Network security intrusion detection method and device

Abstract

The invention provides a network security intrusion detection method and device, and belongs to the field of network security, and the method comprises the steps: constructing a multi-modal directed graph of the industrial Internet of Things based on the state data, log data and physical signal data of each device in the industrial Internet of Things; performing cross-modal embedding learning on the multi-modal directed graph by adopting the trained hierarchical graph attention network to obtain a joint embedding vector of the industrial Internet of Things; and performing causal dependency relationship derivation on the joint embedded vector based on a trained time sequence causal convolutional network, generating an attack path and attack confidence, and taking the attack path and the attack confidence as a network security intrusion detection result of the industrial Internet of Things. According to the network security intrusion detection method and device provided by the invention, malicious behaviors violating the operation logic of an industrial system can be effectively captured, and the network security intrusion detection effect is improved.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and more specifically, to a network security intrusion detection method and device. Background Art

[0002] With the advancement of information technology, cybersecurity threats are becoming increasingly severe. Against this backdrop, network intrusion detection has become a crucial component of cybersecurity defenses. A network intrusion is defined as an unauthorized entity using technical means to breach a system's defenses and illegally access, manipulate, or damage a network, device, or data. Its core characteristic is a violation of the system owner's security policy and the potential for compromise of confidentiality, integrity, or availability.

[0003] Currently, industrial IoT intrusion detection has two major limitations. The first is reliance on single-source data, which only analyzes log data to build event graphs and ignores the relationship between other device parameters and security intrusions. The second is reliance on a predefined rule base to match attack patterns and the inability to dynamically learn new interactive threats between devices, resulting in serious missed detections. Summary of the Invention

[0004] The purpose of this application is to provide a network security intrusion detection method and device to solve the technical problem of serious missed detection in current industrial Internet of Things intrusion detection.

[0005] A first aspect of the embodiments of the present application provides a network security intrusion detection method, comprising: Based on the status data, log data and physical signal data of each device in the Industrial Internet of Things, a multimodal directed graph of the Industrial Internet of Things is constructed; We use a trained hierarchical graph attention network to learn cross-modal embeddings for multimodal directed graphs and obtain a joint embedding vector for the Industrial Internet of Things. Based on the trained temporal causal convolutional network, the causal dependency of the joint embedding vector is derived to generate the attack path and attack confidence, which are used as the network security intrusion detection results of the industrial Internet of Things.

[0006] In one possible implementation, a multimodal directed graph of the Industrial Internet of Things is constructed based on the status data, log data, and physical signal data of each device in the Industrial Internet of Things, including: For every two interacting devices, the event subject device is taken as the source node, the event object device as the target node, the status data and physical signal data as the node attributes, and the log data as the edge attribute to obtain a multimodal directed graph of the Industrial Internet of Things.

[0007] In one possible implementation, a hierarchical graph attention network includes a node layer, a sub-layer layer, and a full-layer layer. A trained hierarchical graph attention network is used to perform cross-modal embedding learning on a multimodal directed graph to obtain a joint embedding vector for the Industrial Internet of Things, including: The multimodal directed graph is divided into subgraphs according to device function, physical space, and causal dependency, respectively, to obtain the device function subgraph, physical space subgraph, and causal dependency subgraph of the multimodal directed graph; Through the node layer based on the cross-modal attention mechanism, the node attributes of each node are fused to obtain multiple node-level embeddings; Through the sub-layer based on cross-subgraph attention, the node-level embeddings in the device function subgraph, physical space subgraph, and causal dependency subgraph are fused to obtain three subgraph-level embeddings; Through global attention and causal enhancement aggregation based on the full-layer layer, the three sub-graph-level embeddings are aggregated to obtain the joint embedding vector of the Industrial Internet of Things.

[0008] In one possible implementation, before using a trained hierarchical graph attention network to perform cross-modal embedding learning on a multimodal directed graph to obtain a joint embedding vector for the Industrial Internet of Things, the following steps are also included: The initial hierarchical graph attention network is trained based on the first positive and negative sample sets and the first loss function to obtain a trained hierarchical graph attention network; wherein, the positive samples in the first positive and negative sample sets are multimodal directed graphs corresponding to historical normal operations, the negative samples in the positive and negative sample sets are multimodal directed graphs corresponding to attack events, and the first loss function is a cross-entropy loss function.

