Machine Learning-Based Methods and Systems for Threat Perception and Control in Converged Media Cybersecurity

Abstract

This invention discloses a machine learning-based method and system for threat perception and control in converged media network security, relating to the field of converged media network security technology. The method includes: collecting and fusing multi-source heterogeneous data from converged media networks to construct a heterogeneous relationship graph between data nodes; dividing nodes based on a clustering algorithm, generating a low-dimensional vector for each node using a graph embedding method, and assigning pseudo-labels and corresponding confidence scores to each node; inputting historical labeled samples and pseudo-labeled samples, weighted by confidence score, into a graph attention network for semi-supervised joint training to obtain a threat detection model; re-performing clustering and pseudo-label updates to iteratively update the model; deploying the trained threat detection model, outputting threat scores for each node in the converged media network subgraph in real time, and automatically triggering protective actions according to preset strategies. The method described in this invention can accurately identify and assess threats, automatically trigger protective actions, and significantly improve the real-time performance and accuracy of network security protection.

Description

Technical Field

[0001] This invention relates to the field of converged media network security technology, and in particular to a converged media network security threat perception and control method and system based on machine learning. Background Technology

[0002] With the rapid development of information technology and the widespread adoption of the internet, converged media networks (including the integration of multiple information sources such as multimedia, social platforms, and mobile devices) have become a core component of information dissemination. The complexity and diversity of converged media networks have led to increasingly serious security threats. Traditional network security protection technologies mainly focus on monitoring and protecting network traffic, user behavior, or device status, but these methods often overlook the heterogeneity of converged media networks and the complex interactions between nodes. In recent years, security protection methods based on graph networks have gradually attracted attention from academia and industry. This method, by modeling each node and its relationships within the network, can more accurately capture the mutual influence and potential threats between nodes, especially in converged media networks facing large-scale data and complex interaction patterns. However, existing graph models mainly focus on the construction and analysis of static graphs, lacking the ability to handle the dynamic and multi-source heterogeneous data unique to converged media networks.

[0003] Current cybersecurity detection methods rely on rule-driven detection engines or statistical learning-based models. While these methods offer some effectiveness in handling large-scale traffic data, significant challenges remain. First, rule-driven detection methods often suffer from high false positive and false negative rates, making them ill-suited to new attack patterns. Existing statistical learning-based models typically rely on specific feature engineering, requiring substantial prior knowledge and human intervention, and struggle to effectively capture potential correlations between data when fusing multi-source, heterogeneous data. Furthermore, traditional methods often lack sufficient flexibility and scalability when dealing with dynamic interactions between nodes. For complex relationships between multi-layered, multi-type nodes (such as user nodes, device nodes, and resource nodes), existing technologies struggle to provide effective security protection strategies from a global perspective. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a machine learning-based method for the perception and control of cybersecurity threats in converged media, which addresses the problems of insufficient data fusion, difficulty in feature extraction, and poor dynamic adaptability faced by existing network security detection technologies.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution:

[0007] In a first aspect, the present invention provides a method for sensing and controlling cybersecurity threats in converged media based on machine learning, which includes collecting multi-source heterogeneous data from converged media networks and fusing them to construct a heterogeneous relationship graph between data nodes;

[0008] The nodes are divided based on the clustering algorithm, and a low-dimensional vector for each node is generated by the graph embedding method on the heterogeneous relationship graph. Pseudo-labels and corresponding confidence scores are assigned to each node.

[0009] The threat detection model is obtained by semi-supervised joint training of a graph attention network by inputting historical labeled samples and pseudo-labeled samples according to their confidence scores;

[0010] Based on the latest node representation, re-execute clustering and pseudo-label updates, and iteratively update the model;

[0011] The deployed and trained threat detection model outputs threat scores to each node in the converged media network subgraph in real time and automatically triggers protection actions according to preset strategies.

[0012] As a preferred embodiment of the machine learning-based method for the perception and control of cybersecurity threats in converged media described in this invention, the construction of the heterogeneous relationship graph between data nodes includes: performing converged media network graph structure modeling, defining node types, establishing edge relationships between different types of nodes based on business connections and security semantics; and extracting multi-dimensional features for each type of node and edge collected.

[0013] The node types include user nodes, IP nodes, device nodes, and resource nodes;

[0014] When new data arrives, if the node does not already exist, the node is automatically added and its characteristics are initialized; edge attributes and weights are assigned based on the interaction type between nodes; multiple interactions between the same pair of nodes are stored as edge objects with timestamps.

[0015] As a preferred embodiment of the machine learning-based method for the perception and control of cybersecurity threats in converged media, the method for dividing nodes based on clustering algorithms includes: using historically labeled samples as seed points to cluster node behavior data; dividing the node behavior data into K clusters using an algorithm; for seed points with known partial threat data, using a semi-supervised clustering algorithm to guide the clustering process with labeled data; calculating the clustering distance for each node behavior data, and dividing the node behavior data into clusters according to the criterion of minimum intra-cluster distance;

[0016] For unsupervised scenarios, the silhouette coefficient is used to evaluate the clustering effect and the K value is selected.

