An Adaptive Threat Intelligence Analysis and Response Method and System for Network Information Security

Abstract

This application provides an adaptive threat intelligence analysis and response method and system for network information security. Specifically, it collects encrypted traffic payload byte streams and segments them into a time-series traffic matrix according to time windows; it parses communication metadata, matches it with features from a threat intelligence database, and generates dynamic threat fingerprints based on protocol compliance and behavioral anomalies. Multi-level wavelet packet decomposition is performed on the matrix to extract the energy spectral density, information entropy, and time-frequency variation coefficient of high-frequency components, which are then weighted and fused to generate a frequency domain composite anomaly index characterizing heartbeat signal properties. A multi-modal fusion mechanism is used to combine the frequency domain index and threat fingerprint to identify covert heartbeat periodicity and protocol violation patterns, outputting a threat score. If a threshold is exceeded, the traffic is intercepted, and new attack characteristics are verified and fed back to update the threat intelligence database, forming a self-evolving defensive closed loop. This application achieves automated interception and closed-loop updates to the threat intelligence database, significantly improving defensive adaptability.

Description

Technical Field

[0001] This application relates to the field of network security threat detection and response technology, and in particular to an adaptive threat intelligence analysis and response method and system for network information security. Background Technology

[0002] Current advanced persistent threat (APS) attacks commonly exploit transport layer security (TLS) encrypted channels to conceal command and control communication behavior. This type of communication is highly stealthy and dynamically mutated; the heartbeat signal period can be adaptively adjusted, and protocol fields can be disguised as compliant interactions. Network security defense systems urgently need to overcome the bottleneck of deep analysis of encrypted traffic to achieve the goal of capturing the periodic characteristics of disguised heartbeat signals.

[0003] Currently, a representative existing solution employs a protocol compliance detection engine based on fixed rules and statistical features. This solution primarily parses metadata from the transport layer security protocol handshake phase, such as server name indication fields and certificate chain information, matches it against a pre-set blacklist of malicious domain names and addresses, determines abnormal data connections through static thresholds, and triggers predefined fixed policies to execute traffic interception actions based on the detection results.

[0004] However, this approach has significant technical shortcomings. It cannot identify implicit distribution patterns in the frequency domain of encrypted payloads, such as abnormal fluctuations in energy spectral density or sudden changes in information entropy, leading to a high false positive rate between encrypted semantically similar normal business traffic and command and control communications. Furthermore, new attack characteristics require manual verification and secondary injection into the system after interception, and the lack of an automated feedback loop hinders the continuous evolution of defense capabilities, preventing the formation of a closed-loop self-evolving capability to counter advanced threats. Summary of the Invention

[0005] This application provides a network information security adaptive threat intelligence analysis and response method and system to solve the problem of high false positive rate in the prior art.

[0006] Firstly, this application provides an adaptive threat intelligence analysis and response method for network information security, including:

[0007] Collect the payload byte stream from the encrypted traffic of the transport layer security protocol, divide the payload byte stream into fixed time windows, and generate a time-series traffic matrix;

[0008] The communication metadata of the payload byte stream is parsed, and the communication metadata is matched and associated with known command and control communication features in the threat intelligence database. Based on the protocol compliance and abnormal behavior judgment results, a dynamically updated threat fingerprint is generated.

[0009] Multi-level wavelet packet decomposition is performed on the flow matrix to extract the energy spectral density, information entropy, and time-frequency variation coefficient of each high-frequency sub-band component. Based on a predefined anomaly template, the energy spectral density, information entropy, and variation coefficient are weighted, fused, and standardized to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity, and stability of the heartbeat signal.

[0010] By fusing the frequency domain composite anomaly index and the threat fingerprint through a multi-head attention mechanism, the periodic characteristics of command and control heartbeat signals hidden in encrypted traffic and protocol violation patterns are identified, and a threat confidence score is generated.

[0011] If the threat confidence score exceeds the preset risk threshold, the dynamic rule chain engine is activated to intercept the corresponding communication traffic. The periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are used as new attack features. After the validity is confirmed by the verification mechanism, the information is fed back to update the threat intelligence database, realizing a closed-loop linkage between threat defense and intelligence updates.

[0012] Optionally, multi-level wavelet packet decomposition is performed on the flow matrix to extract the energy spectral density, information entropy, and time-frequency variation coefficient of each high-frequency sub-band component. Based on a predefined anomaly template, the energy spectral density, information entropy, and variation coefficient are weighted, fused, and standardized to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity, and stability of the heartbeat signal, including:

[0013] Perform a multi-scale decomposition operation on the flow matrix to generate multiple frequency domain sub-band components. For each high-frequency sub-band component, calculate the energy value per unit frequency and generate the energy spectral density based on the energy value per unit frequency.

[0014] Simultaneously, the sequence disorder of the component sequence is calculated as the information entropy, and the variation amplitude parameter of the time-frequency dimension of the component is extracted as the time-frequency variation coefficient.

[0015] A predefined anomaly template containing weighting ratio parameters and benchmark reference values ​​is loaded. The energy spectral density, information entropy, and time-frequency variation coefficient are input into the weighted calculation model. A fusion operation is performed, and the fusion result is standardized and adjusted to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity, and stability of the heartbeat signal.

[0016] Optionally, a multi-scale decomposition operation is performed on the flow matrix to generate multiple sub-band components in the frequency domain. For each high-frequency sub-band component, a unit frequency energy value is calculated, and an energy spectral density is generated based on the unit frequency energy value, including:

[0017] Perform a multi-level decomposition operation on the flow matrix. Each level of decomposition splits the input component into low-frequency components and high-frequency components. Repeat the multi-level decomposition operation until a preset number of levels is reached to generate multiple frequency domain sub-band components.

[0018] Filter all frequency domain sub-band components marked as high frequency, and for each high frequency sub-band component, calculate the sum of squares of the values ​​of each high frequency component, divide by the frequency range width of the high frequency component, and generate a unit frequency energy value.

[0019] The energy value per unit frequency is multiplied by a preset coefficient to output the energy spectral density, which represents the energy intensity.

[0020] Optionally, by fusing the frequency domain composite anomaly index with the threat fingerprint through a multi-head attention mechanism, the periodic characteristics of command and control heartbeat signals hidden in encrypted traffic and protocol violation patterns are identified to generate a threat confidence score, including:

[0021] A multi-head attention model is constructed and the frequency domain composite anomaly index and the threat fingerprint are input. Multiple attention heads focus on different feature dimensions, and the adjustment feature contribution ratio of multiple weight distribution matrices is calculated.

[0022] Based on the contribution ratio of the adjusted features of multiple weight distribution matrices, a fused feature vector is generated. From the fused feature vector, periodic repetition patterns of command and control heartbeat signals hidden in encrypted traffic are identified as periodic features of heartbeat signals. Deviation sequences from standard protocol rules are detected as protocol violation patterns. The periodic features of heartbeat signals and the protocol violation patterns are integrated to generate a threat confidence score.

[0023] Optionally, a multi-head attention model is constructed and the frequency-domain composite anomaly index and the threat fingerprint are input. Multiple attention heads focus on different feature dimensions, and the proportion of adjusted feature contributions from multiple weight distribution matrices is calculated, including:

[0024] Construct a multi-head attention model, which includes a projection matrix group and an attention head component group. The projection matrix group contains three projection matrices, and the number of these matrices is equal to the number of attention heads.

[0025] The frequency domain composite anomaly index and the threat fingerprint are input into the multi-head attention model, an alignment operation is performed to generate feature data, and the feature data is multiplied by the three sets of projection matrices in the projection matrix group to generate query projection data, key projection data and value projection data.

[0026] The query projection data, key projection data, and value projection data are divided into multiple sub-blocks. Each sub-block is input into the corresponding attention head component in the attention head component group. The transpose of the sub-blocks of the query projection data and the key projection data is multiplied to generate the original weight matrix. The original weight matrix is ​​divided by the square root of the feature dimension to generate the scaled weight matrix. The scaled weight matrix is ​​subjected to exponential operation row by row and summed to generate the weight distribution matrix.

[0027] Weight calculation is performed within each attention head component. The weight distribution matrix is ​​multiplied by the value projection data sub-block to generate head output data. Proportional allocation calculation is performed. The head output data is multiplied by a preset head weight coefficient to output the proportional calculation result.

[0028] The proportion calculation results of all attention head components are concatenated along the feature dimension to generate multiple weight distribution matrices to adjust the feature contribution ratio.

[0029] Optionally, if the threat confidence score exceeds a preset risk threshold, the dynamic rule chain engine is activated to intercept the corresponding communication traffic. The periodic characteristics of the heartbeat signal and the protocol violation patterns identified this time are used as new attack features. After the validity is confirmed through a verification mechanism, the information is fed back to update the threat intelligence database, achieving a closed-loop linkage between threat defense and intelligence updates, including:

[0030] The threat confidence score is compared with a preset risk threshold. If the threat confidence score exceeds the preset risk threshold, the dynamic rule chain engine is activated to block the corresponding communication traffic.