[0009] In one possible implementation, causal dependencies are derived from the joint embedding vector based on a trained temporal causal convolutional network to generate attack paths and attack confidences, which are used as network security intrusion detection results for the Industrial Internet of Things. These include: The joint embedding vector is input into the temporal causal convolutional network to obtain the causal violation score of each edge in the multimodal graph; Calculate the physical signal anomaly strength and operational deviation of each edge in the multimodal graph; For each edge, the causal violation score, physical signal anomaly strength, and operation deviation of the edge are weighted and summed to obtain the anomaly score of the edge; Edges whose anomaly scores exceed the anomaly score threshold are identified as high-risk edges, and the high-risk edges are aggregated to obtain the attack path; The attack confidence is calculated as the weighted score of the causal violation score of the attack path and the abnormal strength of the physical signal.

[0010] In one possible implementation, calculating the physical signal anomaly strength and operation deviation of each edge in the multimodal graph includes: Calculate the number of standard deviations of the sensor reading fluctuations on the first side that exceed the preset safety threshold as the physical signal anomaly strength of the first side; where the first side is any side in the multimodal graph; Calculate the cosine similarity between the first edge and multiple historical legal operation patterns, and take the inverse of the largest cosine similarity as the operation deviation of the first edge; The calculation formula for the anomaly score threshold is:

[0011] in, is the anomaly scoring threshold, and is the weight coefficient, As the basic threshold.

[0012] In one possible implementation, before inferring the causal dependency of the joint embedding vector based on the trained temporal causal convolutional network, the following is further included: The initial temporal causal convolutional network is trained based on the second positive and negative sample sets and the second loss function to obtain a trained temporal causal convolutional network; wherein the positive samples in the second positive and negative sample sets are the joint embedding vectors corresponding to historical normal operations, and the negative samples in the positive and negative sample sets are the joint embedding vectors corresponding to attack events. The second loss function is:

[0013] in, is the loss function value, is the sample pair number, is the number of sample pairs, each sample pair includes a positive sample and a negative sample, is a hyperparameter, For sample pairs The causal violation score of the positive sample, For sample pairs Causal violation score for negative samples.

[0014] A second aspect of the embodiments of the present application provides a network security intrusion detection device, comprising: An image construction module, which is used to construct a multimodal directed graph of the Industrial Internet of Things based on the status data, log data, and physical signal data of each device in the Industrial Internet of Things; Embedding learning module, which uses a trained hierarchical graph attention network to perform cross-modal embedding learning on multimodal directed graphs to obtain a joint embedding vector for the Industrial Internet of Things; The intrusion detection module is used to derive causal dependencies of the joint embedding vector based on the trained temporal causal convolutional network, generate attack paths and attack confidences, and use them as network security intrusion detection results for the industrial Internet of Things.

[0015] In a third aspect of an embodiment of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the above-mentioned network security intrusion detection method when executing the computer program.

[0016] In a fourth aspect of an embodiment of the present application, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the above-mentioned network security intrusion detection method are implemented.

[0017] The beneficial effects of a network security intrusion detection method and device provided by an embodiment of the present application are: first, through the multimodal graph structure design, the device status, log and physical signal data are integrated to solve the blind spot problem of traditional single-source detection; then, the hierarchical processing architecture of the hierarchical graph attention network is used to aggregate the embedding vectors, which significantly optimizes the computational efficiency. Its attention mechanism can effectively retain the operating status information of the industrial Internet of Things; finally, a temporal causal convolutional network driven by causal logic is used to quantify the degree of causal violation, greatly improving the interpretability. In scenarios with a variety of network security intrusion methods, it can still effectively capture malicious behaviors that violate the operating logic of the industrial system, thereby improving the network security intrusion detection effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the embodiments or descriptions of the prior art. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without any creative work.

[0019] Figure 1 A flowchart of a network security intrusion detection method provided in one embodiment of the present application; Figure 2 A structural block diagram of a network security intrusion detection device provided in one embodiment of the present application; Figure 3 A schematic block diagram of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0020] In the following description, specific details such as specific system structures and techniques are provided for purposes of illustration rather than limitation to facilitate a thorough understanding of the embodiments of the present application. However, it will be apparent to those skilled in the art that the present application may be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to avoid obscuring the description of the present application with unnecessary detail.

[0021] In order to make the purpose, technical solutions and advantages of this application clearer, specific embodiments will be described below with reference to the accompanying drawings.

[0022] Please refer to Figure 1 , Figure 1 A schematic diagram of a flow chart of a network security intrusion detection method provided in one embodiment of the present application, the method comprising: S101: Based on the status data, log data, and physical signal data of each device in the Industrial Internet of Things, a multimodal directed graph of the Industrial Internet of Things is constructed.

[0023] In this embodiment, device status data can include parameters such as CPU load, memory usage, firmware hash values, and process trees. Log data includes structured information such as the type, frequency, and target of process operations (such as file reads and writes, and network connections). Physical signal data includes real-time fluctuations in sensor readings (such as temperature and pressure). This data is acquired using a sliding time window, the duration of which can be set based on actual needs, for example, 5 minutes.

