Space-time fusion intelligent identification method and device for network flow asset portrait, and storage medium

Abstract

The invention relates to a time-space fusion intelligent identification method for a network flow asset portrait, and the method comprises the following steps: 1, collecting comprehensive equipment information through employing active detection, passive detection and non-intrusive detection based on a search engine according to a detection mode in network space detection, and completing the detection of basic data; step 2, based on the equipment information received in the step 1, a network flow asset portrait space-time intelligent fusion module carries out deep service identification on specific attributes, functions and security conditions of equipment or systems in the network found by the detection module; and step 3, based on an identification result in the step 2, constructing a multi-level layer portrait visualization strategy by a visualization display module. The method can provide data support for network attack and defense confrontation.

Description

Technical Field

[0001] The present invention belongs to the technical field of network traffic asset portrait recognition, and relates to a time-space fusion intelligent recognition method, in particular to a time-space fusion intelligent recognition method for network traffic asset portraits. Background Art

[0002] In the era of digital transformation, the proliferation of smart devices and the rapid development of network technology have enabled the internet to permeate every aspect of society. While this digital revolution is enriching daily life and driving economic growth, it has also brought unprecedented challenges to network security. Network traffic plays a vital role in network security analysis and protection. As a carrier of information transmission and interaction, network traffic data encapsulates information such as system status, network environment, trade secrets, and user privacy. Analyzing the characteristics of network traffic data is crucial for identifying traffic in power networks, providing insights for network situational awareness, and formulating appropriate defense strategies.

[0003] The various types of assets involved in the existing network traffic asset profiling technology, such as general security equipment (unified equipment, self-built equipment) and special border security protection equipment, have problems such as incomplete information, unclear attributes, and insufficient dynamic perception.

[0004] Existing deep learning-based recognition methods mainly use convolutional neural networks and recurrent neural networks to focus on the temporal or spatial characteristics of network traffic assets, ignoring the complex interaction patterns in network traffic.

[0005] Existing methods have not established an effective graph structure learning mechanism and are unable to explicitly model the dynamic association topology between network entities (such as IP addresses, ports, and protocols), resulting in low sensitivity in identifying threat behaviors involving multi-node interactions such as distributed coordinated attacks and lateral movement. Traditional time series modeling methods have difficulty synchronously capturing concurrent multi-dimensional interaction features in network traffic, including time synchronization, protocol state transitions, and load correlation, and are prone to misjudgment when identifying APT attacks with camouflage features. Existing models lack the ability to integrate and process multimodal interaction information such as network metadata, payload content, and behavior logs, resulting in limited ability to parse hidden interaction patterns in encrypted traffic. Summary of the Invention

[0006] The purpose of this invention is to overcome the shortcomings of the existing technology and propose a spatiotemporal fusion intelligent recognition method for network traffic asset profiling, aiming to establish a layer dimension model through feature extraction and asset dimension identification and classification, thereby providing data support for network attack and defense confrontation.

[0007] The present invention solves the practical problem by adopting the following technical solutions:

[0008] A spatiotemporal fusion intelligent identification method for network traffic asset profiling includes the following steps:

[0009] Through cyberspace detection, active detection, passive detection, and search engine-based non-intrusive detection are used to collect device information and complete basic data detection;

[0010] Based on the device information, a deep service recognition model is established to extract temporal features and spatial features, fuse the temporal features and spatial features into cross-modal features, and obtain recognition results through a classification network;

[0011] A multi-level layer image visualization strategy is constructed based on the recognition results.

[0012] Furthermore, the attribute information of the active detection includes: survival status, response time, and IP address.

[0013] Furthermore, the passive detection attribute information includes traffic pattern, device IP address, port usage, communication protocol type, data transmission volume, and session duration.

[0014] Furthermore, the search engine-based non-intrusive detection attribute information includes device type, open ports, geographic location, and security configuration.

