End-network cooperative attack defense method driven by multi-source intelligence

Abstract

The invention discloses a multi-source intelligence-driven end-network cooperative attack defense method, which comprises the following steps of: S1, respectively acquiring terminal log data, network flow data, threat intelligence data and equipment state data, and carrying out standardization processing on the terminal log data, the network flow data, the threat intelligence data and the equipment state data; s2, constructing a feature data hypergraph by taking the standardized data as nodes; s3, inputting the hypergraph into a depth hypergraph anomaly detection model, extracting high-order correlation features and detecting an anomaly mode; s4, inputting an anomaly detection result into a hypergraph Transform sequence modeling mechanism, performing multi-head attention calculation and dynamic interaction, and generating a dynamic fusion feature; s5, judging an attack behavior in real time according to the dynamic fusion features, and generating an end-network cooperative linkage defense strategy; and S6, issuing a defense instruction in real time according to the defense strategy, and executing end-network cooperative attack defense. According to the invention, the real-time performance and accuracy of end-network cooperative attack defense are improved, and the overall efficiency of network security defense is enhanced.

Description

Technical Field

[0001] The present invention relates to the field of network security technology, and in particular to a multi-source intelligence-driven end-to-network collaborative attack defense method. Background Art

[0002] With the rapid development of information, digital, and intelligent technologies, cyberspace has gradually become a critical operating environment for nations, societies, and businesses, and a primary target for various attacks. In recent years, cyberattacks have become increasingly diverse, complex, and covert. Advanced persistent threats, ransomware attacks, phishing attacks, and other security incidents have frequently occurred, posing a serious threat to the secure and stable operation of network environments. To address these increasingly severe cybersecurity threats, cybersecurity defense technologies are gradually evolving from traditional passive defense strategies to active and intelligent defense. In particular, end-to-end collaborative defense technologies are becoming a key trend in cybersecurity development.

[0003] End-to-network collaborative defense technology effectively achieves rapid discovery, precise location, and timely response to network attacks through the collaborative linkage between endpoint security devices and network security devices. Existing technologies typically deploy antivirus software, terminal security protection systems, and other devices on the endpoint side to collect data such as log information, process information, file access records, and user behavior characteristics on the terminal to achieve terminal-level attack detection and preliminary defense; at the same time, firewalls, intrusion detection systems (IDS), intrusion prevention systems (IPS), and security gateways are deployed on the network side to monitor and identify attack behaviors by capturing and analyzing network traffic data. This method of endpoint and network devices working independently improves attack detection and defense effectiveness to a certain extent. However, due to the lack of an effective collaborative linkage mechanism between endpoint and network devices, information silos are easily formed. The intelligence information collected by endpoint security devices and network security devices cannot be fully and effectively shared and integrated, resulting in obvious deficiencies in the accuracy of attack detection and the timeliness of response.

[0004] To address the current situation of information silos between endpoints and network devices, existing technologies have proposed several intelligence fusion solutions, such as traditional data fusion techniques and graph neural network-based intelligence fusion methods. Traditional data fusion techniques generally employ statistical feature matching or rule-based fusion methods. These methods are often limited to expressing simple correlations when processing multi-source heterogeneous data and cannot accurately describe the complex and high-order correlations between attack intelligence data. Consequently, they are prone to false positives or false negatives when detecting complex attacks. While graph neural network-based data fusion methods, which have emerged in recent years, can express first-order or second-order relationships between nodes, they are limited by the structural constraints of GNNs and are therefore insufficient in expressing complex, high-order correlations between multiple nodes. In particular, in the actual detection of advanced threat attacks, multi-source heterogeneous data often exhibits more complex, high-order correlation patterns. Traditional graph neural networks struggle to effectively identify and extract these high-order correlation features, resulting in insufficient attack identification accuracy and significant room for improvement in response timeliness.

[0005] At the same time, cyberattacks themselves are inherently dynamic and sequential, evolving and changing over time. Static data processing and fusion methods are no longer effective in capturing the dynamic evolution of attacks. While the Transformer sequence model, with its self-attention mechanism, has achieved widespread success in natural language processing, the application of the Transformer sequence modeling mechanism to end-to-end collaborative security defense is still in its early stages of exploration. This approach lacks the ability to fully integrate sequence models with the structural and semantic characteristics of multi-source heterogeneous intelligence data, hindering the dynamic fusion of attack detection data and real-time response decision-making.

[0006] Therefore, how to provide a multi-source intelligence-driven end-to-end collaborative attack defense method is an urgent problem that technicians in this field need to solve. Summary of the Invention

[0007] One purpose of the present invention is to propose a multi-source intelligence-driven end-to-end collaborative attack defense method. The present invention adopts a technical means of combining the DeepHypergraphAD deep hypergraph anomaly detection algorithm with the HGTrans hypergraph Transformer dynamic fusion algorithm. By collecting terminal log data, network traffic data, threat intelligence data and device status data and performing feature standardization processing, a multi-source heterogeneous intelligence feature data hypergraph is constructed with standardized data as nodes, and the deep hypergraph anomaly detection model is used to accurately extract high-order correlation features and anomaly patterns between multi-source data; then, the anomaly detection results are input into the hypergraph Transformer The sequence modeling mechanism performs multi-head attention calculation and dynamic interaction to generate dynamic fusion features; then, based on the dynamic fusion features, the attack behavior type, location and threat level are judged and quantitatively analyzed in real time, an end-to-end coordinated defense strategy is generated, and defense instructions are sent to the target terminal security equipment and network security equipment in real time to execute coordinated defense, realizing the deep and accurate fusion of endpoint and network side intelligence information, significantly improving the real-time and accuracy of attack detection, and effectively solving the problems of information islanding of endpoints and network devices, insufficient fusion of multi-source intelligence and slow attack defense response in existing technologies, with the technical effects of real-time and rapid identification of attack behaviors, precise positioning and efficient coordinated response.

[0008] A multi-source intelligence-driven end-to-end coordinated attack defense method according to an embodiment of the present invention includes the following steps:

[0009] S1. Collect terminal log data, network traffic data, threat intelligence data, and device status data, and perform format unification, noise removal, feature extraction, and structured processing based on the data type to obtain standardized multi-source heterogeneous intelligence feature data.

[0010] S2. Using standardized multi-source heterogeneous intelligence feature data as nodes and high-order correlations between intelligence features as hyperedges, a hypergraph of multi-source heterogeneous intelligence feature data is generated based on the association rules of multi-source intelligence data.

[0011] S3. Input the hypergraph of multi-source heterogeneous intelligence feature data into the deep hypergraph anomaly detection model. Through node embedding, hyperedge embedding, and global embedding fusion, the high-order correlation features of the multi-source heterogeneous intelligence feature data are extracted. Based on the high-order correlation features, abnormal patterns in the multi-source intelligence data are identified, and anomaly detection results containing abnormal feature information are output.

