Network attack detection method based on dynamic graph coding

Abstract

The invention belongs to the technical field of network security, provides a network attack detection method based on dynamic graph coding, and solves the problems of poor dynamic adaptability of an attack path and missing of timing constraint in the prior art. The method comprises the following steps: constructing a dynamic threat map, extracting a triple of heterogeneous threat intelligence by using a RoBERTa model, and adding a timestamp and a confidence attribute; a dynamic graph encoder for time sequence perception is designed, semantic and evolution laws are fused through periodic time coding and a multi-head time sequence attention mechanism, and feature weights are adjusted in combination with a gating residual layer; an event-driven incremental updating strategy is adopted, and node similarity is calculated to achieve local subgraph updating; a time sequence rule base is established, three-dimensional parameter verification attack chain time sequence logic is defined, and abnormity is judged through conflict scores; and finally, integrating a graph updating module, a dynamic coding module and a constraint analysis module to realize multi-source threat feature matching and attack detection. According to the method, the adaptability of attack path evolution is improved through dynamic graph modeling and real-time increment updating.

Description

Technical Field

[0001] The present invention belongs to the technical field of network security, and specifically designs a network attack detection method based on dynamic graph coding. Background Art

[0002] With the rapid development of the internet, the way we access and communicate information has undergone tremendous changes. Simultaneously, cyberattack methods continue to escalate. Attackers exploit technical vulnerabilities, social engineering, and other tactics to launch complex and diverse network intrusions targeting critical infrastructure, core enterprise data, and personal privacy. Extracting high-precision attack chains from multi-source, heterogeneous threat intelligence and detecting them has become a critical issue in cybersecurity. Currently, the industry largely relies on regular expressions or natural language processing (NLP) models to extract triples from cyber threat intelligence. These scattered triples are sequentially merged to form an attack chain graph, and topological matching is then performed on the resulting graph to detect cyberattacks. This detection method relies on fixed topological rules within the generated graph, making it difficult to achieve the required detection success rate when the attack path changes. Furthermore, attack chain generation relies solely on matching the topological structure within the threat graph, ignoring the timing constraints of different attack phases, which can easily lead to false positives for logically inconsistent attack chains.

[0003] In response to the above-mentioned problems, the present invention proposes a network attack detection method based on dynamic graph coding. Through dynamic graph coding and incremental graph update mechanism, it realizes the update of dynamic threat graph and accurate detection of attack behavior, effectively solving the problem that most attack detection methods are difficult to adapt to the changes in dynamic attack paths and the lack of timing constraints in the attack stages. Summary of the Invention

[0004] The technical problem to be solved by the present invention is to overcome the defects of existing network attack detection methods, which are difficult to adapt to dynamic attack path changes due to reliance on fixed topology rules, and false alarms due to the lack of timing constraint analysis in the attack stage. Dynamic modeling of attack behavior is achieved through dynamic graph coding and incremental update mechanism, and the timing constraint verification capability is enhanced to improve detection accuracy.

[0005] In order to solve the above technical problems, the present invention adopts the following technical solutions:

[0006] The present invention provides a network attack detection method based on dynamic graph coding, comprising the following steps:

[0007] S1: Build a dynamic threat graph, extract entities and relationships from multi-source heterogeneous threat intelligence to form triples, and add timestamps and confidence attributes to build the initial dynamic threat graph;

[0008] S2: Build a time-aware dynamic graph encoding module that captures the logical associations and temporal evolution patterns of attack behaviors through periodic time encoding and dynamic neighbor aggregation, and uses an event-driven incremental update module mechanism to update the threat map in real time.

[0009] S3: Timing Constraint Analysis and Attack Detection Module: This module builds a timing rule library to quantify and verify the legal time intervals during the attack phase, and combines dynamic threat maps to perform multi-dimensional matching to detect network attacks.

[0010] S4: Integrate dynamic threat graph construction, dynamic graph encoding, incremental update and timing constraint analysis and attack detection modules to form a network attack detection model.