[0031] Based on the rule chain blocking of corresponding communication traffic, the periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are extracted to form new attack characteristics;

[0032] The credibility of the new attack signature is verified by a verification mechanism. The data block of the verified new attack signature is added to the control communication signature and fed back to the threat intelligence database to achieve a closed-loop linkage between threat defense and intelligence update.

[0033] Optionally, the communication metadata of the payload byte stream is parsed, and the communication metadata is matched and associated with known command and control communication characteristics in the threat intelligence database. Based on the protocol compliance and abnormal behavior determination results, a dynamically updated threat fingerprint is generated, including:

[0034] The communication metadata is separated from the payload byte stream, and command and control communication features are retrieved from the threat intelligence database. A similarity calculation mechanism is used to compare the communication metadata with the control communication features item by item to obtain a matching association value.

[0035] Perform protocol rule verification checks, determine the compliance of communication behavior against the standard protocol specification process template, obtain the protocol compliance judgment result, detect the time interval distribution and data volume deviation of the communication sequence, and generate behavior anomaly indication values;

[0036] By integrating the matching correlation value, protocol compliance judgment result, and behavior anomaly indication value, when the behavior anomaly indication value exceeds a predefined threshold, the corresponding new communication mode is added to the control communication feature to generate a dynamically updated threat fingerprint in the form of a storable digital identifier.

[0037] Secondly, this application provides a network information security adaptive threat intelligence analysis and response system, including:

[0038] The acquisition module is used to acquire the payload byte stream in the encrypted traffic of the transport layer security protocol, and to divide the payload byte stream into fixed time windows to generate a time-series traffic matrix.

[0039] The matching module is used to parse the communication metadata of the payload byte stream, match and associate the communication metadata with known command and control communication features in the threat intelligence database, and generate a dynamically updated threat fingerprint based on protocol compliance and abnormal behavior judgment results.

[0040] The decomposition module is used to perform multi-level wavelet packet decomposition on the flow matrix, extract the energy spectral density, information entropy and time-frequency variation coefficient of each high-frequency sub-band component, and perform weighted fusion and standardization on the energy spectral density, information entropy and variation coefficient based on a predefined anomaly template to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity and stability of the heartbeat signal.

[0041] The fusion module is used to fuse the frequency domain composite anomaly index and the threat fingerprint through a multi-head attention mechanism, identify the periodic characteristics of command and control heartbeat signals and protocol violation patterns hidden in encrypted traffic, and generate a threat confidence score.

[0042] The activation module is used to activate the dynamic rule chain engine to intercept the corresponding communication traffic if the threat confidence score exceeds a preset risk threshold. The periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are used as new attack characteristics. After the validity is confirmed by the verification mechanism, the information is fed back to update the threat intelligence database, so as to realize the closed-loop linkage between threat defense and intelligence update.

[0043] Thirdly, this application provides a computing device, including a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement the adaptive threat intelligence analysis and response method for network information security as described in the first aspect above.

[0044] Fourthly, this application provides a computer storage medium storing a computer program, which, when executed by a computer, implements a network information security adaptive threat intelligence analysis and response method as described in the first aspect.

[0045] This application collects payload byte streams from encrypted traffic of transport layer security protocols, segments them into a time-series traffic matrix according to fixed time windows, and constructs a time-series framework for analyzing periodic behavior. Subsequently, it analyzes the communication metadata of the payload byte streams, associates them with known command and control features in the threat intelligence database, and generates dynamically updated threat fingerprints based on protocol compliance and behavioral anomalies, overcoming the limitations of traditional static rule bases with lagging updates. Further, it performs multi-level wavelet packet decomposition on the traffic matrix, extracting the energy spectral density, information entropy, and time-frequency variation coefficients of high-frequency sub-band components. Through weighted fusion and standardization of predefined anomaly templates, it generates frequency-domain composite anomaly indicators, accurately capturing the spectral features of hidden heartbeat signals that traditional statistical methods cannot identify. Then, it employs a multi-head attention mechanism to fuse the frequency-domain indicators and threat fingerprints, identifying hidden heartbeat periodicity and protocol violation patterns in encrypted traffic and outputting threat confidence scores, significantly improving the accuracy of encrypted threat detection. Finally, when the threat score exceeds a preset threshold, it activates a dynamic rule chain engine to intercept the corresponding traffic. Simultaneously, it verifies newly identified attack features and feeds them back into the threat intelligence database, forming a closed-loop mechanism for continuous autonomous evolution of defense capabilities.

[0046] Furthermore, by performing multi-scale wavelet packet decomposition on the time-series traffic matrix to generate multi-band sub-signal components, a separation basis for high-frequency noise and covert signals is established. For each high-frequency sub-band, the energy spectral density is calculated per unit frequency to quantify the energy aggregation characteristics of the heartbeat signal. The component sequence disorder is calculated as information entropy to identify traces of human entropy value tampering. The time-frequency dimension variation amplitude parameter is extracted as the coefficient of variation to detect periodic stability vulnerabilities. Then, a predefined anomaly template containing weighted ratios and benchmark values ​​is loaded. The energy spectral density, information entropy, and time-frequency coefficient of variation are input into a weighted fusion model and, after standardization, output a frequency domain composite anomaly index. This process effectively distinguishes the spectral obfuscation of business traffic from that of attack traffic through physical feature quantification. Overall, this forms a frequency domain probe combination with significant anti-obfuscation capabilities, transforming high-frequency signal energy distribution anomalies, camouflage complexity deviations, and periodic stability defects into quantifiable attack fingerprints, solving the problem of deep camouflage of advanced threats in the frequency domain.

[0047] These or other aspects of this application will become more apparent in the following description of the embodiments. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 A flowchart of an adaptive threat intelligence analysis and response method for network information security provided in this application is shown;

[0050] Figure 2 The illustration shows a scenario diagram of an adaptive threat intelligence analysis and response method for network information security provided in this application;

[0051] Figure 3 This paper presents a schematic diagram of the structure of an adaptive threat intelligence analysis and response system for network information security provided in this application.

[0052] Figure 4 A schematic diagram of the structure of a computing device provided in this application is shown. Detailed Implementation

[0053] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0054] In some of the processes described in the specification, claims, and accompanying drawings of this application, multiple operations appearing in a specific order are included. However, it should be clearly understood that these operations may not be executed in the order they appear herein, or may be executed in parallel. The operation numbers, such as 101, 102, etc., are merely used to distinguish different operations and do not themselves represent any execution order. Furthermore, these processes may include more or fewer operations, and these operations may be executed sequentially or in parallel. It should be noted that the descriptions such as "first," "second," etc., in this document are used to distinguish different messages, devices, modules, etc., and do not represent a chronological order, nor do they limit "first" and "second" to different types.

[0055] Researchers have discovered significant shortcomings in current network security threat intelligence analysis and response methods, particularly regarding threats to encrypted traffic from transport layer security protocols. Traditional encrypted traffic analysis techniques, based on plaintext feature matching or single-dimensional methods, struggle to effectively capture deep patterns hidden within encrypted payloads of malicious command and control communications. Furthermore, they fail to identify implicit distribution patterns in the frequency domain, such as anomalous fluctuations in energy spectral density or sudden changes in information entropy, leading to a high misclassification rate between semantically similar normal business traffic and command and control communications. Therefore, an adaptive threat intelligence analysis and response method is urgently needed that can deeply integrate time-frequency domain features, automatically correlate threat intelligence, and achieve a closed-loop evolution of defense.

[0056] To address the aforementioned issues, this invention proposes an adaptive threat intelligence analysis and response method for network information security. Its core lies in integrating multi-dimensional correlation analysis of time-domain traffic structure and deep frequency-domain features, and achieving self-evolution of intelligence and defense through a closed-loop linkage mechanism. This method significantly reduces the false positive rate between normal and malicious encrypted traffic by meticulously characterizing the frequency-domain distribution anomalies and stability features of encrypted traffic; simultaneously, it constructs an automated closed-loop link of "detection-interception-feature extraction-verification-knowledge update," ensuring the continuous self-evolution capability of the defense system against unknown advanced threats.

[0057] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0058] Figure 1 This application provides a flowchart of an adaptive threat intelligence analysis and response method for network information security, as shown in the embodiments of this application. Figure 1 As shown, the method includes:

[0059] 101. Collect the payload byte stream in the encrypted traffic of the transport layer security protocol, divide the payload byte stream into fixed time windows, and generate a time-series traffic matrix;

[0060] In the above steps, transport layer security protocol encrypted traffic refers to the encrypted network data stream generated by the secure transport protocol used in network communication, ensuring that the data is not stolen or tampered with during transmission; payload byte stream refers to the byte sequence portion in the encrypted traffic that carries the actual data content, without including the header metadata of the network data packets; fixed time window refers to a pre-defined interval of the same length used to divide the continuous byte stream into multiple blocks of equal length, each block corresponding to a time period; time-sequential traffic matrix refers to converting the blocks after the time window is divided into a data array structure arranged in chronological order, where each row represents the numerical digest information of the byte stream after processing within a time window, and the time dimension represents the window sequence index.