[0015] Furthermore, the specific steps of establishing a deep service recognition model based on device information, extracting temporal features and spatial features, fusing the temporal features and spatial features into cross-modal features, and obtaining recognition results through a classification network include:

[0016] Establish a deep business identification model, which includes two parallel networks for temporal feature extraction and spatial feature extraction. The extracted temporal and spatial features are then fused and passed through a classification network to perform deep business identification;

[0017] Based on the constructed deep service identification model, wavelet analysis is used to extract the time-frequency characteristics of the signal. Dobesi wavelet 3 is selected as the wavelet function to perform wavelet decomposition on the network traffic sequence signal to obtain the time-frequency characteristics of the signal.

[0018] Use traffic interaction graphs to characterize the interactive behavior patterns of network traffic, and use graph neural networks to extract the spatial features of these interaction patterns;

[0019] A cross-modal attention module is used to fuse features from different modalities to obtain temporal-spatial cross-modal features that can be used for deep business recognition, and a position encoding module is added.

[0020] Based on the extracted time-space cross-modal features, deep business recognition results are obtained through a fully connected classification network.

[0021] Furthermore, the multi-level layer portrait visualization strategy includes a geographical environment layer, a network environment layer, a behavior subject layer, and a business environment layer; wherein:

[0022] The geographical environment layer includes the geographical location, topography, climate conditions and other natural environment information of the power network;

[0023] The network environment layer includes the location of assets in the network topology and connection relationship information;

[0024] The behavioral subject layer includes information about the users and managers behind the assets;

[0025] The business environment layer includes information about the business type and importance of the assets.

[0026] A spatiotemporal fusion intelligent recognition device for network traffic asset profiling, comprising:

[0027] The detection module collects device information through active detection, passive detection, and search engine-based non-intrusive detection to complete basic data detection through cyberspace detection;

[0028] The recognition module builds a deep business recognition model based on device information, extracts temporal and spatial features, fuses them into cross-modal features, and obtains recognition results through a classification network.

[0029] The visualization module builds a multi-level layer portrait visualization strategy based on the recognition results.

[0030] Furthermore, the attribute information actively detected by the detection module includes: survival status, response time, and IP address.

[0031] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the method according to any one of claims 1 to 6 when executing the computer program.

[0032] A computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

[0033] Advantages and beneficial effects of the present invention:

[0034] This paper proposes a spatiotemporal fusion intelligent recognition method for network traffic asset profiling.

[0035] 1. The detection module builds a multimodal data pool covering device attributes, communication behavior, and environmental context through a three-dimensional data collection system that combines active, passive, and non-intrusive detection. Combined with the multi-source feature alignment mechanism of the cross-modal attention module, this effectively addresses the shortcomings of traditional methods in integrating multimodal information such as metadata, payloads, and behavior logs.

[0036] 2. The recognition module innovatively employs a parallel architecture combining wavelet decomposition (12-level time-frequency feature extraction) and graph neural networks (traffic interaction graph spatial modeling). This architecture implements a cross-modal attention mechanism to dynamically weight spatiotemporal features. This design overcomes the limitations of traditional CNN / RNN single-dimensional modeling.

[0037] 3. The four-dimensional visualization system constructed by the visualization module includes the geographic environment layer (climate and terrain correlation analysis), the network environment layer (topology situation awareness), the behavioral subject layer (personnel operation portrait), and the business environment layer (business risk heat map). Through the business semantic mapping of spatiotemporal characteristics, it transforms traditional black box detection into an explainable decision path. BRIEF DESCRIPTION OF THE DRAWINGS

[0038] Figure 1 This is a flow chart of the spatiotemporal fusion intelligent identification method for network traffic asset profiling of the present invention;

[0039] Figure 2 This is a flow chart of the spatiotemporal fusion intelligent recognition algorithm of the present invention;

[0040] Figure 3 (a) is a flow interaction diagram of the present invention;

[0041] Figure 3 (b) is the flow interaction diagram (conversion format) of the present invention;

[0042] Figure 4 This is a visualization diagram of the network traffic asset portrait mapping of the present invention. DETAILED DESCRIPTION

[0043] The embodiments of the present invention are further described below in conjunction with the accompanying drawings:

[0044] A spatiotemporal fusion intelligent identification method for network traffic asset profiling, including three architectures: basic data detection, deep business identification, and multi-level visualization display. Figure 1 shown.