[0011] In the above solution, the construction of the dynamic threat map includes the following steps:

[0012] S11: Data preprocessing and feature extraction for multi-source heterogeneous threat intelligence, including:

[0013] S111: Obtain structured and unstructured data from system logs, network traffic data, and open source threat intelligence, clean unstructured text using regular expressions, and generate standardized input sequences;

[0014] S112: The pre-processed text is input into the RoBERTa pre-trained language model, and its bidirectional Transformer structure is used to capture long-range semantic dependencies. The BiLSTM-CRF module is superimposed to jointly optimize the entity recognition task and output the entity boundary and context embedding vectors. The loss function of the entity recognition task is:

[0015]

[0016] The embedding vector of the i-th Token output by the RoBERTa pre-trained language model, y i is the entity label, θ LSTM and θ CRF are model parameters;

[0017] S12: Build an extensible threat graph based on structured triples, including:

[0018] S121: For the identified entity pair (h, t), calculate the relationship probability distribution and retain the high confidence triples. The relationship classification probability formula is:

[0019]

[0020] W r and b r is the trainable relation classification parameter matrix and bias term, r is the relation type, and, Head and tail entity embedding vectors;

[0021] S122: Extract the maximum probability value in the probability distribution as the confidence level p r , only keep the confidence p r >0.85 triples, generate a structured triple set {(h, r, t, p r , t update )}, where t update Update timestamp for triples;

[0022] S123: Map triples to graph nodes and edges. The node attributes are defined as:

[0023] Node={e,t first , t last , Confidence, Embedding}

[0024] where t first and t last are the first and last appearance times of the entity, respectively. Embedding is the entity semantic vector generated by the model.

[0025] The edge attributes are defined as:

[0026] Edge={(h, r, t), t update , p r}

[0027] S124: Multi-source entity alignment is performed using the cosine similarity of entity embedding vectors. The alignment formula is:

[0028]

[0029] The dynamic threat map is stored in the Neo4j graph database, and time index and semantic index are established for nodes and edges.

[0030] In the above solution, the construction and incremental update of the time-series-aware dynamic image encoder includes the following steps:

[0031] S21: Construct a dynamic graph encoder with time decay characteristics, including:

[0032] S211: Based on the time t0 when the first attack occurred, the absolute timestamp is converted into a relative time series:

[0033] t rel =t abs -t0

[0034] S212: Then, a period parameter T is selected according to the attack pattern characteristics to generate a coding vector:

[0035]

[0036] S213: Constructing a graph attention network with time decay characteristics:

[0037]

[0038] Among them, Softmax is a normalized exponential function, WQ, W K is a learnable 256-dimensional projection matrix, △t=tt j , h i 、h j represents the original embedding vector of node i and node j, and represents the temporal encoding vector of nodes i and j, || represents the vector concatenation operation, d represents the dimension of the embedding vector, and λ is the temporal decay coefficient;

[0039] S214: Dynamically adjust the importance of multi-time window features through the gated residual fusion layer and output the aggregated node embedding:

[0040]

[0041] Among them, h i (t) is the new embedding representation of the node after the gated residual fusion layer is processed, LayerNorm is the layer normalization process, g k is a gate value ranging from 0 to 1, generated by the Sigmoid function, Head k is the kth attention head, h i (t) represents the embedding of the original node i at time t;

[0042] S22: Real-time graph evolution based on event-driven incremental update mechanism:

[0043] S221: Set the dual trigger conditions of abnormal behavior detection event and periodic forced update event, and the forced update interval τ is based on the minimum period parameter T of the active attack mode. i Dynamic adjustment;

[0044] S222: Calculate the newly added node v new With the full graph node v j Similarity:

[0045]

[0046] where h new and h j is the embedding representation, T avg is the mean time interval of all edges in the current graph, λ tis the time decay coefficient in the dynamic image encoder, t new and t j Represents node v new and node v j Last updated time,

[0047] S223: For the node pairs whose similarity is higher than the threshold θ, a local update is performed, and a new triplet △G is added. t ={(h′, r′, t′)} timestamp t′ is input into the periodic coding layer, and TE(t′) is generated to update the embedding of the associated subgraph nodes;

[0048] S224: The updated node embedding is written into the Neo4j database after layer normalization, completing the dynamic fusion of the attack behavior temporal features and semantic association relationships.