[0061] In this embodiment, a general network packet capture tool is first used to monitor the network interface, filtering and capturing transport layer security protocol traffic, extracting only the payload byte sequence. This involves capturing the original data packets, discarding the header information, and retaining only the continuous stream of payload bytes. Then, the captured continuous byte stream is divided into equal intervals according to fixed time length ranges, using a timer and counter tool to divide the byte stream into blocks, ensuring that each block contains the complete byte sequence within its time window. Specifically, the segmentation process is as follows: the timer is initialized, and whenever the time reaches the window length, the currently accumulated byte sequence is truncated as a block; if the byte stream does not fill a window, it is padded with zeros or the remaining portion is retained. Next, the byte sequence of each time window block is processed and analyzed to generate a feature summary value for that window, and all feature summaries of all windows are arranged in chronological order into a matrix structure. In this way, the byte stream is converted into an easily processed temporal matrix, facilitating subsequent analysis. For example, in practical applications, a fixed time window is set to 2 seconds. The captured transport layer security protocol encrypted traffic payload byte stream is a long sequence, such as the initial part being the byte sequence [65, 120, 200, ..., 150], with a total duration of 10 seconds. After segmentation, 5 time windows are generated: the first 2-second window contains the byte sequence [65, 120], with a total of 2 bytes and an average of 92.5; the second 2-second window contains the byte sequence [200, 180], with a total of 2 bytes and an average of 190; and so on. The fifth window may be padded with zeros due to insufficient byte sequence, for example, the byte sequence [5, 0], with a total of 1 byte and an average of 2.5. All window features are organized into a time-series flow matrix: the first row represents the total number of bytes and the average value of time index 1 ([2, 92.5]), the second row represents the value of time index 2 ([2, 190]), and so on up to the fifth row represents the value of time index 5 ([1, 2.5] or [2, 2.5]), forming a complete matrix structure for time series pattern recognition.

[0062] In practical applications, for example, in an experiment, researchers first collected payload byte streams from the network environment of Company A, specifically collecting 10,000 bytes of data samples from the encrypted traffic of the transport layer security protocol. Then, these byte streams were divided into 50 independent segments according to a fixed time window of 200 milliseconds. Finally, a time-series traffic matrix was generated to facilitate subsequent analysis of encryption behavior characteristics.

[0063] In the overall scheme of step 101 above, the payload byte stream in the encrypted traffic of the transport layer security protocol is collected and divided into fixed time windows to finally generate a time-series traffic matrix. This process realizes the structured processing of network traffic data, which facilitates subsequent efficient time-series analysis, abnormal behavior detection and network security monitoring applications.

[0064] 102. Parse the communication metadata of the payload byte stream, match and associate the communication metadata with known command and control communication features in the threat intelligence database, and generate a dynamically updated threat fingerprint based on protocol compliance and abnormal behavior judgment results;

[0065] Optionally, step 102 may specifically include the following steps:

[0066] 1021. Separate communication metadata from the payload byte stream, retrieve command and control communication features from the threat intelligence database, and use a similarity calculation mechanism to perform item-by-item pairing and comparison between the communication metadata and the control communication features to obtain a matching association value;

[0067] 1022. Perform protocol rule verification and check, judge the compliance of communication behavior against the standard protocol specification process template, obtain the protocol compliance judgment result, detect the time interval distribution and data volume deviation of the communication sequence, and generate behavior anomaly indication value;

[0068] 1023. Integrate the matching correlation value, protocol compliance judgment result and behavior anomaly indication value. When the behavior anomaly indication value exceeds the predefined threshold, add the corresponding new communication mode to the control communication feature to generate a dynamically updated threat fingerprint in the form of a storable digital identifier.

[0069] In the above steps, communication metadata refers to the network communication-related information extracted from the payload byte stream, such as source address, destination address, port number, timestamp, and other communication descriptive information. Threat intelligence database refers to a data set that stores known malicious activity patterns, including command and control communication characteristics. These characteristics describe typical behavioral sequences of attackers remotely controlling devices. Similarity calculation mechanism refers to a standard method used to measure the degree of similarity between two data items. Matching correlation value refers to a numerical value that represents the degree of matching between communication metadata and known characteristics. Protocol rule verification check refers to checking whether communication behavior conforms to the standard protocol specification process template. The template defines expected rules such as normal communication handshake steps. Behavior anomaly indication value refers to a numerical value that reflects the degree to which communication behavior deviates from the normal state. Predefined threshold refers to the set boundary value for anomaly judgment. New communication pattern refers to the detected abnormal communication sequence. Dynamically updated threat fingerprint refers to a malicious behavior digital identifier generated or updated based on the detection results.

[0070] In this embodiment, firstly, in step 1021, communication metadata is separated from the payload byte stream, and command and control communication features are retrieved from the threat intelligence database. A similarity calculation mechanism is then used to compare the communication metadata with the control communication features item by item to obtain a matching correlation value. This step involves first using a general metadata extraction tool, such as a parser developed based on Python scripts, to separate metadata fields from the payload byte stream generated in step 101, such as source address, target address, port number, and timestamp. Then, the threat intelligence database is accessed, which can be a local database or a cloud storage service. Known command and control communication features are retrieved through a matching query interface, such as features describing targets whose source address is within a specific malicious IP range. Next, a similarity calculation mechanism, such as a cosine similarity algorithm, is used to compare the correspondence between metadata fields and features item by item. For example, for the source address, the similarity score between the metadata value and the feature value is calculated. Finally, the calculation results of all fields are summarized, for example, by taking the average, to obtain a matching correlation value, such as a percentage value. For example, in a practical application, the input payload byte stream comes from TLS encrypted traffic and contains metadata such as source address 19216811 and destination address 10001 port 443. A characteristic source address range of 19216810-192168254 is retrieved from the threat intelligence database. The similarity score is calculated by the distance difference between the source address 19216811 and the characteristic range. The score based on the distance function is 75. Other metadata such as port 443 is compared with the characteristic port 443 and the similarity is 100. The overall matching correlation degree is calculated as a weighted average of 85, indicating a high degree of matching.

[0071] Next, in step 1022, a protocol rule verification check is performed. The compliance of communication behavior is determined by comparing it against the standard protocol specification process template, resulting in a protocol compliance judgment. The time interval distribution and data volume deviation of the communication sequence are detected, and a behavior anomaly indication value is generated. This step involves: first, using the matching correlation value output in step 1021 as the input context, a protocol rule verification check is performed. Using the standard protocol specification process template, such as the TLS protocol handshake sequence rules stored in an in-memory data structure, the behavior of the metadata fields of the communication sequence is compared to determine compliance, such as whether the continuous request-response steps conform to the expected process. The result is output as a compliant or non-compliant text. Then, the time interval distribution of the communication sequence is detected, and the degree of difference in time intervals is calculated using simple variance statistics. Simultaneously, the data volume deviation is calculated, and the standard deviation method is used to analyze abnormal fluctuations in byte traffic size. Finally, the compliance judgment and time data deviation are integrated to generate a comprehensive behavior anomaly indication value, such as a percentage value. The specific process involves extracting time series data, such as the millisecond interval between requests, and data series data, such as the number of bytes in each communication block, from communication metadata. The interval distribution is calculated using variance. For example, if the time interval is 100-150 milliseconds, compared to the normal range of 50-100 milliseconds, a variance value greater than the normal range of 60 indicates high deviation. Data volume deviation is calculated based on a moving average. For example, if the traffic value is 200-300 bytes, compared to the normal value of 150, a standard deviation of 40 is calculated, which is higher than the baseline of 30, indicating high deviation. Compliance is determined by factors such as detecting a missing TLS end-of-handshake marker in the communication sequence, which is considered non-compliant. These factors are integrated to generate an abnormal behavior indicator value, such as 65, which is considered abnormal if it exceeds the normal threshold of 50. For example, in practical applications, if the matching correlation value is 85, after determining that the communication may be abnormal, the protocol rule verification is executed. The communication sequence time interval is detected to be 120-130 milliseconds, and the data volume is 500-600 bytes. The standard template expects an interval of 50-100 milliseconds and a data volume of 300-400 bytes. The calculated time interval variance is 70, and the data volume standard deviation is 80. The compliance is determined to be non-compliant, and an integrated abnormal behavior indication value of 70 is generated.

[0072] Finally, in step 1023, the matching correlation value, protocol compliance judgment result, and behavioral anomaly indication value are integrated. When the behavioral anomaly indication value exceeds a predefined threshold, the corresponding new communication pattern is added to the control communication feature, generating a dynamically updated, storable threat fingerprint in the form of a digital identifier. This step involves first using the behavioral anomaly indication value output in step 1022 as input, integrating it with other elements, such as the matching correlation value (e.g., 85) and the protocol compliance judgment result (e.g., non-compliance), and generating a comprehensive score through weighted averaging or logical rules. Then, when the behavioral anomaly indication value exceeds a predefined threshold (e.g., a threshold of 60), it is considered an anomaly. The newly detected communication pattern, extracted from the metadata's anomaly sequence, is added to the command and control communication feature in the threat intelligence database as a new entry. Finally, a digital identifier generator is used to convert the new feature into a storable threat fingerprint, such as a unique identifier string, for subsequent querying and tracking, enabling dynamic updates. For example, in practical applications, if the input matching correlation value is 85, the protocol compliance judgment result is non-compliant, the behavior abnormality indication value is 70, and the integrated comprehensive score of 75 exceeds the predefined threshold of 60, then a new communication pattern is extracted from the communication metadata, such as the repeated request sequence of source address 19216811, and this pattern is added to the threat intelligence database. Then, a dynamically updated threat fingerprint is generated, such as a hexadecimal ID FP123AB, which is stored in the database to complete the fingerprint update.

