A network security monitoring and early warning method and device of a business system, an electronic device, and a storage medium

Abstract

The present disclosure provides a network security monitoring and early warning method and device of a business system, an electronic device and a storage medium. The method comprises: acquiring multi-modal data of the business system, the multi-modal data comprising at least one of network traffic data, system log data, user data and device data; acquiring an ensemble learning model, the ensemble learning model comprising a plurality of machine learning models, each machine learning model corresponding to an adaptive dynamic weight; performing threat detection on the multi-modal data based on the plurality of machine learning models in the ensemble learning model to obtain a plurality of threat detection sub-results; performing fusion processing on the plurality of threat detection sub-results based on the adaptive dynamic weight corresponding to each machine learning model to obtain a threat detection result, the threat detection result comprising threat classification information; and performing early warning processing based on the early warning mode corresponding to the threat classification information. The dynamic weight adjustment mechanism enables the model to improve the overall detection performance according to the real-time changes of the data.

Description

Technical Field

[0001] This disclosure relates to the field of network security technology, and in particular to a network security monitoring and early warning method, device, electronic device and storage medium for a business system. Background Technology

[0002] With the continuous development of computer and network technologies, online businesses are booming, and the resulting security issues are becoming increasingly serious.

[0003] During the operation of a business system, there may be external attacks that threaten the network security of the business system, thus affecting its network security.

[0004] In the process of realizing this disclosure, it was found that the existing technology has at least the following technical problems: existing threat detection mostly relies on pre-set rules or models trained based on historical data, which makes it difficult to quickly adapt to the complex characteristics and dynamic change patterns of new threats, and cannot detect and warn of network security threats in a timely and effective manner, which seriously affects the security and stability of business systems. Summary of the Invention

[0005] This disclosure provides a method, apparatus, electronic device, and storage medium for network security monitoring and early warning of business systems, which improves the accuracy of threat detection for business systems and enhances the network security of business systems.

[0006] According to one aspect of this disclosure, a method for network security monitoring and early warning of a business system is provided, comprising:

[0007] Acquire multimodal data from the business system, wherein the multimodal data includes at least one of network traffic data, system log data, user data, and device data;

[0008] Obtain an ensemble learning model, which includes multiple machine learning models, each of which corresponds to adaptive dynamic weights;

[0009] Based on the multiple machine learning models in the ensemble learning model, threat detection is performed on the multimodal data to obtain multiple threat detection sub-results;

[0010] Based on the adaptive dynamic weights corresponding to each of the machine learning models, the multiple threat detection sub-results are fused to obtain a threat detection result, which includes threat classification information.

[0011] Early warning processing is performed based on the warning method corresponding to the threat classification information.

[0012] Optionally, the ensemble learning model is represented as {M1, M2, ... M}. n}, where Mi Characterize the i-th machine learning model;

[0013] Any machine learning model M i The methods for determining adaptive dynamic weights include:

[0014] Obtain the performance metrics for each machine learning model within the time window t, including accuracy and recall.

[0015] Based on the machine learning model M i The machine learning model M is calculated using the performance metrics within time window t, the performance metrics corresponding to the machine learning model within time window t, and the weight data of the performance metrics. i Adaptive dynamic weights.

[0016] Optionally, the machine learning model M i The adaptive dynamic weights are calculated using the following formula:

[0017]

[0018] Among them, Acc i，t For the machine learning model M i Accuracy within time window t, Rec i，t For the machine learning model M i The recall rate within the time window t, where α and β are the weighted data of the performance metrics.

[0019] Optionally, the method further includes:

[0020] The current alarm information is generated based on the threat detection results, and the current alarm information is output through the warning method;

[0021] Obtain historical alarm information from the business system, perform correlation information mining based on the historical alarm information and the current alarm information to obtain alarm correlation information, and display the alarm correlation information.

[0022] Optionally, the step of mining correlation information based on the historical alarm information and the current alarm information to obtain alarm correlation information includes:

[0023] A time window is set based on the timestamp of the current alarm information, and the alarm information within the time window is obtained to form an alarm information set, which includes the current alarm information and historical alarm information.

[0024] Extract the features of each alarm information in the alarm information set, and perform clustering processing on the alarm information based on the features of each alarm information to obtain at least one cluster. The cluster includes at least one alarm information, and the alarm information in the same cluster is related.

[0025] For at least one alarm message in each cluster, identify the causal relationship between the at least one alarm message, and use the alarm causal relationship as the alarm association information.

[0026] Optionally, the step of mining correlation information based on the historical alarm information and the current alarm information to obtain alarm correlation information includes:

[0027] The historical alarm information and the current alarm information are sorted based on timestamps to obtain an alarm information sequence;

[0028] Time series analysis is performed on the alarm information sequence to obtain the alarm pattern, and the alarm pattern is used as the alarm association information.

[0029] Optionally, the step of mining correlation information based on the historical alarm information and the current alarm information to obtain alarm correlation information includes:

[0030] A network security knowledge graph is constructed based on the network traffic data, system log data, user data, device data, and entity information and relationships in threat types corresponding to historical alarm information and the current alarm information, respectively.

[0031] Based on the network security knowledge graph, the attack links of the business system within the time span of the historical alarm information and the current alarm information are identified, and the attack links are used as the alarm association information.

[0032] According to another aspect of this disclosure, a network security monitoring and early warning device for a business system is provided, comprising:

[0033] The data acquisition module is used to acquire multimodal data from the business system, wherein the multimodal data includes at least one of network traffic data, system log data, user data, and device data;

[0034] The threat detection sub-result determination module is used to acquire an ensemble learning model, which includes multiple machine learning models, each of which corresponds to an adaptive dynamic weight; and to perform threat detection on the multimodal data based on the multiple machine learning models in the ensemble learning model, thereby obtaining multiple threat detection sub-results.