[0012] S4, taking the anomaly detection results as input, through the sequence modeling mechanism of the hypergraph transformer, performs multi-head attention calculation and dynamic interaction on the abnormal feature information in the anomaly detection results, and generates dynamic fusion features in real time;

[0013] S5. Analyze attack behaviors in real time based on dynamic fusion features. Quantify the attack behavior type, location, and threat level to generate a coordinated end-to-end defense strategy that includes real-time attack behavior information.

[0014] S6. Based on the end-network collaborative defense strategy, specific defense instructions are issued to the associated terminal security devices and network security devices in real time to execute end-network collaborative attack defense.

[0015] Optionally, the S1 specifically includes:

[0016] S11. Collecting raw log data generated by terminal security devices, performing field extraction, content parsing, and field mapping on the log data according to unified processing rules for the terminal security device log data format, to obtain structured terminal log feature data;

[0017] S12. Collecting raw network traffic data collected by network security devices, determining traffic data feature extraction rules based on network traffic data types, performing payload extraction, session reassembly, and protocol feature extraction on the traffic data to obtain structured network traffic feature data;

[0018] S13. Collecting original threat intelligence data provided by the threat intelligence source system, performing noise removal and data cleaning based on the characteristic field screening rules defined by the threat intelligence type, and obtaining structured threat intelligence feature data based on the threat intelligence correlation feature extraction rules;

[0019] S14. Collect operational status data of terminal security devices and network security devices, and use predefined field parsing rules for device status data to perform validity screening, normalization conversion, and field alignment processing on the operational status indicators of the devices to obtain structured device status feature data.

[0020] S15. Perform feature field verification, missing value filling, and outlier removal based on data type feature specifications on the structured terminal log feature data, structured network traffic feature data, structured threat intelligence feature data, and structured device status feature data, respectively, to generate a complete feature set that has been cleaned and verified.

[0021] S16. Perform standardization processing on the feature data in the complete feature set, and uniformly map all types of feature data to a unified scale interval through the normalization conversion rules of data features to obtain the final standardized multi-source heterogeneous intelligence feature data.

[0022] Optionally, the S2 specifically includes:

[0023] S21. Perform node number mapping processing on each type of feature data in the standardized multi-source heterogeneous intelligence feature data, and assign a unique node identifier to each intelligence feature data;

[0024] S22, converting the feature data of any two nodes into corresponding feature vectors, and calculating the cosine similarity value of the two feature vectors;

[0025] S23, determining an association threshold between nodes based on the cosine similarity values ​​between the nodes, where the predefined association threshold is 0.85, and using the association threshold to select node pairs with cosine similarity values ​​greater than or equal to 0.85, to establish an association relationship set between the nodes;

[0026] S24, traversing the association relationship set, if any two nodes between three or more nodes meet the association threshold, then these three or more nodes are defined as a hyperedge, and the node identifiers in the hyperedge are recorded to generate a hyperedge set;

[0027] S25. Using a hypergraph data structure, define all node identifiers as a node set of the hypergraph, and define all hyperedges as a hyperedge set of the hypergraph;

[0028] S26. Based on the hypergraph construction rules, each hyperedge in the hyperedge set is associated and mapped with the corresponding node in the node set to form the final multi-source heterogeneous intelligence feature data hypergraph.

[0029] Optionally, the S3 specifically includes:

[0030] S31, performing feature vector initialization processing on each node in the multi-source heterogeneous intelligence feature data hypergraph, and generating an initial embedding vector for each node;

[0031] S32. Perform feature aggregation on the initial embedding vectors of all nodes connected by the hyperedge to obtain the hyperedge embedding vector:

[0032]

[0033] Among them, E e is the hyperedge embedding vector, V e is the set of nodes connected by the current hyperedge, x i is the initial embedding vector of node i, W v is the weight matrix, b v is the bias vector, σ(·) is the nonlinear activation function;

[0034] S33. Perform global embedding calculation based on the initial embedding vectors of all nodes and the embedding vectors of all hyperedges to obtain a global embedding vector:

[0035]

[0036] Among them, E g is the global embedding vector, V is the set of hypergraph nodes, E is the set of hypergraph hyperedges, is the embedding vector of hyperedge j, W g 、W h is the weight matrix, b g is the bias vector, σ(·) is the nonlinear activation function;

[0037] S34, fusing the node initial embedding vector, the hyperedge embedding vector and the global embedding vector to obtain a complete set of high-order correlation feature vectors;

[0038] S35. Input the high-order correlation feature vector set into the anomaly pattern recognition classifier in the deep hypergraph anomaly detection model, classify and judge the high-order correlation feature vectors according to predefined anomaly pattern recognition rules, determine the anomaly pattern type and output an anomaly detection result containing anomaly feature information.

[0039] Optionally, the S35 specifically includes:

[0040] S351. Perform feature space encoding on each high-order correlation feature vector input to obtain the initial latent variable feature vector:

[0041]

[0042] in, is the initial latent variable eigenvector of node i, x i is the high-order correlation feature vector of the input, W enc is the encoding weight matrix, b enc is the encoding bias vector, ReLU(·) is the nonlinear activation function;

[0043] S352. Input the initial latent variable feature vector into the deep hypergraph convolutional network and use the hypergraph convolution formula to extract deep features:

[0044]

[0045] in, represents the latent variable feature vector of node i in the l-th layer hypergraph convolutional network, N(i) is the set of neighboring nodes of node i, and W (l) is the weight matrix of the l-th layer convolutional network, b (l) is the bias vector of the lth convolutional network layer, ReLU(·) is a nonlinear activation function, and the hypergraph convolutional network includes 2 to 5 convolutional layers;

[0046] S353. Input the final latent variable feature vector output by the deep hypergraph convolutional network into the abnormal pattern recognition classifier to obtain the abnormal pattern probability distribution:

[0047]

[0048] Among them, y i is the probability distribution of each abnormal pattern type corresponding to node i, is the final latent variable feature vector after processing by the deep hypergraph convolutional network, W cls is the classifier weight matrix, b cls is the classifier bias vector, and Softmax(·) is used to convert the classification results into probability distribution;

[0049] S354. Based on the abnormal pattern probability distribution, a predefined abnormal pattern recognition rule is used to make an abnormal pattern classification decision. The predefined abnormal pattern recognition rule is as follows: if the probability corresponding to any abnormal pattern type in the abnormal pattern probability distribution of the node is greater than or equal to a threshold value of 0.8, then the node is determined to belong to the corresponding abnormal pattern type; otherwise, the node is determined to be in a normal pattern;

[0050] S355: Record the node identifiers determined to be abnormal pattern types and the corresponding abnormal pattern types, and output the final abnormality detection results.