[0073] In practical applications, for example, in an experiment, researchers collected 10,000 bytes of payload byte stream from encrypted traffic of transport layer security protocols in network system A. They then parsed the communication metadata of this payload byte stream, including elements such as source address and destination port, and matched it against 20 known command and control communication features stored in threat intelligence database B. A cosine similarity algorithm was used to calculate the correlation between the communication metadata and the features item by item, resulting in an average matching correlation with a minimum value of 0.75 and a maximum value of 0.95. Next, protocol rule verification checks were performed, referring to the process template of standard protocol specification template C. The communication behavior compliance result was determined to be abnormal, and the time interval distribution of the communication sequence was detected, finding an average deviation of 50 milliseconds. The data volume deviation was calculated to exceed a baseline value of 60 bytes, generating a behavior anomaly indication value. Finally, the matching correlation value, protocol compliance judgment result, and behavior anomaly indication value were integrated. When the anomaly indication value exceeded a preset threshold of 30, the corresponding new communication pattern was added to the control communication feature database, generating a dynamically updated, storable digital identifier-based threat fingerprint.

[0074] In the overall scheme of step 102 above, the communication metadata of the encrypted traffic payload byte stream of the transport layer security protocol is parsed and matched with known command and control communication characteristics in the threat intelligence database. Based on protocol rule verification checks and abnormal behavior detection, multi-dimensional indicators are integrated to achieve protocol compliance determination and dynamic monitoring of abnormal behavior. This technology comprehensively considers the matching correlation results, protocol compliance status, and communication sequence deviation indicators. When anomalies are detected exceeding preset security thresholds, new communication pattern characteristics are automatically updated to the threat intelligence database, generating a dynamically evolving, storable digital identifier-based threat fingerprint. Ultimately, this forms a proactive defense mechanism capable of continuously detecting new attack methods.

[0075] 103. Perform multi-level wavelet packet decomposition on the flow matrix, extract the energy spectral density, information entropy and time-frequency variation coefficient of each high-frequency sub-band component, and perform weighted fusion and standardization on the energy spectral density, information entropy and variation coefficient based on a predefined anomaly template to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity and stability of the heartbeat signal.

[0076] Optionally, step 103 may specifically include the following steps:

[0077] 1031. Perform a multi-scale decomposition operation on the flow matrix to generate multiple sub-band components in the frequency domain. For each high-frequency sub-band component, calculate the energy value per unit frequency and generate the energy spectral density based on the energy value per unit frequency.

[0078] Step 1031 may specifically include the following process: performing a multi-level decomposition operation on the flow matrix, whereby each level of decomposition splits the input component into low-frequency components and high-frequency components, repeating the multi-level decomposition operation until a preset number of levels is reached, generating multiple frequency domain sub-band components; filtering all frequency domain sub-band components marked as high-frequency, and for each high-frequency sub-band component, calculating the sum of the squares of the values ​​of each high-frequency component, dividing by the frequency range width of the high-frequency component, to generate a unit frequency energy value; multiplying the unit frequency energy value by a preset coefficient, and outputting the energy spectral density characterizing the energy intensity.

[0079] 1032. Simultaneously calculate the sequence disorder of the component sequences as information entropy, and extract the variation amplitude parameter of the time-frequency dimension of the components as the time-frequency variation coefficient.

[0080] 1033. Load a predefined anomaly template containing weighted ratio parameters and benchmark reference values, input the energy spectral density, information entropy and time-frequency variation coefficient into the weighted calculation model, perform a fusion operation, and perform standardization adjustment processing on the fusion result to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity and stability of the heartbeat signal.

[0081] In the above steps, the flow matrix refers to the time-series data array structure generated in step 101, where each row represents a feature summary sequence of a time window. Multi-level wavelet packet decomposition refers to the technique of using wavelet functions such as Daubechies wavelets to decompose the signal into multiple sub-band components of different frequencies. High-frequency sub-band components refer to the signal components that represent higher frequency components after decomposition. Energy spectral density refers to the calculated energy intensity value per unit frequency. Information entropy refers to the index of the disorder of the component sequence calculated using information theory formulas. Time-frequency coefficient of variation refers to the parameter that measures the magnitude of the variation of the component in the time and frequency dimensions, usually the standard deviation divided by the mean. Predefined anomaly template refers to the reference value template stored in the configuration file, which includes weighting ratio parameters and benchmark reference values. Weighted fusion refers to the operation of multiplying multiple indicators by their respective weights and then summing them. Standardization refers to the mathematical processing of adjusting the data to a uniform scale range. Frequency domain composite anomaly index refers to the final generated value, which comprehensively reflects the degree of anomaly in energy distribution, complexity, and stability.

[0082] In this embodiment of the application, firstly, a multi-scale decomposition operation is performed on the flow matrix in step 1031 to generate multiple sub-band components in the frequency domain. For each high-frequency sub-band component, the unit frequency energy value is calculated, and the energy spectral density is generated based on the unit frequency energy value. The implementation process of this step includes using a discrete wavelet transform algorithm such as the Daubechies wavelet to perform multi-level decomposition. Each level of decomposition splits the input components into low-frequency components and high-frequency components. Specifically, the decomposition level is preset to 3. The initial flow matrix is ​​used as input. The first level of decomposition splits the row vectors of the matrix into low-frequency components and high-frequency components. The high-frequency components are stored as sub-bands. The second level uses the low-frequency components from the previous round as input to continue splitting into new low-frequency and high-frequency components. This process is repeated until the preset level of 3 is reached, generating multiple high-frequency sub-band components. Then, all sub-band components marked as high-frequency are selected. For each high-frequency component sequence, the sum of the squares of its values ​​is calculated and divided by the frequency range width to generate a unit frequency energy value. Specifically, when calculating the unit frequency energy value, the frequency range width is set based on the frequency resolution of the wavelet coefficients. Finally, the unit frequency energy value is multiplied by a preset coefficient, such as 1.2, and the output is the energy spectral density representing the energy intensity. For example, in practical applications, the input flow matrix has two rows of data. The first row represents the feature summary of time index 1, with a total number of bytes of 20 and an average value of 40. The second row has a total number of bytes of 30 and an average value of 50. The preset decomposition level is 3. After Daubechies wavelet decomposition, two high-frequency sub-band components are obtained. The first high-frequency component sequence has values ​​of 0.5 and 0.6. The frequency range width is set to 1kHz. The sum of squares is calculated as 0.5 squared plus 0.6 squared, which equals 0.61. Dividing by the width of 1kHz, we get the unit frequency energy value of 0.61. Multiplying by the preset coefficient 1.2, we output the energy spectral density of 0.732. The second high-frequency component is calculated similarly to generate other energy spectral densities.

[0083] Secondly, through step 1032, the sequence disorder of the component sequences is simultaneously calculated as the information entropy, and the variation amplitude parameter of the time-frequency dimension of the components is extracted as the time-frequency variation coefficient. The implementation process of this step includes: for each high-frequency sub-band component sequence, the sequence disorder is calculated as the information entropy using the Shannon entropy formula. Specifically, the information entropy is calculated by normalizing the sequence values ​​to a probability distribution, applying the Shannon entropy formula to sum the probability multiplied by the negative value of the log probability, and simultaneously, for the same component sequence, the standard deviation of the time-frequency dimension is calculated and divided by the mean as the time-frequency variation coefficient. Specifically, the variation amplitude parameter is extracted as follows: for sequence values ​​in the time dimension such as 0.5 and 0.6, the mean is calculated to be 0.55 and the standard deviation is 0.05. The variation coefficient is equal to the standard deviation of 0.05 divided by the mean of 0.55, approximately 0.09. For example, in practical applications, a high-frequency subband component sequence has values ​​of 0.3 and 0.7. After normalization, the probability distributions are 0.3 / 1 and 0.7 / 1. Applying the Shannon entropy formula, the entropy value is calculated as the negative Log0.3 of probability 0.3 multiplied by 0.3 plus the negative Log0.7 of probability 0.7 multiplied by 0.7, which is approximately 0.881. The information entropy output is 0.881. The mean of the same sequence is 0.5, the standard deviation is 0.2, and the time-frequency variation coefficient is calculated as 0.2 divided by 0.5, which equals 0.4.