[0045] Cyberspace detection uses active detection, passive detection, and search engine-based non-intrusive detection to collect comprehensive device information and complete basic data detection;

[0046] The attribute information of the active detection includes: survival status, response time, IP address and other information;

[0047] In this embodiment, an active detection method, ICMP (Internet Control Message Protocol) Ping scanning, is used to determine the liveness and response time of network devices by sending ICMP Echo Request packets and waiting for ICMP Echo Reply packets. The liveness of devices is directly related to the stability of power safety equipment. During an ICMP scan, an ICMP Echo Request packet is generated, typically containing a sequence number and timestamp for tracking and calculating round-trip time. This packet is then sent over the network to the target IP address. When the target host receives this request, if its network configuration allows, it responds with an ICMP Echo Reply (ICMP type 0), returning the data in the request intact to the sender. After receiving the reply, the scanner records the response time and other relevant information to determine the status of the target host. If no reply is received, this may indicate that the target host is offline, ICMP is blocked by a firewall, or there are other network issues. Therefore, ICMP Ping scanning can actively detect the target host's connectivity and basic network status.

[0048] The passive detection attribute information includes: traffic pattern, device IP address, port usage, communication protocol type, data transmission volume, session duration, etc.

[0049] By monitoring and analyzing network traffic, information about network usage and device communication patterns can be obtained without actively sending any packets. Network traffic monitoring involves deploying network monitoring devices or tools (such as network probes and traffic analyzers) at key network nodes (such as routers, switches, or specific network segments). These devices capture all packets flowing through the network in promiscuous mode. Captured packets contain information such as the source IP address, destination IP address, port number, protocol type, and packet size. These captured packets are then deeply analyzed to identify communication patterns, traffic characteristics, and potential abnormal behavior. Connection establishment and disconnection can be detected by analyzing the TCP / IP handshake process, while the mapping between host names and IP addresses can be identified by analyzing DNS queries and responses. Specific application layer protocols (such as HTTP, FTP, and SMTP) can be identified through traffic patterns and further analyzed. The advantage of passive probing is that it does not impose additional load on the network and is not easily detected by the target system.

[0050] The non-intrusive detection attribute information based on the search engine includes: device type, open ports, geographical location, security configuration, etc.

[0051] In this embodiment, Shodan, a dedicated network security search engine, is used to obtain network asset information. Devices connected to the Internet are searched, and a database is built by crawling and collecting public information about the devices. Shodan actively detects devices and services in the entire network address space through continuous network scanning. Requests for various protocols (such as HTTP, FTP, SSH, Telnet, etc.) are sent to the target IP address, and the returned response information is recorded. Specific services and device types are identified based on common port numbers (such as HTTP service on port 80, HTTPS service on port 443, etc.). Shodan parses the returned response data and extracts useful metadata, including service version, operating system, geographic location, open ports, device type (such as router, industrial control system, etc.), and other identifiable feature information. The data is then stored in Shodan's database. Specific query conditions (such as geographic location, service type, device manufacturer, etc.) are entered to retrieve relevant device and service information. Shodan's detection method relies on active scanning of the Internet, so it can discover a large number of publicly exposed devices and services.

[0052] This multi-dimensional "people-ground-network" system breaks the limitations of traditional single-dimensional detection, making asset identification more comprehensive and accurate. Comprehensive data detection across the "people-ground-network" network aggregates a vast amount of device information.