[0051] Optionally, the S4 specifically includes:

[0052] S41. Input the anomaly detection result into the sequence modeling mechanism of the hypergraph transformer, and obtain the anomaly feature information sequence through sequence modeling;

[0053] S42, performing feature vector linear mapping processing on each abnormal feature information in the abnormal feature information sequence to generate a corresponding abnormal feature information vector;

[0054] S43, performing multi-head attention calculation on the abnormal feature information vector simultaneously to generate attention vectors output by multiple attention heads;

[0055] S44, after concatenating the attention vectors output by all attention heads, a multi-head attention fusion vector is obtained through a linear fusion operation;

[0056] S45. Use a feedforward neural network to perform nonlinear dynamic interaction processing on the multi-head attention fusion vector to generate dynamic fusion features;

[0057] S46. Reorganize the dynamic fusion features according to the sequence order to form dynamic fusion features with real-time sequence characteristics, and output the dynamic fusion features in real time.

[0058] Optionally, the sequence modeling mechanism of the hypergraph transformer specifically includes:

[0059] Each abnormal feature information in the abnormality detection result is used as a sequence node, and the abnormal feature information sequence is constructed according to the time sequence of the abnormal feature information;

[0060] Perform initial feature encoding on each node in the sequence, and generate a sequence node feature vector with position information for each node through linear mapping and position encoding;

[0061] Using the self-attention calculation mechanism of the hypergraph transformer, the attention weights between nodes are calculated for all sequence node feature vectors to determine the degree of association between nodes in the sequence;

[0062] By using layer normalization and residual connection methods, the attention weights are fused with the sequence node feature vectors to generate a stable self-attention enhanced feature vector;

[0063] The self-attention enhanced feature vector is processed by nonlinear interaction of the feedforward neural network, and layer normalization and residual connection operations are used again to finally generate an abnormal feature information sequence after sequence modeling processing.

[0064] Optionally, the S5 specifically includes:

[0065] S51. Receive dynamic fusion features and extract attack behavior related feature fields contained in each dynamic fusion feature, wherein the attack behavior related feature fields specifically include attack type features, attack location features, and attack threat level features;

[0066] S52, identifying the attack behavior category based on the attack type feature, comparing the attack type feature with a predefined attack behavior category standard feature library for similarity, and determining the specific attack behavior category based on the comparison result;

[0067] S53: locating and analyzing the attack location feature, matching the network address information contained in the attack location feature with the defined network topology data, and determining the terminal device where the attack occurred;

[0068] S54. Quantify the attack threat level characteristics and calculate the threat level value of the specific attack behavior using a predefined threat level quantification formula:

[0069] T v =α·C v +β·I v +γ·A v ;

[0070] Among them, T v is the calculated attack threat level value, C v is a quantitative score of the impact of attack behavior on system confidentiality, I vA is a quantitative score of the impact of attack behavior on system integrity. v is a quantitative score of the impact of attack behavior on system availability, where α, β, and γ are predefined weight coefficients of confidentiality, integrity, and availability, respectively, and α+β+γ=1;

[0071] S55. Based on the attack behavior category, attack location, and threat level value, when the threat level value is greater than or equal to a set threshold, determine it as a high-risk attack behavior and record the corresponding attack behavior category and attack location;

[0072] S56. Based on the real-time attack behavior information and the corresponding attack category, attack location and threat level, generate an end-network collaborative linkage defense strategy including the attack target terminal and network device identification, specific defense actions and response levels, and output the end-network collaborative linkage defense strategy in real time.

[0073] Optionally, the S6 specifically includes:

[0074] S61, receiving the end-network collaborative linkage defense strategy, and extracting the network device identification, specific defense action, and response level of the attack target terminal contained in the defense strategy;

[0075] S62: Based on the network device identification of the target terminal, query a pre-established terminal security device and network security device identification database to determine the target terminal security device and target network security device for executing the defense action;

[0076] S63: Convert the specific defense action into a defense instruction that can be executed by the target terminal security device, wherein the defense instruction includes a process termination instruction, a file isolation instruction, and a user authority restriction instruction;

[0077] S64, converting the specific defense action into a defense instruction that can be executed by the target network security device, wherein the defense instruction includes a network access control instruction, a connection blocking instruction, and a traffic filtering instruction;

[0078] S65. Determine the priority of the defense instructions based on the response level, and generate a defense instruction execution sequence using an instruction priority rule. The instruction priority rule is that the defense instruction with the highest response level is issued and executed first, and the defense instructions of the terminal security device are executed before the defense instructions of the network security device at the same response level.

[0079] S66. Send a terminal defense instruction execution sequence to the target terminal security device in real time through the device control communication channel, driving the target terminal security device to execute the corresponding defense action.

[0080] The beneficial effects of the present invention are:

[0081] (1) The present invention adopts the DeepHypergraph (AD) deep hypergraph anomaly detection algorithm to construct a hypergraph of multi-source heterogeneous intelligence feature data, and uses the node embedding, hyperedge embedding and global embedding fusion mechanism to accurately express and extract high-order correlation features between multi-source intelligence data, significantly improving the recognition accuracy of abnormal data and complex attack patterns, effectively reducing the missed reporting and false alarm rates, and enhancing the accuracy and effectiveness of the fusion of endpoint and network device information.

[0082] (2) By adopting the sequence modeling mechanism and multi-head attention calculation method of HGTrans hypergraph Transformer, the present invention realizes the dynamic real-time fusion of abnormal feature information in the anomaly detection results, significantly improves the real-time capture and analysis capabilities of attack behaviors, and shows better adaptability in real-time attack scenarios such as advanced persistent threats (APTs), effectively reducing the delay in attack behavior identification and defense decision-making from minutes to seconds, significantly improving the attack response speed and accuracy.

[0083] (3) In terms of generating end-to-network collaborative defense strategies, the present invention conducts real-time quantitative analysis of attack types, locations, and threat levels based on dynamic fusion features, effectively solving the problems of slow attack defense response and poor strategy targeting caused by insufficient intelligence data fusion in the existing technology. It breaks through the technical bottleneck of the existing technology in real-time judgment of attack behaviors and precise linkage defense, realizes the precise classification of attack behaviors and accurate quantification of threat levels, and thus effectively improves the practicality and engineering application capabilities of the network security defense system.