[0035] The threat detection result determination module is used to fuse the multiple threat detection sub-results based on the adaptive dynamic weights corresponding to each of the machine learning models to obtain a threat detection result, which includes threat classification information.

[0036] The early warning module is used to perform early warning processing based on the early warning method corresponding to the threat classification information.

[0037] According to another aspect of this disclosure, an electronic device is provided, the electronic device comprising:

[0038] At least one processor; and

[0039] A memory communicatively connected to the at least one processor; wherein,

[0040] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to execute the network security monitoring and early warning method for the business system described in any embodiment of this disclosure.

[0041] According to another aspect of this disclosure, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the network security monitoring and early warning method of the business system described in any embodiment of this disclosure.

[0042] The technical solution of this disclosure improves data comprehensiveness and provides data support for threat detection by acquiring multimodal data from the business system. Multiple machine learning models in an ensemble learning model are used to perform threat detection on the multimodal data of the business system, resulting in multiple threat detection sub-results. These sub-results are then fused based on adaptive dynamic weights corresponding to each machine learning model to obtain the final threat detection result. This dynamic weight adjustment mechanism allows the model to fully leverage the advantages of different models based on real-time data changes, improving overall detection performance. Early warning processing is then performed based on the threat classification information in the threat detection results, achieving intelligent early warning and facilitating timely handling of threat events by security management personnel, thereby improving the network security of the business system.

[0043] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of this disclosure, nor is it intended to limit the scope of this disclosure. Other features of this disclosure will become readily apparent from the following description. Attached Figure Description

[0044] To more clearly illustrate the technical solutions in the embodiments of this disclosure, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this disclosure. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0045] Figure 1 This is a flowchart of a network security monitoring and early warning method for a business system provided in this disclosure embodiment;

[0046] Figure 2 This is a flowchart of a network security monitoring and early warning method for a business system provided in this disclosure embodiment;

[0047] Figure 3 This is a schematic diagram of the structure of a network security monitoring and early warning device for a business system provided in an embodiment of this disclosure;

[0048] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. Detailed Implementation

[0049] To enable those skilled in the art to better understand the present disclosure, the technical solutions of the present disclosure will be clearly and completely described below with reference to the accompanying drawings of the embodiments. Obviously, the described embodiments are only some embodiments of the present disclosure, and not all embodiments. Based on the embodiments of the present disclosure, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present disclosure.

[0050] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this disclosure are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this disclosure described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0051] The acquisition, storage, and / or processing of data in the technical solutions involved in this application comply with the relevant provisions of national laws and regulations. It should be noted that certain software, components, models, and other existing solutions in the industry may be mentioned in the embodiments of this application. These should be considered as exemplary, and their purpose is only to illustrate the feasibility of implementing the technical solutions of this application, but does not mean that the applicant has used or necessarily used such solutions.

[0052] Figure 1 This is a flowchart illustrating a network security monitoring and early warning method for a business system provided in this embodiment. This embodiment is applicable to situations where the network security of a business system is monitored during its operation, and an automatic early warning is issued when a threat is detected. This method can be executed by a network security monitoring and early warning device for the business system. This device can be implemented in hardware and / or software and can be configured in devices such as terminal devices, computer equipment, or servers. Figure 1 As shown, the method includes:

[0053] S110. Obtain multimodal data from the business system, wherein the multimodal data includes at least one of network traffic data, system log data, user data, and device data.

[0054] S120. Obtain an ensemble learning model, wherein the ensemble learning model includes multiple machine learning models, and each machine learning model corresponds to an adaptive dynamic weight.

[0055] S130. Based on the multiple machine learning models in the ensemble learning model, threat detection is performed on the multimodal data to obtain multiple threat detection sub-results.

[0056] S140. Based on the adaptive dynamic weights corresponding to each of the machine learning models, the multiple threat detection sub-results are fused to obtain a threat detection result, which includes threat classification information.

[0057] S150. Perform early warning processing based on the early warning method corresponding to the threat classification information.

[0058] A business system can be understood as a system that conducts business activities and provides services through an internet platform, and can include information exchange, service provision, and commercial transactions via the network. For example, a business system can be an online business system, and the online business performed by this system may include, but is not limited to, online transaction business based on e-commerce platforms, online financial business, online multimedia content service business, online sharing business, online social business, online medical business, and online government affairs business. A business system can also be an enterprise business system used to execute internal enterprise business.

[0059] During the operation of the business system, multimodal data of the business system is acquired in real time or periodically to detect threats to the business system, and to provide early warning when the business system is detected to be under threat, so as to ensure the network security of the business system.

[0060] Multimodal data includes at least one of network traffic data, system log data, user data, and device data. Network traffic data can be understood as dynamic information recording data transmission within the network, serving as crucial evidence for monitoring network activity and detecting abnormal behavior. Specifically, network traffic data can include packet information, traffic statistics, and connection information. Packet information includes, but is not limited to, source IP address, destination IP address, source port, destination port, and protocol type, used to characterize the sender, receiver, and protocol used for transmission. Traffic statistics include, but are not limited to, traffic volume (amount of data transmitted per unit time), traffic rate (data transmission speed), number of packets, and number of bytes, used to characterize network congestion and the presence of abnormal traffic fluctuations. Connection information includes, but is not limited to, connection establishment time, connection duration, and connection status, used to characterize the lifecycle and current state of network connections, helping to detect abnormal connection behavior, such as connections left open for extended periods or frequent connection attempts.