[0017] Each cluster is assigned a label. If a cluster contains known threat samples, the cluster is marked as a threat; if the samples in the cluster are normal samples, they are marked as normal. For behavioral data without explicit labels, a soft labeling method is used, which assigns a threat probability label based on the distance of the data within the cluster, resulting in pseudo-labeled samples.

[0018] As a preferred embodiment of the machine learning-based method for sensing and controlling cybersecurity threats in converged media according to the present invention, the graph embedding method includes embedding the graph using a random walk algorithm to generate low-dimensional vector representations of the nodes;

[0019] For each node Randomly initialize a vector in the diagram. Randomly select a starting node in the graph and perform multiple walks; each walk starts from node [node name missing]. Start by randomly jumping along the edges of the graph to adjacent nodes. The walk yields a node sequence. , indicating from node The initial path taken;

[0020] Based on the node pairs in the walk path The modeling objective is to maximize the value of a given node. At that time, predict the probability of other nodes in the path; use a negative sampling method to approximate the objective function, and train to obtain the probability of each node. Low-dimensional vector representation It contains the structure and attribute information of the nodes.

[0021] As a preferred embodiment of the machine learning-based method for the perception and control of cybersecurity threats in converged media described in this invention, the semi-supervised joint training includes calculating the confidence level of the pseudo-label samples of each node and adjusting the confidence level by the graph embedding similarity of the nodes.

[0022] The model is built using a graph attention network, with historical labeled samples and pseudo-labeled samples weighted by confidence. For each node, the attention coefficient between the node and its neighboring nodes is calculated. Based on the calculated attention coefficient, the information of the neighboring nodes is aggregated to update the representation of each node. The cross-entropy loss function is used to evaluate the performance of the model.

[0023] After training the graph attention network, the node representation is updated; the node representation is a vector that includes the node's position in the graph and the node's behavioral features.

[0024] The updated node representation is used to perform a secondary clustering operation, which re-divides the nodes into different clusters.

[0025] After obtaining the new node representations and the updated secondary clustering results, the pseudo-labels of each node are recalculated. The specific process includes:

[0026] Based on the similarity update between the node and the cluster center, if the node representation of the node is close to the cluster center, the pseudo-label of the node is adjusted to be consistent with the label of the cluster.

[0027] Based on neighbor consistency update, if the pseudo-labels of a node's neighboring nodes are the same, then the node's pseudo-label is updated to be consistent with the neighboring nodes.

[0028] In each round of training, clustering is re-executed based on the current node representation to obtain new node clusters and cluster centers; the pseudo-label of each node is updated based on the new node representation and clustering results, and the model is continued to be trained using the updated pseudo-label and node representation; the node representation, clustering results and pseudo-label are iteratively updated to optimize the graph attention model until the model's loss function converges.

[0029] As a preferred embodiment of the machine learning-based method for the perception and control of cybersecurity threats in converged media described in this invention, the output threat score includes: calculating the similarity between the output of the graph attention model of each node and known types of threats; scoring the threat level based on the similarity calculation results and classifying it into severe, high-risk, medium-risk, and low-risk levels.

[0030] As a preferred embodiment of the machine learning-based network security threat perception and control method of the present invention, wherein: the automatic triggering of protection actions according to a preset strategy includes using a reinforcement learning algorithm to optimize the preset strategy through a Q-value function; state This represents the global state of the current graph structure, i.e., the feature vectors of the nodes and edges in the current graph; node features are aggregated through a graph attention network to finally obtain a high-dimensional feature representation of each node. This summarizes the data to obtain a global representation of the entire graph; where, , Indicates the number of nodes. Represents a node At any moment eigenvectors;

[0031] Each movement This refers to the defensive actions that can be taken to minimize threats in the current state. These actions include blocking edges, isolating nodes, rate limiting, and adjusting firewall policies. The Q-value function represents the defensive actions that can be taken to minimize threats in the current state. Next action The maximum cumulative reward that can be obtained; the reward is obtained by evaluating a reward function, which is set according to preventing the spread of threats, reducing false alarms and delays;

[0032] When an abnormal node is detected, the optimal defense operation is automatically executed through a reinforcement learning algorithm; and a search is performed. Calculate the similarity of anomalous node pairs to preliminarily estimate the threat propagation path;

[0033] For each anomalous node, a propagation chain is constructed step by step along the nodes with the highest similarity in the graph; a propagation threshold is set. Only when the similarity is greater than the threshold At that time, determine the node It is part of the transmission path;

[0034] By tracing the origin of a threat through reverse attribution, the score of the attribution propagation path is evaluated. Based on the score of the propagation path, the nodes are sorted according to the relevance of the threat source to obtain the source node of the threat. After the risk attribution is completed, the attribution results are visualized and the impact range of the threat propagation chain is evaluated.

