Multi-modal big data fusion analysis method and system for network security

Abstract

The invention relates to the technical field of network security-oriented multi-modal big data fusion analysis, and discloses a network security-oriented multi-modal big data fusion analysis method and system. Establishing a communication topology for the firewall, the network access control system, the video switching system and the three-layer switch, and positioning an external injection point; collecting multi-source data to count the packet amount in a fixed window, and converting the packet amount into link / node equivalent resistance; a resistance network and an admittance matrix are assembled, a current vector is constructed in combination with injection flow, and node data potential is solved; generating a dynamic baseline according to historical data and calculating a real-time deviation; normalizing the potential and the current deviation to obtain an abnormal score and judging an abnormal node; and tracing the abnormal nodes by applying a minimum dissipation path algorithm, and outputting a node set and a path.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security-oriented multi-modal big data fusion analysis, in particular to a network security-oriented multi-modal big data fusion analysis method and system. BACKGROUND

[0002] With the continuous improvement of network scale and business complexity, the data collection, analysis and traceability tasks faced by network security are becoming increasingly difficult. Traditional network security protection mainly relies on a single data source or a simple rule engine, such as threshold detection based on firewall logs, intrusion detection system alarms or traffic characteristics. These methods, when faced with diversified attack scenarios, can only respond passively to known threats and are difficult to discover new and complex attack paths. In addition, although existing security information and event management systems can integrate multi-source data such as logs, alarms, and traffic, most of them are limited to keyword-based or statistical rule-based correlation analysis, lacking deep physical meaning modeling of network topology structure and node state.

[0003] In the era of big data, network data presents the characteristics of "large scale, multiple types, and fast update". Multi-modal data such as packet capture, traffic metadata, device performance indicators, video monitoring, and access control system logs coexist, and there are complex relationships between data. Existing researches mostly use machine learning or deep learning models for anomaly detection of traffic data, such as autoencoders, long short-term memory networks, and graph neural networks. However, these methods often ignore the physical or logical topology relationship between network nodes, making it difficult to reflect the propagation path of security events in the network and intuitively associate the detection results with specific devices or links. Another type of research focuses on topology-based traffic analysis and visualization, such as using graph theory to track network traffic spread paths. However, most of them stop at the level of topology view display and lack fusion analysis of network performance indicators (such as link delay, node processing capacity) and security state. Traditional network topology modeling generally starts from the device level of routers, switches, etc., establishing node and port connection relationships, but rarely combines them with real-time traffic and device processing delay and other dynamic indicators to construct mathematical models with "electrical" significance, resulting in security analysis that cannot quantitatively measure the sensitivity and abnormal influence range of nodes or links. Existing circuit simulation ideas have been applied in the field of network performance analysis, such as mapping network delay or load to resistance and capacitance models to evaluate network congestion or QoS. In addition, existing anomaly detection methods are often limited to giving an abnormal node list or traffic anomaly indicators after generating an alarm, lacking accurate root cause path positioning for anomalies. Even some researches introduce tracking algorithms, which are mostly based on simplified shortest paths or statistical correlations and do not consider device performance differences and link delay factors, lacking support for accuracy and priority ranking of traceability paths, resulting in low efficiency of subsequent security response and forensics work.

[0004] To this end, the present case aims to propose a network security-oriented multi-modal big data fusion analysis method and system, and proposes a unified modeling idea of abstracting the network environment as an equivalent circuit system. By accurately depicting the network topology and external injection points, the link traffic and node processing delay are mapped to the resistance elements in the circuit; then the admittance matrix is constructed and combined with the actual injection flow to form the current vector, and the "data potential" of each network node is obtained by solving the linear circuit equation, so as to describe the network state with physical quantitative indicators. Based on historical data, a dynamic baseline model is established, the deviation between the real-time state and the baseline state is normalized, and the abnormal source is quickly located through the traceability path exploration algorithm. SUMMARY

[0005] The present application provides a network security-oriented multi-modal big data fusion analysis method and system, which solves the problems mentioned in the background art.

[0006] The present application provides the following technical scheme: a network security-oriented multi-modal big data fusion analysis method, comprising: Modeling the network topology structure of the target network environment, and identifying the external data injection points to form an abstract representation of the network nodes and their connection relationships; Collecting multi-source heterogeneous data of network links and nodes, based on time window statistics, measuring the data packet flow of each link, and calculating the equivalent resistance parameters of the links and nodes; According to the network topology structure and the equivalent resistance parameters, an equivalent circuit model is constructed to establish the corresponding circuit element association relationship of each node and link in the network; Using the equivalent circuit model, assemble the network admittance matrix to form the admittance relationship between the nodes, and combine the actual collected injection flow data to construct the current vector; Solve the network equation set to obtain the data potential distribution of each node; Establish a baseline model reflecting the normal operation state of the network, calculate the network electrical parameters during the baseline period based on historical data, and analyze the deviation between the real-time collected data and the baseline data; According to the deviation of the node potential and the link current, the abnormal score is calculated by using the normalization method, and the abnormality is determined according to the score result; Based on the determination result of the abnormal node, the network abnormality traceability path is explored, and the abnormal node set and the corresponding traceability path are output.