[0084] Finally, in step 1033, a predefined anomaly template containing weighting ratio parameters and benchmark reference values ​​is loaded. The energy spectral density, information entropy, and time-frequency coefficient of variation are input into the weighted calculation model, a fusion operation is performed, and the fusion result is standardized to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity, and stability of the heartbeat signal. This step involves loading a predefined anomaly template from a configuration file (e.g., a JSON file). The template contains weighting ratio parameters such as energy spectral density weight 0.4, information entropy weight 0.3, and coefficient of variation weight 0.3, as well as benchmark reference values ​​such as energy spectral density benchmark 1.0, information entropy benchmark 1.0, and coefficient of variation benchmark 0.2. Then, the indexes output in steps 1031 and 1032 are input into the weighted calculation model, and a weighted fusion operation is performed. Specifically, the weighted model uses a weighted summation formula to multiply each index by its weight and then sums them. Next, a standardization adjustment is performed on the fusion result. Specifically, the difference between the weighted fusion value and the benchmark reference value is calculated, divided by the benchmark value range, multiplied by 100 to convert to a percentage value, and the frequency domain composite anomaly index is output. For example, in practical applications, the input energy spectral density is 0.732, information entropy is 0.881, and time-frequency variation coefficient is 0.4. The template weights are 0.4, 0.3, and 0.3, respectively, and the baseline values ​​are 1.0, 1.0, and 0.2, respectively. The weighted fusion calculation is 0.732 multiplied by 0.4 plus 0.881 multiplied by 0.3 plus 0.4 multiplied by 0.3, approximately 0.2928 plus 0.2643 plus 0.12, which equals 0.6771. The standardization processing baseline value range is set to 0.5. The calculated standard value is equal to 0.6771 minus 0 baseline and the range of 0.5. The standardization output is 0.6771 divided by 0.5 multiplied by 100, which equals 135.42. This indicates that an anomaly index higher than 100 is abnormal. The generated frequency domain composite anomaly index of 135.42 is used to assess the degree of abnormality of the heartbeat signal.

[0085] In a practical application scenario of a network security monitoring platform, technicians conducted in-depth analysis of encrypted traffic collected from data center B. First, they captured 15 consecutive minutes of TLS encrypted payloads from the network boundary gateway, forming a traffic matrix containing 4500 200-millisecond time windows. When the system processed time window number 1024, it performed a three-level wavelet packet decomposition on its 1840-byte payload: using the DB4 wavelet basis function and iteratively calculating through seven layers, ultimately generating 16 sub-band components covering the 0-500Hz frequency band. Three key high-frequency subbands (215-245Hz, 335-370Hz, and 410-440Hz) were selected, and feature extraction was performed on each. For the 245Hz bandwidth subband, the sum of squares of the data points was calculated to be 18740, which was then divided by the 30Hz bandwidth to obtain a frequency energy value of 624.7 units. This value was multiplied by a preset calibration coefficient of 1.15 to generate an energy spectral density of 718.4. The information entropy of this subband was calculated based on the distribution of 256 byte values, yielding 2.48. A coefficient of variation of 0.22 was extracted by analyzing time-frequency fluctuations through a sliding window. The system calls a preset anomaly detection template and performs weighted fusion with an energy spectral density weight of 0.45, an information entropy weight of 0.3, and a coefficient of variation weight of 0.25 (718.4×0.45+2.48×0.3+0.22×0.25=324.28). After transformation by a standardized function, a composite anomaly index in the -0.87 frequency domain is generated. This index dynamically reflects the energy focusing degree of potential control commands, data disorder characteristics, and transmission stability in the current communication flow.

[0086] In the overall scheme of step 103 above, after extracting high-frequency subband components by performing multi-level wavelet packet decomposition on the encrypted traffic matrix of the transport layer, the three major characteristic parameters of energy spectral density, information entropy, and time-frequency variation coefficient are systematically calculated. Based on the weight configuration and benchmark parameter setting of various indicators in the predefined anomaly detection template, the energy distribution pattern, complexity characteristics, and frequency domain stability of the signal are comprehensively quantified in the dynamic weighted fusion model. After standardization and calibration, a multi-dimensional frequency domain composite anomaly index is finally generated. This index integrates the energy intensity spectrum characteristics, sequence statistical disorder characteristics, and time-frequency fluctuation characteristics of the high-frequency subband to characterize the degree of abnormal deviation of the encrypted heartbeat signal in three dimensions: energy distribution balance, information structure complexity, and time stability, providing a frequency domain-level quantitative criterion for subsequent abnormal communication detection.

[0087] 104. By fusing the frequency domain composite anomaly index and the threat fingerprint through a multi-head attention mechanism, the periodic characteristics of command and control heartbeat signals hidden in encrypted traffic and protocol violation patterns are identified, and a threat confidence score is generated.

[0088] Optionally, step 104 may specifically include the following steps:

[0089] 1041. Construct a multi-head attention model and input the frequency domain composite anomaly index and the threat fingerprint. Focus on different feature dimensions through multiple attention heads and calculate the adjustment feature contribution ratio of multiple weight distribution matrices.

[0090] Step 1041 may specifically include the following processes: constructing a multi-head attention model, which includes a projection matrix group and an attention head component group. The projection matrix group contains three projection matrices, and the number of these matrices is equal to the number of attention heads. The frequency domain composite anomaly index and the threat fingerprint are input into the multi-head attention model, and an alignment operation is performed to generate feature data. The feature data is multiplied by the three projection matrices in the projection matrix group to generate query projection data, key projection data, and value projection data. The query projection data, key projection data, and value projection data are divided into multiple sub-blocks, and each sub-block is input into the corresponding attention head component group. The attention head component multiplies the transpose of the sub-blocks of the query projection data and the sub-blocks of the key projection data to generate an original weight matrix. It then divides the original weight matrix by the square root of the feature dimension to generate a scaled weight matrix. The scaled weight matrix is ​​then subjected to row-wise exponential operations and summed to generate a weight distribution matrix. Within each attention head component, weight calculations are performed. The weight distribution matrix is ​​multiplied by the sub-blocks of the value projection data to generate head output data. A proportional allocation calculation is then performed, and the head output data is multiplied by a preset head weight coefficient to output the proportional calculation result. Finally, the proportional calculation results from all attention head components are concatenated along the feature dimension to generate multiple weight distribution matrices that adjust the feature contribution ratio.

[0091] 1042. Based on the contribution ratio of the adjustment features of multiple weight distribution matrices, a fused feature vector is generated. From the fused feature vector, the periodic repetition signal pattern of command and control heartbeat signals hidden in the encrypted traffic is identified as the periodic feature of the heartbeat signal. Deviation sequences from standard protocol rules are detected as protocol violation patterns. The periodic feature of the heartbeat signal and the protocol violation patterns are integrated to generate a threat confidence score.

[0092] In the above steps, the multi-head attention mechanism refers to a neural network component that uses multiple parallel attention modules to process the input data. The frequency domain composite anomaly index refers to the value output from the previous step, reflecting the degree of energy anomaly of the heartbeat signal in the frequency domain. The threat fingerprint refers to a dynamically updated malicious behavior identifier, such as a unique string ID. The attention head refers to an independent module in the multi-head attention, with each module focusing on a different part of the input. The projection matrix group refers to a set of weight matrices used to map the input data to different spaces. The query projection data refers to the vector data used to retrieve relevant information after projection. The key projection data refers to the key vector data used to match queries. The value projection data refers to the vector data storing the actual values. The weight distribution matrix refers to the matrix representing the probability of attention allocation. The adjusted feature contribution ratio refers to the calculated weight value, indicating the importance of different features in the fusion. The fusion feature vector refers to the unified vector representation formed after integrating all features. The command and control heartbeat signal periodicity feature refers to the periodically repeating signal pattern in the detected encrypted traffic, such as a timed communication sequence. The protocol violation pattern refers to the sequence identified as deviating from the standard protocol rules. The threat confidence score refers to the generated numerical score, representing the level of confidence of the detected threat.

[0093] In this embodiment, firstly, through step 1041, a multi-head attention model is constructed and the frequency domain composite anomaly index and the threat fingerprint are input. Multiple attention heads focus on different feature dimensions, and the proportion of the modulated feature contribution of multiple weight distribution matrices is calculated. The implementation process of this step includes constructing a multi-head attention model, which includes a projection matrix group and an attention head component group. The projection matrix group consists of three pre-trained weight matrices, the number of which is equal to the number of attention heads. Then, the frequency domain composite anomaly index and the threat fingerprint are input. Specifically, the alignment operation involves concatenating two input feature sequences, such as numerical arrays, or averaging them element-wise to generate a feature data vector. Next, the feature data vector is multiplied by the three matrices of the projection matrix group to generate query projection data, key projection data, and value projection data. Then, these projection data are divided into multiple sub-blocks, each corresponding to one attention head. If four attention heads are set, the projection data is divided into four equal blocks, and each sub-block is input... The data is fed into the corresponding attention head component. Within each component, the transpose of the query projection sub-block and the key projection sub-block is multiplied to generate the original weight matrix. Then, the original weight matrix is ​​scaled by dividing it by the square root of the feature dimension. Next, the scaled weight matrix is ​​subjected to exponential operations row by row and summed to generate a weight distribution matrix. Specifically, the softmax operation is performed by calculating the exponent value, dividing it by the sum of the exponents in that row to standardize it into a probability distribution. Then, within the attention head, the weight distribution matrix is ​​multiplied by the value projection data sub-block to generate the head output data. The proportional allocation calculation is performed, and this process is repeated for all attention heads. Finally, the proportional calculation results of all heads are concatenated along the feature dimension to generate multiple weight distribution matrices to adjust the feature contribution ratio. For example, the input frequency domain composite anomaly index value is 100, the threat fingerprint numerical code is 120, and the feature data vector is constructed as [100, 120]. The projection matrix is ​​obtained by multiplying a simple diagonal matrix such as [[1,0],[0,1]] and querying the projected data [100,120]. The key projection data is the same, and the value projection data is [100,120]. It is divided into two sub-blocks corresponding to two attention heads, such as query block

[100] , key block

[100] , and value block

[100] . The original weight matrix is ​​calculated by multiplying 100 by 100 and transposing it to get 10000. After scaling, it is divided by the square root of 2 to get approximately 7071. The weight distribution matrix is ​​softmaxed to get a probability of 1. The head output data is 100 multiplied by the weight 1 to get 100. The ratio is calculated by multiplying by the head weight coefficient of 0.5 to get 50. The other head outputs 50 in a similar way. After concatenation, the feature contribution ratio is adjusted to a vector [50,50] for subsequent feature fusion.