[0035] Secondly, the present invention provides a converged media network security threat perception and control system based on machine learning, including a data acquisition module that collects multi-source heterogeneous data from the converged media network and constructs a heterogeneous relationship graph;

[0036] The label generation module uses a semi-supervised clustering algorithm to cluster node behavior data and assign labels to each cluster;

[0037] The threat monitoring module uses a trained threat detection model to score the threats to nodes in the converged media network in real time and trigger protection actions according to preset policies.

[0038] Thirdly, the present invention provides a computer device, including a memory and a processor, wherein the memory stores a computer program, wherein: when the computer program is executed by the processor, it implements any step of the machine learning-based converged media cybersecurity threat perception and control method described in the first aspect of the present invention.

[0039] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the machine learning-based method for sensing and controlling cybersecurity threats in converged media as described in the first aspect of the present invention.

[0040] The beneficial effects of this invention are as follows: By integrating multi-source heterogeneous data from converged media networks, a heterogeneous relationship graph between data nodes is constructed. A deep learning method based on clustering algorithms and graph embedding is employed to dynamically update node representations and pseudo-labels, achieving efficient threat detection. Through semi-supervised training of graph attention networks and reinforcement learning-driven optimization of protection strategies, this invention can accurately identify and assess threats, automatically triggering protection actions, significantly improving the real-time performance and accuracy of network security protection. Compared to traditional technologies, this invention effectively reduces false positive and false negative rates and adapts to the complex and dynamic threat changes in converged media networks, exhibiting stronger scalability and intelligence. Attached Figure Description

[0041] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 This is a flowchart of a machine learning-based method for the perception and control of cybersecurity threats in converged media. Detailed Implementation

[0043] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0044] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0045] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0046] Reference Figure 1 This is one embodiment of the present invention, which provides a machine learning-based method for the perception and control of cybersecurity threats in converged media, comprising the following steps:

[0047] S1: Collect and merge multi-source heterogeneous data from converged media networks to construct a heterogeneous relationship diagram between data nodes.

[0048] Furthermore, define node types, including: user nodes (user account, session ID); IP nodes (source IP, destination IP); device nodes (terminal device ID, media server node); and resource nodes (URL, API interface, media file).

[0049] Define edge types, including: access edges, which record access relationships; communication edges, which record network session traffic; login edges, which record user and device bindings; and dependency edges, which record inter-service calls.

[0050] The construction of the heterogeneous relationship graph between data nodes includes performing converged media network graph structure modeling, defining node types, establishing edge relationships between different types of nodes based on business connections and security semantics, and extracting multi-dimensional features for each type of node and edge collected.

[0051] Furthermore, the node types include user nodes, IP nodes, device nodes, and resource nodes.

[0052] When new data arrives, if the node does not already exist, the node is automatically added and its characteristics are initialized; edge attributes and weights are assigned based on the interaction type between nodes; multiple interactions between the same pair of nodes are stored as edge objects with timestamps.

[0053] For each type of node and edge collected, multi-dimensional features are extracted. Node features include user node login frequency and number of abnormal behaviors; device node operating system type and number of vulnerabilities; and IP node geographical location and blacklist status. Edge features include access frequency, request latency, data traffic, and call interval.

[0054] All features are standardized or normalized, and some categorical features are encoded using one-hot encoding to ensure that the features can be directly input into the subsequent graph neural network for processing.

[0055] The relationship graph uses "node-edge-node" as the basic unit, and dynamically organizes all entities and their relationships into a heterogeneous relationship graph in the following way:

[0056] Whenever new data arrives, if the node does not already exist, the node is automatically added and its characteristics are initialized; based on the events or interactions in the data, corresponding edges are established between the nodes, and the weights or attributes of the edges are assigned according to the actual interaction content.

[0057] It supports temporal edge modeling, storing multiple interactions of the same pair of nodes as timestamped edge objects to preserve historical evolution information. A distributed graph computing platform is used to manage the graph structure, enabling efficient CRUD operations and batch processing. Incremental updates to the graph structure allow for batch insertion of new nodes and edges for newly added data, and support for periodic cleanup of old or useless nodes.

[0058] It should be noted that the system provides efficient graph structure data export and interface services, allowing the constructed heterogeneous relationship graph to be input into subsequent graph neural networks (GCN, GAT, etc.) for threat detection and analysis. It supports exporting in various formats such as batch subgraphs and time slices, achieving efficient data supply for different analysis tasks. Through multi-source data fusion and graph construction algorithms, it achieves structured, dynamic, and scalable modeling of various security-related entities and behaviors in the converged media network environment, greatly enhancing the capabilities of subsequent threat detection and anomaly propagation tracing.