[0049] In the above solution, the timing constraint analysis and attack detection includes the following steps:

[0050] S31: Build a timing rule library based on prior knowledge and perform attack chain logic verification, including:

[0051] S311: Decompose the attack phase dependencies from the MITRE ATT&CK tactical library and define three-dimensional constraint parameters: the tolerance window α is set according to the MITRE tactical response window;

[0052] The delay threshold β is defined according to the urgency of the attack type;

[0053] The weight w0 is determined according to the tactical level;

[0054] S312: Perform timing constraint verification on candidate attack chains in the dynamic threat map. For the continuous attack phase, if A→B If the legal timing interval is met, the timing is legal; otherwise, it is considered a violation and a conflict score is triggered;

[0055] The legal timing interval is defined as:

[0056]

[0057] in, Indicates the end time of phase A, Indicates the start time of phase B, T A , T B Indicates the duration of phases A and B;

[0058] S313: Calculate the conflict score of the violation attack chain:

[0059]

[0060] in, Indicates the absolute value of the time difference, max(T A , TB) is the normalization factor, where is the normalized output of the kth attention head, σ is the Sigmoid function, is a learnable parameter matrix unique to each head, h i (t) represents the embedding of the original node i at time t,

[0061] S314: When the ConflictScore exceeds the threshold, an alarm is triggered. After manual review, the rule base is updated or the attack chain is adjusted.

[0062] S32: Perform multi-dimensional attack detection based on dynamic threat graphs:

[0063] S321: Extract standardized triples from the threat intelligence to be detected and calculate the entity node v new With graph node v j The comprehensive similarity of:

[0064]

[0065] where g k is the weight of the gated residual layer, λ is the time decay coefficient in the encoder, T is the attack period parameter defined by the algorithm, and the timing constraint check is calculated according to the conflict scoring formula. new and h j is the embedding representation, t new and t j Represents node v new and node v j Last updated time;

[0066] S322: Similarity Sim(v new , v j ) is higher than the threshold θ sim The candidate attack chain performs secondary verification of timing constraints, and when the conflict score ConflictScore exceeds the threshold, it is determined to be an abnormal attack;

[0067] S323: The triplet set ΔG that has passed the test t ={(h′, r′, t′)} is incrementally updated to the dynamic threat map, and the new attack mode expands the temporal rule base and adds attack stage parameters.

[0068] Because the present invention adopts the above technical solution, it has the following beneficial effects:

[0069] The present invention uses dynamic graph coding and periodic time embedding technology to convert timestamps into periodic coding vectors and integrate a multi-head temporal attention mechanism, thereby solving the technical problem that traditional methods pay insufficient attention to the temporal evolution laws of attack paths, and achieving the effect of improving the accuracy of capturing the logical correlation features of attack behaviors.

[0070] The present invention solves the technical problem of excessive computational overhead during real-time updates of large-scale threat maps by adopting a gated weight to dynamically adjust time window characteristics and an event-driven local subgraph update mechanism. This achieves the effect of significantly shortening system response time, improving memory utilization, and ensuring the integrity of attack path characteristics.

[0071] By defining the tolerance window α, delay threshold β, and dynamic weight w based on the MITRE ATT&CK tactical library, this paper solves the technical problem of false attack alarms caused by the lack of timing logic verification of the attack chain in traditional methods. It achieves the effect of determining whether the timing characteristics of the attack path are legal, thereby improving the accuracy and credibility of attack detection.