[0024] A multimodal directed graph is a mathematical structure that uniformly represents discrete data in the Industrial Internet of Things. Nodes represent devices in the Industrial Internet of Things, and directed edges between nodes represent the interactions between devices. This graph structure can associate device status, operation logs, and physical signals in a unified framework, laying the foundation for detecting complex attacks.

[0025] S102: Use the trained hierarchical graph attention network to perform cross-modal embedding learning on the multimodal directed graph to obtain the joint embedding vector of the Industrial Internet of Things.

[0026] In this embodiment, the Hierarchical Graph Attention Network (HGAT) can perform hierarchical feature extraction and cross-modal attention calculation on multimodal directed graphs, concatenate the hierarchical aggregation results with the cross-modal attention output, and generate a joint embedding vector.

[0027] The joint embedding vector generated by the Hierarchical Graph Attention Network is essentially a mathematical representation formed by fusing multimodal data. The network's design is inspired by the hierarchical nature of industrial systems—from individual device behavior, device cluster collaboration, to full system linkage—constituting different levels of abstraction. The joint embedding vector can reflect the overall behavior of the Industrial Internet of Things (IIoT), providing an interpretable basis for intrusion detection.

[0028] S103: Based on the trained temporal causal convolutional network, causal dependencies are derived from the joint embedding vector to generate attack paths and attack confidences, which are used as network security intrusion detection results for the industrial Internet of Things.

[0029] In this embodiment, the input to the Temporal Causal Convolutional Network (TCN) is a joint embedding vector generated by a hierarchical graph attention network. Each time step corresponds to an event (such as a process operation or sensor data change), forming a temporal sequence. Dilated causal convolution is then used to analyze the temporal dependencies of the event chain. In a smart factory scenario, the input might be: event sequence = [firmware verification, firmware write, sensor update, ...]. The embedding vector corresponding to each event contains log operation features (such as operation type and parameters) and physical signal features (such as temperature fluctuation amplitude).

[0030] The TCN outputs a causal violation score for each event, quantifying its degree of deviation from predefined causal rules. The output dimension is [T × 1] (one score per event), and the score range is [0, 1], where 0 indicates complete compliance and 1 indicates severe violation. For example, if the event sequence is "sensor update → firmware verification," which is a reverse causal path, the TCN outputs a causal violation score of 0.9. If the sequence is "firmware verification → firmware write → sensor update," which is a compliant path, the causal violation score is 0.1.

[0031] The network's core innovation lies in incorporating causal logic into threat detection. TCN training utilizes a contrastive learning strategy: positive samples are historically normal operation sequences, while negative samples are known attack sequences. The objective function forces a larger embedding distance between the two. This design enables the model to not only identify statistical anomalies but also capture malicious behavior that violates the operational logic of industrial systems.

[0032] The embodiment of the present invention first solves the blind spot problem of traditional single-source detection by integrating device status, log and physical signal data through multimodal graph structure design, and then aggregates embedding vectors through the hierarchical processing architecture of the hierarchical graph attention network, significantly optimizing the computational efficiency. Its attention mechanism can effectively retain the operating status information of the industrial Internet of Things. Finally, a temporal causal convolutional network driven by causal logic is used to quantify the degree of causal violation, greatly improving the interpretability. In scenarios with a variety of network security intrusion methods, it can still effectively capture malicious behaviors that violate the operating logic of the industrial system, thereby improving the network security intrusion detection effect.

[0033] In one possible implementation, a multimodal directed graph of the Industrial Internet of Things is constructed based on the status data, log data, and physical signal data of each device in the Industrial Internet of Things, including: For every two interacting devices, the event subject device is taken as the source node, the event object device as the target node, the status data and physical signal data as the node attributes, and the log data as the edge attribute to obtain a multimodal directed graph of the Industrial Internet of Things.

[0034] In this embodiment, the core of constructing a multimodal directed graph lies in accurately characterizing the interactions between devices. Specifically, the subject (e.g., process ID, device ID) and object (e.g., file path, sensor ID) of a log event are used as the source and target nodes of the graph, respectively.

[0035] Node attributes integrate multi-dimensional status information. Device status data includes CPU / memory usage (reflecting real-time load), firmware hash values ​​(verifying integrity), and process tree hash values ​​(detecting anomalous process injection). Physical signal data associates sensor IDs with signal types (e.g., "TempSensor01_temperature") to dynamically record fluctuations in physical quantities like temperature and pressure.

[0036] The timestamp of an edge is the time when the log event occurs. The edge attributes include the operation type (file reading and writing, network connection), operation parameters (such as file size, target IP address), and associated physical signal anomaly indicators (such as temperature mutation amplitude).