[0007] Optionally, the network topology structure of the target network environment is modeled, and the external data injection points are identified to form an abstract representation of the network nodes and their connection relationships, specifically comprising: Get the total number of firewalls, denoted as , numbered ; get the total number of network access control systems, denoted as , numbered ; get the total number of video security exchange access systems, denoted as , numbered ; get the total number of three-layer switches, denoted as , numbered ; wherein ; represents the th device in the network, when represents the firewall node, when represents the network access control system, when represents the video security exchange system node, and when represents the three-layer switch node; Construct a link set ; the elements in the set are ordered pairs representing and can directly communicate with each other; Construct an adjacency matrix : , , ; wherein represents whether node and are directly connected, if , then node and are directly connected; if , then node and are not directly connected; Get all firewall ports interacting with the external network to form a set ; Initiate a depth or breadth first search from to calculate the number of reachable nodes ; If , then for each connected component: if the component contains elements, then supplement the link; otherwise, remove the component; Output the connected topology: , ; wherein is a connected graph composed of a node set and an edge set .

[0008] Optionally, the collection of multi-source heterogeneous data of network links and nodes is based on time window statistics, measures the data packet flow of each link, and calculates the equivalent resistance parameters of the link and the node, specifically including: Let the monitoring interval be ; Let the upper limit of the link packet counter be ; Calculate the link packet increment: ; wherein, is the cumulative packet number at time ; is the packet number in the interval; is the maximum resistance ; ; ; Link equivalent resistance: ; wherein, is the average transmission delay of each packet in the link ; Get the number of packets handled by node in , denoted as ; get the incoming and outgoing timestamps of the th packet, denoted as ; calculate the packet processing delay ; Node equivalent resistance: ; wherein, is the average processing delay of node .

[0009] Optionally, the equivalent circuit model is constructed according to the network topology and the equivalent resistance parameters, and the corresponding circuit element association relationship of each node and link of the network is established, specifically including: Let the circuit node be , wherein, represents the reference ground node, which is the circuit zero potential; Link resistance element: , ; wherein, represents the resistance element connecting and ; is the resistance value of the link ; Node resistance element: , ; wherein, is the connection between and the reference ground; is the resistance value of the link ; Construct the circuit netlist .

[0010] Optionally, the step of assembling the network admittance matrix using an equivalent circuit model to form the admittance relationship between nodes, and constructing a current vector by combining the actual collected injected flow data, specifically includes: Calculate admittance: , ;in, and These are the admittances of the link and the node, respectively; Construct the admittance matrix: , , , ; Calculate the nodes separately exist Total number of packages Total number of packages : , ; Constructing the injection traffic vector ; in .

[0011] Optionally, obtaining the data potential distribution of each node by solving the network equations specifically includes: Constructing linear equations ;in, The node potential vector; Constructing a determinant: , ;in, Let be the determinant of the admittance matrix; This refers to the determinant operation of a matrix; To be No. Column replacement The determinant after; To be No. Column replacement The matrix after; Calculate the position of a single node .

[0012] Optionally, the step of establishing a baseline model reflecting the normal operating status of the network, calculating network electrical parameters during the baseline period based on historical data, and performing deviation analysis between real-time acquired data and baseline data specifically includes: Let the baseline start point be , ;in, The baseline time period length; This represents the number of monitoring windows included in the baseline time period, and ; Calculate the average link resistance during the baseline period ; Calculate the average node resistance during the baseline period ; Calculate the average net inflow during the baseline period ; Solve the baseline potential: , , ; wherein, is the determinant of the baseline admittance matrix; is the baseline admittance matrix, in terms of average resistance , reconstructed; is the determinant after replacing a column of the baseline matrix; is the matrix after replacing the th column of with the baseline injection vector ; is the average data potential of node during the baseline period; Calculate the deviation of node potential ; Calculate the deviation of link current ; wherein, is the average admittance during the baseline period, .

[0013] Optionally, according to the deviations of node potential and link current, the abnormal score is calculated by using the normalization method, and the abnormality is determined according to the score result, specifically including: Normalize the current deviation ; wherein, is the baseline link current; Normalize the potential deviation ; Calculate the total abnormal score of node ; ; Calculate the baseline mean and standard deviation of the abnormal score respectively: , ; Set the determination threshold to ; If , determine that node is abnormal; if , determine that node is normal.

[0014] Optionally, the determination result based on the abnormal node is used to explore a network abnormality tracing path, and an abnormal node set and a corresponding tracing path are output, and specifically includes: Constructing an abnormal node set ; Setting a mapping function , returning a node or , recording a direct predecessor when a node is traced; For each , steps S810 to S820 are executed: S810, initializing a weight function ; and marking all nodes as unvisited; S820, repeating until all are visited or there is no unvisited node: S821, selecting a node from the unvisited nodes that makes the minimum and marking it as visited; S822, for each unvisited neighbor , calculating a candidate weight , if , updating , ; For each , steps S830 to S840 are executed: S830, if , a path is constructed along in reverse to ; ; S840, otherwise, marking as unreachable; Outputting an abnormal node set and a path set , including an unreachable identifier.

[0015] A system for implementing the network security-oriented multi-modal big data fusion analysis method and system, comprising: A data acquisition module for acquiring network topology information and running data; A model construction module for constructing an equivalent circuit model based on the collected data; A parameter calculation module for calculating equivalent resistance and admittance parameters of links and nodes; An anomaly detection module for generating an abnormality score based on a baseline model and deviation analysis and making a determination; A tracing analysis module for executing path exploration in the equivalent circuit model and outputting abnormality tracing results.

[0016] The present application has the following advantages: 1. By treating network devices, communication links, and external access ports as circuit nodes and connections, and using automated scripts to acquire and uniformly number various firewalls, access control systems, and switching devices, a standardized abstraction of the complex network environment is achieved. A graph traversal algorithm is used to solve for connected components and eliminate isolated regions, ensuring that subsequent analysis is performed on a complete and meaningful connected graph. Compared to traditional methods that only focus on a single device or a simple topology snapshot, this approach dynamically excludes irrelevant nodes and automatically completes connected links, guaranteeing model integrity and analysis efficiency. On the one hand, it improves the quality of initial data, avoiding false positives and false negatives; on the other hand, by clearly defining the boundaries of external injection points, it provides a precise starting point for tracing the source and identifying the attack surface, laying a solid foundation for downstream circuit modeling.