[0059] S2: Based on the clustering algorithm, the nodes are divided, and a graph embedding method is used to generate a low-dimensional vector for each node on the heterogeneous relationship graph. Pseudo-labels and corresponding confidence scores are assigned to each node.

[0060] Furthermore, the node partitioning based on the clustering algorithm includes: using historically labeled samples as seed points to cluster node behavior data; dividing the node behavior data into K clusters using an algorithm; for seed points with known partial threat data, using a semi-supervised clustering algorithm, and using labeled data to guide the clustering process. The clustering distance is calculated for each node behavior data point, and the node behavior data is assigned to clusters based on the criterion of minimum intra-cluster distance. For each node... To calculate its distance from other nodes in the cluster, Euclidean distance is typically used:

[0061]

[0062] in, It is a cluster The central node. Minimum intra-cluster distance criterion: Based on the criterion of minimum intra-cluster distance, nodes are... Assign to the nearest cluster .

[0063] Unsupervised clustering and evaluation: In unsupervised scenarios, where there is no pre-labeled threat data, the clustering process relies entirely on the similarity between nodes. Therefore, silhouette coefficients are used to evaluate clustering performance and select an appropriate number of clusters. :

[0064]

[0065] in, It is the average distance between nodes within the cluster. It is the average distance from a node to its nearest other cluster. The choice is the one that maximizes the silhouette coefficient. This serves as the final cluster number.

[0066] For each cluster Labels are assigned based on the annotation status of nodes within a cluster. Threat-labeled data: If a cluster contains known threat samples, it is labeled as a threat. Normal data: If a cluster contains only normal nodes, it is labeled as normal. For nodes without explicit labels, a soft-labeling method is used to assign them threat probability labels. The threat probability of each node is calculated based on its relative distance within its cluster (proximity to the cluster center). :

[0067]

[0068] in, Represents a node To the cluster center The distance. Using this method, pseudo-labels are generated for each unlabeled node, and their confidence scores are stored in [the appropriate database]. middle.

[0069] Each cluster is assigned a label. If a cluster contains known threat samples, the cluster is marked as a threat; if the samples in the cluster are normal samples, they are marked as normal. For behavioral data without explicit labels, a soft labeling method is used, which assigns a threat probability label based on the distance of the data within the cluster, resulting in pseudo-labeled samples.

[0070] The graph embedding method includes embedding the graph using a random walk algorithm to generate low-dimensional vector representations of the nodes.

[0071] A random walk algorithm is employed to embed heterogeneous relational graphs, thereby generating low-dimensional vector representations of nodes. The goal of the random walk method is to learn the embedded representations of nodes based on the structural relationships between them, capturing the potential associations between nodes.

[0072] Initialize the node vector, and in the graph, for each node... Randomly initialize a vector . Indicates all A set of dimensional real vectors, i.e., a field of the embedding space. Represents the embedded spatial dimension. The traversal process: starting from any node... Initially, a starting node is randomly selected, and multiple random walks are performed. In each walk, the node randomly jumps to adjacent nodes along the edges of the graph, generating a walk path. Walk path modeling: Modeling is performed using the pairs of nodes in the walk path, with the goal of maximizing the probability of predicting other nodes in the path given a given node.

[0073]

[0074] in, These are nodes in the walking path. A negative sampling method is used to approximate the objective function, reducing computational cost. The goal of the negative sampling method is to optimize the embedding representation of each node by comparing the probabilities of positive and negative samples. :

[0075]

[0076] in, It is the sigmoid function. and It is a node and The low-dimensional embedding representation, It is the representation of the negative sample nodes of the negative sampling.

[0077] For each node Randomly initialize a vector in the diagram. Randomly select a starting node in the graph and perform multiple walks; each walk starts from node [node name missing]. Start by randomly jumping along the edges of the graph to adjacent nodes. The walk yields a node sequence. , indicating from node The initial path taken.

[0078] Based on the node pairs in the walk path The modeling objective is to maximize the value of a given node. At that time, predict the probability of other nodes in the path; use a negative sampling method to approximate the objective function, and train to obtain the probability of each node. Low-dimensional vector representation It contains the structure and attribute information of the nodes.

[0079] It should be noted that the nodes were divided into multiple clusters, generating pseudo-labels and corresponding confidence scores for each node. A graph embedding method was used to generate low-dimensional vector representations for each node. These representations contain the node's structure and attribute information, which can be used for subsequent threat detection and protection strategies. Low-dimensional representation training involved multiple iterations to refine the low-dimensional vector representation of each node. It can capture as much structural and attribute information as possible from the nodes. Ultimately, a low-dimensional vector representation of each node is obtained. This will help with subsequent threat detection and prediction tasks.

[0080] S3: Input historical labeled samples and pseudo-labeled samples into a graph attention network according to confidence level for semi-supervised joint training to obtain a threat detection model.

[0081] The semi-supervised joint training includes calculating the confidence of pseudo-label samples for each node and adjusting the confidence based on the graph embedding similarity of the nodes.