[0037] The time window uses a sliding mechanism with a 5-minute window length and a 1-minute step size. It has been verified that the 5-minute window covers a typical control instruction cycle, while the 1-minute overlap ensures the continuity of the event chain across windows. Within each window, nodes and edges are sorted by timestamp to form a time-series subgraph, preserving the true order of events while avoiding the computational burden of full-time processing.

[0038] In one possible implementation, a hierarchical graph attention network includes a node layer, a sub-layer layer, and a full-layer layer. A trained hierarchical graph attention network is used to perform cross-modal embedding learning on a multimodal directed graph to obtain a joint embedding vector for the Industrial Internet of Things, including: The multimodal directed graph is divided into subgraphs according to device function, physical space, and causal dependency, respectively, to obtain the device function subgraph, physical space subgraph, and causal dependency subgraph of the multimodal directed graph; Through the node layer based on the cross-modal attention mechanism, the node attributes of each node are fused to obtain multiple node-level embeddings; Through the sub-layer based on cross-subgraph attention, the node-level embeddings in the device function subgraph, physical space subgraph, and causal dependency subgraph are fused to obtain three subgraph-level embeddings; The three sub-graph-level embeddings are aggregated through global attention and causal enhancement aggregation at the full layer to obtain the joint embedding vector of the Industrial Internet of Things.

[0039] In this embodiment, subgraphs are divided based on three dimensions: device function, physical space, and causal dependency. In the device function dimension, devices performing the same task are clustered (e.g., all cooling water pumps form a functional group), reflecting the modular design characteristics of industrial systems. In the physical space dimension, devices are grouped by their physical location (e.g., assembly line area A), reflecting the risk model of "proximity attack propagation." In the causal dependency dimension, subgraphs are constructed based on predefined operation chains (e.g., "firmware verification → write → sensor update") to ensure that logically related devices are not separated.

[0040] HGAT's three-stage treatment process includes: (1) Node-level fusion. The input data is the original node feature matrix and the adjacency matrix (node ​​connection relationship). The node layer performs intra-modal attention and cross-modal fusion on the input data, and then outputs multiple node-level embeddings. Its physical meaning is to capture the multimodal behavior characteristics of a single device.

[0041] (2) Subgraph layer processing. The input data is node-level embedding, subgraph partitioning results (functional group / spatial group / communication group), and inter-subgraph adjacency matrix. Subgraph pooling and cross-subgraph attention are performed respectively, and through hierarchical skip connections, the subgraph-level embedding is output. Its physical meaning is the collaborative behavior of the device cluster.

[0042] (3) Full-graph layer processing. The input data is the subgraph-level embedding and the full-graph adjacency matrix. After global attention aggregation and causal enhancement aggregation, the global embedding is output, which is the joint embedding vector of the Industrial Internet of Things.

[0043] In one possible implementation, before using a trained hierarchical graph attention network to perform cross-modal embedding learning on a multimodal directed graph to obtain a joint embedding vector for the Industrial Internet of Things, the following steps are also included: The initial hierarchical graph attention network is trained based on the first positive and negative sample sets and the first loss function to obtain a trained hierarchical graph attention network; wherein, the positive samples in the first positive and negative sample sets are multimodal directed graphs corresponding to historical normal operations, the negative samples in the positive and negative sample sets are multimodal directed graphs corresponding to attack events, and the first loss function is a cross-entropy loss function.

[0044] In this embodiment, the intrusion detection requirements of industrial scenarios are that the normal operation mode is stable but the attack variants are diverse, so the training of HGAT adopts a supervised learning strategy.

[0045] Positive samples are selected from multimodal graphs of historical normal operations (such as compliant firmware update sequences), which are required to cover different shifts and load states to learn the resilience of legitimate operations; negative samples come from real attack events (such as operation graphs when ransomware encrypts files), which must include advanced threats such as APT attacks and zero-day vulnerability exploits.

[0046] The choice of cross-entropy rather than mean squared error (MSE) as the loss function stems from the nature of classification tasks—the need to clearly distinguish between "normal" and "attack" data, rather than relying on regression fitting. During training, weighted sampling is performed, increasing the weight of attack samples to address the scarcity of attack events in industrial environments.