[0017] 2. By mapping various network traffic and latency metrics to "equivalent resistance" in a circuit, and utilizing a unified time window statistical mechanism, the system accurately measures link packet increments and node processing latency. The system not only considers packet counter wraparound correction but also adaptively selects monitoring intervals to balance response speed and data reliability. Compared to existing technologies that primarily rely on throughput, latency thresholds, or machine learning feature engineering, this stage offers a natural advantage in data fusion with unified dimensions, avoiding the difficulties of adjusting weights between different metrics. Simultaneously, it intuitively transforms network performance into physical quantity values, facilitating subsequent circuit modeling and mathematical solutions. This technology maintains statistical stability even in high-concurrency environments and can be deployed in edge or cloud-network integrated scenarios.

[0018] 3. Mapping the network topology and calculated equivalent resistance parameters to a circuit netlist—each link is mapped to a series resistor element, and the processing delay of each network node is treated as a grounding resistor element, with a reference ground node introduced to unify the circuit zero potential. Unlike previous analysis methods based solely on graph theory or machine learning models, the circuit-based model constructed in this stage can directly call mature circuit simulation and matrix operation tools, simplifying the algorithm implementation; furthermore, network performance indicators are naturally embedded in the model, allowing for real-time updates of resistance values ​​to track network dynamics. This innovation not only improves interpretability, enabling maintenance personnel to intuitively understand the delay distribution of each node and link, but also reduces subsequent computational complexity, laying a solid foundation for efficiently solving the admittance matrix and circuit equations.

[0019] 4. By converting equivalent resistance into admittance values, a smooth transition from resistive networks to linear equation systems is achieved: not only are admittance matrices between nodes automatically assembled, but injection flow vectors are also constructed based on the real-time packet input and output volumes of each node. Compared to traditional methods that require manual setting of feature weights or training of model parameters, the matrices and vectors used in this stage can be directly generated from standard linear algebra libraries, exhibiting high automation and reusability. Through the tight coupling of admittance matrices and injection vectors, a mathematical description of the network state is achieved; the rigor and consistency of the calculation formulas are ensured, while supporting parallel or distributed computing, adapting to large-scale network scenarios, and effectively reducing false alarm rates while ensuring real-time performance.

[0020] 5. Utilizing the linear equations solution method in circuit theory, the "data potential" of each network node is directly calculated, quantifying the node's health status as a physical potential value. Compared to existing threshold-based judgments or unstructured deep models, this explicit solution provides continuous and comparable numerical results, making latent anomalies easier to identify. Furthermore, since the solution process is based on matrix operations, large-scale concurrent solutions can be achieved using high-performance computing frameworks. This innovation improves diagnostic accuracy and interpretability, allowing maintenance personnel to intuitively understand network hotspots and potential bottlenecks based on the potential distribution map, solving the problems of lack of visualization support and difficulty in capturing subtle anomalies inherent in previous black-box models.

[0021] 6. Historical network state data is used for statistical modeling. By setting a stable operating range, the average resistance, average current, and node potential during the baseline period are calculated to form a dynamic baseline model. For real-time acquired network parameters, the deviation is automatically calculated based on the baseline model. Compared with static thresholds or single-time sliding window methods, the dynamic baseline can adaptively adjust the detection sensitivity as the network evolves, reducing false alarms and false negatives. This ensures the system is applicable to various network traffic cycle characteristics, has controllable sensitivity to sudden fluctuations, and avoids safety blind spots caused by improper threshold settings. It effectively solves the problems of unstable baselines and difficulty in accommodating multi-cycle characteristics in existing technologies.

[0022] 7. After normalization, the node potential deviation and link current deviation are weighted and accumulated to generate a comprehensive anomaly score. This score is then combined with the mean and fluctuation of baseline statistics to calculate a judgment threshold, enabling accurate identification of anomalous nodes. Unlike traditional methods that rely on a single indicator or coarse-grained thresholds, this method integrates multi-dimensional deviation information, making the anomaly score more comprehensive and reliable. Furthermore, the dynamic threshold can be flexibly adjusted according to the actual network volatility, providing a higher ability to distinguish minor anomalies. This innovation not only improves detection accuracy but also gives the anomaly judgment process high interpretability, providing a quantitative basis for security decisions and effectively solving the problems of large and uncontrollable single-factor judgment errors in existing technologies.

[0023] 8、In the abnormal node is determined, through the weighted shortest path search algorithm in the equivalent circuit model to find the minimum "energy dissipation" path from the abnormal node to the external injection point, the network traceability problem is mapped to the physical minimum path problem. Compared with the traditional flow tracking or log analysis complex and time-consuming way, the method directly executes path search on the unified model, efficient and parallel, can give clear abnormal propagation path in seconds. On the one hand, it provides accurate traceability clues for security operation and maintenance, shortens the emergency response time; On the other hand, from the perspective of physical energy dissipation, the path result is more in line with the actual network traffic distribution law, improves the traceability accuracy and operability, solves the problem of large traceability difficulty and high error in the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0024] Figure 1 The flowchart of the present application is shown. DETAILED DESCRIPTION