[0084] (4) The present invention uses a clear end-network collaborative defense strategy and defense instruction priority rules to issue clear defense action instructions to target terminals and network devices in real time, significantly improving the execution efficiency of defense actions of terminals and network security devices, ensuring the accuracy and real-time nature of the issuance and execution of attack defense instructions, and enhancing the overall effectiveness and stability of the end-network collaborative defense system. BRIEF DESCRIPTION OF THE DRAWINGS

[0085] The accompanying drawings are used to provide a further understanding of the present invention and constitute a part of the specification. Together with the embodiments of the present invention, they are used to explain the present invention and do not constitute a limitation of the present invention. In the accompanying drawings:

[0086] Figure 1 This is a schematic diagram of the overall process of a multi-source intelligence-driven end-to-network collaborative attack defense method proposed by the present invention;

[0087] Figure 2 This is a flowchart of a deep hypergraph anomaly detection model for a multi-source intelligence-driven end-network collaborative attack defense method proposed in the present invention;

[0088] Figure 3 Schematic diagram of the hypergraph Transformer dynamic fusion mechanism of the multi-source intelligence-driven end-network collaborative attack defense method proposed in this invention. DETAILED DESCRIPTION

[0089] The present invention will now be described in further detail with reference to the accompanying drawings, which are simplified schematic diagrams that illustrate the basic structure of the present invention in a schematic manner.

[0090] refer to Figure 1-Figure 3 , a multi-source intelligence driven end-to-end coordinated attack defense method, comprising the following steps:

[0091] S1. Collect terminal log data, network traffic data, threat intelligence data, and device status data, and perform format unification, noise removal, feature extraction, and structured processing based on the data type to obtain standardized multi-source heterogeneous intelligence feature data.

[0092] S2. Using standardized multi-source heterogeneous intelligence feature data as nodes and high-order correlations between intelligence features as hyperedges, a hypergraph of multi-source heterogeneous intelligence feature data is generated based on the association rules of multi-source intelligence data.

[0093] S3. Input the hypergraph of multi-source heterogeneous intelligence feature data into the deep hypergraph anomaly detection model. Through node embedding, hyperedge embedding, and global embedding fusion, the high-order correlation features of the multi-source heterogeneous intelligence feature data are extracted. Based on the high-order correlation features, abnormal patterns in the multi-source intelligence data are identified, and anomaly detection results containing abnormal feature information are output.

[0094] S4, taking the anomaly detection results as input, through the sequence modeling mechanism of the hypergraph transformer, performs multi-head attention calculation and dynamic interaction on the abnormal feature information in the anomaly detection results, and generates dynamic fusion features in real time;

[0095] S5. Analyze attack behaviors in real time based on dynamic fusion features. Quantify the attack behavior type, location, and threat level to generate a coordinated end-to-end defense strategy that includes real-time attack behavior information.

[0096] S6. Based on the end-network collaborative defense strategy, specific defense instructions are issued to the associated terminal security devices and network security devices in real time to execute end-network collaborative attack defense.

[0097] The present invention constructs a hypergraph of multi-source heterogeneous intelligence feature data and combines it with a deep hypergraph anomaly detection algorithm to achieve accurate extraction of high-order correlation features in multi-source intelligence data, effectively improving the detection accuracy of abnormal patterns and reducing the omission rate and false alarm rate; at the same time, the present invention introduces the sequence modeling mechanism of the hypergraph Transformer, generates dynamic fusion features through multi-head attention calculation and dynamic interaction, and significantly improves the real-time recognition capability of attack behavior; in addition, through the generation of end-network collaborative linkage defense strategies and the issuance and execution of real-time defense instructions, the present invention effectively solves the problems of information islanding between endpoints and network devices and slow attack response speed in the existing technology, realizes the rapid and accurate response of end-network collaborative defense, and improves the overall effectiveness of network security defense.

[0098] In this embodiment, S1 specifically includes:

[0099] S11. Collecting raw log data generated by terminal security devices, performing field extraction, content parsing, and field mapping on the log data according to unified processing rules for the terminal security device log data format, to obtain structured terminal log feature data;

[0100] S12. Collecting raw network traffic data collected by network security devices, determining traffic data feature extraction rules based on network traffic data types, performing payload extraction, session reassembly, and protocol feature extraction on the traffic data to obtain structured network traffic feature data;

[0101] S13. Collecting original threat intelligence data provided by the threat intelligence source system, performing noise removal and data cleaning based on the characteristic field screening rules defined by the threat intelligence type, and obtaining structured threat intelligence feature data based on the threat intelligence correlation feature extraction rules;

[0102] S14. Collect operational status data of terminal security devices and network security devices, and use predefined field parsing rules for device status data to perform validity screening, normalization conversion, and field alignment processing on the operational status indicators of the devices to obtain structured device status feature data.

[0103] S15. Perform feature field verification, missing value filling, and outlier removal based on data type feature specifications on the structured terminal log feature data, structured network traffic feature data, structured threat intelligence feature data, and structured device status feature data, respectively, to generate a complete feature set that has been cleaned and verified.

[0104] S16. Perform standardization processing on the feature data in the complete feature set, and uniformly map all types of feature data to a unified scale interval through the normalization conversion rules of data features to obtain the final standardized multi-source heterogeneous intelligence feature data.

[0105] The present invention obtains high-quality multi-source heterogeneous intelligence feature data through the collection and standardized processing of detailed and standardized terminal log data, network traffic data, threat intelligence data and device status data, thereby ensuring the accuracy and reliability of data fusion from the source; adopts unified and clear data feature verification rules and standardized conversion processing to effectively improve the quality and accuracy of subsequent intelligence data fusion, provide a solid data foundation for hypergraph construction and anomaly detection, and significantly enhance the technical performance and overall effect of end-to-network collaborative attack defense.

[0106] In this embodiment, S2 specifically includes:

[0107] S21. Perform node number mapping processing on each type of feature data in the standardized multi-source heterogeneous intelligence feature data, and assign a unique node identifier to each intelligence feature data;

[0108] S22, converting the feature data of any two nodes into corresponding feature vectors, and calculating the cosine similarity value of the two feature vectors;

[0109] S23, determining an association threshold between nodes based on the cosine similarity values ​​between the nodes, where the predefined association threshold is 0.85, and using the association threshold to select node pairs with cosine similarity values ​​greater than or equal to 0.85, to establish an association relationship set between the nodes;

[0110] S24, traversing the association relationship set, if any two nodes between three or more nodes meet the association threshold, then these three or more nodes are defined as a hyperedge, and the node identifiers in the hyperedge are recorded to generate a hyperedge set;

[0111] S25. Using a hypergraph data structure, define all node identifiers as a node set of the hypergraph, and define all hyperedges as a hyperedge set of the hypergraph;

[0112] S26. Based on the hypergraph construction rules, each hyperedge in the hyperedge set is associated and mapped with the corresponding node in the node set to form the final multi-source heterogeneous intelligence feature data hypergraph.

[0113] The present invention effectively establishes high-order complex correlation relationships in multi-source heterogeneous intelligence data through steps such as node number mapping processing, cosine similarity calculation and high-order correlation threshold setting, and accurately expresses and captures high-order correlation features between multi-source data by constructing a hypergraph data structure of hyperedge sets and node sets, thereby achieving accurate characterization of complex correlation relationships between data, thereby effectively improving the accuracy of anomaly detection and attack identification, and enhancing the adaptability and practicality of the end-to-network collaborative attack defense technical solution in complex network environments.