[0061] System log data is a record generated during system operation, detailing various system activities and events, and is crucial for analyzing system status and troubleshooting. System log data includes operating system log information, application log information, and security log information. Operating system log information includes system startup and shutdown records, system error information (such as kernel errors and driver failures), system service status changes (such as service startup, shutdown, and restart), and user login and logout information (login time, logged-in user, and logged-in IP address). Application log information records the application's runtime process, such as application operation records (file read / write, database operations), error logs (program crashes and exceptions), and performance metrics (response time and throughput). Security log information records security-related events, such as user permission changes, access control events (authorization and denial of access), security policy enforcement status, and intrusion detection system alarms.

[0062] User data is used to characterize user actions and activity patterns within a business system. Analyzing user data can identify normal and abnormal user behavior patterns. User data includes, but is not limited to, user login information, action behavior data, action frequency information, and user permission data. User login information includes, but is not limited to, login time, login location (located via IP address), login device type (e.g., PC, mobile phone, tablet), and login method (password login, fingerprint login, verification code login). Action behavior data can be understood as user access and operation information for system resources, such as accessed pages, clicked buttons, submitted forms, and executed commands. Action frequency information records the number of times a user performs a certain operation within a certain period, such as file download frequency or data query frequency. User permission data includes the user's permission level, permission change records, and the corresponding operation scope of permissions, used to determine whether a user's operation is within their authorized scope and to prevent unauthorized operations.

[0063] Device data is used to describe the basic characteristics and operating status of various devices in the business system, characterizing their health and performance. Device data includes basic device attributes, hardware configuration information, device operating status data, and device configuration information. Basic device attributes include device name, model, manufacturer, serial number, and location. Hardware configuration information covers CPU model, number of cores, clock speed, memory capacity, hard drive capacity, and graphics card model. Device operating status data includes CPU utilization, memory usage, hard drive I / O read / write speed, network interface traffic, device temperature, and fan speed. Device configuration information records the device's network configuration (IP address, subnet mask, gateway), software installation status (operating system version, application version), and service configuration (enabled services, service ports).

[0064] Preprocessing of multi-dimensional data includes at least one of the following: cleaning the multi-dimensional data to remove duplicate and erroneous data; and processing numerical data using normalization and standardization methods to unify the data scale. For unstructured log data, natural language processing techniques are used to extract key information and transform it into structured data.

[0065] In this embodiment, threat detection is performed on multi-dimensional data using an ensemble learning model. The ensemble learning model includes multiple machine learning models; for example, the ensemble learning model can be represented as {M1, M2, ... M...}. n}, where M i Characterize the i-th machine learning model.

[0066] The ensemble learning model can include, but is not limited to, random forests, XGBoost models, LightGBM models, Transformer models, convolutional neural network models, and graph neural network models. There is no limitation on the types and number of machine learning models included in the ensemble learning model; the machine learning models in the ensemble learning model can be dynamically updated according to needs. Threat detection of business systems can be performed using different machine learning models within the ensemble learning model. Machine learning models such as random forests, XGBoost models, and LightGBM models can process structured data and extract shallow features to obtain threat detection sub-results. Deep learning models such as Transformer models, convolutional neural network models, and graph neural network models have advantages in handling complex patterns and high-dimensional data, and can process multi-dimensional data from business systems to obtain threat detection sub-results.

[0067] By using multiple machine learning models to analyze multi-dimensional data of business systems from different perspectives, the complex characteristics of threats to business systems can be fully captured, making up for the shortcomings of traditional single models in feature extraction capabilities, thus effectively addressing the problems of single and lagging threat detection technologies.

[0068] Specifically, the preprocessed multi-dimensional data is input into each machine learning model. Each model then performs threat detection on the preprocessed multi-dimensional data to obtain threat detection sub-results. These sub-results can be in numerical form, representing the severity of the threat detected by the machine learning model. The severity of the threat is positively correlated with the numerical value. The magnitude of the potential loss and the scope of impact on the business system under threat reflect the severity of the threat.

[0069] The threat detection result is obtained by fusing multiple threat detection sub-results. Specifically, the sub-results are weighted and fused based on the adaptive dynamic weights corresponding to each machine learning model. The adaptive dynamic weights for each machine learning model can be dynamically changed; for example, the adaptive dynamic weights for each machine learning model can be determined within each time window. By dynamically adjusting the weights of the machine learning models to adapt to changes in the business system's data, and considering the complex and ever-changing nature of cybersecurity threat scenarios, different models exhibit varying detection performance across different time windows and data scenarios, a dynamic weight allocation mechanism is designed to adjust the weights of each machine learning model's output in real time based on performance metrics such as accuracy and recall under different time windows and data scenarios. For example, if the XGBoost model has a high accuracy rate in detecting a certain type of network traffic anomaly within a certain time period, its weight will increase accordingly; conversely, when data patterns change and deep learning models perform better, the weights will be dynamically adjusted again. This dynamic weight adjustment mechanism allows the model to fully leverage the advantages of different models based on real-time data changes, improving overall detection performance, adapting promptly to evolving network threats, and avoiding detection lag caused by fixed model weights.

[0070] Optional, any machine learning model M i The method for determining the adaptive dynamic weights includes: obtaining the performance metrics of each machine learning model within a time window t, wherein the performance metrics include accuracy and recall; and based on the machine learning model M... i The machine learning model M is calculated using the performance metrics within time window t, the performance metrics corresponding to the machine learning model within time window t, and the weight data of the performance metrics. i Adaptive dynamic weights.