[0025] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0026] Embodiments, refer to Figure 1 A network security-oriented multi-modal big data fusion analysis method, comprising: Modeling the network topology of the target network environment, and identifying the external data injection point to form an abstract representation of the network nodes and their connection relationships; Collecting multi-source heterogeneous data of network links and nodes, measuring the data packet flow of each link based on time window statistics, and calculating the equivalent resistance parameters of links and nodes; According to the network topology structure and the equivalent resistance parameters, an equivalent circuit model is constructed to establish the corresponding circuit element association relationship of each node and link in the network; Using the equivalent circuit model, assemble the network admittance matrix to form the admittance relationship between nodes, and combine the actual collected injection flow data to construct the current vector; Solve the network equation set to obtain the data potential distribution of each node; Establish a baseline model reflecting the normal operation state of the network, calculate the network electrical parameters during the baseline period based on historical data, and perform deviation analysis on the real-time collected data and the baseline data; According to the deviation amount of node potential and link current, the abnormal score is calculated by using the normalization method, and the abnormality is determined according to the score result; Based on the abnormal node determination result, the network abnormality tracing path is explored, and the abnormal node set and the corresponding tracing path are output.

[0027] Through the key steps of global topology abstraction of network environment, fine-grained data collection, equivalent circuit modeling, matrix assembly and physical equation solving, dynamic baseline comparison, and abnormal scoring and tracing, the method effectively solves the core problems in traditional security analysis, such as the inability of multi-source indicators to unify dimensions, the unexplainability of model black box, the poor sensitivity of static threshold, and the difficulty of positioning the tracing path. First, through network structure description and external injection point positioning, it is ensured that all analyses are conducted on the real connected topology, avoiding misjudgment and omission caused by isolated or missing nodes. Second, a unified resistance-admittance physical perspective is adopted to map multi-modal data such as throughput, delay, and processing time into the same dimension, breaking the bottleneck of heterogeneous data fusion and laying a quantitative foundation for subsequent mathematical solving. Third, the historical baseline model and real-time deviation analysis are introduced, making the anomaly detection no longer dependent on fixed thresholds, but able to adjust dynamically with the network, improving detection sensitivity and reducing false positive rate. Finally, through the exploration of the tracing path, the propagation link of the abnormal event is converted into the minimum "dissipation" path, providing visual and traceable security positioning clues, shortening the emergency response time and improving the positioning accuracy. Overall, the method balances analysis accuracy, explainability, and real-time performance, providing a systematic, physical, and easy-to-engineer innovative solution for network security big data fusion analysis.

[0028] The target network environment is modeled and the external data injection point is identified to form an abstract representation of the network nodes and their connection relationships, specifically including: The total number of firewalls is obtained, denoted as , numbered as ; the total number of network access control systems is obtained, denoted as , numbered as ; the total number of video security exchange access systems is obtained, denoted as , numbered as ; the total number of three-layer switches is obtained, denoted as , numbered as ; wherein, ; represents the th device in the network, when represents the firewall node, when represents the network access control system, when represents the video security exchange system node, and when represents the three-layer switch node; the analysis object is clearly defined, and the index format is unified to facilitate subsequent reference and calculation; The link set ; elements in the set are ordered pairs represent ; elements in the set are ordered pairs are directly communicable construct the adjacency matrix : , , ; wherein represent nodes are directly communicable if , then nodes are directly communicable if , then nodes are not directly communicable ; mapping the network topology to a mathematical graph structure provides the basic data for connectivity and circuit construction acquire all firewall ports interacting with the external network to form a set ; determine the target for tracing back the source to provide a set of boundary nodes for abnormal positioning initiate a depth or breadth first search from to calculate the number of reachable nodes ; if , then for each connected component: if the component contains elements, then supplement the link; otherwise, eliminate the component; ensure that the network within the analysis range is a connected graph, excluding irrelevant or isolated parts, and ensuring the integrity of the model output the connected topology: , ; wherein is a connected graph composed of a set of nodes and a set of edges ; give the network model that can be directly used for circuit simulation and admittance matrix construction

[0029] By unified numbering and classified management of various key devices in the network, combined with link set and adjacency matrix for structured representation, and using graph traversal algorithm for automatic correction or removal of connected components, this step effectively solves the model distortion and redundancy problems caused by various device types, non-standard numbering, incomplete links or isolated nodes in traditional network modeling. In the detailed execution, first, through the device quantity statistics and numbering method, the network is scanned by all types of firewalls, access control and switching devices, to ensure that all nodes to be analyzed are included in the model; second, the link set based on ordered pair is constructed, and the adjacency matrix is generated, so that the network connectivity can be quickly operated in matrix form; then through depth or breadth first traversal, the potential non-connected subsets in the network are identified, and the missing connections are automatically completed or the isolated parts irrelevant to the analysis target are removed, to ensure that the subsequent analysis and processing are carried out on the real connected structure without errors or omissions; finally, the output connected topology graph not only has integrity and accuracy, but also can be directly used for circuit modeling and admittance matrix construction, improving the efficiency and quality of model construction.

[0030] The multi-source heterogeneous data of the network link and node is collected, the data packet flow of each link is measured based on time window statistics, and the equivalent resistance parameters of the link and node are calculated, specifically including: The monitoring interval is set as ; the unified data collection frequency is ensured to ensure the time sequence consistency; The monitoring sampling interval is fixed for the whole network, which is used to measure the time window of packet count and delay statistics before and after. Function: Determine the time scale of packet increment ; Determine the denominator of equivalent resistance calculation; affect the sensitivity of node delay and flow deviation. Value size influence: too small, data noise and counter jitter ratio is high, calculation is unstable, system overhead is large; too large, unable to capture short-time exceptions in time, response lag, basic assumption (network state smooth) easy to fail. Value basis: network size and flow level (packet rate); expected detection of the shortest attack or fault duration; processing and storage capacity of the monitoring system. Value suggestion: data center or high bandwidth scene: ; Small and medium-sized enterprise network: ; Adjust according to event duration requirements and resource capacity.