[0047] In one possible implementation, causal dependencies are derived from the joint embedding vector based on a trained temporal causal convolutional network to generate attack paths and attack confidences, which are used as network security intrusion detection results for the Industrial Internet of Things. These include: The joint embedding vector is input into the temporal causal convolutional network to obtain the causal violation score of each edge in the multimodal graph; Calculate the physical signal anomaly strength and operational deviation of each edge in the multimodal graph; For each edge, the causal violation score, physical signal anomaly strength, and operation deviation of the edge are weighted and summed to obtain the anomaly score of the edge; Edges whose anomaly scores exceed the anomaly score threshold are identified as high-risk edges, and the high-risk edges are aggregated to obtain the attack path; The attack confidence is calculated as the weighted score of the causal violation score of the attack path and the abnormal strength of the physical signal.

[0048] In this embodiment, the detection process of a temporal causal convolutional network (TCN) consists of three stages: causal analysis, anomaly scoring, and path generation. First, the TCN receives the joint embedding vector of the HGAT and scans the event sequence using a dilated causal convolution kernel. It outputs a high score when it detects reverse causality (e.g., a temperature configuration change occurs before firmware signature verification). This is based on the principle that industrial control systems must adhere to the "authenticate before execute" security standard.

[0049] Each edge is then scored for anomaly based on three dimensions: causal violation, physical signal anomaly strength, and operational deviation. The anomaly scoring threshold is dynamic and adjusts dynamically with CPU load. During high loads, the threshold is relaxed to avoid false positives from normal maintenance operations; during low loads, the threshold is tightened to improve attack detection sensitivity. The attack paths formed by aggregating high-risk edges can be automatically mapped to the MITRE ATT&CK framework. For example, "abnormal firmware write → cross-device propagation" is mapped to the T1190 attack technique, enabling dynamic response to attacks.

[0050] The attack confidence level is calculated by combining the causal violation score of the attack path and the weighted score of the physical signal anomaly strength. This approach focuses on the coordination between causality and physical evidence (e.g., causal violation accompanied by strong physical anomaly results in high confidence), ensuring the reliability of response decisions.

[0051] In one possible implementation, calculating the physical signal anomaly strength and operation deviation of each edge in the multimodal graph includes: Calculate the number of standard deviations of the sensor reading fluctuations on the first side that exceed the preset safety threshold as the physical signal anomaly strength of the first side; where the first side is any side in the multimodal graph; Calculate the cosine similarity between the first edge and multiple historical legal operation patterns, and take the inverse of the largest cosine similarity as the operation deviation of the first edge; The calculation formula for the anomaly score threshold is:

[0052] in, is the anomaly scoring threshold, and is the weight coefficient, As the basic threshold.

[0053] In this embodiment, the calculation of physical signal anomaly intensity focuses on the degree of deviation from a safety threshold. For a temperature sensor, for example, the preset safety threshold is based on historical statistics. The magnitude of the current reading exceeding the safety threshold is converted to a multiple of the standard deviation, for example, 5σ is 1.67. This standardization process addresses the dimensional differences between different sensors and makes anomaly intensity comparable.

[0054] The design of the operation deviation metric is based on attacker behavioral characteristics: malicious operations intentionally deviate from normal patterns. This metric calculates the cosine similarity between the current operation and historically legitimate operation patterns (e.g., comparing process call parameters and file access sequences), and takes the inverse of the maximum similarity as the deviation metric. Even if an attacker uses camouflage techniques such as naming the malicious process "system_update," this method can still identify parameter anomalies due to the unconventional file path.

[0055] To address the unique characteristics of industrial scenarios, the dynamic threshold formula incorporates CPU load as a regulatory factor. For example, CPU fluctuations during high-load periods such as peak production periods may be due to business pressure rather than attacks. The weight coefficients α and β are dynamically optimized through reinforcement learning to ensure that false positives are minimized while not missing real threats.

[0056] In one possible implementation, before inferring the causal dependency of the joint embedding vector based on the trained temporal causal convolutional network, the following is further included: The initial temporal causal convolutional network is trained based on the second positive and negative sample sets and the second loss function to obtain a trained temporal causal convolutional network; wherein the positive samples in the second positive and negative sample sets are the joint embedding vectors corresponding to historical normal operations, and the negative samples in the positive and negative sample sets are the joint embedding vectors corresponding to attack events. The second loss function is:

[0057] in, is the loss function value, is the sample pair number, is the number of sample pairs, each sample pair includes a positive sample and a negative sample, is a hyperparameter, For sample pairs The causal violation score of the positive sample, For sample pairs Causal violation score for negative samples.

[0058] In this embodiment, TCN training utilizes a contrastive learning strategy, the core of which is to enforce a separation in the embedding space between normal and abnormal sequences. Positive samples are selected from historical normal operation sequences (such as compliant firmware update chains), requiring them to cover legitimate operations across different devices and time periods. Negative samples include known attack sequences (such as ransomware encryption processes) and artificially generated causal violation sequences (such as reverse operation chains).