[0071] For example, machine learning model M i The adaptive dynamic weights are calculated using the following formula:

[0072]

[0073] Among them, Acc i，t For the machine learning model M i Accuracy within time window t, Rec i，t For the machine learning model M i The recall rate within the time window t, where α and β are the weighted data of the performance metrics.

[0074] Optionally, the multiple machine learning models in the ensemble learning model can be trained separately based on reinforcement learning. During the application of the ensemble learning model, the performance metrics of each machine learning model are determined within each time window to update the adaptive dynamic weights of each machine learning model.

[0075] Correspondingly, the fusion process of threat detection sub-results can be represented by the following formula:

[0076]

[0077] Among them, M i (x t x represents the threat detection sub-result output by machine learning model i. t The data at time t represents multi-dimensional data. R is the fused value, which can be matched with the fused value based on the classification threshold to determine the threat classification information. Threat classification information can include general, severe, and urgent. Different threat classification information can correspond to different warning methods. For example, general threats are notified to security management personnel via email, severe threats are alerted via both SMS and system pop-up, and urgent threats immediately trigger an audible and visual alarm and notify relevant personnel for emergency handling.

[0078] After handling a threat incident, security managers feed back the results and relevant information to the system. The system optimizes its detection model based on this feedback. If false positives or false negatives are detected, the system adds relevant data to the training dataset and retrains the model to further improve its detection accuracy and adaptability to new threats.

[0079] The technical solution of this embodiment improves data comprehensiveness and provides data support for threat detection by acquiring multimodal data from the business system. Multiple machine learning models within an ensemble learning model are used to perform threat detection on the multimodal data of the business system, resulting in multiple threat detection sub-results. These sub-results are then fused based on adaptive dynamic weights corresponding to each machine learning model to obtain the final threat detection result. This dynamic weight adjustment mechanism allows the model to fully leverage the advantages of different models based on real-time data changes, improving overall detection performance. Early warning processing is then performed based on the threat classification information in the threat detection results, achieving intelligent early warning and facilitating timely handling of threat events by security management personnel, thereby improving the network security of the business system.

[0080] In some embodiments of this disclosure, a model structure for a deep learning model is provided. This deep learning model includes a multimodal feature extraction module, a feature fusion module, a feature enhancement module, and a threat classification module. The multimodal feature extraction module may include multiple processing branch network blocks, such as CNN convolutional blocks, LSTM network blocks, and transformer network blocks. The CNN convolutional block may include multiple convolutional layers and pooling layers to perform local feature extraction on network traffic data. The LSTM network block may include LSTM layers and attention mechanism processing layers to process system log data, capturing the dependencies between log events, and applying self-attention to the LSTM layer output to highlight key events. The transformer network block may include multi-head attention layers and position encoding layers to process user data and device data; for example, it captures long-term dependencies of user operations through an 8-head attention mechanism, and adds positional information to behavioral sequences through a position encoding layer to avoid loss of temporal information.

[0081] The feature fusion module performs weighted fusion of features extracted from multiple processing branch network blocks in the multimodal feature extraction module to obtain fused features. The feature enhancement module may include residual blocks and Dropout layers. Residual blocks can alleviate the vanishing gradient problem and enhance feature representation; Dropout layers prevent overfitting. The threat classification module may include a multilayer perceptron and an output layer to output threat detection sub-results.

[0082] In some embodiments of this disclosure, optionally, the threat detection sub-result may also include the threat type and the confidence level of the threat type. For example, the threat types suffered by the business system include, but are not limited to, brute-force attacks, SQL injection attacks, cross-site scripting attacks, distributed denial-of-service attacks, and malware attacks. Different threat types can be reflected through anomalies in different data fields, that is, different threat types correspond to different performance fields. Taking brute-force attacks as an example, they can be reflected through the login time field, user ID field, and IP address field. For example, the login time field will show frequent and dense login attempt records, for example, a large number of login requests from the same IP address or different IP addresses appear in a short period of time; for example, for the user ID field, there may be one or more user IDs with an abnormally large number of failed login records, which are significantly different from the login failure frequency of normal users; for example, for the IP address field, it can be found that a specific IP address initiates a large number of login requests in a short period of time, or there are multiple abnormal IP addresses making login attempts, and these IP addresses may not be the normal access source of the business system.

[0083] Optionally, the threat detection result determined based on multiple threat detection sub-results includes the threat type and the confidence level of the threat type. When the confidence level of the threat type is greater than the confidence level threshold, the threat type of the corresponding threat event in the business system is determined, the field content corresponding to the threat type is obtained, and the threat type is verified using the field content. If there is an anomaly in the field content corresponding to the threat type, the verification is successful.

[0084] Optionally, threat detection identifies threat events in the business system, but the confidence scores for all known threat types are below the confidence threshold, indicating that a new threat type has been detected. Anomaly fields from the multimodal data are obtained and used as the corresponding representation fields for the new threat type, establishing a correspondence between the new threat type and the representation fields, providing a foundation for subsequent threat event and threat type monitoring. Furthermore, new sample data is generated based on the multimodal data and the new threat type. This new sample data is then used to update and train each machine learning model in the ensemble learning model, improving the ensemble learning model's adaptability to the business system.

[0085] Figure 2 This is a flowchart of a network security monitoring and early warning method for a business system provided in this disclosure embodiment. Based on the above embodiment, when a threat event is detected, current alarm information is generated, and correlation mining is performed on historical alarm information and current alarm information. Figure 2 As shown, the method includes:

[0086] S210. Obtain multimodal data from the business system, wherein the multimodal data includes at least one of network traffic data, system log data, user data, and device data.

[0087] S220. Obtain an ensemble learning model, wherein the ensemble learning model includes multiple machine learning models, and each machine learning model corresponds to an adaptive dynamic weight.