[0094] Secondly, through step 1042, based on the adjusted feature contribution ratio of multiple weight distribution matrices, a fused feature vector is generated. From the fused feature vector, the periodic repetition signal pattern of command and control heartbeat signals hidden in the encrypted traffic is identified as the periodic feature of the heartbeat signal, and the deviation sequence from the standard protocol rules is detected as the protocol violation pattern. The periodic feature of the heartbeat signal and the protocol violation pattern are integrated to generate a threat confidence score. The implementation process of this step includes: first, based on the adjustment feature contribution ratio vector as input, a fused feature vector is generated through concatenation or weighted summation operations; then, periodic repetitive signal patterns are identified from the fused feature vector; the repetitive patterns are detected using a fast Fourier transform algorithm or autocorrelation analysis; frequency components are calculated using FFT; peak positions correspond to periodic features such as repetitive patterns every 5 time units; the periodic features of the heartbeat signal are output; simultaneously, deviation sequences from standard protocol rules are detected; pre-stored protocol rule templates such as handshake step sequences are loaded; the deviation of the fused feature vector sequence is compared; for example, if the rule requires the sequence value to be stable but large fluctuations are detected, the standard deviation or difference is calculated as the protocol violation pattern; finally, the periodic features and violation pattern values ​​are integrated, and a threat confidence score is generated using linear weighting or logistic regression. For example, with an input adjustment ratio vector of [50,30,70], a fused feature vector of [50,30,70] is generated. Applying FFT, a periodic peak interval of 2 units is detected in the sequence, resulting in a periodic feature value of 0.9 for the heartbeat signal. Simultaneously, the expected value of the regular template is compared, and the stationary deviation of the sequence [50,30,70] within 10 is calculated. The root mean square deviation is 20, resulting in a protocol violation pattern value of 0.5. The integration weights are 0.7 multiplied by 0.9 and 0.3 multiplied by 0.5, yielding 0.78, generating a threat confidence score of 0.78, indicating a medium to high threat confidence.

[0095] In practical applications, during the actual operation of a network security system, technicians conducted in-depth analysis of encrypted traffic within the 200-millisecond time window (number 217). The system obtained two key inputs through the feature extraction module: a frequency domain composite anomaly index value of -0.76 generated based on wavelet packet decomposition, and a dynamically updated 128-bit hexadecimal threat fingerprint identifier of 3E5A7B. A three-attention head fusion mechanism was employed for processing. First, a multi-head attention architecture containing three sets of 384-dimensional projection matrices was constructed to uniformly convert the two features into a 768-dimensional combined vector. Through the projection matrix group, the frequency domain anomaly index was projected by weight matrices WQ1, WK1, and WV1 to generate a 256-dimensional query vector, key vector, and value vector. The threat fingerprint was projected by matrix group WQ2, WK2, and WV2 into a three-vector group of corresponding dimensions. In the first attention head processing stage, the 215-dimensional query block was multiplied by the transposed key block matrix to generate the elements of the original weight matrix, with values ​​distributed in the range of -12.8 to +15.3. The matrix is ​​divided by the square root of the feature dimension of 32 and scaled to a range of -0.4 to +0.48. After row direction exponential normalization, a weight distribution matrix is ​​obtained, where the maximum value of 0.92 clearly focuses on the frequency domain fluctuation characteristics of the abnormal indicators. This weight matrix is ​​multiplied by a 136-dimensional value vector block to generate the header output data, and then multiplied by a preset header weight coefficient of 0.33. In subsequent parallel processing, the second attention head detects the protocol violation marker feature in the threat fingerprint corresponding to the weight peak of 0.87. The third attention head captures a periodic signal pattern in the time dimension, with a pulse peak amplitude of 0.94 at 0.72-second intervals in the weight distribution matrix. The outputs of the three attention heads are concatenated along the feature dimension to form a 1024-dimensional fused feature vector, from which two key threat features are identified: the periodic heartbeat signal feature is manifested as an energy spike that repeats every 0.72 seconds in the spectral dimension, with a time standard deviation of only 0.05 seconds; the protocol violation pattern is manifested as a sequence of abnormal data blocks that deviate from the transport layer security protocol handshake specification three times in a row, with a single block length of 403 bytes. Finally, by integrating features through a fully connected layer, a threat confidence score of 0.86 is output. This value quantifies the level of trusted threats to latent command and control communications within the current encrypted stream.

[0096] In the overall scheme of step 104 above, frequency domain composite anomaly indicators and threat fingerprint data are fused through a multi-head attention mechanism. The system uses multiple attention heads to focus on different feature dimensions to calculate the contribution ratio of the adjusted features in the weight distribution matrix, thereby generating a fused feature vector. From this vector, the periodic characteristics of command and control heartbeat signals hidden in encrypted traffic and their protocol violation patterns are accurately identified, and finally, a threat confidence score is generated. This technology uses the weight allocation mechanism of attention heads to adjust the contribution ratio of frequency domain energy anomaly indicators and threat fingerprint features. In the integrated fused features, periodic communication patterns and protocol rule deviation sequences are detected simultaneously, realizing the joint analysis of multi-dimensional features of encrypted heartbeat signals and generating a confidence score that quantitatively represents the threat risk.

[0097] 105. If the threat confidence score exceeds the preset risk threshold, the dynamic rule chain engine is activated to intercept the corresponding communication traffic. The periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are used as new attack characteristics. After the validity is confirmed by the verification mechanism, the information is fed back to update the threat intelligence database to achieve closed-loop linkage between threat defense and intelligence update.

[0098] Optionally, step 105 may specifically include the following steps:

[0099] 1051. Compare the threat confidence score with a preset risk threshold. If the threat confidence score exceeds the preset risk threshold, activate the dynamic rule chain engine to block the corresponding communication traffic.

[0100] 1052. Based on the rule chain blocking of corresponding communication traffic, extract the periodic features of the heartbeat signal and the protocol violation pattern identified this time to form new attack features;

[0101] 1053. The credibility of the new attack feature is verified through a verification mechanism. The data block of the verified new attack feature is added to the control communication feature and fed back to the threat intelligence database to achieve a closed-loop linkage between threat defense and intelligence update.

[0102] In the above steps, the threat confidence score refers to the numerical score generated in step 104, which represents the level of confidence in the detected threat. The preset risk threshold refers to the pre-set danger judgment threshold. The dynamic rule chain engine refers to the program module that can modify the interception rules. The new attack feature refers to the malicious behavior pattern data identified this time, including the periodic features of heartbeat signals and protocol violation patterns. The verification mechanism refers to the method of verifying the effectiveness of new features through the testing process. Feedback update refers to feeding back the verified new data to the database. The threat intelligence database refers to the database that stores the features of malicious activities. The closed-loop linkage refers to the formation of a complete loop system of detection, defense and update.

[0103] In this embodiment, step 1051 first compares the threat confidence score with a preset risk threshold. If the score exceeds the threshold, the dynamic rule chain engine is activated to block the corresponding communication traffic. This step involves comparing the threat confidence score (e.g., 0.78) output in step 104 with the preset risk threshold (e.g., a set value of 0.7). If 0.78 is greater than 0.7, an activation command is triggered. Specifically, the activation operation calls the rule chain engine interface and sends an interception command containing a traffic identifier. For example, after receiving the command, the engine blocks TLS encrypted traffic originating from address 19216811. In practical applications, for instance, if the input threat confidence score is 0.85 and the preset risk threshold is 0.6, the rule chain engine will intercept the target IP communication because 0.85 is greater than 0.6.

[0104] Next, in step 1052, based on the rule chain blocking of the corresponding communication traffic, the periodic features of the heartbeat signal and the protocol violation pattern identified in this instance are extracted to form a new attack feature. This step involves extracting the periodic features of the heartbeat signal recorded in step 104, such as the periodic time value of 2 seconds, and the protocol violation pattern, such as a missing handshake step marker, after the rule chain engine completes traffic interception. Specifically, the extraction operation involves copying the metadata of the calculation results from this round of detection and integrating the two features into a structured data object as the new attack feature. For example, in a practical application, the heartbeat signal periodic feature value is a repetition interval of 3 seconds, and the protocol violation pattern value is a data packet length anomaly marker; these are integrated to generate a new attack feature object containing fields.