[0053] The identification module is based on the device information collected by the detection module, and the network traffic asset portrait spatiotemporal intelligent fusion module conducts in-depth business identification of the specific attributes, functions and security status of the devices or systems in the network discovered by the detection module;

[0054] The specific process of deep service identification includes:

[0055] Example 1

[0056] (1) Establish a deep business identification model;

[0057] It contains two parallel networks for temporal feature extraction and spatial feature extraction. These extracted temporal and spatial features are then fused and passed through a classification network for deep business recognition.

[0058] (2) Extracting temporal and spatial features based on the constructed deep business recognition model;

[0059] Wavelet analysis is used to extract the signal's time-frequency characteristics. Daubechies 3 is selected as the wavelet function for wavelet decomposition of the network traffic sequence signal. Through continuous signal decomposition and scaling, the signal is decomposed into 12 levels. The data from these 13 levels (12 high-frequency signals and one low-frequency signal) is normalized to the range of 0-255 and fed into a one-dimensional convolutional network as 13-channel data to extract time-frequency characteristics.

[0060] like Figure 3 (a) is a schematic diagram showing the communication between the client and the server. Each line in the diagram represents a traffic data packet, and the direction of the arrow indicates the direction of data packet transmission. It is further converted into the format of the traffic interaction diagram as follows: Figure 3 (b) We use traffic interaction graphs to characterize the interactive behavior patterns of network traffic and use graph neural networks to extract the spatial features of these interaction patterns.

[0061] (3) Fusing the extracted temporal and spatial features to form cross-modal features;

[0062] A cross-modal attention module is used to fuse features from different modalities. The feature fusion process consists of multiple layers of cross-modal attention modules. The primary purpose of this fusion is to enhance cross-modal features by comparing and integrating features from two different modalities. Through the cross-modal attention module, a temporal-spatial integrated feature is obtained. To ensure that the input features are positionally aware, a positional encoding module is added. This module enables the feature sequence to be fully positionally aware.

[0063] (4) Based on the extracted cross-modal features, deep business recognition results are obtained through a fully connected classification network.

[0064] Example 2

[0065] (1) Extract the temporal features of network traffic data through wavelet transform and convert them into temporal vector features using convolutional network;

[0066] (2) Construct a network traffic interaction graph and use graph convolution to extract spatial vector features;

[0067] (3) Generate cross-modal features by fusing temporal and spatial features through a cross-modal attention module;

[0068] (4) Outputting recognition results through a classification network based on the cross-modal features.

[0069] In this embodiment, the purpose of asset identification is to conduct in-depth analysis of detected assets to determine their type, brand and model, operating system, running services and applications, and possible vulnerabilities and weaknesses. Network asset identification can be achieved using deep learning algorithms. In power network traffic asset profiling, network traffic is divided into different types of services or applications based on its characteristics and rules. A training model automatically learns to identify and classify new network traffic based on historical traffic data and known labels. By deploying traffic collection and analysis devices, general network protocol and industrial control protocol traffic within the production control area, equipment communication traffic within the power monitoring system network, and transmission line monitoring traffic can be collected. Machine learning algorithms and statistical methods are used to analyze network traffic data to achieve network traffic service identification.

[0070] The overall architecture of the proposed recognition model is as follows Figure 2 As shown in Figure 2, network traffic data is processed through two parallel networks to extract temporal and spatial features. For temporal feature extraction, a wavelet transform is applied to the network traffic data, which is then converted into temporal vector features using a convolutional neural network. Simultaneously, spatial features are derived by constructing a network traffic interaction graph and using graph convolution to obtain spatial vector features. These extracted temporal and spatial features are then fused and passed through a classification network to produce deep service recognition results.

[0071] Network traffic data is processed through two parallel networks to extract temporal and spatial features. For temporal feature extraction, a wavelet transform is applied to the network traffic data, which is then converted into temporal vector features using a convolutional neural network. Simultaneously, spatial features are derived by constructing a network traffic interaction graph and using graph convolution to obtain spatial vector features. These extracted temporal and spatial features are then fused and passed through a classification network to identify network traffic assets.