[0059] The physical meaning of the loss function is that the score of the normal sequence should be at least one boundary value higher than the score of the abnormal sequence . It has been verified by experiments. Taking 0.5 can balance the convergence speed and generalization ability. After training, the score of normal sequences approaches 0 and the score of abnormal sequences approaches 1, so that the model has the ability to identify zero-day attacks.

[0060] Corresponding to a network security intrusion detection method of the above embodiment, Figure 2 This is a structural block diagram of a network security intrusion detection device provided by an embodiment of the present application. For ease of explanation, only the parts related to the embodiment of the present application are shown. Figure 2 The network security intrusion detection device 20 includes: An image construction module 21 is used to construct a multimodal directed graph of the industrial Internet of Things based on the status data, log data, and physical signal data of each device in the industrial Internet of Things; An embedding learning module 22 is used to perform cross-modal embedding learning on a multimodal directed graph using a trained hierarchical graph attention network to obtain a joint embedding vector of the industrial Internet of Things; The intrusion detection module 23 is used to derive causal dependencies on the joint embedding vector based on the trained temporal causal convolutional network, generate attack paths and attack confidences, and use them as network security intrusion detection results for the industrial Internet of Things.

[0061] In a possible implementation, the image construction module 21 is specifically configured to: For every two interacting devices, the event subject device is taken as the source node, the event object device as the target node, the status data and physical signal data as the node attributes, and the log data as the edge attribute to obtain a multimodal directed graph of the Industrial Internet of Things.

[0062] In one possible implementation, the hierarchical graph attention network includes a node layer, a sub-layer layer, and a full layer layer; the embedding learning module 22 is specifically used to: The multimodal directed graph is divided into subgraphs according to device function, physical space, and causal dependency, respectively, to obtain the device function subgraph, physical space subgraph, and causal dependency subgraph of the multimodal directed graph; Through the node layer based on the cross-modal attention mechanism, the node attributes of each node are fused to obtain multiple node-level embeddings; Through the sub-layer based on cross-subgraph attention, the node-level embeddings in the device function subgraph, physical space subgraph, and causal dependency subgraph are fused to obtain three subgraph-level embeddings; The three sub-graph-level embeddings are aggregated through global attention and causal enhancement aggregation at the full layer to obtain the joint embedding vector of the Industrial Internet of Things.

[0063] In a possible implementation, the embedded learning module 22 is further configured to: Before using the trained hierarchical graph attention network to perform cross-modal embedding learning on the multimodal directed graph to obtain the joint embedding vector of the industrial Internet of Things, the initial hierarchical graph attention network is trained based on the first positive and negative sample sets and the first loss function to obtain a trained hierarchical graph attention network; wherein, the positive samples in the first positive and negative sample sets are the multimodal directed graphs corresponding to historical normal operations, the negative samples in the positive and negative sample sets are the multimodal directed graphs corresponding to attack events, and the first loss function is the cross-entropy loss function.

[0064] In one possible implementation, the intrusion detection module 23 is specifically configured to: The joint embedding vector is input into the temporal causal convolutional network to obtain the causal violation score of each edge in the multimodal graph; Calculate the physical signal anomaly strength and operational deviation of each edge in the multimodal graph; For each edge, the causal violation score, physical signal anomaly strength, and operation deviation of the edge are weighted and summed to obtain the anomaly score of the edge; Edges whose anomaly scores exceed the anomaly score threshold are identified as high-risk edges, and the high-risk edges are aggregated to obtain the attack path; The attack confidence is calculated as the weighted score of the causal violation score of the attack path and the abnormal strength of the physical signal.

[0065] In one possible implementation, the intrusion detection module 23 is specifically configured to: Calculate the number of standard deviations of the sensor reading fluctuations on the first side that exceed the preset safety threshold as the physical signal anomaly strength of the first side; where the first side is any side in the multimodal graph; Calculate the cosine similarity between the first edge and multiple historical legal operation patterns, and take the inverse of the largest cosine similarity as the operation deviation of the first edge; The calculation formula for the anomaly score threshold is:

[0066] in, is the anomaly scoring threshold, and is the weight coefficient, As the basic threshold.

[0067] In a possible implementation, the intrusion detection module 23 is further configured to: Before deriving the causal dependency relationship of the joint embedding vector based on the trained temporal causal convolutional network, the initial temporal causal convolutional network is trained based on the second positive and negative sample sets and the second loss function to obtain a trained temporal causal convolutional network; wherein the positive samples in the second positive and negative sample sets are the joint embedding vectors corresponding to historical normal operations, and the negative samples in the positive and negative sample sets are the joint embedding vectors corresponding to attack events. The second loss function is:

[0068] in, is the loss function value, is the sample pair number, is the number of sample pairs, each sample pair includes a positive sample and a negative sample, is a hyperparameter, For sample pairs The causal violation score of the positive sample, For sample pairs Causal violation score for negative samples.