[0088] S230. Based on the multiple machine learning models in the ensemble learning model, threat detection is performed on the multimodal data to obtain multiple threat detection sub-results.

[0089] S240. Based on the adaptive dynamic weights corresponding to each of the machine learning models, the multiple threat detection sub-results are fused to obtain a threat detection result, which includes threat classification information.

[0090] S250. Generate current alarm information based on the threat detection results, and output the current alarm information based on the warning method corresponding to the threat classification information for warning processing.

[0091] S260. Obtain historical alarm information of the business system, perform correlation information mining based on the historical alarm information and the current alarm information to obtain alarm correlation information, and display the alarm correlation information.

[0092] The alarm information may include alarm attributes and abnormal pattern information. Alarm attributes include, but are not limited to, the timestamp of the alarm occurrence, the threat type, the device or user ID involved, the source IP address and the destination IP address of the alarm. Abnormal patterns can be understood as abnormal behavior patterns or network models. For example, abnormal behavior patterns may be user login behavior patterns. The pattern information corresponding to user login behavior patterns may include, but is not limited to, login frequency, login time period distribution and the number of accounts attempting to log in.

[0093] Each alarm message corresponds to a timestamp and stores historical alarm information. By correlating and mining historical alarm information with current alarm information, the problem of incomplete information in a single alarm message, which cannot restore the full picture of the threat event, and thus prevents network security personnel from quickly and comprehensively handling threat events in a timely manner is solved.

[0094] Optionally, the correlation information mining includes mining at least one of the following: alarm causality, alarm pattern, and attack chain. In some embodiments of this disclosure, historical alarm information and current alarm information are input into a correlation information mining model to obtain the above-mentioned at least one type of alarm correlation information. The correlation information mining model can be a pre-trained neural network model.

[0095] In some embodiments of this disclosure, correlation information mining is performed based on the historical alarm information and the current alarm information to obtain the following: setting a time window based on the timestamp of the current alarm information, acquiring alarm information within the time window to form an alarm information set, the alarm information set including the current alarm information and historical alarm information; extracting features of each alarm information in the alarm information set, clustering the alarm information based on the features of each alarm information to obtain at least one cluster, the cluster including at least one alarm information, and the alarm information in the same cluster being correlated; for at least one alarm information in each cluster, identifying the causal relationship between the at least one alarm information, and using the alarm causal relationship as the alarm correlation information.

[0096] This can be achieved by extracting features from any alarm information in the current and historical alarm information sets, for example, through a neural network model; or by converting the alarm information into vector features. Optionally, clustering algorithms can be used to cluster the features of each alarm information in the alarm information set to obtain at least one cluster. Alternatively, similarity data between alarm information can be determined based on the features of the alarm information, and the alarm information can be clustered based on this similarity data, with at least one alarm information satisfying the similarity condition forming a cluster, thus obtaining at least one cluster. Each cluster includes at least one alarm information, and the alarm information within the same cluster is correlated.

[0097] Optionally, a causal relationship database is pre-configured. This database may include multiple causal relationship rules. For alarm information in any cluster, matching is performed in the causal relationship database to determine alarm information that conforms to the causal relationship rules. Optionally, the causal relationship rules in the database may include a first alarm behavior pattern and a second alarm behavior pattern. The alarm information corresponding to the first alarm behavior pattern and the alarm information corresponding to the second alarm behavior pattern have a causal relationship. The causal relationship rules define the alarm behavior patterns corresponding to the "cause" and "effect," respectively. For example, the first alarm behavior pattern is a firewall abnormal interception alarm, and the second alarm behavior pattern is a large number of abnormal requests from the same source IP. If two alarm information in the same cluster satisfy the above causal relationship rules, then the two alarm information are determined to have a causal relationship, and the firewall interception is triggered by abnormal requests from that source IP. That is, the alarm information corresponding to the second alarm behavior pattern is the cause, and the alarm information corresponding to the first alarm behavior pattern is the effect.

[0098] Optionally, based on the causal relationships between alarm information identified during the operation of the business system, a causal relationship graph is constructed. This graph can include alarm nodes and the causal relationships between them. Alarm nodes include abnormal request alarm nodes and firewall interception alarm nodes, with abnormal request alarm nodes pointing to firewall interception alarm nodes via arrows, representing the causal relationship between them. Furthermore, the causal relationship types between alarm nodes can be marked in the graph. Constructing a causal relationship graph can be used to identify threat propagation chains within the business system, enabling threat attribution.

[0099] In some embodiments of this disclosure, alarm association information is mined based on the historical alarm information and the current alarm information to obtain alarm association information, including: sorting the historical alarm information and the current alarm information based on timestamps to obtain an alarm information sequence; performing time series analysis on the alarm information sequence to obtain an alarm pattern, and using the alarm pattern as the alarm association information.

[0100] Optionally, time series analysis algorithms can be used to analyze the alarm information sequence to obtain alarm patterns. These algorithms include, but are not limited to, ARIMA (Autoregressive Integrated Moving Average model) and LSTM (Long Short-Term Memory network model). An alarm pattern can be understood as a periodic or regular occurrence pattern of alarm information over time. For example, alarms triggered by a specific threat type may occur within a specific time period (e.g., afternoon) at a preset time interval (e.g., a week).

[0101] Optionally, by sorting the timestamps of alarm information in the alarm information set, and performing time-dimensional statistical processing on the sorted alarm information, statistical data can be obtained. This statistical data includes, but is not limited to, the frequency of alarm occurrences in different time periods, the frequency of alarms corresponding to each threat type in different time periods, the trend of alarm frequency changes, and the alarm interval for the same threat type. Time-series analysis of the alarm information sequence is then performed using the above statistical data to obtain alarm patterns. For example, the above statistical data can be used to create visual charts, and time-series analysis of the alarm information sequence can be performed using these visual charts to obtain alarm patterns.