[0114] In this embodiment, S3 specifically includes:

[0115] S31, performing feature vector initialization processing on each node in the multi-source heterogeneous intelligence feature data hypergraph, and generating an initial embedding vector for each node;

[0116] S32. Perform feature aggregation on the initial embedding vectors of all nodes connected by the hyperedge to obtain the hyperedge embedding vector:

[0117]

[0118] Among them, E e is the hyperedge embedding vector, V e is the set of nodes connected by the current hyperedge, x i is the initial embedding vector of node i, W v is the weight matrix, b v is the bias vector, σ(·) is the nonlinear activation function;

[0119] S33. Perform global embedding calculation based on the initial embedding vectors of all nodes and the embedding vectors of all hyperedges to obtain a global embedding vector:

[0120]

[0121] Among them, E g is the global embedding vector, V is the set of hypergraph nodes, E is the set of hypergraph hyperedges, is the embedding vector of hyperedge j, W g 、W h is the weight matrix, b g is the bias vector, σ(·) is the nonlinear activation function;

[0122] S34, fusing the node initial embedding vector, the hyperedge embedding vector and the global embedding vector to obtain a complete set of high-order correlation feature vectors;

[0123] S35. Input the high-order correlation feature vector set into the anomaly pattern recognition classifier in the deep hypergraph anomaly detection model, classify and judge the high-order correlation feature vectors according to predefined anomaly pattern recognition rules, determine the anomaly pattern type and output an anomaly detection result containing anomaly feature information.

[0124] In this embodiment, the S35 specifically includes:

[0125] S351. Perform feature space encoding on each high-order correlation feature vector input to obtain the initial latent variable feature vector:

[0126]

[0127] in, is the initial latent variable eigenvector of node i, xi is the high-order correlation feature vector of the input, W enc is the encoding weight matrix, b enc is the encoding bias vector, ReLU(·) is the nonlinear activation function;

[0128] S352. Input the initial latent variable feature vector into the deep hypergraph convolutional network and use the hypergraph convolution formula to extract deep features:

[0129]

[0130] in, represents the latent variable feature vector of node i in the l-th layer hypergraph convolutional network, N(i) is the set of neighboring nodes of node i, and W (l) is the weight matrix of the l-th layer convolutional network, b (l) is the bias vector of the lth convolutional network layer, ReLU(·) is a nonlinear activation function, and the hypergraph convolutional network includes 2 to 5 convolutional layers;

[0131] S353. Input the final latent variable feature vector output by the deep hypergraph convolutional network into the abnormal pattern recognition classifier to obtain the abnormal pattern probability distribution:

[0132]

[0133] Among them, y i is the probability distribution of each abnormal pattern type corresponding to node i, is the final latent variable feature vector after processing by the deep hypergraph convolutional network, W cls is the classifier weight matrix, b cls is the classifier bias vector, and Softmax(·) is used to convert the classification results into probability distribution;

[0134] S354. Based on the abnormal pattern probability distribution, a predefined abnormal pattern recognition rule is used to make an abnormal pattern classification decision. The predefined abnormal pattern recognition rule is as follows: if the probability corresponding to any abnormal pattern type in the abnormal pattern probability distribution of the node is greater than or equal to a threshold value of 0.8, then the node is determined to belong to the corresponding abnormal pattern type; otherwise, the node is determined to be in a normal pattern;

[0135] S355: Record the node identifiers determined to be abnormal pattern types and the corresponding abnormal pattern types, and output the final abnormality detection results.

[0136] The present invention effectively realizes the refined extraction and expression of high-order correlation features of the hypergraph of multi-source heterogeneous intelligence feature data through the fusion of node initial embedding vectors, hyperedge embedding vectors and global embedding vectors, thereby improving the ability to accurately identify complex abnormal patterns; at the same time, through the abnormal pattern recognition classifier in the deep hypergraph anomaly detection model, accurate classification and output of abnormal feature information are achieved, which significantly reduces the probability of false alarms and missed alarms, thereby improving the real-time, accuracy and overall technical effectiveness of end-to-network collaborative attack defense.

[0137] In this embodiment, the S4 specifically includes:

[0138] S41. Input the anomaly detection result into the sequence modeling mechanism of the hypergraph transformer, and obtain the anomaly feature information sequence through sequence modeling;

[0139] S42, performing feature vector linear mapping processing on each abnormal feature information in the abnormal feature information sequence to generate a corresponding abnormal feature information vector;

[0140] S43, performing multi-head attention calculation on the abnormal feature information vector simultaneously to generate attention vectors output by multiple attention heads;

[0141] S44, after concatenating the attention vectors output by all attention heads, a multi-head attention fusion vector is obtained through a linear fusion operation;

[0142] S45. Use a feedforward neural network to perform nonlinear dynamic interaction processing on the multi-head attention fusion vector to generate dynamic fusion features;

[0143] S46. Reorganize the dynamic fusion features according to the sequence order to form dynamic fusion features with real-time sequence characteristics, and output the dynamic fusion features in real time.

[0144] In this embodiment, the sequence modeling mechanism of the hypergraph transformer specifically includes:

[0145] Each abnormal feature information in the abnormality detection result is used as a sequence node, and the abnormal feature information sequence is constructed according to the time sequence of the abnormal feature information;

[0146] Perform initial feature encoding on each node in the sequence, and generate a sequence node feature vector with position information for each node through linear mapping and position encoding;

[0147] Using the self-attention calculation mechanism of the hypergraph transformer, the attention weights between nodes are calculated for all sequence node feature vectors to determine the degree of association between nodes in the sequence;

[0148] By using layer normalization and residual connection methods, the attention weights are fused with the sequence node feature vectors to generate a stable self-attention enhanced feature vector;

[0149] The self-attention enhanced feature vector is processed by nonlinear interaction of the feedforward neural network, and layer normalization and residual connection operations are used again to finally generate an abnormal feature information sequence after sequence modeling processing.

[0150] The present invention uses the hypergraph Transformer sequence modeling mechanism to serialize the anomaly detection results and linearly map the feature vectors. Combined with the multi-head attention mechanism, it realizes the refined dynamic interaction and fusion of anomaly feature information, effectively captures the real-time dynamic features of the evolution of attack behavior, and improves the real-time identification and dynamic tracking capabilities of attack behavior. At the same time, through the feature sequence recombination and real-time output of dynamic fusion features, the immediacy and accuracy of the attack defense response are guaranteed, thereby significantly improving the accuracy and practicality of the end-to-network collaborative defense strategy.