[0105] Finally, in step 1053, the credibility of the new attack signature is verified through a verification mechanism. The verified new attack signature data block is added to the control communication signatures, feeding back into the threat intelligence database to achieve a closed-loop linkage. This step involves executing a verification mechanism on the new attack signature. Specifically, verification is achieved by testing its detection accuracy through historical traffic replay and calculating reliability indicators such as the false positive rate. If the false positive rate is below 5, it is considered credible. For example, if 90 out of 100 attack traffic replay tests are correctly identified, the verification is valid. Then, the signature object is converted to a database-compatible format and added to the control communication signature list of the threat intelligence database. For example, the new signature is appended to the signature database JSON file, completing the threat intelligence database update and ultimately forming a closed-loop process from detection to defense and knowledge update. For example, in a practical application, after verifying the new attack signature with 500 test traffic samples and achieving an accuracy rate of 95%, it is deemed valid and updated to the threat intelligence database, adding a new entry with the signature ID CMD999.

[0106] In practical application, during the implementation of a large-scale network security platform, when the system analyzed the ingress traffic of the C Financial Data Center, it identified a specific encrypted session with a threat confidence score of 0.83, exceeding the preset risk threshold of 0.75. The system immediately activated its dynamic rule chain engine, generating three interception strategies to block the target port communication of the session. Technical personnel extracted the core attack characteristics detected: a heartbeat signal energy spike characteristic template with a period of 1.2 seconds, and a data packet sequence pattern of three consecutive violations of the transport layer security protocol handshake process. These two were combined into a new attack characteristic template. This characteristic template was sent to an isolated verification environment for dual verification through replaying attack traffic and continuous monitoring of behavior patterns. After 72 hours of effectiveness verification, it was confirmed that this characteristic had an accuracy rate of over 95% in identifying similar malicious communications. Finally, it was compiled into a hexadecimal format signature code and synchronously updated to the eighth version of the control communication feature set in the D threat intelligence database, forming a closed-loop linkage mechanism where defense strategies take effect immediately and attack characteristics provide dynamic feedback.

[0107] In the overall scheme of step 105 above, when the threat confidence score exceeds the preset risk threshold, the dynamic rule chain execution engine is automatically activated to intercept the target encrypted traffic. At the same time, the periodic characteristics of the detected heartbeat signal and the protocol violation pattern are extracted as new attack features in a structured manner. After the feature validity is verified through an automated trustworthiness verification process, the verified new attack feature data block is injected back into the command and control communication feature set in the threat intelligence database. This forms a closed-loop linkage mechanism between attack behavior blocking and threat feature auto-evolution, ultimately achieving continuous and dynamic enhancement of threat defense capabilities.

[0108] The following is a complete embodiment for steps 101 to 105:

[0109] like Figure 2 As shown, in a company's data center network security protection practice, the system monitors encrypted traffic of transport layer security protocols. First, a 25-minute payload byte stream is collected and divided into 750 time-series traffic matrices based on 200-millisecond time windows. When processing window number 518, the system parses the communication metadata of its 1920-byte payload and matches it with 120 known control communication features in the threat intelligence database. The highest matching degree is measured at 0.88, and three abnormal handshake behaviors are detected. Based on this, a 128-bit threat fingerprint 9F4A2C is dynamically generated. A level 4 wavelet packet decomposition is performed on this window, calculating a unit frequency energy value of 624 in the 285-320Hz high-frequency sub-band. After calibration with a coefficient of 1.15, an energy spectral density of 717.6 is obtained. Simultaneously, the information entropy of 2.53 and the time-frequency variation coefficient of 0.21 are acquired. After fusing the three parameters with weights of 0.45:0.3:0.25 and standardizing, the frequency domain composite anomaly index is output as -0.84.

[0110] Anomaly indicators and threat fingerprints are fused using a three-attention head mechanism: the first attention head captures periodic energy pulses at intervals of 1.28 seconds ± 0.03 seconds, with a peak weight of 0.93; the second attention head identifies four consecutive anomalous data packets (lengths of 398 / 417 / 435 / 452 bytes); and the third attention head correlates threat fingerprint features to obtain a weighting coefficient of 0.89. The fusion generates a 1024-dimensional feature vector, which, after passing through a fully connected layer, yields a threat confidence score of 0.84.

[0111] When the score exceeds the preset threshold of 0.8, the dynamic rule chain engine blocks communication on port 443 of the target IP within 300 milliseconds. The extracted heartbeat cycle features and protocol violation sequences were verified in a sandbox: after replaying 20,000 attack traffic flows, the accuracy of the cycle feature detection was >95%, and the protocol deviation behavior reproducibility rate was 100%. After 28 hours, the compiled signature code CTI-213 was updated to the threat intelligence database and simultaneously distributed to 350 protection nodes across the network, achieving a complete closed-loop defense from attack occurrence to signature update.

[0112] Figure 3 This application provides a schematic diagram of the structure of a network information security adaptive threat intelligence analysis and response system, as shown in the embodiments of this application. Figure 3 As shown, the system includes:

[0113] The acquisition module 31 is used to acquire the payload byte stream in the encrypted traffic of the transport layer security protocol, divide the payload byte stream into fixed time windows, and generate a time-series traffic matrix.

[0114] Matching module 32 is used to parse the communication metadata of the payload byte stream, match and associate the communication metadata with known command and control communication features in the threat intelligence database, and generate dynamically updated threat fingerprints based on protocol compliance and abnormal behavior judgment results.

[0115] The decomposition module 33 is used to perform multi-level wavelet packet decomposition on the flow matrix, extract the energy spectral density, information entropy and time-frequency variation coefficient of each high-frequency sub-band component, and perform weighted fusion and standardization on the energy spectral density, information entropy and variation coefficient based on a predefined anomaly template to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity and stability of the heartbeat signal.

[0116] The fusion module 34 is used to fuse the frequency domain composite anomaly index and the threat fingerprint through a multi-head attention mechanism, identify the periodic characteristics of command and control heartbeat signals and protocol violation patterns hidden in encrypted traffic, and generate a threat confidence score.

[0117] The activation module 35 is used to activate the dynamic rule chain engine to intercept the corresponding communication traffic if the threat confidence score exceeds the preset risk threshold. The periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are used as new attack characteristics. After the validity is confirmed by the verification mechanism, the information is fed back to the threat intelligence database to realize the closed-loop linkage between threat defense and intelligence update.

[0118] Figure 3 The aforementioned adaptive threat intelligence analysis and response system for network information security can perform... Figure 1 The implementation principle and technical effects of the adaptive threat intelligence analysis and response method for network information security described in the illustrated embodiments will not be repeated here. The specific methods by which each module and unit of the adaptive threat intelligence analysis and response system for network information security in the above embodiments are performed have been described in detail in the embodiments related to this method, and will not be elaborated upon here.

[0119] In one possible design, Figure 3 The network information security adaptive threat intelligence analysis and response system of the embodiment shown can be implemented as a computing device, such as... Figure 4 As shown, the computing device may include a storage component 41 and a processing component 42;

[0120] The storage component 41 stores one or more computer instructions, wherein the one or more computer instructions are invoked and executed by the processing component 42.

[0121] The processing component 42 is used for the above Figure 1 The embodiment describes an adaptive threat intelligence analysis and response method for network information security.

[0122] The processing component 42 may include one or more processors to execute computer instructions to complete all or part of the steps in the above-described method. Alternatively, the processing component may be implemented as one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), controllers, microcontrollers, microprocessors, or other electronic components to perform the above-described method.

[0123] Storage component 41 is configured to store various types of data to support operations at the terminal. The storage component can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0124] Of course, computing devices may also include other components, such as input / output interfaces, display components, communication components, etc.

[0125] Input / output interfaces provide interfaces between processing components and peripheral interface modules, which can be output devices, input devices, etc.

[0126] The communication components are configured to facilitate wired or wireless communication between computing devices and other devices.

[0127] The computing device can be a physical device or an elastic computing host provided by a cloud computing platform. In this case, the computing device can refer to a cloud server, and the aforementioned processing components, storage components, etc., can be basic server resources rented or purchased from the cloud computing platform.

[0128] This application also provides a computer storage medium storing a computer program, which, when executed by a computer, can perform the above-described functions. Figure 1 The embodiment shown illustrates an adaptive threat intelligence analysis and response method for network information security.

[0129] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0130] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, i.e., they may be located in one location or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of the present embodiment. Persons of ordinary skill in the art will be able to understand and implement the present invention without inventive effort.