[0102] By performing time-series analysis on alarm information sequences, alarm patterns in the time dimension can be obtained, which facilitates the timely detection and prevention of threat events and improves the network security of business systems.

[0103] In some embodiments of this disclosure, correlation information mining is performed based on the historical alarm information and the current alarm information to obtain alarm correlation information, including: constructing a network security knowledge graph based on entity information and correlation relationships in network traffic data, system log data, user data, device data, and threat types corresponding to the historical alarm information and the current alarm information, respectively; identifying the attack links of the business system within the time span of the historical alarm information and the current alarm information based on the network security knowledge graph, and using the attack links as the alarm correlation information.

[0104] For any alarm in the alarm information set, extract the entity information and relationships from the corresponding network traffic data, system log data, user data, device data, and threat types. Construct a network security knowledge graph based on the entity information and the relationships between them. Entity information includes, but is not limited to, devices (e.g., servers or terminals), user identifiers, threat types, data assets (e.g., databases or files), and vulnerabilities (e.g., CVE numbers). Relationships between entities include: operational relationships between users and devices, attack relationships between devices and threat types, exploitation relationships between threat types and vulnerabilities, and storage relationships between devices and data assets. Map each alarm in the alarm information set to its corresponding entity and relationship in the network security knowledge graph. Set timestamp attributes for the entities and relationships corresponding to alarm information in the network security knowledge graph to record the time range in which the alarm occurred.

[0105] Optionally, an attack chain within a time span can be determined using a graph traversal approach and a network security knowledge graph. For example, this could involve discovering the chain by traversing the graph starting from any alarm in the alarm information set. For instance, the current alarm could be used as the starting point for graph traversal, tracing back along relationships in the network security knowledge graph to determine the attack chain corresponding to the current alarm. Specifically, this could involve identifying entities with a relationship to the starting alarm, and determining candidate entities based on time constraints. The time constraint can be understood as the timestamp of the previous event being less than the timestamp of the next event on the chain. After determining the candidate entities corresponding to the starting alarm, this candidate entity is used as the current entity to continue determining candidate entities with a relationship to it that also satisfy the time constraints, and this process is recursively repeated until a candidate attack chain is formed.

[0106] The candidate attack chains are evaluated and verified, and unreasonable candidate chains are removed to obtain the attack chains corresponding to the business system. The evaluation and verification of candidate chains includes at least one of the following: evaluating the reasonableness of the attack phase sequence formed by the candidate chains; evaluating the temporal continuity of the candidate chains; and verifying the candidate chains by combining threat intelligence and domain knowledge. Optionally, multiple reasonable attack phase sequences are pre-set, and the reasonableness evaluation result is determined by the similarity between the reasonable attack phase sequences and the attack phase sequences formed by the candidate chains. Optionally, a continuity evaluation is performed by using the timestamps corresponding to entities / relationships in the candidate chains to obtain a continuity evaluation result. Optionally, a database containing threat intelligence and domain knowledge is set up, and the candidate chains are retrieved from the database for knowledge recall. The candidate chains are then matched with the recalled knowledge for similarity, and the knowledge verification result is determined based on the similarity data.

[0107] Based on the aforementioned rationality assessment results, continuity assessment results, and knowledge verification results, a comprehensive evaluation result for candidate links is determined. Based on this comprehensive evaluation result and screening thresholds, the attack link corresponding to the business system is identified. By constructing a security knowledge graph from historical and current alarm information and determining the attack links over a time span, alarms scattered across different time points can be linked into a complete attack path, clarifying the attack source and evolution process. By identifying early stages in the attack chain (such as scanning and probing), potential threats can be warned in advance. Furthermore, the importance of different assets in the attack chain can be quantified, optimizing the allocation of security resources.

[0108] The technical solution of this embodiment performs threat detection on the business system, generates current alarm information based on the threat detection results, and performs alarm correlation mining based on the current alarm information and historical alarm information. It effectively correlates the current alarm information and mines alarm correlations over a long period of time, providing support for accurate early warning and timely handling of network security incidents.

[0109] Figure 3 This is a schematic diagram of the structure of a network security monitoring and early warning device for a business system provided in an embodiment of this disclosure. Figure 3 As shown, the device includes:

[0110] The data acquisition module 310 is used to acquire multimodal data from the business system, wherein the multimodal data includes at least one of network traffic data, system log data, user data, and device data;

[0111] The threat detection sub-result determination module 320 is used to acquire an ensemble learning model, which includes multiple machine learning models, each of which corresponds to an adaptive dynamic weight; and to perform threat detection on the multimodal data based on the multiple machine learning models in the ensemble learning model to obtain multiple threat detection sub-results.

[0112] The threat detection result determination module 330 is used to perform fusion processing on the multiple threat detection sub-results based on the adaptive dynamic weights corresponding to each of the machine learning models to obtain a threat detection result, wherein the threat detection result includes threat classification information.

[0113] The early warning module 340 is used to perform early warning processing based on the early warning method corresponding to the threat classification information.

[0114] The technical solution of this embodiment improves data comprehensiveness and provides data support for threat detection by acquiring multimodal data from the business system. Multiple machine learning models within an ensemble learning model are used to perform threat detection on the multimodal data of the business system, resulting in multiple threat detection sub-results. These sub-results are then fused based on adaptive dynamic weights corresponding to each machine learning model to obtain the final threat detection result. This dynamic weight adjustment mechanism allows the model to fully leverage the advantages of different models based on real-time data changes, improving overall detection performance. Early warning processing is then performed based on the threat classification information in the threat detection results, achieving intelligent early warning and facilitating timely handling of threat events by security management personnel, thereby improving the network security of the business system.