[0031] The upper limit of the link packet counter is set as ; used to detect and correct the counter wraparound, ensure the correctness of packet increment calculation; is the maximum representable value of the link hardware / software packet counter, for example Function: Used to detect and correct "packet counter wraparound" to ensure accurate calculation of the true packet increment when there is a negative error. Impact of Value: Too small, wraparound occurs too frequently, causing the algorithm to frequently enter the wraparound branch, increasing errors; too large, exactly equal to or greater than the device's maximum count value, ensures no wraparound correction is missed. Value Basis: Read the counter bit width of the actual network card or switch, typically 32-bit or 64-bit. Value Recommendation: Maintain consistency with the device manual: for 32-bit counters... 64-bit .

[0032] Calculate the link packet increment: ;in, For link At any moment The cumulative number of packages; for The number of packets within the interval; to obtain accurate packet flow rate over a time period, providing data for equivalent resistance calculation; Set the maximum resistance to In the case of zero-packet flow or open circuit, maintain model integrity and avoid division by zero; This is a "maximum resistance" constant used to represent the equivalent open-circuit resistance when there is no flow or no processing. Its function is to... or At this time, avoid division by zero and reflect "infinite" latency. The magnitude of the value has an impact: too small, and it will be mistaken for normal high latency, masking a true anomaly of no traffic / no processing; too large, and it will appear normal... A difference in magnitude of several to tens of times can be considered an open circuit. Value selection criteria: maximum value of a normal link / node. Multiply the value by a safety factor, such as 10-100. Suggested value: Let... This ensures that the resistance is fully separated from the normal resistance level.

[0033] Link equivalent resistance: ;in, For each packet in the link The average transmission delay; converting packet traffic into resistance to characterize link transmission delay; Get Nodes exist The number of packets processed internally is denoted as ; Get the The inbound and outbound timestamps of each packet are recorded as follows: Calculate the packet processing delay. ; Obtain the node processing delay distribution to provide raw data for node resistance calculation; Node equivalent resistance: ;in, For nodes average processing delay; converting node processing time into resistance, representing the processing delay within the node.

[0034] By setting a reasonable monitoring time window and combining with the packet counter wraparound correction mechanism, this step solves the problem of inaccurate flow statistics caused by timing misalignment or counter reset in the link data collection process. In this stage, first, a unified monitoring time window is used to ensure that the packet flow and delay data from each device are comparable, thereby avoiding timing deviations caused by inconsistent sampling frequencies; second, to address the potential loop wraparound phenomenon of hardware or software counters, an automated correction algorithm is used to correct counter wraparound errors in real time, ensuring the accuracy of flow increment calculation; third, when there is no data flow or temporary interruption for a certain period of time, a pre-set maximum resistance is introduced to maintain the connectivity of the circuit model and prevent division by zero errors, allowing the model to operate stably in extreme cases; finally, the real packet increment is combined with the statistical average transmission delay or processing delay to accurately convert it into equivalent resistance, providing high-precision performance parameters for subsequent circuit modeling. This process not only unifies the dimensions of heterogeneous indicators such as throughput and delay, but also improves the robustness and reliability of data statistics, reducing the impact of noise interference on model accuracy, and laying a solid data foundation for subsequent admittance matrix construction and state solving.

[0035] According to the network topology structure and equivalent resistance parameters, an equivalent circuit model is constructed, and a corresponding circuit element association relationship is established for each node and link of the network, specifically including: Let the circuit node be , wherein represents the reference ground node, which is the zero potential of the circuit; the reference ground is introduced to complete the node set preparation of the circuit topology; Link resistance element: , ; wherein represents the resistance element connecting and ; is the resistance value of the link ; accurately map the link delay characteristics in the circuit model; Node resistance element: , ; wherein is the connection between and the reference ground; is the resistance value of the link ; map the node processing delay in the circuit model; Construct circuit netlist ; form a complete resistance network description that can be used for mathematical solving.

[0036] By mapping network nodes and link performance parameters into ground resistance and series resistance elements respectively, and combining the setting of circuit reference ground, this step completely solves the semantic gap between network data and circuit model, and realizes the seamless conversion from network physical structure to standard circuit topology. Specifically, first, according to the logical relationship of nodes and links in the network topology, the corresponding circuit node set is constructed, and the reference ground node is introduced to unify the potential zero point; second, the previously calculated link transmission delay is converted into an equivalent series resistance element, and the internal processing delay of the node is mapped into a resistance element connected to the ground, thereby completely reproducing the network performance characteristics at the physical level; finally, the generated circuit netlist can directly call mature circuit solving and simulation library for admittance matrix assembly and state solving. This mapping method not only simplifies the implementation difficulty of network performance analysis, but also enhances the interpretability of the model - the operation and maintenance personnel can intuitively correspond the network congestion or fault location to the high resistance area in the circuit, improving the efficiency and accuracy of fault location and performance optimization.

[0037] The equivalent circuit model is used to assemble the network admittance matrix, form the admittance relationship between nodes, and combine the actual collected injection flow data to build a current vector, specifically including: Calculate the admittance: , ; wherein, and are the admittances of the links and nodes respectively; converting resistance to admittance facilitates the construction of linear equations; Build the admittance matrix: , , , ; build the node admittance matrix of the circuit ; Calculate the total number of incoming packets and the total number of outgoing packets of node : , ; calculate the net packet inflow / outflow of each node to provide data for the injection vector; Build the injection flow vector ; wherein ; obtain the equivalent "injection current" vector in the circuit.