[0072] For temporal feature extraction, network traffic data constitutes a discrete time series. Wavelet transform is a mathematical analysis method used to decompose time signals into multiple scales or frequency components. This technique provides multi-resolution analysis, characterizing local signal features in both the time and frequency domains and effectively extracting information from the signal. By treating network traffic as a discrete time series signal, wavelet analysis has been shown to be effective for detecting network traffic. This method uses Daubechies wavelet 3 as the wavelet function to perform wavelet decomposition on the network traffic series signal. By decomposing the continuous signal and adjusting the scale to obtain low-frequency or high-frequency signal information, the signal is decomposed into twelve levels. This decomposition facilitates the analysis and processing of signals across different frequency bands, providing an overview of low-frequency components and detailed high-frequency information. The data from the 13 levels (including 12 high-frequency signals and one low-frequency signal) is normalized to the range of 0-255 and fed as 13-channel data into a one-dimensional convolutional network to extract time-frequency features.

[0073] For spatial feature extraction, the interaction pattern between the two communicating parties remains consistent regardless of the content of the exchange. Each type of network traffic maintains its own unique interaction mode. A business flow consists of a series of data packets generated by the interaction between the client and the server, which can be represented by an information-rich graph structure. Therefore, the traffic interaction graph can effectively reflect the exchange pattern between the two communicating parties. Figure 3 (a) shows a schematic diagram of the communication between the client and the server. In this description, each line in the figure represents a traffic flow packet, and the direction of the arrow indicates the transmission direction of the packet. This representation is further transformed into a graph structure, such as Figure 3 (b) Here, we introduce the concept of cluster. A cluster is defined as a sequence of consecutive data packets sent from the same source address to the same destination address within a short time interval. In addition, the time interval between consecutive data packets in a cluster does not exceed a predefined threshold. Figure 3 As shown in (a), each box represents a cluster. Although cluster a and cluster b consist of the same sequence of consecutive packets, the time interval between them exceeds a specified threshold, causing them to be classified as two independent clusters. In the entire network traffic, each packet is regarded as a single node in the traffic interaction graph. The edges in the traffic interaction graph consist of two types: intra-cluster edges and inter-cluster edges. The former edges connect packets according to their time order within the same cluster. For example, in cluster x, there are edges connecting node a to node b and node b to node c. The latter edges connect the first node of the latter cluster with the first node of the former cluster. We use the traffic interaction graph to characterize the interactive behavior patterns of network traffic and use graph neural networks to extract the spatial features of these interaction patterns.

[0074] Regarding feature fusion, the proposed model uses a cross-modal attention module to fuse features from different modalities. The feature fusion process consists of multiple layers of cross-modal attention modules. The primary purpose of this fusion is to enhance cross-modal features by comparing and integrating features from two different modalities. In this framework, features from both modalities are simultaneously input into the network. The temporal modal features undergo layer-by-layer normalization and are then converted into a set of key-value pairs, denoted as Kt and Vt. Similarly, the spatial modal features undergo layer-by-layer normalization and are converted into a query matrix Qs. These three matrices, Qs, Kt, and Vt, are used to calculate the cross-modal attention feature A, thereby enabling continuous feature updating. Through the cross-modal attention module, a comprehensive temporal-spatial feature is obtained. To ensure that the input features are position-aware, a positional encoding module is added. This module enables the feature sequence to be fully position-aware. The final extracted cross-modal features are then passed through a fully connected classification network to obtain the recognition result.

[0075] The visualization module builds a multi-layer image visualization strategy based on the recognition results of the recognition module.