[0072] The present invention dynamically adjusts the similarity threshold θ of the model through manual review feedback sim and the time decay coefficient λ, which solves the problem of poor adaptability to different threat scenarios caused by the static model parameters in traditional methods, and achieves the effect of improving the recognition speed of new attack patterns and improving the adaptability of the model to different threat scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0073] Figure 1 : Overall framework diagram of network attack detection model;

[0074] Figure 2 : Schematic diagram of the dynamic image encoding module structure;

[0075] Figure 3 : Timing constraint analysis flow chart; DETAILED DESCRIPTION

[0076] The network attack detection method based on dynamic graph coding proposed in the invention is specifically used in threat intelligence analysis and network attack detection work of the network security department of an organization.

[0077] The present invention proposes a network attack detection method based on dynamic graph coding, which specifically addresses the problem that current attack detection methods are difficult to adapt to changes in dynamic attack paths and lack of timing constraints in attack stages. This method supports the real-time evolution of network attack paths by constructing a time-aware dynamic threat map and incremental update mechanism, and realizes dynamic modeling of network attack behaviors and real-time updating of the map. This method designs a dynamic graph encoder, captures the periodic characteristics of attacks through time coding, and combines the multi-head temporal attention mechanism to fuse semantic associations and temporal evolution laws. In addition, the present invention enhances the temporal constraint analysis capability of attack detection, constructs a temporal rule base and defines three-dimensional parameters, quantifies the legal time intervals of the attack stage, verifies the temporal rationality of the attack chain, and provides an innovative solution for the real-time detection of complex network attacks.

[0078] Example 1

[0079] S1: Building a dynamic threat map

[0080] S101 obtains threat intelligence and performs text cleaning and annotation.

[0081] During the data preprocessing and feature extraction phase, we first acquire structured and unstructured data from system logs, network traffic data, the MITREAT&CK tactical library, and open-source threat intelligence platforms through multi-source heterogeneous data interfaces. We then perform time-series normalization using a timestamp alignment algorithm. For unstructured text, we use regular expressions to filter out redundant characters, retaining the core threat action descriptions.

[0082] The cleaned text is then semantically annotated and entity boundaries are identified using the RoBERTa model. After tokenization, the input text is fed into the model's Transformer encoding layer. Its dynamic masking mechanism and deep bidirectional attention model contextual semantics, outputting a contextual embedding vector for each token. Furthermore, a Bidirectional LSTM and Conditional Random Field (BiLSTM-CRF) module is stacked on top of the model to jointly optimize the entity recognition task. The loss function is set as follows:

[0083]

[0084] is the embedding vector of the i-th Token output by the model, y i is the entity label, θ LSTM and θ CRF are model parameters.

[0085] S102 extracts triples from threat intelligence and builds a dynamic intelligence map.

[0086] For the entity pair (h, t) identified in the text, extract the entity embedding vector h output by the modelh With h t , after concatenation, it is input into the fully connected layer for relationship classification. The relationship probability distribution is calculated as follows:

[0087]

[0088] W r and b r is the trainable relation classification parameter matrix and bias term, and r is the relation type.

[0089] Only keep the confidence p r >0.85 triples, generate a structured triple set {(h, r, t, p r ,t update )}, where t update Update the timestamp for the triple. Then map the triple to the nodes and edges of the graph and add the time sequence and confidence attributes. Node = {e, t first , t last ,Confidence,Embedding}, where t first and t last are the first and last appearance time of the entity, respectively; Embedding is the entity semantic vector generated by the model; Edge = {(h, r, t), t update , p r}, record the relationship update time and confidence.

[0090] For different representations of the same entity in multi-source data, alignment is performed using the cosine similarity of the entity embedding vectors:

[0091]

[0092] Neo4j is used to store dynamic threat graphs, and time indexes and semantic indexes are established for nodes and edges.

[0093] S2: Building a temporally aware dynamic graph encoder

[0094] S201 builds a timing-aware dynamic graph encoder by generating periodic encoding vectors of timestamps and dynamic neighbor aggregation.

[0095] Taking the time t0 when the first attack occurred as the benchmark, the absolute timestamp is converted into a relative time series:

[0096] t rel =t abs -t0

[0097] Then, the period parameter T is selected according to the attack pattern characteristics to generate the encoding vector:

[0098]

[0099] Wherein, T is a preset period, which takes a corresponding value according to the characteristics of the attack behavior and is used to capture the periodic characteristics of the attack behavior.