[0151] In this embodiment, the S5 specifically includes:

[0152] S51. Receive dynamic fusion features and extract attack behavior related feature fields contained in each dynamic fusion feature, wherein the attack behavior related feature fields specifically include attack type features, attack location features, and attack threat level features;

[0153] S52, identifying the attack behavior category based on the attack type feature, comparing the attack type feature with a predefined attack behavior category standard feature library for similarity, and determining the specific attack behavior category based on the comparison result;

[0154] S53: locating and analyzing the attack location feature, matching the network address information contained in the attack location feature with the defined network topology data, and determining the terminal device where the attack occurred;

[0155] S54. Quantify the attack threat level characteristics and calculate the threat level value of the specific attack behavior using a predefined threat level quantification formula:

[0156] T v =α·C v +β·I v +γ·A v ;

[0157] Among them, T v is the calculated attack threat level value, C v is a quantitative score of the impact of attack behavior on system confidentiality, I v A is a quantitative score of the impact of attack behavior on system integrity. vis a quantitative score of the impact of attack behavior on system availability, where α, β, and γ are predefined weight coefficients of confidentiality, integrity, and availability, respectively, and α+β+γ=1;

[0158] S55. Based on the attack behavior category, attack location, and threat level value, when the threat level value is greater than or equal to a set threshold, determine it as a high-risk attack behavior and record the corresponding attack behavior category and attack location;

[0159] S56. Based on the real-time attack behavior information and the corresponding attack category, attack location and threat level, generate an end-network collaborative linkage defense strategy including the attack target terminal and network device identification, specific defense actions and response levels, and output the end-network collaborative linkage defense strategy in real time.

[0160] The present invention significantly improves the accuracy of real-time judgment of attack behavior through accurate identification and quantitative analysis of attack behavior category features, location features and threat degree features in dynamic fusion features; in particular, through similarity comparison between attack type features and predefined standard libraries, accurate matching of location features and network topology data, and quantitative calculation of threat degree, it effectively improves the accuracy of attack behavior classification and threat assessment, realizes timely and accurate identification of high-risk attack behaviors, and generates highly targeted end-to-network collaborative defense strategies based on this, thereby effectively enhancing the accuracy, real-time performance and effectiveness of network security defense response.

[0161] In this embodiment, S6 specifically includes:

[0162] S61, receiving the end-network collaborative linkage defense strategy, and extracting the network device identification, specific defense action, and response level of the attack target terminal contained in the defense strategy;

[0163] S62: Based on the network device identification of the target terminal, query a pre-established terminal security device and network security device identification database to determine the target terminal security device and target network security device for executing the defense action;

[0164] S63: Convert the specific defense action into a defense instruction that can be executed by the target terminal security device, wherein the defense instruction includes a process termination instruction, a file isolation instruction, and a user authority restriction instruction;

[0165] S64, converting the specific defense action into a defense instruction that can be executed by the target network security device, wherein the defense instruction includes a network access control instruction, a connection blocking instruction, and a traffic filtering instruction;

[0166] S65. Determine the priority of the defense instructions based on the response level, and generate a defense instruction execution sequence using an instruction priority rule. The instruction priority rule is that the defense instruction with the highest response level is issued and executed first, and the defense instructions of the terminal security device are executed before the defense instructions of the network security device at the same response level.

[0167] S66. Send a terminal defense instruction execution sequence to the target terminal security device in real time through the device control communication channel, driving the target terminal security device to execute the corresponding defense action.

[0168] The present invention ensures that defense instructions are accurately and efficiently issued to target terminal security devices and target network security devices in real time through a clear end-to-network collaborative defense strategy and a precise conversion and priority determination mechanism of defense instructions, effectively improving the efficiency of collaborative defense execution of terminals and network security devices; through predefined instruction priority rules, it ensures priority and rapid response to high-risk attack behaviors, significantly reduces attack response delays, ensures the real-time and effectiveness of attack defense, and thus effectively enhances the overall reliability and responsiveness of the end-to-network collaborative attack defense system.

[0169] Example 1:

[0170] In order to verify the feasibility of the present invention, the present invention is applied to a large-scale manufacturing enterprise. The enterprise has multiple production plants, R&D centers and administrative office areas, and each area is connected through an internal enterprise network to achieve data communication and information sharing. In recent years, with the expansion of enterprise scale and the improvement of informatization, network security risks have increased significantly, especially the frequent occurrence of advanced persistent threat (APT) attacks and complex phishing attacks, which have posed a serious threat to enterprise information assets. The enterprise information security department found that there is a lack of efficient intelligence sharing mechanism between traditional endpoint security equipment (such as antivirus software, terminal security software) and network security equipment (such as firewalls, intrusion detection equipment), making it difficult to accurately identify and promptly prevent attack behaviors in the early stages of an attack, resulting in delayed response to security incidents and increasing potential data leakage risks, which has become a major technical problem that enterprises urgently need to solve.

[0171] In order to address the above-mentioned problems, the enterprise deployed the multi-source intelligence-driven end-to-network collaborative attack defense method proposed in the present invention. First, the enterprise implemented the data collection and standardization processing method provided by the present invention in terminal security equipment and network security equipment. By uniformly collecting and processing terminal equipment logs, network traffic data, threat intelligence data and equipment status data, high-quality multi-source heterogeneous intelligence feature data is obtained. The collection of these data covers terminal equipment, servers, switches, firewalls and security gateways in various regions within the enterprise, realizing comprehensive data monitoring and collection. Subsequently, through the node mapping and cosine similarity calculation technology of the present invention, accurate high-order correlation analysis of the data is performed, and a feature data hypergraph that can accurately express the high-order relationship of intelligence data is constructed, which significantly improves the accuracy and reliability of data fusion and analysis.

[0172] During the actual attack event monitoring process, the company deployed a deep hypergraph anomaly detection model based on the present invention. Through the precise fusion of node embedding, hyperedge embedding, and global embedding features, it achieved accurate identification of abnormal attack behaviors. For example, in a real APT attack incident, the system of the present invention successfully identified an attack against the R&D center server. The attacker made multiple abnormal access attempts to the server during non-working hours at night. These access attempts did not trigger the alarm of the traditional security system, but the system of the present invention accurately detected the attack behavior by capturing the abnormal high-level features.

[0173] Subsequently, the hypergraph Transformer sequence modeling and dynamic fusion mechanism provided by this invention played a key role. Through the self-attention mechanism and multi-head attention calculation method, the system achieved real-time dynamic fusion of anomaly detection results, accurately capturing the evolving characteristics of attack behavior, thereby enabling efficient quantitative analysis of attack behavior type, attack location, and threat level. The system quickly identified this attack as an APT attack targeting specific R&D data on the R&D center server, posing an extremely high threat level.

[0174] After quickly and accurately identifying attack behavior, the system automatically generates a coordinated, end-to-end defense strategy. Based on the attack type, location, and threat level, it determines specific defense instructions, including emergency file isolation and process termination on the target server, as well as real-time blocking of affected network connections. Predefined defense instruction priority rules ensure the rapid and orderly execution of these actions. Upon receiving these instructions, the endpoint security device quickly isolated sensitive files and terminated suspicious processes on the target server. The network security device also blocked the source of the abnormal connection, effectively curbing the attack and preventing potential data leaks.