[0069] The embodiment of the present invention first solves the blind spot problem of traditional single-source detection by integrating device status, log and physical signal data through multimodal graph structure design, and then aggregates embedding vectors through the hierarchical processing architecture of the hierarchical graph attention network, significantly optimizing the computational efficiency. Its attention mechanism can effectively retain the operating status information of the industrial Internet of Things. Finally, a temporal causal convolutional network driven by causal logic is used to quantify the degree of causal violation, greatly improving the interpretability. In scenarios with a variety of network security intrusion methods, it can still effectively capture malicious behaviors that violate the operating logic of the industrial system, thereby improving the network security intrusion detection effect.

[0070] See also Figure 3 , Figure 3 This is a schematic block diagram of an electronic device provided in one embodiment of the present application. Figure 3The electronic device 300 in the embodiment shown may include: one or more processors 301, one or more input devices 302, one or more output devices 303, and one or more memories 304. The processors 301, input devices 302, output devices 303, and memories 304 communicate with each other via a communication bus 305. The memory 304 is used to store computer programs, which include program instructions. The processor 301 is used to execute the program instructions stored in the memory 304. The processor 301 is configured to call the program instructions to execute the functions of the modules / units in the above-mentioned device embodiments, such as Figure 2 The functions of the image construction module 21, the embedding learning module 22, and the intrusion detection module 23 are shown.

[0071] It should be understood that in the embodiment of the present application, the processor 301 may be a central processing unit (CPU), and the processor may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor may be a microprocessor or any conventional processor, etc.

[0072] The input device 302 may include a touchpad, a fingerprint collection sensor (for collecting user fingerprint information and fingerprint direction information), a microphone, etc. The output device 303 may include a display (LCD, etc.), a speaker, etc.

[0073] The memory 304 may include a read-only memory and a random access memory, and provides instructions and data to the processor 301. A portion of the memory 304 may also include a non-volatile random access memory. For example, the memory 304 may also store device type information.

[0074] In a specific implementation, the processor 301, input device 302, and output device 303 described in the embodiments of the present application can execute the implementation methods described in the first and second embodiments of a network security intrusion detection method provided in the embodiments of the present application, and can also execute the implementation methods of the electronic device described in the embodiments of the present application, which will not be repeated here.

[0075] In another embodiment of the present application, a computer-readable storage medium is provided. The computer-readable storage medium stores a computer program. The computer program includes program instructions. When the program instructions are executed by a processor, all or part of the process of the method in the above embodiment is implemented. The computer program can also be used to instruct related hardware to complete the process. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of each of the above method embodiments are implemented. The computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can include: any entity or device capable of carrying computer program code, recording medium, USB flash drive, mobile hard disk, magnetic disk, optical disk, computer memory, read-only memory (ROM), random access memory (RAM), electrical carrier signal, telecommunication signal and software distribution medium.

[0076] The computer-readable storage medium can be an internal storage unit of the electronic device in any of the aforementioned embodiments, such as a hard disk or memory of the electronic device. The computer-readable storage medium can also be an external storage device of the electronic device, such as a plug-in hard disk, a Smart Media Card (SMC), a Secure Digital (SD) card, a flash memory card, etc. Furthermore, the computer-readable storage medium can include both an internal storage unit of the electronic device and an external storage device. The computer-readable storage medium is used to store computer programs and other programs and data required by the electronic device. The computer-readable storage medium can also be used to temporarily store data that has been output or is about to be output.

[0077] Those skilled in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in terms of function in the above description. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0078] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the electronic devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0079] In the several embodiments provided in this application, it should be understood that the disclosed electronic devices and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of units is only a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection through some interfaces or units, or can be an electrical, mechanical or other form of connection.

[0080] The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiments of the present application.

[0081] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0082] The above are only specific embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and such modifications or substitutions should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A network security intrusion detection method, characterized in that: include: Constructing a multimodal directed graph of the industrial Internet of Things based on status data, log data, and physical signal data of each device in the industrial Internet of Things; Using a trained hierarchical graph attention network to perform cross-modal embedding learning on the multimodal directed graph to obtain a joint embedding vector of the industrial Internet of Things; Based on the trained temporal causal convolutional network, causal dependencies are derived for the joint embedding vector to generate attack paths and attack confidences, which are used as network security intrusion detection results for the industrial Internet of Things.