[0100] For the neighbor set N(i, t) of node i at time t, the weighted influence of its historical neighbors is calculated through the multi-head attention mechanism. Attention weight α ij The calculation combines semantic similarity and time decay, which can simultaneously capture the logical correlation and temporal evolution of network attack behaviors and construct a graph attention network with time decay characteristics:

[0101]

[0102] τ=1hour is the attenuation coefficient benchmark, and the time attenuation coefficient λ is adjusted according to the attack evolution speed. Q , W K is a learnable 256-dimensional projection matrix, △t=tt j Indicates the update interval between the current time and neighbor nodes.

[0103] In order to more efficiently fuse attack features of multiple time scales and avoid the problem of feature dimension expansion and repeated information caused by direct splicing, a gated residual fusion layer is used to achieve flexible aggregation of outputs by dynamically adjusting the importance of features in different time windows. The formula is as follows:

[0104]

[0105] Among them, h i (t) is the new embedding representation of the node after the gated residual fusion layer is processed, LayerNorm is the layer normalization process, g k is a gate value ranging from 0 to 1, generated by the Sigmoid function, Head k is the kth attention head, h i (t) represents the embedding of the original node i at time t. The residual connection retains the original node embedding features and prevents feature degradation in multi-layer network training.

[0106] Gate value g k Determined by the current node state and the corresponding header output:

[0107]

[0108] Where σ is the Sigmoid function, It is a learnable parameter matrix unique to each head, used to map the concatenated vector to a scalar of gated values. k , introduce independent periodic code φ(T k , tj ), where T k Determined according to the attack mode, the recognition accuracy of different attack modes can be improved.

[0109] The aggregated node embedding h i (t)∈R d After the fully connected layer and nonlinear activation function, the final low-dimensional vector representation is generated for subsequent similarity calculation. Figure 2 .

[0110] S202 dynamically updates the threat map through event-driven methods and adopts a local update strategy to reduce the computational overhead of the model.

[0111] The update behavior of the threat map is set to be triggered by abnormal behavior detection events and periodic forced update events. When the network traffic monitoring module detects a sudden increase in request frequency or identifies high-risk vulnerability exploitation features, the incremental triple set △G is extracted from the system log t ={(h′, r′, t′)}, triggering the local update process; at the same time, the time interval for periodic mandatory updates is dynamically configured according to the risk level of the network environment. A mandatory update is performed every 30 minutes in a high-risk environment and every 6 hours in a low-risk environment.

[0112] After determining the set of incremental triples, the timestamp t of each newly added triple is passed through the periodic time coding layer to generate a time encoding vector TE(t′), and is input into the dynamic graph encoder together with the node embedding vector h generated by the model.

[0113] Use the local update strategy to locate the affected subgraph associated with the newly added triples and calculate the node v in the newly added triples new With the full graph node v j Similarity(v new , v j ) Node pairs with a similarity above a threshold of θ = 0.85 are considered associated nodes, and only associated nodes are updated to preserve the temporal decay characteristics and semantic associations. The updated node embedding vectors are then normalized using the LayerNorm layer and written to the graph database, completing the temporal feature fusion and semantic association update of the local subgraph.

[0114] The similarity calculation formula is as follows:

[0115]

[0116] where h new and h j is the embedding representation, T avg is the mean time interval of all edges in the current graph, λ tis the time decay coefficient in the dynamic image encoder, t new and t j Represents node v new and node v j For node pairs whose similarity is higher than the threshold θ, they are updated through the temporal encoder to fully preserve the time decay characteristics and semantic association relationship.

[0117] In addition, based on the smallest period parameter T among all currently active attack modes i ,dynamically adjust the forced update interval τ to effectively cope with the real-time changing characteristics of attack behavior.

[0118] S3: Timing Constraint Analysis and Attack Detection

[0119] This step eliminates logical contradictions by introducing a timing constraint verification mechanism and performs constraint logic verification on the dynamic threat map. At the same time, features are extracted from threat intelligence such as traffic logs and mapped to the dynamic threat map to achieve network attack detection.