[0175] In order to objectively demonstrate the technical effects of the present invention, the enterprise information security department conducted comprehensive data statistics on network security before and after deployment. The statistical period is 3 months. The specific data is shown in the following table:

[0176] Table 1: Comparison of network security performance before and after deployment of the present invention

[0177]

[0178]

[0179] According to the data in the above table, it can be clearly seen that after deploying the end-network collaborative attack defense method of the present invention, the network security capabilities of the enterprise have been significantly improved. The average number of abnormal attack events detected per month has dropped from 26 to 2; the accuracy of abnormal event identification has been greatly improved, from 79.4% to 97.6%; the number of system false alarms has dropped from the original 8 times per month to 1 time. In particular, the average time for attack response has been significantly reduced from the original 35 minutes to less than 3 minutes, effectively improving the company's real-time response capabilities to security incidents. At the same time, the company has not experienced any data leakage incidents during the statistical period after deployment, and the proportion of timely and effective control of high-risk attack incidents has reached more than 98%, and the overall network security defense effectiveness has been significantly improved.

[0180] Through the detailed description and data analysis of the above embodiments, the multi-source intelligence-driven end-to-network collaborative attack defense method of the present invention effectively solves the problems existing in traditional technologies such as the isolation of endpoint and network equipment intelligence information, delayed attack response, and insufficient intelligence fusion, and significantly improves the overall level of enterprise network security and the ability to deal with complex network attacks. In particular, it shows extremely outstanding technical effects and applicability in dealing with APT attacks and phishing attacks, meets the high requirements and actual needs of enterprise network security, and verifies the practical application value and good engineering implementation effect of the present invention.

[0181] The above description is only a preferred specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any technician familiar with the technical field, within the technical scope disclosed by the present invention, who makes equivalent replacements or changes based on the technical solution and inventive concept of the present invention, should be covered by the scope of protection of the present invention.

Claims

1. A multi-source intelligence-driven end-to-end collaborative attack defense method, characterized in that: The following steps are involved: S1. Collect terminal log data, network traffic data, threat intelligence data, and device status data, and perform format unification, noise removal, feature extraction, and structured processing based on the data type to obtain standardized multi-source heterogeneous intelligence feature data. S2. Using standardized multi-source heterogeneous intelligence feature data as nodes and high-order correlations between intelligence features as hyperedges, a hypergraph of multi-source heterogeneous intelligence feature data is generated based on the association rules of multi-source intelligence data. S3. Input the hypergraph of multi-source heterogeneous intelligence feature data into the deep hypergraph anomaly detection model. Through node embedding, hyperedge embedding, and global embedding fusion, the high-order correlation features of the multi-source heterogeneous intelligence feature data are extracted. Based on the high-order correlation features, abnormal patterns in the multi-source intelligence data are identified, and anomaly detection results containing abnormal feature information are output. S4, taking the anomaly detection results as input, through the sequence modeling mechanism of the hypergraph transformer, performs multi-head attention calculation and dynamic interaction on the abnormal feature information in the anomaly detection results, and generates dynamic fusion features in real time; S5. Analyze attack behaviors in real time based on dynamic fusion features. Quantify the attack behavior type, location, and threat level to generate a coordinated end-to-end defense strategy that includes real-time attack behavior information. S6. Based on the end-network collaborative defense strategy, specific defense instructions are issued to the associated terminal security devices and network security devices in real time to execute end-network collaborative attack defense.

2. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 1, characterized in that: Said S1 specifically includes: S11. Collecting raw log data generated by terminal security devices, performing field extraction, content parsing, and field mapping on the log data according to unified processing rules for the terminal security device log data format, to obtain structured terminal log feature data; S12. Collecting raw network traffic data collected by network security devices, determining traffic data feature extraction rules based on network traffic data types, performing payload extraction, session reassembly, and protocol feature extraction on the traffic data to obtain structured network traffic feature data; S13. Collecting original threat intelligence data provided by the threat intelligence source system, performing noise removal and data cleaning based on the characteristic field screening rules defined by the threat intelligence type, and obtaining structured threat intelligence feature data based on the threat intelligence correlation feature extraction rules; S14. Collect operational status data of terminal security devices and network security devices, and use predefined field parsing rules for device status data to perform validity screening, normalization conversion, and field alignment processing on the operational status indicators of the devices to obtain structured device status feature data. S15. Perform feature field verification, missing value filling, and outlier removal based on data type feature specifications on the structured terminal log feature data, structured network traffic feature data, structured threat intelligence feature data, and structured device status feature data, respectively, to generate a complete feature set that has been cleaned and verified. S16. Perform standardization processing on the feature data in the complete feature set, and uniformly map all types of feature data to a unified scale interval through the normalization conversion rules of data features to obtain the final standardized multi-source heterogeneous intelligence feature data.

3. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 1, characterized in that: The S2 specifically includes: S21. Perform node number mapping processing on each type of feature data in the standardized multi-source heterogeneous intelligence feature data, and assign a unique node identifier to each intelligence feature data; S22, converting the feature data of any two nodes into corresponding feature vectors, and calculating the cosine similarity value of the two feature vectors; S23, determining an association threshold between nodes based on the cosine similarity values ​​between the nodes, where the predefined association threshold is 0.85, and using the association threshold to select node pairs with cosine similarity values ​​greater than or equal to 0.85, to establish an association relationship set between the nodes; S24, traversing the association relationship set, if any two nodes between three or more nodes meet the association threshold, then these three or more nodes are defined as a hyperedge, and the node identifiers in the hyperedge are recorded to generate a hyperedge set; S25. Using a hypergraph data structure, define all node identifiers as a node set of the hypergraph, and define all hyperedges as a hyperedge set of the hypergraph; S26. Based on the hypergraph construction rules, each hyperedge in the hyperedge set is associated and mapped with the corresponding node in the node set to form the final multi-source heterogeneous intelligence feature data hypergraph.

4. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 1, characterized in that: The S3 specifically includes: S31, performing feature vector initialization processing on each node in the multi-source heterogeneous intelligence feature data hypergraph, and generating an initial embedding vector for each node; S32. Perform feature aggregation on the initial embedding vectors of all nodes connected by the hyperedge to obtain the hyperedge embedding vector: Among them, E e is the hyperedge embedding vector, V e is the set of nodes connected by the current hyperedge, x i is the initial embedding vector of node i, W v is the weight matrix, b v is the bias vector, σ(·) is the nonlinear activation function; S33. Perform global embedding calculation based on the initial embedding vectors of all nodes and the embedding vectors of all hyperedges to obtain a global embedding vector: Among them, E g is the global embedding vector, V is the set of hypergraph nodes, E is the set of hypergraph hyperedges, is the embedding vector of hyperedge j, W g 、W h is the weight matrix, b g is the bias vector, σ(·) is the nonlinear activation function; S34, fusing the node initial embedding vector, the hyperedge embedding vector and the global embedding vector to obtain a complete set of high-order correlation feature vectors; S35. Input the high-order correlation feature vector set into the anomaly pattern recognition classifier in the deep hypergraph anomaly detection model, classify and judge the high-order correlation feature vectors according to predefined anomaly pattern recognition rules, determine the anomaly pattern type and output an anomaly detection result containing anomaly feature information.

5. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 4, characterized in that: The S35 specifically includes: S351. Perform feature space encoding on each high-order correlation feature vector input to obtain the initial latent variable feature vector: in, is the initial latent variable eigenvector of node i, x i is the high-order correlation feature vector of the input, W enc is the encoding weight matrix, b enc is the encoding bias vector, ReLU(·) is the nonlinear activation function; S352. Input the initial latent variable feature vector into the deep hypergraph convolutional network and use the hypergraph convolution formula to extract deep features: in, represents the latent variable feature vector of node i in the l-th layer hypergraph convolutional network, N(i) is the set of neighboring nodes of node i, and W (l) is the weight matrix of the l-th layer convolutional network, b (l) is the bias vector of the lth convolutional network layer, ReLU(·) is a nonlinear activation function, and the hypergraph convolutional network includes 2 to 5 convolutional layers; S353. Input the final latent variable feature vector output by the deep hypergraph convolutional network into the abnormal pattern recognition classifier to obtain the abnormal pattern probability distribution: Among them, y i is the probability distribution of each abnormal pattern type corresponding to node i, is the final latent variable feature vector after processing by the deep hypergraph convolutional network, W cls is the classifier weight matrix, b cls is the classifier bias vector, and Softmax(·) is used to convert the classification results into probability distribution; S354. Based on the abnormal pattern probability distribution, a predefined abnormal pattern recognition rule is used to make an abnormal pattern classification decision. The predefined abnormal pattern recognition rule is as follows: if the probability corresponding to any abnormal pattern type in the abnormal pattern probability distribution of the node is greater than or equal to a threshold value of 0.8, then the node is determined to belong to the corresponding abnormal pattern type; otherwise, the node is determined to be in a normal pattern; S355: Record the node identifiers determined to be abnormal pattern types and the corresponding abnormal pattern types, and output the final abnormality detection results.

6. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 1, characterized in that: The S4 specifically includes: S41. Input the anomaly detection result into the sequence modeling mechanism of the hypergraph transformer, and obtain the anomaly feature information sequence through sequence modeling; S42, performing feature vector linear mapping processing on each abnormal feature information in the abnormal feature information sequence to generate a corresponding abnormal feature information vector; S43, performing multi-head attention calculation on the abnormal feature information vector simultaneously to generate attention vectors output by multiple attention heads; S44, after concatenating the attention vectors output by all attention heads, a multi-head attention fusion vector is obtained through a linear fusion operation; S45. Use a feedforward neural network to perform nonlinear dynamic interaction processing on the multi-head attention fusion vector to generate dynamic fusion features; S46. Reorganize the dynamic fusion features according to the sequence order to form dynamic fusion features with real-time sequence characteristics, and output the dynamic fusion features in real time.

7. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 6, characterized in that: The sequence modeling mechanism of the hypergraph transformer specifically includes: Each abnormal feature information in the abnormality detection result is used as a sequence node, and the abnormal feature information sequence is constructed according to the time sequence of the abnormal feature information; Perform initial feature encoding on each node in the sequence, and generate a sequence node feature vector with position information for each node through linear mapping and position encoding; Using the self-attention calculation mechanism of the hypergraph transformer, the attention weights between nodes are calculated for all sequence node feature vectors to determine the degree of association between nodes in the sequence; By using layer normalization and residual connection methods, the attention weights are fused with the sequence node feature vectors to generate a stable self-attention enhanced feature vector; The self-attention enhanced feature vector is processed by nonlinear interaction of the feedforward neural network, and layer normalization and residual connection operations are used again to finally generate an abnormal feature information sequence after sequence modeling processing.

8. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 1, characterized in that: The S5 specifically includes: S51. Receive dynamic fusion features and extract attack behavior related feature fields contained in each dynamic fusion feature, wherein the attack behavior related feature fields specifically include attack type features, attack location features, and attack threat level features; S52, identifying the attack behavior category based on the attack type feature, comparing the attack type feature with a predefined attack behavior category standard feature library for similarity, and determining the specific attack behavior category based on the comparison result; S53: locating and analyzing the attack location feature, matching the network address information contained in the attack location feature with the defined network topology data, and determining the terminal device where the attack occurred; S54. Quantify the attack threat level characteristics and calculate the threat level value of the specific attack behavior using a predefined threat level quantification formula: T v =α·C v +β·I v +γ·A v ; Among them, T v is the calculated attack threat level value, C v is a quantitative score of the impact of attack behavior on system confidentiality, I v A is a quantitative score of the impact of attack behavior on system integrity. v is a quantitative score of the impact of attack behavior on system availability, where α, β, and γ are predefined weight coefficients of confidentiality, integrity, and availability, respectively, and α+β+γ=1; S55. Based on the attack behavior category, attack location, and threat level value, when the threat level value is greater than or equal to a set threshold, determine it as a high-risk attack behavior and record the corresponding attack behavior category and attack location; S56. Based on the real-time attack behavior information and the corresponding attack category, attack location and threat level, generate an end-network collaborative linkage defense strategy including the attack target terminal and network device identification, specific defense actions and response levels, and output the end-network collaborative linkage defense strategy in real time.

9. The multi-source intelligence-driven end-to-end coordinated attack defense method according to claim 1, characterized in that: The S6 specifically includes: S61, receiving the end-network collaborative linkage defense strategy, and extracting the network device identification, specific defense action, and response level of the attack target terminal contained in the defense strategy; S62: Based on the network device identification of the target terminal, query a pre-established terminal security device and network security device identification database to determine the target terminal security device and target network security device for executing the defense action; S63: Convert the specific defense action into a defense instruction that can be executed by the target terminal security device, wherein the defense instruction includes a process termination instruction, a file isolation instruction, and a user authority restriction instruction; S64, converting the specific defense action into a defense instruction that can be executed by the target network security device, wherein the defense instruction includes a network access control instruction, a connection blocking instruction, and a traffic filtering instruction; S65. Determine the priority of the defense instructions based on the response level, and generate a defense instruction execution sequence using an instruction priority rule. The instruction priority rule is that the defense instruction with the highest response level is issued and executed first, and the defense instructions of the terminal security device are executed before the defense instructions of the network security device at the same response level. S66. Send a terminal defense instruction execution sequence to the target terminal security device in real time through the device control communication channel, driving the target terminal security device to execute the corresponding defense action.

Images