2. The network security intrusion detection method according to claim 1, wherein: The multimodal directed graph of the industrial Internet of Things is constructed based on the status data, log data, and physical signal data of each device in the industrial Internet of Things, including: For every two interacting devices, the event subject device is used as the source node, the event object device is used as the target node, the status data and physical signal data are used as node attributes, and the log data is used as the edge attribute to obtain the multimodal directed graph of the industrial Internet of Things.

3. The network security intrusion detection method according to claim 2, wherein: The hierarchical graph attention network includes a node layer, a sublayer layer, and a full layer layer; the trained hierarchical graph attention network is used to perform cross-modal embedding learning on the multimodal directed graph to obtain a joint embedding vector of the industrial Internet of Things, including: Dividing the multimodal directed graph into subgraphs according to device functions, physical spaces, and causal dependencies, respectively, to obtain a device function subgraph, a physical space subgraph, and a causal dependency subgraph of the multimodal directed graph; The node attributes of each node are fused based on the cross-modal attention mechanism through the node layer to obtain multiple node-level embeddings; By using the sub-layer based on cross-sub-graph attention, the node-level embeddings in the device function sub-graph, the physical space sub-graph, and the causal dependency sub-graph are fused to obtain three sub-graph-level embeddings; The three sub-graph-level embeddings are aggregated through the full-graph layer based on global attention and causal enhancement aggregation to obtain a joint embedding vector of the industrial Internet of Things.

4. The network security intrusion detection method according to claim 3, wherein: Before using the trained hierarchical graph attention network to perform cross-modal embedding learning on the multimodal directed graph to obtain the joint embedding vector of the industrial Internet of Things, the method further includes: An initial hierarchical graph attention network is trained based on a first positive and negative sample set and a first loss function to obtain a trained hierarchical graph attention network; wherein the positive samples in the first positive and negative sample set are multimodal directed graphs corresponding to historical normal operations, the negative samples in the positive and negative sample set are multimodal directed graphs corresponding to attack events, and the first loss function is a cross-entropy loss function.

5. The network security intrusion detection method according to claim 1, wherein: The causal dependency derivation of the joint embedding vector based on the trained temporal causal convolutional network is performed to generate an attack path and an attack confidence as the network security intrusion detection result of the industrial Internet of Things, including: Inputting the joint embedding vector into a temporal causal convolutional network to obtain a causal violation score for each edge in the multimodal graph; Calculating the physical signal anomaly strength and operation deviation of each edge in the multimodal graph; For each edge, the causal violation score, physical signal anomaly strength, and operation deviation of the edge are weighted and summed to obtain the anomaly score of the edge; Edges whose anomaly scores exceed the anomaly score threshold are identified as high-risk edges, and the high-risk edges are aggregated to obtain the attack path; A weighted score of the causal violation score of the attack path and the abnormal strength of the physical signal is calculated as the attack confidence.

6. The network security intrusion detection method according to claim 5, wherein: The calculating of the physical signal abnormality strength and the operation deviation of each edge in the multimodal graph includes: Calculating the number of standard deviations of sensor reading fluctuations on a first side exceeding a preset safety threshold as the abnormal strength of the physical signal of the first side; wherein the first side is any side in the multimodal graph; Calculating cosine similarities between the first edge and multiple historical legal operation patterns, and taking the inverse of the maximum cosine similarity as the operation deviation of the first edge; The calculation formula for the anomaly score threshold is: in, is the anomaly scoring threshold, and is the weight coefficient, As the basic threshold.

7. The network security intrusion detection method according to claim 5, characterized in that: Before the causal dependency relationship of the joint embedding vector is derived based on the trained temporal causal convolutional network, the method further includes: The initial temporal causal convolutional network is trained based on the second positive and negative sample sets and the second loss function to obtain a trained temporal causal convolutional network; wherein the positive samples in the second positive and negative sample sets are joint embedding vectors corresponding to historical normal operations, and the negative samples in the positive and negative sample sets are joint embedding vectors corresponding to attack events, and the second loss function is: in, is the loss function value, is the sample pair number, is the number of sample pairs, each sample pair includes a positive sample and a negative sample, is a hyperparameter, For sample pairs The causal violation score of the positive sample, For sample pairs Causal violation score for negative samples.

8. A network security intrusion detection device, characterized in that: include: An image construction module, configured to construct a multimodal directed graph of the industrial Internet of Things based on status data, log data, and physical signal data of each device in the industrial Internet of Things; An embedding learning module, configured to perform cross-modal embedding learning on the multimodal directed graph using a trained hierarchical graph attention network to obtain a joint embedding vector of the industrial internet of things; An intrusion detection module is used to derive causal dependencies on the joint embedding vector based on a trained temporal causal convolutional network, generate attack paths and attack confidences, and use them as network security intrusion detection results for the industrial Internet of Things.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images