[0120] S301 builds a temporal rule library based on prior knowledge and performs constraint logic verification on the dynamic threat map.

[0121] The technical execution process in MITRE ATT&CK tactics is broken down into sequential attack phases. Each phase node stores the tactic ID, phase name, threat level, and minimum duration parameters. Dependencies between phases are converted into directed edges and supplemented with timing constraints, including tolerance window α, latency threshold β, and weight w0, to establish a timing rule base. This rule base is stored persistently and efficiently traversed and queried using the Neo4j graph database.

[0122] The tolerance window is set according to the response window recommended in the MITRE tactical document, the delay threshold is defined according to the urgency of the attack type, and the basic weight w0 is determined according to the MITRE ATT&CK tactical level.

[0123] The dynamic weight w incorporates the dynamic gating value g of the gated residual layer k , the formula is as follows:

[0124]

[0125] in is the normalized output of the kth attention head.

[0126] The constraint verification phase traverses all candidate attack chains in the dynamic threat graph and extracts the actual timestamps of each consecutive stage pair (such as A→B) in each attack chain. and Combined with the corresponding α, β and max(T A, T B ),verify Whether it meets the legal time interval If it is satisfied, the timing is legal. Otherwise, it is considered a violation and the conflict score calculation is triggered:

[0127]

[0128] When the score exceeds the threshold θ=0.8, an alarm is triggered and a violation report is generated. At the same time, the conflict attack chain is marked as pending review. If it is confirmed to be a false alarm, the rule base parameters are adjusted and the attack mode is expanded; if it is confirmed to be erroneous data, the dynamic threat map is updated and the erroneous nodes and edges are deleted.

[0129] After the constraint logic verification of the dynamic threat map in S302 is completed, the corresponding features are extracted from the threat intelligence to be detected and compared with the dynamic threat map in multiple dimensions to perform attack detection.

[0130] Preprocess the threat intelligence to be detected, extract the standardized triple set, and generate structured data containing entities, relationships, timestamps and confidence. new and node v in the dynamic threat graph j Perform multi-dimensional matching and calculate the comprehensive similarity. If there is a node pair that satisfies Sim(v new ,vj)≥θ sim (θ sim =0.85), it is determined to be a potential associated node, and the temporal legitimacy of its relationship type and timestamp is further verified.

[0131] Among them, Sim(v new , v j )The formula is as follows:

[0132]

[0133] where g k is the weight of the gated residual layer, λ is the time decay coefficient in the encoder, and T is the attack period parameter defined by . The timing constraint check is calculated according to the conflict scoring formula.

[0134] Using attack chain timing verification and conflict scoring, we accurately identify abnormal attack behavior. If the conflict score exceeds the threshold, an alert is triggered. If neither the similarity nor the conflict score exceeds the threshold, the triplet is marked as noise data and discarded. For alert cases, manual review confirms the validity of the attack logic. If it is a known attack variant, the associated triplet is incrementally updated to the dynamic threat map. If it represents a new attack pattern, the timing rule base is expanded and the corresponding attack stage parameters are added. If it is erroneous data, it is directly discarded.

[0135] S4: Model Integration

[0136] The construction of dynamic threat graph, dynamic graph coding, timing constraint analysis and attack detection modules are effectively integrated to build an efficient and robust network attack detection model.

[0137] This implementation method effectively solves the problem that network attack detection methods are difficult to adapt to changes in dynamic attack paths and lack of timing constraints in the attack stage by combining dynamic threat graphs, dynamic graph encoding, incremental updates of knowledge graphs, timing constraint analysis and attack detection mechanisms.