[0082] The model is built using a graph attention network, with historical labeled samples and pseudo-labeled samples weighted by confidence. For each node, the attention coefficient between the node and its neighboring nodes is calculated. Based on the calculated attention coefficient, the information of the neighboring nodes is aggregated to update the representation of each node. The cross-entropy loss function is used to evaluate the performance of the model.

[0083] First, for each node, calculate the pseudo-label confidence. It is necessary to calculate the confidence level of its pseudo-labels. Pseudo-labels are generated based on the distance between a node and the cluster center and the consistency of its neighbors. A node's confidence score is related to its position in the cluster and its similarity to its neighbors. The formula is expressed as:

[0084]

[0085] in, It is a node The center of the cluster, Represents a node With cluster center The smaller the distance, the closer the node representation is to the cluster center, and the higher the confidence level.

[0086] Next, we will model the nodes using a Graph Attention Network (GAT). We will compute the values ​​for each node. Its adjacent nodes Attention coefficient between It dynamically adjusts based on node characteristics and adjacency information:

[0087]

[0088] in, Represents a node and nodes The correlation between nodes can be obtained by calculating the inner product of their representations or other similarity metrics. This can be achieved through the attention coefficient. ,node Aggregate its neighbor nodes Update its feature representation based on the information:

[0089]

[0090] in, This is the updated node representation. It is a weight matrix. It is an activation function. It is a bias term.

[0091] During training, historical labeled samples and pseudo-labeled samples are input into the graph attention network based on their confidence levels. The confidence level of historical labeled samples is 1, while the confidence level of pseudo-labeled samples is... Adjustments are made based on the similarity to the cluster center:

[0092]

[0093] in, It is a node eigenvectors, It is the confidence level of the node. This represents the adjusted vector value. By using weighted inputs, the model will pay more attention to samples with higher confidence levels, ensuring the effectiveness and robustness of training.

[0094] Training using the cross-entropy loss function. The training process uses the cross-entropy loss function. To evaluate the model's performance:

[0095]

[0096] in, It is a node The true label, These are the labels predicted by the model. The loss calculation for historical labeled samples is the same as in standard supervised learning methods, while the loss for pseudo-labeled samples is weighted according to their confidence level.

[0097] It should be noted that through multiple iterations of training, the graph attention network will learn the representation of each node. These representations not only include the node's own feature information but also its structural information within the graph. After training, the model can perform real-time threat detection and defense decisions based on the latest node representations.

[0098] S4: Re-execute clustering and pseudo-label updates based on the latest node representation, and iteratively update the model.

[0099] After training with a graph attention network, the node representation is updated; the node representation is a vector that includes the node's position in the graph and the node's behavioral features.

[0100] After each round of training, the clustering operation is re-performed based on the latest node representations. This is done by computing the representation vector for each node. Based on the similarity with the cluster center, update the cluster label of each node.

[0101] The similarity between a node and the cluster center is updated if the node New representation With cluster center If the nodes are similar (closely related), then the pseudo-label of that node is updated to the cluster label. .

[0102] Neighbor consistency update: if node If the pseudo-labels of the neighboring nodes are consistent, then the node The pseudo-labels have also been updated to match those of the neighbors, that is... (For all neighbors) In this way, the pseudo-label is updated based on the node's position in the graph and its consistency with its neighbors.

[0103] The updated node representation is used to perform a secondary clustering operation, which re-divides the nodes into different clusters.

[0104] After obtaining the new node representations and the updated secondary clustering results, the pseudo-labels of each node are recalculated. The specific process includes:

[0105] Based on the similarity update between nodes and cluster centers, if a node's node representation is close to the cluster center, then the node's pseudo-label is adjusted to be consistent with the cluster's label.

[0106] Based on neighbor consistency updates, if a node's neighboring nodes have the same pseudo-label, then the node's pseudo-label is updated to be consistent with that of its neighboring nodes.

[0107] In each round of training, clustering is re-executed based on the current node representation to obtain new node clusters and cluster centers; the pseudo-label of each node is updated based on the new node representation and clustering results, and the model is continued to be trained using the updated pseudo-label and node representation; the node representation, clustering results and pseudo-label are iteratively updated to optimize the graph attention model until the model's loss function converges.

[0108] In each training round, the node representations, clustering results, and pseudo-labels are updated, and the model is trained again using the updated pseudo-labels and node representations. This process is repeated until the model's loss function is satisfied. convergence:

[0109]

[0110] in, It is the loss of historical labeled samples. It is a weighted loss of pseudo-labeled samples. The graph attention model is optimized through continuous iterative updates.

[0111] It should be noted that the semi-supervised joint training process uses a graph attention network to weight the input of historical labeled samples and pseudo-labeled samples, and updates the pseudo-labels based on the node representations. Through iterative updates, a powerful threat detection model is finally obtained. In each round of training, node representations, pseudo-labels, and clustering results are optimized, thereby improving the model's performance and accuracy.