[0076] The multi-level layer portrait visualization strategy includes a geographical environment layer, a network environment layer, a behavior subject layer, and a business environment layer; wherein:

[0077] The geographical environment layer includes the geographical location, topography, climate conditions and other natural environment information of the power network;

[0078] The network environment layer includes the location of assets in the network topology and connection relationship information;

[0079] The behavioral subject layer includes information about the users and managers behind the assets;

[0080] The business environment layer includes information about the business type and importance of the assets.

[0081] In this embodiment, based on the asset identification results, we define a multi-level layer portrait visualization strategy, dividing the network space into 4 layers. The geographical environment layer mainly includes information such as the geographical location, topography, climate conditions and other natural environment of the power network. The goal of this layer is to map the virtual devices and physical geographical locations in the network space, so as to characterize the power network in the spatial dimension; the network environment layer describes the location and connection relationship of the assets in the network topology, including the network topology, communication protocols, network equipment (such as routers, switches, firewalls, etc.), and network security equipment (such as intrusion detection / prevention systems, security audit systems, etc.) of the power network. The goal of this layer is to characterize The logical structure and communication model of the power network provide the foundation for network attack and defense countermeasures and coordinated defense. The behavioral subject layer describes the personnel information behind the assets, including users, managers, and other actors within the power network. This layer aims to identify and characterize various actors and their behavioral characteristics within the network, supporting behavioral analysis and threat detection. The business environment layer reflects the type and importance of the services carried by the assets, including power generation, transmission, distribution, and consumption, as well as related business systems and application software. This layer aims to characterize the business structure and application models of the power network, supporting business continuity and security. This layered model enables a more systematic and structured asset profile. By layering the power network space, a more comprehensive and systematic understanding of the structure, composition, and operational status of the power network is achieved, enabling a clearer and more concise profile of subsequent network resources.

[0082] The visualization of cyberspace relationships mainly studies the structural characteristics of cyberspace, and combines the interactive mapping of cyberspace and geographic space elements to study the multi-scale topological associations between cyberspace and geographic space, and realizes the structural projection of network entities in cyberspace and geographic space.

[0083] The relationships between network elements are analyzed through network detection and topology analysis techniques, which analyze network resource attributes to form a rich network entity connection topology structure. This allows for visualization of network topologies at different levels and granularities, showcasing topological relationships across a wide range of scopes. Geographic space and cyberspace have complex coupled relationships, and visualization of the relationship between cyberspace and geographic space focuses on achieving dynamic interaction between the two spaces. Combining cyberspace element visualization with network asset detection, network topology spatialization, and integrated two-dimensional and three-dimensional network geographic data association, this study investigates entity connections and relationship identification across multiple scales of geographic space and cyberspace, exploring the inherent connections between space, information, and human behavior, and achieving multi-comparative, multi-scale, multi-dimensional, and dynamic visualization of geographic space and cyberspace.

[0084] The spatial scale is used to comprehensively display the relationship between nodes in the network topology, as well as the relationship between network space and geographic space. Figure 4 As shown in the figure, according to the hierarchical network design model, the network design is typically divided into the core layer, aggregation layer, and access layer. The relationships between these layers are displayed in a topological form. To enhance visualization, the geographical locations of key nodes at each layer are determined, and the relationships between these layers are expressed in geographic space. Spatial network element relationships are often displayed in a two-dimensional logical topology, which provides poor visualization. Based on the relationships between nodes in the core, aggregation, and access layers of the network topology, a hierarchical display is combined with the locations of two-dimensional and three-dimensional geographic elements, with each node associated with a geographic entity on the map. This hierarchical display of the network topology provides a clearer visualization of network spatial relationships while establishing a sufficient connection with geographic space.

[0085] According to the network hierarchical design model, the network design is usually divided into the core layer, aggregation layer and access layer, and the relationship between each layer is displayed in the form of topology. To enhance the visualization effect, the geographical location of the key nodes at each layer is determined, and the relationship between each layer is expressed in geographic space.