[0038] ​By automatically converting resistance parameters into admittance values ​​and assembling them into a standard node admittance matrix, and simultaneously constructing a current injection vector based on real-time network packet inflows and outflows, this step effectively solves the problem of loose coupling between the circuit model and the network traffic model. Specifically, firstly, the resistances of each link and node in the equivalent circuit are converted into corresponding admittance parameters according to physical rules, generating a highly automated node admittance matrix that fully reflects the energy exchange relationships between all nodes in the network. Secondly, based on the packet inflow and outflow counts of nodes within the same time window, the net data inflow of each node is calculated and mapped into injection current, forming a current vector that can be directly coupled with the admittance matrix. Combining this admittance matrix and current vector, a set of linear equations can be constructed to accurately describe the real-time state of the network. This process improves the efficiency of the conversion from the circuit model to mathematical solutions, reduces manual intervention and parameter adjustments, and ensures the scientific validity and consistency of the analysis results, providing solid mathematical support for quickly locating network anomalies.

[0039] The process of obtaining the data potential distribution of each node by solving the network equations specifically includes: Constructing linear equations ;in, The node potential vector is used to transform the equivalent circuit problem into a system of linear equations. Constructing a determinant: , ;in, Let be the determinant of the admittance matrix, indicating the solvability of the system; This refers to the determinant operation of a matrix; To be No. Column replacement The determinant after; To be No. Column replacement The matrix after; Calculate the position of a single node ; Explicitly calculate the potential of each node .

[0040] By converting the circuitized network model into a linear equation set and solving it, this step solves the limitations of traditional network state analysis methods that rely on thresholds or empirical rules, and realizes the physical and mathematical characterization of network behavior. Specifically, first, according to the assembled admittance matrix and the injected flow vector, a complete node potential linear equation set is constructed, which directly reflects the energy balance and flow distribution relationship between nodes; second, the solvability of the equation set is ensured through determinant judgment and operation, and high-precision node potential distribution is obtained by using mature numerical solution techniques; finally, the continuous potential value is used as an intuitive indicator of network health status, which can be used to measure the stress level of nodes under the current network load. This method not only eliminates the instability of static threshold setting, but also improves the accuracy and interpretability of anomaly detection, enabling network status to be quantified as a potential value with physical meaning, providing a convincing reference for operation and automation decision-making.

[0041] The baseline model reflecting the normal operation state of the network is established, the network electrical parameters during the baseline period are calculated based on historical data, and deviation analysis is performed on the real-time collected data and the baseline data, specifically including: Let the baseline starting point be , ; wherein, is the baseline period length; is the number of monitoring windows contained in the baseline period, which determines the baseline sample size, and ; determine the period of stable network state for subsequent deviation comparison; effect: determines the baseline sample size, directly affecting the confidence of the mean and the standard deviation . The value size affects: smaller, insufficient sample, large variance of statistical results, unstable threshold; larger, baseline is too long, slow adaptation to system state changes, poor real-time performance. Value basis and suggestion: according to network fluctuation frequency: if the flow / delay periodicity is obvious, take at least one complete cycle; calculation and storage capacity: generally is more balanced, covering enough samples and ensuring response timeliness.

[0042] Calculate the average link resistance during the baseline period ; Calculate the average node resistance during the baseline period ; Calculate the average net inflow during the baseline period ; Obtain the node potential of each node in the baseline state, providing a reference for deviation calculation; Solve the baseline potential: , , ; wherein, is the determinant of the baseline admittance matrix, used for baseline potential solving; is the baseline admittance matrix during the baseline period, averaged by the average resistance , reconstruction; is the determinant of the baseline matrix after replacing a column; is the matrix after replacing the th column of with the baseline injection vector ; is the average data potential of the node during the baseline period; obtaining the potential of each node in the baseline state provides a reference for deviation calculation; calculating the deviation amount of the node potential ; calculating the deviation amount of the link current ; wherein, is the average admittance during the baseline period, ; quantifying the potential and current changes of the current state relative to the baseline.

[0043] By introducing a dynamic baseline model and comparing it with the real-time measured network electrical parameters, this step solves the false positives and false negatives caused by relying on static threshold judgment, and realizes adaptive monitoring of the network operating state. Specifically, first, identify and select the stable operation interval in the network historical data, obtain a sufficient number of monitoring time window samples to ensure the reliability of the baseline statistics; second, calculate the average resistance and net inflow of the links and nodes in this interval, and use the same solving process to obtain the baseline potential distribution, forming the electrical characteristic file under the normal state of the network; then, analyze the differences between the potential and current data collected in the real-time environment and the baseline file, and quantify the deviation amount; finally, introduce normalization processing according to the deviation amount to ensure that the deviation of different dimensions and numerical ranges can be fairly evaluated. This method enables the detection system to dynamically adjust the sensitivity, both capturing sudden abnormalities in time and tolerating periodic fluctuations, improving the accuracy and scope of network security monitoring.

[0044] According to the deviation amount of the node potential and the link current, the abnormal score is calculated by using the normalization method, and the abnormality is judged according to the score result, which specifically includes: normalizing the current deviation ; wherein, is the baseline link current; evaluating the deviation degree of the link current relative to the baseline; normalizing the potential deviation ; evaluating the node potential change rate; calculating the node Total Abnormal Score Combined potential and current deviations to quantify the degree of node anomalies; Calculate the baseline mean of the anomaly scores separately. and standard deviation : , Obtain the baseline mean and fluctuation of the rating distribution to provide a basis for determining the threshold; Set the judgment threshold to ; like Then determine the node Abnormal; if Then determine the node Normal; determine whether it exceeds the normal fluctuation range based on baseline statistics.