Claims

1. A network attack detection method based on dynamic graph coding, characterized in that: The following steps are involved: S1: Build a dynamic threat graph, extract entities and relationships from multi-source heterogeneous threat intelligence to form triples, and add timestamps and confidence attributes to build the initial dynamic threat graph; S2: Build a time-aware dynamic graph encoding module that captures the logical associations and temporal evolution patterns of attack behaviors through periodic time encoding and dynamic neighbor aggregation, and uses an event-driven incremental update module mechanism to update the threat map in real time. S3: Timing constraint analysis and attack detection module, which builds a timing rule library to quantitatively verify the legal timing intervals during the attack phase and combines it with dynamic threat maps to perform multi-dimensional matching to detect network attacks; S4: Integrate dynamic threat graph construction, dynamic graph encoding, incremental update and timing constraint analysis and attack detection modules to form a network attack detection model.

2. The method according to claim 1, characterized in that The construction of the dynamic threat map includes the following steps: S11: Data preprocessing and feature extraction for multi-source heterogeneous threat intelligence, including: S111: Obtain structured and unstructured data from system logs, network traffic data, and open source threat intelligence, clean unstructured text using regular expressions, and generate standardized input sequences; S112: The pre-processed text is input into the RoBERTa pre-trained language model, and its bidirectional Transformer structure is used to capture long-range semantic dependencies. The BiLSTM-CRF module is superimposed to jointly optimize the entity recognition task and output the entity boundary and context embedding vectors. The loss function of the entity recognition task is: The embedding vector of the i-th Token output by the RoBERTa pre-trained language model, y i is the entity label, θ LSTM and θ CRF are model parameters; S12: Build an extensible threat graph based on structured triples, including: S121: For the identified entity pair (h, t), calculate the relationship probability distribution and retain the high confidence triples. The relationship classification probability formula is: W r and b r is the trainable relation classification parameter matrix and bias term, r is the relation type, and, Head and tail entity embedding vectors; S122: Extract the maximum probability value in the probability distribution as the confidence level p r , only keep the confidence p r >0.85 triples, generate a structured triple set {(h, r, t, p r , t update )}, where t update Update timestamp for triples; S123: Map triples to graph nodes and edges. The node attributes are defined as: Node={e,t first ,t last ,Confidence,Embedding} where t first and t last are the first and last appearance times of the entity, respectively. Embedding is the entity semantic vector generated by the model. The edge attributes are defined as: Edge={(h,r,t),t update ,p r } S124: Multi-source entity alignment is performed using the cosine similarity of entity embedding vectors. The alignment formula is: The dynamic threat map is stored in the Neo4j graph database, and time index and semantic index are established for nodes and edges.

3. The method according to claim 1, characterized in that The construction and incremental update of the temporal-aware dynamic image encoder includes the following steps: S21: Construct a dynamic graph encoder with time decay characteristics, including: S211: Based on the time t0 when the first attack occurred, the absolute timestamp is converted into a relative time series: t rel =t abs -t0 S212: Then, a period parameter T is selected according to the attack pattern characteristics to generate a coding vector: S213: Constructing a graph attention network with time decay characteristics: Where Softmax is a normalized exponential function, W Q , W K is a learnable 256-dimensional projection matrix, Δt=tt j , h i 、h j represents the original embedding vector of node i and node j, and represents the temporal encoding vector of nodes i and j, || represents the vector concatenation operation, d represents the dimension of the embedding vector, and λ is the temporal decay coefficient; S213: Dynamically adjust the importance of multi-time window features through the gated residual fusion layer and output the aggregated node embedding: Among them, h' j (t) is the new embedding representation of the node after the gated residual fusion layer is processed, LayerNorm is the layer normalization process, g k is a gate value ranging from 0 to 1, generated by the Sigmoid function, Head k is the kth attention head, h i (t) represents the embedding of the original node i at time t; S22: Real-time graph evolution based on event-driven incremental update mechanism: S221: Set the dual trigger conditions of abnormal behavior detection event and periodic forced update event, and the forced update interval τ is based on the minimum period parameter T of the active attack mode. i Dynamic adjustment; S222: Calculate the newly added node v new With the full graph node v j Similarity: where h new and h j is the embedding representation, T avg is the mean time interval of all edges in the current graph, λ t is the time decay coefficient in the dynamic image encoder, t new and t j Represents node v new and node v j Last updated time; S223: For the node pairs whose similarity is higher than the threshold θ, a local update is performed, and a new triple ΔG is added. t ={(h′, r′, t′)} timestamp t′ is input into the periodic coding layer, and TE(t′) is generated to update the embedding of the associated subgraph nodes; S224: The updated node embedding is written into the Neo4j database after layer normalization, completing the dynamic fusion of the attack behavior temporal features and semantic association relationships.