[0086] This invention uses asset detection to comprehensively discover all types of equipment in the power network, including device type, device system, device service, and device port. It then uses spatiotemporal intelligent recognition to classify and identify these detected resources, clarifying their attributes and functions. Next, the complex power network space is layered for easier management and analysis. Based on the data obtained in the previous steps, a comprehensive portrait of the power network space is constructed, providing visual management and decision support.

[0087] It should be emphasized that the embodiments described in the present invention are illustrative rather than restrictive. Therefore, the present invention includes but is not limited to the embodiments described in the specific embodiments. Any other embodiments derived by those skilled in the art based on the technical solutions of the present invention also fall within the scope of protection of the present invention.

Claims

1. A spatiotemporal fusion intelligent identification method for network traffic asset profiling, characterized by: include: Through cyberspace detection, active detection, passive detection, and search engine-based non-intrusive detection are used to collect device information and complete basic data detection; Based on device information, a deep business recognition model is established to extract temporal and spatial features, fuse them into cross-modal features, and obtain recognition results through a classification network. Construct a multi-level layer portrait visualization strategy based on the recognition results.

2. The spatiotemporal fusion intelligent identification method for network traffic asset profiling according to claim 1 is characterized by: The attribute information of the active detection includes: survival status, response time, and IP address.

3. The spatiotemporal fusion intelligent identification method for network traffic asset profiling according to claim 1 or 2 is characterized by: The passive detection attribute information includes traffic pattern, device IP address, port usage, communication protocol type, data transmission volume and session duration.

4. The spatiotemporal fusion intelligent identification method for network traffic asset profiling according to claim 1 or 2 is characterized by: The search engine-based non-intrusive detection attribute information includes device type, open ports, geographic location and security configuration.

5. The spatiotemporal fusion intelligent identification method for network traffic asset profiling according to claim 1 or 2, characterized in that: The specific steps of establishing a deep service recognition model based on device information, extracting temporal features and spatial features, fusing the temporal features and spatial features into cross-modal features, and obtaining recognition results through a classification network include: Establish a deep business identification model, which includes two parallel networks for temporal feature extraction and spatial feature extraction. The extracted temporal and spatial features are then fused and passed through a classification network to perform deep business identification; Based on the constructed deep service identification model, wavelet analysis is used to extract the time-frequency characteristics of the signal. Dobesi wavelet 3 is selected as the wavelet function to perform wavelet decomposition on the network traffic sequence signal to obtain the time-frequency characteristics of the signal. Use traffic interaction graphs to characterize the interactive behavior patterns of network traffic, and use graph neural networks to extract the spatial features of these interaction patterns; A cross-modal attention module is used to fuse features from different modalities to obtain temporal-spatial cross-modal features that can be used for deep business recognition, and a position encoding module is added. Based on the extracted time-space cross-modal features, deep business recognition results are obtained through a fully connected classification network.

6. The spatiotemporal fusion intelligent identification method for network traffic asset profiling according to claim 1 or 2, characterized in that: The multi-level layer portrait visualization strategy includes a geographical environment layer, a network environment layer, a behavior subject layer and a business environment layer; Among them, the geographical environment layer includes the geographical location, topography, climate conditions and other natural environment information of the power network; The network environment layer includes the location of assets in the network topology and connection relationship information; The behavioral subject layer includes information about the users and managers behind the assets; The business environment layer includes information about the business type and importance of the assets.

7. A spatiotemporal fusion intelligent recognition device for network traffic asset profiling, characterized by: include: The detection module collects device information through active detection, passive detection, and search engine-based non-intrusive detection to complete basic data detection through cyberspace detection; The recognition module builds a deep business recognition model based on device information, extracts temporal and spatial features, fuses them into cross-modal features, and obtains recognition results through a classification network. The visualization module builds a multi-level layer portrait visualization strategy based on the recognition results.

8. The spatiotemporal fusion intelligent recognition device for network traffic asset profiling according to claim 7, characterized in that: The attribute information actively detected by the detection module includes: survival status, response time, and IP address.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images