[0045] By uniformly normalizing node potential deviations and link current deviations and calculating a comprehensive anomaly score based on this normalization, this step solves the problem that traditional single-factor or static threshold judgments are easily affected by noise and network fluctuations. Specifically, firstly, the deviation values ​​of nodes and links are mapped to the same normalization space, making different physical quantities comparable; secondly, the normalization results are weighted and accumulated according to a unified index to generate a comprehensive score reflecting the degree of node anomaly; then, the anomaly judgment threshold is dynamically set using the mean and standard deviation of the score obtained during the baseline period; finally, the real-time score is compared with the threshold to determine whether the node is abnormal. This method not only takes into account the comprehensive evaluation of different dimensions of indicators, but also automatically adjusts the sensitivity according to the overall network fluctuations, improving the ability to detect weak anomalies while maintaining a low false alarm rate, providing quantitative and interpretable anomaly detection results for operation and maintenance personnel or automated systems.

[0046] Based on the determination results of abnormal nodes, the network anomaly tracing path is explored, and the set of abnormal nodes and their corresponding tracing paths are output, specifically including: Construct a set of abnormal nodes ; Filter out all nodes that are judged to be abnormal; Set mapping function Return node or Record the direct predecessor of the node during tracing; record the predecessor node of each node in the tracing path; For each Perform steps S810 to S820: S810, Initialize weight function And mark all nodes as unvisited; S820, Repeat until all Visited or no unvisited nodes: S821, Select from unvisited nodes smallest node The site has been visited. S822, For each unvisited neighbor Calculate candidate weights ,like Then update , ; Find the path with the least "dissipation" from the abnormal node to the external injection point to achieve source tracing; For each Execution steps S830 to S840: S830, if Then along Reverse to Build path ; S840, Otherwise mark as unreachable; Restore the specific network flow path to guide maintenance and troubleshooting; Output abnormal node set With each path set It includes unreachable indicators; providing accurate and actionable traceability clues for safe operation and maintenance.

[0047] By constructing a node predecessor mapping based on an equivalent circuit model and performing a weighted shortest path search, this step solves the problems of difficult network security tracing and complex and time-consuming path localization. First, nodes identified as abnormal are marked in the circuitized network based on the set of abnormal nodes. Second, weights are assigned to each link and node, and a predecessor node mapping is constructed to record possible traffic propagation directions. Then, a shortest path search strategy is adopted, traversing backward from the abnormal node to the external injection point, prioritizing the path with the smallest weight. Simultaneously, all reachable nodes are traversed, and unreachable areas are marked. Finally, the tracing path corresponding to the abnormal node and the unreachability message are output. This method, combining a physical equivalent model with classical path algorithms, can not only quickly locate the source of security incident propagation but also visualize the root cause chain, shortening response time and improving tracing accuracy, providing strong technical support for emergency response to network security incidents.

[0048] This embodiment also provides a system for a multimodal big data fusion analysis method for network security, including: The data acquisition module is used to acquire network topology information and operational data; The model building module is used to build an equivalent circuit model based on the collected data; The parameter calculation module is used to calculate the equivalent resistance and admittance parameters of links and nodes; Anomaly detection module, configured to generate anomaly scores and make decisions based on the baseline model and deviation analysis; Trace analysis module, configured to perform path exploration in the equivalent circuit model and output anomaly trace results.

[0049] It should be noted that, in this article, the relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment.

[0050] The above is only the preferred embodiment of the present application, it should be noted that, for those skilled in the art, without departing from the technical principles of the present application, a number of improvements and refinements can also be made, which should be considered as the protection scope of the present application.

Claims

1. A cyber-security oriented multi-modal big data fusion analysis method, characterized in that, Comprise: The target network environment is modeled and the external data injection point is identified, forming an abstract representation of the network nodes and their connection relationships; Collecting multi-source heterogeneous data of network links and nodes, based on time window statistics, measuring the data packet flow of each link, and calculating the equivalent resistance parameters of the links and nodes; According to the network topology structure and the equivalent resistance parameters, an equivalent circuit model is constructed to establish the corresponding circuit element association relationship of each node and link in the network; Using the equivalent circuit model, assemble the network admittance matrix, form the admittance relationship between nodes, and construct the current vector combined with the actual collected injection flow data; Solve the network equation set to obtain the data potential distribution of each node; Establish a baseline model reflecting the normal operation state of the network, calculate the network electrical parameters during the baseline period based on historical data, and perform deviation analysis on the real-time collected data and baseline data; According to the deviation amount of node potential and link current, the abnormal score is calculated by normalization method, and the abnormality is judged according to the score result; Based on the judgment result of abnormal nodes, explore the network abnormality tracing path, and output the abnormal node set and the corresponding tracing path.

