one of claims 1 to 8, characterized in that: In step 7, during the result archiving and loop execution, the logs, difference feedback information and rollback operations of each strategy generation, execution and modification process are written into the audit and knowledge base; tags are added to typical scenarios that are successfully blocked to facilitate rapid retrieval and call of subsequent similar scenarios; when encountering similar security incidents in the next round, the verified effective defense action combination can be directly reused to reduce the delay of model recalculation and deployment configuration.

10. A security decision execution system based on adaptive feedback, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method steps according to any one of claims 1 to 9 are completed.

Images