[0115] Based on the above embodiments, optionally, the ensemble learning model is represented as {M1, M2, ... M}. n}, where M i Characterize the i-th machine learning model;

[0116] The device also includes an adaptive weight determination module, used to obtain the performance metrics of each machine learning model within a time window t, the performance metrics including accuracy and recall; based on the machine learning model M i The machine learning model M is calculated using the performance metrics within time window t, the performance metrics corresponding to the machine learning model within time window t, and the weight data of the performance metrics. i Adaptive dynamic weights.

[0117] Optionally, the adaptive weight determination module performs the following calculations:

[0118]

[0119] Among them, Acc i，t For the machine learning model M i Accuracy within time window t, Rec i，t For the machine learning model M i The recall rate within the time window t, where α and β are the weighted data of the performance metrics.

[0120] Optionally, based on the above embodiments, the device further includes: an association information mining module, used to generate current alarm information based on the threat detection results, the current alarm information being output through the warning method; to obtain historical alarm information of the business system, to perform association information mining based on the historical alarm information and the current alarm information to obtain alarm association information, and to display the alarm association information.

[0121] Optionally, the correlation information mining module is used to: set a time window based on the timestamp of the current alarm information, acquire the alarm information within the time window, form an alarm information set, the alarm information set including current alarm information and historical alarm information; extract the features of each alarm information in the alarm information set, perform clustering processing on the alarm information based on the features of each alarm information to obtain at least one cluster, the cluster including at least one alarm information, and the alarm information in the same cluster is correlated; for at least one alarm information in each cluster, identify the causal relationship between the at least one alarm information, and use the alarm causal relationship as the alarm correlation information.

[0122] Optionally, the association information mining module is used to: sort the historical alarm information and the current alarm information based on timestamps to obtain an alarm information sequence; perform time series analysis on the alarm information sequence to obtain an alarm pattern, and use the alarm pattern as the alarm association information.

[0123] Optionally, the association information mining module is used to: construct a network security knowledge graph based on entity information and relationships in network traffic data, system log data, user data, device data, and threat types corresponding to historical alarm information and the current alarm information, respectively; identify the attack links of the business system within the time span of the historical alarm information and the current alarm information based on the network security knowledge graph, and use the attack links as the alarm association information.

[0124] The network security monitoring and early warning device for business systems provided in this disclosure can execute the network security monitoring and early warning method for business systems provided in any embodiment of this disclosure, and has the corresponding functional modules and beneficial effects of executing the method.

[0125] Figure 4 This is a schematic diagram of the structure of an electronic device provided in an embodiment of this disclosure. The electronic device 10 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0126] like Figure 4As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0127] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0128] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, central processing unit (CPU), graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as network security monitoring and early warning methods for business systems.

[0129] In some embodiments, the network security monitoring and early warning method for a business system can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via read-only memory (ROM) 12 and / or communication unit 19. When the computer program is loaded into random access memory (RAM) 13 and executed by processor 11, one or more steps of the network security monitoring and early warning method for a business system described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute the network security monitoring and early warning method for a business system by any other suitable means (e.g., by means of firmware).

[0130] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0131] Computer programs used to implement the network security monitoring and early warning methods of the business systems disclosed herein can be written in any combination of one or more programming languages. These computer programs can be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs can be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0132] This disclosure also provides a computer-readable storage medium storing computer instructions for causing a processor to execute a network security monitoring and early warning method for a business system, the method comprising:

[0133] The system acquires multimodal data from a business system, including at least one of network traffic data, system log data, user data, and device data; acquires an ensemble learning model, which includes multiple machine learning models, each corresponding to an adaptive dynamic weight; performs threat detection on the multimodal data based on the multiple machine learning models in the ensemble learning model, obtaining multiple threat detection sub-results; fuses the multiple threat detection sub-results based on the adaptive dynamic weights corresponding to each machine learning model, obtaining a threat detection result, which includes threat classification information; and performs early warning processing based on the early warning method corresponding to the threat classification information.

[0134] In the context of this disclosure, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0135] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0136] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0137] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through a communication network. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0138] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this disclosure can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this disclosure can be achieved, and this is not limited herein.

[0139] The specific embodiments described above do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure should be included within the scope of protection of this disclosure.

Claims

1. A network security monitoring and early warning method of a business system, characterized in that, The method comprises: obtaining multi-modal data of a business system, the multi-modal data comprising at least one of network traffic data, system log data, user data and device data; wherein the user data represents the operation behavior and activity track of a user in the business system; and the device data describes the basic features and running state of various devices in the business system; An ensemble learning model is acquired, the ensemble learning model including a plurality of machine learning models, each of the machine learning models corresponding to an adaptive dynamic weight; the weights of the machine learning models are adjusted based on the accuracy and recall rates of the machine learning models in different time windows and data scenarios; wherein the adaptive dynamic weight of a machine learning model is calculated by the following formula: ​ wherein, is the machine learning model the accuracy at a time window t, is the machine learning model the recall at a time window t, and are weight data of the performance indicators, respectively; performing threat detection on the multi-modal data based on a plurality of machine learning models in an integrated learning model, to obtain a plurality of threat detection sub-results; the threat detection sub-result comprises a numerical value representing threat severity, a threat type and a confidence degree of the threat type; The threat detection results are obtained by performing fusion processing on the plurality of threat detection sub-results based on the adaptive dynamic weights corresponding to the respective machine learning models, wherein the fusion processing is represented as: threat detection result = f (threat detection sub-result 1, threat detection sub-result 2, …, threat detection sub-result n), wherein threat detection sub-result 1, threat detection sub-result 2, …, and threat detection sub-result n represent the plurality of threat detection sub-results, and f represents a fusion function. wherein, a threat detection sub-result output by the machine learning model i, a multi-dimensional data at time t, a fusion value; the threat grading information is determined by matching the grading threshold and the fusion value. performing early warning processing based on a corresponding early warning mode of the threat grading information; in a case where it is determined based on the threat detection result that a threat event exists in the business system, and the confidence degrees of known threat types are all less than a confidence degree threshold, determining that a new threat type is detected, obtaining an abnormal field in the multi-modal data, taking the abnormal field as a performance field corresponding to the new threat type, establishing a corresponding relationship between the new threat type and the performance field, and generating new sample data based on the multi-modal data and the new threat type, and updating and training the plurality of machine learning models in the integrated learning model based on the new sample data.