4. The method according to claim 1, wherein The timing constraint analysis and attack detection includes the following steps: S31: Build a timing rule library based on prior knowledge and perform attack chain logic verification, including: S311: Decompose the attack phase dependencies from the MITRE ATT&CK tactical library and define three-dimensional constraint parameters: the tolerance window α is set according to the MITRE tactical response window; The delay threshold β is defined according to the urgency of the attack type; The weight w0 is determined according to the tactical level; S312: Perform timing constraint verification on candidate attack chains in the dynamic threat map. For the continuous attack phase, if A→B If the legal timing interval is met, the timing is legal; otherwise, it is considered a violation and a conflict score is triggered; The legal timing interval is defined as: in, Indicates the end time of phase A, Indicates the start time of phase B, T A , T B Indicates the duration of phases A and B; S313: Calculate the conflict score of the violation attack chain: in, Indicates the absolute value of the time difference, max(T A , T B ) is the normalization factor, where is the normalized output of the kth attention head, σ is the Sigmoid function, is a learnable parameter matrix unique to each head, h i (t) represents the embedding of the original node i at time t, S314: When the ConflictScore exceeds the threshold, an alarm is triggered. After manual review, the rule base is updated or the attack chain is adjusted. S32: Perform multi-dimensional attack detection based on dynamic threat graphs: S321: Extract standardized triples from the threat intelligence to be detected and calculate the entity node v new With graph node v j The comprehensive similarity of: where g k is the weight of the gated residual layer, λ is the time decay coefficient in the encoder, T is the attack period parameter defined by the algorithm, and the timing constraint check is calculated according to the conflict scoring formula. new and h j is the embedding representation, t new and t j Represents node v new and node v j Last updated time; S322: Similarity Sim(v new , v j ) is higher than the threshold θ sim The candidate attack chain performs secondary verification of timing constraints, and when the conflict score ConflictScore exceeds the threshold, it is determined to be an abnormal attack; S323: The triplet set ΔG that has passed the test t ={(h′, r′, t′)} is incrementally updated to the dynamic threat map, and the new attack mode expands the temporal rule base and adds attack stage parameters.

5. The method according to claim 1, wherein The network attack detection model includes the following steps: S41: Construct a network attack detection model ontology, including: S411: Establish a data interface layer, design a unified data access protocol, and use Kafka to build a real-time message queue; S412: Constructing a dynamic threat graph, a dynamic graph encoding module, an incremental update module, a timing constraint analysis module, and an attack detection module; S413: Build a visualization interface to display dynamic threat maps, attack detection results, timing constraint verification results, and incremental update monitoring interface; S42: Build a dynamic training mechanism for network attack detection models, including: S421: Automatically export the attack chain time series subgraph of the past 72 hours from Neo4j every 24 hours, and generate negative samples by randomly disrupting the timestamps of legitimate attack chains to build a balanced training dataset; S422: Automatically adjust key parameters based on real-time performance indicators, where the similarity threshold θ sim Through dynamic optimization of the ROC curve, the time decay coefficient λ is adaptively adjusted according to the attack frequency; S43: Build a manual review and feedback mechanism for the model, including: S431: Verify alarm cases through a visual review interface. False positives are identified by marking the error type and correcting the association rules. For missed positives, missing attack paths are supplemented. S432: Update the training set of the model, add false positive cases to the negative sample set, and add missed negative cases to the positive sample set; S433: Update the dynamic threat intelligence graph, delete the error edge for the false positive case, insert the corresponding triple for the missed positive case, and dynamically adjust the threshold θ based on the false positive statistics. sim .

Images