[0112] S5: Deploy the trained threat detection model, output threat scores for each node in the converged media network subgraph in real time, and automatically trigger protection actions according to preset strategies.

[0113] Furthermore, the high-dimensional feature representation of each node is based on the weighted aggregation of the features of its neighboring nodes, capturing the relationship between the node and other nodes in the graph.

[0114] Feature representation of each node Calculate the similarity between the feature vector and the known threat type. Assume the threat type is... Each threat type has a representative feature vector. .

[0115] Similarity The calculation uses cosine similarity:

[0116]

[0117] in, Represents the dot product. It is the norm of the vector.

[0118] Threat scoring and level classification, based on similarity calculations, assesses the threat level of nodes. If a node... Threat type A higher degree of similarity indicates a more serious threat.

[0119] Automatically triggering protective actions according to a preset strategy includes using a reinforcement learning algorithm to optimize the preset strategy through a Q-value function; state This represents the global state of the current graph structure, i.e., the feature vectors of the nodes and edges in the current graph; node features are aggregated through a graph attention network to finally obtain a high-dimensional feature representation of each node. This summarizes the data to obtain a global representation of the entire graph; where, , Indicates the number of nodes. Represents a node At any moment eigenvectors.

[0120] Based on similarity scores, the threat levels are categorized as severe, high-risk, medium-risk, and low-risk.

[0121] Each movement These are the defensive operations that can be performed in the current state. In each state, the system can perform a series of defensive operations, including: blocking edges (isolating threat propagation paths), isolating nodes (isolating abnormal nodes from the network), rate limiting (reducing network bandwidth to slow the spread of potential threats), and adjusting firewall policies (enhancing firewall rules to prevent attacks).

[0122] Q-value function Assessment in status Next action The maximum cumulative reward that can be obtained later:

[0123]

[0124] in, It is a discount factor. It is an immediate reward obtained after performing an action. This represents the number of future time steps. When calculating the expected cumulative reward, Starting from 0 indicates the time step from the current time. The number of time steps from the start to the future. Each Corresponding to the current time go through Rewards for each step .so, The increase implies a "future" discount on the reward, that is, taking into account the time elapsed since the present. The rewards received in more distant times.

[0125] reward function Evaluation is based on the following factors: Preventing threat propagation: A positive reward is given if defensive actions effectively slow down threat propagation. Reducing false alarms: Higher rewards are given if defensive operations do not mistakenly harm healthy nodes. Minimizing latency: Defensive operations should be executed as quickly as possible; the shorter the latency, the higher the reward.

[0126] Through the Q-learning algorithm, the system continuously optimizes its protection strategy, enabling it to select the optimal defense action in each state. .

[0127] When an abnormal node is detected, the optimal defense operation is automatically executed through a reinforcement learning algorithm; and a search is performed. Calculate the similarity of anomalous node pairs to preliminarily estimate the propagation path of the threat.

[0128] For each anomalous node, a propagation chain is constructed step by step along the nodes with the highest similarity in the graph; the propagation path is calculated assuming a set of anomalous nodes has been detected. The goal is to predict the propagation paths of these anomalous nodes. Possible propagation paths are estimated by calculating the similarity between anomalous nodes and other nodes. For each pair of nodes... and Calculate their similarity:

[0129]

[0130] in, and These are nodes and Embedded vector, and It is their Euclidean norm.

[0131] Propagation chain prediction is based on the similarity of node embedding vectors, using a shortest path algorithm to find the most likely propagation path for anomalous nodes in the graph. Path selection prioritizes nodes with high similarity to anomalous nodes.

[0132] For each abnormal node By following the nodes with the highest similarity in the graph, a propagation chain is gradually constructed.

[0133] Propagation threshold: Set the propagation threshold Only when similarity Greater than the threshold At that time, node It is considered to be part of the propagation path.

[0134] By tracing the origin of a threat through reverse attribution, the score of the attribution propagation path is evaluated. Based on the score of the propagation path, the nodes are sorted according to the relevance of the threat source to obtain the source node of the threat. After the risk attribution is completed, the attribution results are visualized and the impact range of the threat propagation chain is evaluated.

[0135] Once an anomalous node is identified through backpropagation, the origin of the threat can be traced back through reverse attribution. The core idea of ​​backpropagation is to find the source node that may have caused the threat by moving in the opposite direction from the anomalous node in the graph.

[0136] The path is backtracked, starting from the abnormal node and propagating backward along the path with the highest similarity. For example, for a node... ,calculate This allows us to trace back to the possible source node.

[0137] The propagation path score is calculated by evaluating the score of the path during each backward backtracking. The score determines whether the path represents the actual threat propagation path.

[0138] The source node ranking is based on the score of the propagation path, and the nodes are ranked according to their relevance to the threat source to obtain the most likely source node of the threat. :

[0139]

[0140] in, It is with nodes All related nodes.