2. The network security oriented multi-modal big data fusion analysis method according to claim 1, characterized in that, The target network environment is modeled and the external data injection point is identified, forming an abstract representation of the network nodes and their connection relationships, specifically comprising: The total number of firewalls is obtained, denoted as , numbered as ; the total number of network access control systems is obtained, denoted as , numbered as ; the total number of video security exchange access systems is obtained, denoted as , numbered as ; the total number of three-layer switches is obtained, denoted as , numbered as ; wherein ; represents the device in the network, when represents the firewall node, when represents the network access control system, when represents the video security exchange system node, and when represents the three-layer switch node. Constructing a set of links ; elements of the set are ordered pairs representing with directly communicable; Constructing an adjacency matrix : , , ;in, Represents a node and Can it be directly connected? If so... Then the node and It can be directly connected; if Then the node and Direct connection is not possible; Get all the firewall ports that interact with the external network, and form a set ; From initiate a depth or breadth first search, count the number of reachable nodes ; If then for each connected component: if the component contains elements, then supplement the link; otherwise, eliminate the component; Output connected topology: , ; wherein, is a connected graph with a set of nodes and a set of edges .

3. The network security oriented multi-modal big data fusion analysis method of claim 2, wherein, The multi-source heterogeneous data of network links and nodes is collected, based on time window statistics, the data packet flow of each link is measured, and the equivalent resistance parameters of the links and nodes are calculated, specifically comprising: Let the monitoring interval be ; Set the upper limit of the link packet counter to ; Calculate the link packet increment: ; wherein, is a link at time the cumulative number of packets; is the number of packets in the interval; The great resistance is set to ; Link equivalent resistance: ; wherein, is the average transmission delay per packet over the link ; Acquisition node In the number of packets processed within ; the ingress and egress timestamps of the first packet are denoted by ; the packet processing delay ; Node equivalent resistance: ; wherein, is the average processing delay of the node .

4. The network security oriented multi-modal big data fusion analysis method of claim 3, wherein, According to the network topology structure and the equivalent resistance parameters, an equivalent circuit model is constructed to establish the corresponding circuit element association relationship of each node and link in the network, specifically comprising: Let the circuit node be wherein, denotes a reference ground node, which is the zero potential of the circuit. link resistance element: , ; wherein, represents a resistance element connecting and ; is the resistance value of the link ; Node resistance element: , ; wherein, is the connection to the reference ground; is the resistance value of the link . Constructing a circuit netlist .

5. The cyber security oriented multi-modal big data fusion analysis method of claim 4, wherein, Using the equivalent circuit model, assemble the network admittance matrix, form the admittance relationship between nodes, and construct the current vector combined with the actual collected injection flow data, specifically comprising: The conductance is calculated as: , ; where, and are the conductances of the links and nodes, respectively. Constructing the admittance matrix: , , , ; Respective calculation node In Total incoming packet number And total outgoing packet number : ， ； Constructing injection flow vector ; wherein .

6. The cyber security oriented multi-modal big data fusion analysis method of claim 5, wherein, Solve the network equation set to obtain the data potential distribution of each node, specifically comprising: constructing linear equations ; wherein is a node potential vector; Constructing the determinant: , ; where, is the determinant of the admittance matrix; is the determinant operation on a matrix; is the determinant of the matrix after replacing the column with ; is the determinant of the matrix after replacing the column with ; Computing individual node locations .

7. The cyber security oriented multi-modal big data fusion analysis method of claim 6, wherein, The baseline model reflecting the normal operation state of the network is established, the network electrical parameters during the baseline period are calculated based on historical data, and deviation analysis is performed on the real-time collected data and baseline data, specifically comprising: Let the baseline start point be , ; wherein, is the baseline period length; is the number of monitoring windows contained in the baseline period, and ; calculating the average link resistance during the baseline period ; Calculate average node resistance during baseline ; Calculate the average net inflow during the baseline period ; Solve the baseline potential: , , ; where, is the determinant of the baseline admittance matrix; is the baseline admittance matrix during the baseline period, in average resistance , reconstructed; is the determinant of the baseline matrix after replacing a column; is the matrix after replacing the th column of with the baseline injection vector ; is the average data potential of node during the baseline period; Computing node potential bias amount ; Computing a bias quantity for link current ; wherein, is the average admittance during the baseline, .

8. The cyber-security oriented multi-modal big data fusion analysis method of claim 7, wherein, According to the deviation amount of node potential and link current, the abnormal score is calculated by normalization method, and the abnormality is judged according to the score result, specifically comprising: Normalized current deviation ; wherein, Ibase is the baseline link current; Normalized potential deviation ; Computing node Sum of abnormal scores ; Calculate the baseline mean of the abnormal scores and standard deviation respectively ， ； The determination threshold is set to ; If then decision node abnormal; if then decision node normal. 9.The network security oriented multi-modal big data fusion analysis method of claim 8, wherein, Based on the judgment result of abnormal nodes, explore the network abnormality tracing path, and output the abnormal node set and the corresponding tracing path, specifically comprising: Constructing a set of abnormal nodes ; Setting a mapping function , return the node or , record the immediate predecessor when tracing the node For each , steps S810 to S820 are executed: S810, initialize the weight function ; and mark all nodes as unvisited; S820, repeat until all Visited or no unvisited nodes: S821, select from the unvisited nodes the one with the smallest node , mark as visited; S822, for each unvisited neighbor Compute candidate weights , if , then update , ; for each Steps S830 to S840 are executed. S830、if then along reverse to build path ; S840, otherwise mark unreachable; Output abnormal node set With each path set , containing unreachable identifiers.

10. A system employing the network security oriented multi-modal big data fusion analysis method of claim 9, characterized in that, Comprise: Data acquisition module, for acquiring network topology information and running data; Model construction module, for constructing an equivalent circuit model based on the collected data; Parameter calculation module, for calculating the equivalent resistance and admittance parameters of the links and nodes; Abnormality detection module, for generating abnormal score and making judgment based on baseline model and deviation analysis; Trace analysis module, for performing path exploration in the equivalent circuit model and outputting abnormality tracing result.

Images