2. The method of claim 1, wherein, The ensemble learning model is represented as , wherein, represents the i-th machine learning model; Any machine learning model The determination manner of the adaptive dynamic weight of any machine learning model includes: obtaining performance indicators corresponding to each of the machine learning models in a time window t, the performance indicators comprising accuracy and recall rate; The adaptive dynamic weight of the machine learning model is calculated based on the performance indicators corresponding to the time window t respectively and the weight data of the performance indicators. of the machine learning model 3. The method of claim 1, wherein, The method further comprises: generating current alarm information based on the threat detection result, the current alarm information being output through the early warning mode; obtaining historical alarm information of the business system, performing association information mining based on the historical alarm information and the current alarm information, obtaining alarm association information, and displaying the alarm association information.

4. The method of claim 3, wherein, The association information mining based on the historical alarm information and the current alarm information to obtain alarm association information comprises: setting a time window based on the timestamp of the current alarm information, obtaining alarm information in the time window to form an alarm information set, the alarm information set comprising the current alarm information and the historical alarm information; extracting features of each alarm information in the alarm information set, performing clustering processing on the alarm information based on the features of each alarm information to obtain at least one clustering cluster, the clustering cluster comprising at least one alarm information, and the alarm information in the same clustering cluster having correlation; for at least one alarm information in each clustering cluster, identifying the causal relationship between the at least one alarm information, and taking the alarm causal relationship as the alarm association information.

5. The method of claim 3, wherein, The association information mining based on the historical alarm information and the current alarm information to obtain alarm association information comprises: sorting the historical alarm information and the current alarm information based on timestamps to obtain an alarm information sequence; performing time series analysis on the alarm information sequence to obtain an alarm pattern, and taking the alarm pattern as the alarm association information.

6. The method of claim 3, wherein, The association information mining based on the historical alarm information and the current alarm information to obtain alarm association information comprises: construct a network security knowledge graph based on entity information and association relationships in the threat types and network flow data, system log data, user data and device data corresponding to the historical alarm information and the current alarm information respectively; identify an attack link of the business system within a time span of the historical alarm information and the current alarm information based on the network security knowledge graph, and take the attack link as the alarm association information.

7. A network security monitoring and early warning device for a business system, characterized in that, Comprise: a data acquisition module configured to acquire multi-modal data of a business system, the multi-modal data comprising at least one of network flow data, system log data, user data and device data; wherein the user data represents the operation behavior and activity track of a user in the business system; and the device data describes the basic features and running state of various devices in the business system; The threat detection sub-result determination module is configured to obtain an ensemble learning model, wherein the ensemble learning model comprises a plurality of machine learning models, and each machine learning model corresponds to an adaptive dynamic weight; perform threat detection on the multi-modal data based on the plurality of machine learning models in the ensemble learning model, to obtain a plurality of threat detection sub-results; and the weight of each machine learning model is adjusted based on the accuracy and recall rate of the machine learning model in different time windows and data scenarios; wherein the adaptive dynamic weight of the machine learning model is calculated by the following formula: ​ wherein, is the machine learning model the accuracy at a time window t, is the machine learning model the recall at a time window t, and are weight data of the performance indicators, respectively; The threat detection result determination module is configured to perform fusion processing on the plurality of threat detection sub-results based on the adaptive dynamic weights corresponding to the machine learning models respectively, to obtain a threat detection result, wherein the threat detection sub-result includes a numerical value representing threat severity, a threat type, and a confidence degree of the threat type; the threat detection result includes threat classification information, a threat type, and a confidence degree of the threat type; and the fusion processing is represented as: wherein, a threat detection sub-result output by the machine learning model i, a multi-dimensional data at time t, a fusion value; the threat grading information is determined by matching the grading threshold and the fusion value. In a case where it is determined based on the threat detection result that the business system has a threat event, and the confidence of the known threat types is less than a confidence threshold, a new threat type is determined to be detected, an abnormal field in the multi-modal data is acquired, the abnormal field is taken as a performance field corresponding to the new threat type, a corresponding relationship between the new threat type and the performance field is established, new sample data is generated based on the multi-modal data and the new threat type, and the multiple machine learning models in the ensemble learning model are updated and trained based on the new sample data; an early warning module configured to perform early warning processing based on a pre-warning mode corresponding to the threat classification information.

8. An electronic device, comprising: The electronic device comprises: at least one processor; and a memory connected in communication with the at least one processor; wherein the memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the network security monitoring and early warning method of the business system according to any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions, and the computer instructions are used to enable the processor to implement the network security monitoring and early warning method of the business system according to any one of claims 1-6 when executed.

Images