[0141] After risk attribution is completed, the results are visualized to help security personnel locate the source of the threat and assess the scope of the threat propagation chain. A graphical interface can be used to display the propagation paths and attribution relationships between each node.

[0142] By combining propagation path prediction with attribution analysis, a multi-layered threat analysis view is formed. By analyzing the propagation path and attribution history of each node, the role of that node in the overall threat chain (such as attack source, propagation node, or target node) can be determined.

[0143] It should be noted that low-dimensional node representation: Graph embeddings generate low-dimensional representations by capturing the structural features of the graph, which can help subsequent tasks (such as clustering, similarity calculation, etc.) to be performed efficiently. For some tasks, low-dimensional representations are sufficient to provide information about the relationships between nodes. High-dimensional node representation: Graph neural networks generate high-dimensional representations through deep learning techniques that can capture the more complex relationships between node features and their surrounding environment, and continuously optimize their representations through training. This is indispensable for more complex tasks (such as threat detection, decision support, etc.).

[0144] This embodiment also provides a converged media network security threat perception and control system based on machine learning, including: a data acquisition module, which collects multi-source heterogeneous data from the converged media network and constructs a heterogeneous relationship graph.

[0145] The label generation module uses a semi-supervised clustering algorithm to cluster node behavior data and assign labels to each cluster.

[0146] The threat monitoring module uses a trained threat detection model to score the threats to nodes in the converged media network in real time and trigger protection actions according to preset policies.

[0147] This embodiment also provides a computer device applicable to the case of a machine learning-based method for the perception and control of cybersecurity threats in converged media, including: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the machine learning-based method for the perception and control of cybersecurity threats in converged media as proposed in the above embodiment.

[0148] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0149] This embodiment also provides a storage medium storing a computer program. When executed by a processor, the program implements the machine learning-based method for sensing and controlling cybersecurity threats in converged media, as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read-Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0150] In summary, this invention achieves the following: First, it collects and fuses multi-source heterogeneous data from a converged media network to construct a heterogeneous relationship graph between data nodes. Second, it divides the nodes based on a clustering algorithm and generates a low-dimensional vector for each node using a graph embedding method on the heterogeneous relationship graph, assigning pseudo-labels and corresponding confidence levels to each node. Third, it inputs historical labeled samples and pseudo-labeled samples, weighted by confidence level, into a graph attention network for semi-supervised joint training to obtain a threat detection model. Fourth, it re-executes clustering and pseudo-label updates based on the latest node representations, iteratively updating the model. Fifth, it deploys the trained threat detection model, outputs threat scores for each node in the converged media network subgraph in real time, and automatically triggers protective actions according to a preset strategy.

[0151] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A machine learning-based method for the perception and control of cybersecurity threats in converged media, characterized in that: include, Collect and fuse multi-source heterogeneous data from converged media networks to construct a heterogeneous relationship graph between data nodes; The nodes are divided based on the clustering algorithm, and a low-dimensional vector for each node is generated by the graph embedding method on the heterogeneous relationship graph. Pseudo-labels and corresponding confidence scores are assigned to each node. The threat detection model is obtained by semi-supervised joint training of a graph attention network by inputting historical labeled samples and pseudo-labeled samples according to their confidence scores; Based on the latest node representation, re-execute clustering and pseudo-label updates, and iteratively update the model; Deploy the trained threat detection model, output threat scores for each node in the converged media network subgraph in real time, and automatically trigger protection actions according to preset strategies; The construction of the heterogeneous relationship graph between data nodes includes: performing converged media network graph structure modeling, defining node types, establishing edge relationships between different types of nodes based on business connections and security semantics; and extracting multi-dimensional features for each type of node and edge collected. The node types include user nodes, IP nodes, device nodes, and resource nodes; When new data arrives, if the node does not already exist, the node is automatically added and its characteristics are initialized; edge attributes and weights are assigned based on the interaction type between nodes; multiple interactions of the same pair of nodes are stored as edge objects with timestamps. The node partitioning based on the clustering algorithm includes: using historical labeled samples as seed points to cluster node behavior data; dividing the node behavior data into K clusters using the algorithm; for seed points with known partial threat data, using a semi-supervised clustering algorithm to guide the clustering process using labeled data; calculating the clustering distance for each node behavior data, and partitioning the node behavior data into clusters according to the criterion of minimum intra-cluster distance; For unsupervised scenarios, the silhouette coefficient is used to evaluate the clustering effect and the K value is selected. Each cluster is assigned a label. If a cluster contains known threat samples, the cluster is marked as a threat; if the samples in the cluster are normal samples, they are marked as normal. For behavioral data without explicit labels, a soft labeling method is used, which assigns a threat probability label based on the distance of the data within the cluster, resulting in pseudo-labeled samples.