[0131] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0132] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A method for adaptive threat intelligence analysis and response in network information security, characterized in that, include: Collect the payload byte stream from the encrypted traffic of the transport layer security protocol, divide the payload byte stream into fixed time windows, and generate a time-series traffic matrix; The communication metadata of the payload byte stream is parsed, and the communication metadata is matched and associated with known command and control communication features in the threat intelligence database. Based on the protocol compliance and abnormal behavior judgment results, a dynamically updated threat fingerprint is generated. Multi-level wavelet packet decomposition is performed on the flow matrix to extract the energy spectral density, information entropy, and time-frequency variation coefficient of each high-frequency sub-band component. Based on a predefined anomaly template, the energy spectral density, information entropy, and variation coefficient are weighted, fused, and standardized to generate a frequency-domain composite anomaly index characterizing the energy distribution, complexity, and stability of the heartbeat signal. Here, the energy spectral density refers to the calculated energy intensity value per unit frequency; the information entropy refers to the component sequence disorder index calculated using information theory formulas; the time-frequency variation coefficient is a parameter measuring the magnitude of component changes in time and frequency dimensions; and the predefined anomaly template refers to a reference value template stored in a configuration file, containing weighting ratio parameters and a baseline reference value. By fusing the frequency domain composite anomaly index and the threat fingerprint through a multi-head attention mechanism, the periodic characteristics of command and control heartbeat signals hidden in encrypted traffic and protocol violation patterns are identified, generating a threat confidence score, including: A multi-head attention model is constructed and the frequency domain composite anomaly index and the threat fingerprint are input. Multiple attention heads focus on different feature dimensions, and the adjustment feature contribution ratio of multiple weight distribution matrices is calculated. Based on the adjustment feature contribution ratio of multiple weight distribution matrices, a fused feature vector is generated. From the fused feature vector, the periodic repetition signal pattern of command and control heartbeat signals hidden in encrypted traffic is identified as the periodic feature of the heartbeat signal. Deviation sequences from standard protocol rules are detected as protocol violation patterns. The periodic feature of the heartbeat signal and the protocol violation patterns are integrated to generate a threat confidence score. If the threat confidence score exceeds the preset risk threshold, the dynamic rule chain engine is activated to intercept the corresponding communication traffic. The periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are used as new attack features. After the validity is confirmed by the verification mechanism, the information is fed back to update the threat intelligence database, realizing a closed-loop linkage between threat defense and intelligence updates.

2. The method according to claim 1, characterized in that, Multi-level wavelet packet decomposition is performed on the flow matrix to extract the energy spectral density, information entropy, and time-frequency variation coefficient of each high-frequency sub-band component. Based on a predefined anomaly template, the energy spectral density, information entropy, and variation coefficient are weighted, fused, and standardized to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity, and stability of the heartbeat signal, including: Perform a multi-scale decomposition operation on the flow matrix to generate multiple frequency domain sub-band components. For each high-frequency sub-band component, calculate the energy value per unit frequency and generate the energy spectral density based on the energy value per unit frequency. Simultaneously, the sequence disorder of the component sequence is calculated as the information entropy, and the variation amplitude parameter of the time-frequency dimension of the component is extracted as the time-frequency variation coefficient. A predefined anomaly template containing weighting ratio parameters and benchmark reference values ​​is loaded. The energy spectral density, information entropy, and time-frequency variation coefficient are input into the weighted calculation model. A fusion operation is performed, and the fusion result is standardized and adjusted to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity, and stability of the heartbeat signal.

3. The method according to claim 2, characterized in that, Perform a multi-scale decomposition operation on the flow matrix to generate multiple frequency domain sub-band components. For each high-frequency sub-band component, calculate the energy value per unit frequency. Based on the energy value per unit frequency, generate the energy spectral density, including: Perform a multi-level decomposition operation on the flow matrix. Each level of decomposition splits the input component into low-frequency components and high-frequency components. Repeat the multi-level decomposition operation until a preset number of levels is reached to generate multiple frequency domain sub-band components. Filter all frequency domain sub-band components marked as high frequency, and for each high frequency sub-band component, calculate the sum of squares of the values ​​of each high frequency component, divide by the frequency range width of the high frequency component, and generate a unit frequency energy value. The energy value per unit frequency is multiplied by a preset coefficient to output the energy spectral density, which represents the energy intensity.

4. The method according to claim 1, characterized in that, A multi-head attention model is constructed and the frequency domain composite anomaly index and the threat fingerprint are input. Multiple attention heads focus on different feature dimensions, and the modulated feature contribution ratios of multiple weight distribution matrices are calculated, including: Construct a multi-head attention model, which includes a projection matrix group and an attention head component group. The projection matrix group contains three projection matrices, and the number of these matrices is equal to the number of attention heads. The frequency domain composite anomaly index and the threat fingerprint are input into the multi-head attention model, an alignment operation is performed to generate feature data, and the feature data is multiplied by the three sets of projection matrices in the projection matrix group to generate query projection data, key projection data and value projection data. The query projection data, key projection data, and value projection data are divided into multiple sub-blocks. Each sub-block is input into the corresponding attention head component in the attention head component group. The transpose of the sub-blocks of the query projection data and the key projection data is multiplied to generate the original weight matrix. The original weight matrix is ​​divided by the square root of the feature dimension to generate the scaled weight matrix. The scaled weight matrix is ​​subjected to exponential operation row by row and summed to generate the weight distribution matrix. Within each attention head component, weight calculation is performed, multiplying the weight distribution matrix with the sub-blocks of the value projection data to generate head output data, performing proportional allocation calculation, and multiplying the head output data by a preset head weight coefficient to output the proportional calculation result; The proportion calculation results of all attention head components are concatenated along the feature dimension to generate multiple weight distribution matrices to adjust the feature contribution ratio.

5. The method according to claim 1, characterized in that, If the threat confidence score exceeds a preset risk threshold, the dynamic rule chain engine is activated to intercept the corresponding communication traffic. The periodic characteristics of the heartbeat signal and the protocol violation patterns identified this time are used as new attack features. After the validity is confirmed through a verification mechanism, the information is fed back to update the threat intelligence database, achieving a closed-loop linkage between threat defense and intelligence updates, including: The threat confidence score is compared with a preset risk threshold. If the threat confidence score exceeds the preset risk threshold, the dynamic rule chain engine is activated to block the corresponding communication traffic. Based on the rule chain blocking of corresponding communication traffic, the periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are extracted to form new attack characteristics; The credibility of the new attack signature is verified by a verification mechanism. The data block of the verified new attack signature is added to the control communication signature and fed back to the threat intelligence database to achieve a closed-loop linkage between threat defense and intelligence update.

6. The method according to claim 1, characterized in that, The communication metadata of the payload byte stream is parsed, and the communication metadata is matched and associated with known command and control communication characteristics in the threat intelligence database. Based on protocol compliance and abnormal behavior determination results, a dynamically updated threat fingerprint is generated, including: The communication metadata is separated from the payload byte stream, and command and control communication features are retrieved from the threat intelligence database. A similarity calculation mechanism is used to compare the communication metadata with the control communication features item by item to obtain a matching association value. Perform protocol rule verification checks, determine the compliance of communication behavior against the standard protocol specification process template, obtain the protocol compliance judgment result, detect the time interval distribution and data volume deviation of the communication sequence, and generate behavior anomaly indication values; By integrating the matching correlation value, protocol compliance judgment result, and behavior anomaly indication value, when the behavior anomaly indication value exceeds a predefined threshold, the corresponding new communication mode is added to the control communication feature to generate a dynamically updated threat fingerprint in the form of a storable digital identifier.

7. A network information security adaptive threat intelligence analysis and response system, used to execute the network information security adaptive threat intelligence analysis and response method according to any one of claims 1 to 6, characterized in that, include: The acquisition module is used to acquire the payload byte stream in the encrypted traffic of the transport layer security protocol, and to divide the payload byte stream into fixed time windows to generate a time-series traffic matrix. The matching module is used to parse the communication metadata of the payload byte stream, match and associate the communication metadata with known command and control communication features in the threat intelligence database, and generate a dynamically updated threat fingerprint based on protocol compliance and abnormal behavior judgment results. The decomposition module is used to perform multi-level wavelet packet decomposition on the flow matrix, extract the energy spectral density, information entropy and time-frequency variation coefficient of each high-frequency sub-band component, and perform weighted fusion and standardization on the energy spectral density, information entropy and variation coefficient based on a predefined anomaly template to generate a frequency domain composite anomaly index characterizing the energy distribution, complexity and stability of the heartbeat signal. The fusion module is used to fuse the frequency domain composite anomaly index and the threat fingerprint through a multi-head attention mechanism, identify the periodic characteristics of command and control heartbeat signals and protocol violation patterns hidden in encrypted traffic, and generate a threat confidence score. The activation module is used to activate the dynamic rule chain engine to intercept the corresponding communication traffic if the threat confidence score exceeds a preset risk threshold. The periodic characteristics of the heartbeat signal and the protocol violation pattern identified this time are used as new attack characteristics. After the validity is confirmed by the verification mechanism, the information is fed back to update the threat intelligence database, so as to realize the closed-loop linkage between threat defense and intelligence update.

8. A computing device, characterized in that, It includes a processing component and a storage component; the storage component stores one or more computer instructions; the one or more computer instructions are invoked and executed by the processing component to implement a network information security adaptive threat intelligence analysis and response method as described in any one of claims 1 to 6.

9. A computer storage medium, characterized in that, The device contains a computer program that, when executed by a computer, implements a network information security adaptive threat intelligence analysis and response method as described in any one of claims 1 to 6.

Images