2. The method for sensing and controlling cybersecurity threats in converged media based on machine learning as described in claim 1, characterized in that: The graph embedding method includes embedding the graph using a random walk algorithm to generate low-dimensional vector representations of the nodes; For each node Randomly initialize a vector in the diagram. Randomly select a starting node in the graph and perform multiple walks; each walk starts from node [node name missing]. Start by randomly jumping along the edges of the graph to adjacent nodes. The walk yields a node sequence. , indicating from node The initial path taken; Based on the node pairs in the walk path The modeling objective is to maximize the value of a given node. At that time, predict the probability of other nodes in the path; use a negative sampling method to approximate the objective function, and train to obtain the probability of each node. Low-dimensional vector representation It contains the structure and attribute information of the nodes.

3. The method for sensing and controlling cybersecurity threats based on machine learning as described in claim 2, characterized in that: The semi-supervised joint training includes calculating the confidence of pseudo-label samples for each node and adjusting the confidence based on the graph embedding similarity of the nodes; The model is built using a graph attention network, with historical labeled samples and pseudo-labeled samples input by confidence weights. For each node, the attention coefficient between the node and its neighboring nodes is calculated. Based on the calculated attention coefficient, the information of the neighboring nodes is aggregated to update the representation of each node. Use the cross-entropy loss function to evaluate the model's performance; After training the graph attention network, the node representation is updated; the node representation is a vector that includes the node's position in the graph and the node's behavioral features. The updated node representation is used to perform a secondary clustering operation, which re-divides the nodes into different clusters. After obtaining the new node representations and the updated secondary clustering results, the pseudo-labels of each node are recalculated. The specific process includes: Based on the similarity update between the node and the cluster center, if the node representation of the node is close to the cluster center, the pseudo-label of the node is adjusted to be consistent with the label of the cluster. Based on neighbor consistency update, if the pseudo-labels of a node's neighboring nodes are the same, then the node's pseudo-label is updated to be consistent with the neighboring nodes. In each round of training, clustering is re-executed based on the current node representation to obtain new node clusters and cluster centers; the pseudo-label of each node is updated based on the new node representation and clustering results, and the model is continued to be trained using the updated pseudo-label and node representation; the node representation, clustering results and pseudo-label are iteratively updated to optimize the graph attention model until the model's loss function converges.

4. The method for sensing and controlling cybersecurity threats based on machine learning as described in claim 3, characterized in that: The output threat score includes calculating the similarity between the output of the graph attention model for each node and known threat types; and scoring the threat level based on the similarity calculation results, classifying it into severe, high-risk, medium-risk, and low-risk levels.

5. The method for sensing and controlling cybersecurity threats in converged media based on machine learning as described in claim 4, characterized in that: The automatic triggering of protection actions according to a preset strategy includes using a reinforcement learning algorithm to optimize the preset strategy through a Q-value function; state The graph represents the global state of the current graph structure, including the feature vectors of the nodes and edges in the current graph; node features are aggregated through a graph attention network to obtain a high-dimensional feature representation for each node. This summarizes the data to obtain a global representation of the entire graph; where, , Indicates the number of nodes. Represents a node At any moment eigenvectors; Each movement This refers to the defensive operations that can be performed in the current state. These actions include blocking edges, isolating nodes, rate limiting, and adjusting firewall policies. The Q-value function represents the defensive actions that can be performed in the current state. Next action The maximum cumulative reward that can be obtained; the reward is obtained by evaluating a reward function, which is set based on preventing the spread of threats, reducing false alarms, and minimizing latency; When an abnormal node is detected, the optimal defense operation is automatically executed through a reinforcement learning algorithm; and a search is performed. Calculate the similarity of anomalous node pairs to preliminarily estimate the threat propagation path; For each anomalous node, a propagation chain is constructed step by step along the nodes with the highest similarity in the graph; a propagation threshold is set. Only when the similarity is greater than the threshold At that time, determine the node It is part of the transmission path; By tracing the origin of a threat through reverse attribution, the score of the attribution propagation path is evaluated. Based on the score of the propagation path, the nodes are sorted according to the relevance of the threat source to obtain the source node of the threat. After the risk attribution is completed, the attribution results are visualized and the impact range of the threat propagation chain is evaluated.

6. A machine learning-based system for the perception and control of cybersecurity threats in converged media, based on the machine learning-based method for the perception and control of cybersecurity threats in converged media as described in any one of claims 1 to 5, characterized in that: This includes a data acquisition module that collects multi-source heterogeneous data from the converged media network and constructs a heterogeneous relationship graph; The label generation module uses a semi-supervised clustering algorithm to cluster node behavior data and assign labels to each cluster; The threat monitoring module uses a trained threat detection model to score the threats to nodes in the converged media network in real time and trigger protection actions according to preset policies.

7. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the machine learning-based method for sensing and controlling cybersecurity threats in converged media as described in any one of claims 1 to 5.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the machine learning-based network security threat perception and control method according to any one of claims 1 to 5.

Images