Intelligent response strategy adaptive generation method and system

Abstract

The invention discloses an intelligent response strategy adaptive generation method and system, and relates to the technical field of network security. The method comprises the following steps: calling an information confrontation sample, and mining a causal chain set based on a network attack scene; according to the causal chain set, constructing a strategy generator and deploying the strategy generator in a network security center; the method comprises the following steps: performing real-time operation monitoring by taking a network attack element as an identification target, triggering a strategy generator, executing a multi-step decision, and determining a target response strategy, the multi-step decision comprising first causal matching of the triggering of the network attack element and the response strategy, and second judgment positioning based on strategy fitness; third combination optimization based on strategy point combination optimization; and performing network security management according to the target response strategy. The technical problem that in the prior art, network attack response strategy generation depends on a static rule, and consequently the response strategy is not accurate and effective enough is solved, and the technical effects that the self-adaptive response strategy is intelligently generated through multi-step decision making, and the network security protection effect is improved are achieved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to an intelligent response strategy adaptive generation method and system. Background Technology

[0002] As cyberattacks become increasingly complex and covert, traditional cybersecurity response strategies typically rely on static rules and manually pre-defined schemes for matching and execution. This static, passive defense approach often fails to dynamically adjust strategies based on the attack context when facing new, advanced persistent threats (APTs) or multi-stage chain attacks. This results in inaccurate and ineffective response strategies, leading to issues such as response delays, policy mismatches, or overreactions. Especially when attacks exhibit causal relationships and multi-path propagation, the lack of systematic modeling and utilization of attack causal chains makes existing response strategies ill-suited to the security needs of complex network environments. Summary of the Invention

[0003] This application provides an intelligent response strategy adaptive generation method and system, which solves the technical problem that the generation of network attack response strategies in the prior art relies on static rules, resulting in response strategies that are not accurate and effective enough.

[0004] A first aspect of this application provides an adaptive generation method for intelligent response strategies, the method comprising: Information adversarial samples are retrieved to mine causal chain sets based on network attack scenarios; based on the causal chain sets, a policy generator is constructed and deployed in the network security center; real-time monitoring is performed with network attack elements as identification targets, triggering the policy generator to execute multi-step decision-making for network attack scenario matching and response strategies, and determining the target response strategy. The multi-step decision-making includes a first causal matching of network attack element triggering and response strategies, a second judgment and positioning based on policy fitness, and a third combination optimization based on policy point combination optimization; network security management is performed based on the target response strategy.

[0005] A second aspect of this application provides an intelligent response strategy adaptive generation system, the system comprising: The system comprises the following modules: a data mining module, a policy generator, and a management module. The mining module retrieves adversarial samples and mines causal chains based on network attack scenarios. The generator construction module constructs a policy generator based on these causal chains and deploys it in the network security center. The policy determination module monitors network attack elements in real time, triggers the policy generator, executes multi-step decision-making for network attack scenario matching and response strategies, and determines the target response strategy. The multi-step decision-making includes a first causal matching of network attack element triggering and response strategies, a second judgment based on policy fitness, and a third combination optimization based on policy point combination optimization. The management module performs network security management based on the target response strategy.

[0006] One or more technical solutions provided in this application have at least the following technical effects or advantages: First, adversarial information samples are retrieved to mine causal chains based on network attack scenarios. Next, a policy generator is constructed and deployed in the network security center based on these causal chains. Then, real-time monitoring is performed using network attack elements as identification targets, triggering the policy generator to execute multi-step decision-making for network attack scenario matching and response strategies, determining the target response strategy. This multi-step decision-making includes a first causal matching based on the triggering and response strategies of network attack elements, a second judgment based on policy fitness, and a third combination optimization based on policy point combination optimization. Finally, network security management is performed based on the target response strategy. This solves the technical problem in existing technologies where network attack response strategy generation relies on static rules, leading to inaccurate and ineffective response strategies. It achieves the technical effect of improving network security protection by intelligently generating adaptive response strategies through multi-step decision-making. Attached Figure Description

[0007] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0008] Figure 1 This is a schematic diagram of the intelligent response strategy adaptive generation method provided in the embodiments of this application; Figure 2 A schematic diagram of the intelligent response strategy adaptive generation system provided in the embodiments of this application.

[0009] Figure labeling: Mining module 11, Generator construction module 12, Strategy determination module 13, Management module 14. Detailed Implementation

[0010] This application solves the technical problem in the prior art where the generation of network attack response strategies relies on static rules, resulting in inaccurate and ineffective response strategies, by providing an intelligent response strategy adaptive generation method and system.

[0011] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0012] It should be noted that the terms "comprising" and "having" are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or server that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or modules that are not explicitly listed or that are inherent to these processes, methods, products, or devices.

[0013] Example 1, as Figure 1 As shown, this application provides an adaptive generation method for intelligent response strategies, wherein the method includes: Retrieve adversarial samples and mine causal chain sets based on network attack scenarios.

[0014] Information adversarial samples are retrieved from network security logs, intrusion detection systems (IDS), attack simulation platforms, or historical attack and defense drills. These samples include attacker behavior logs, attack path sequences, attack payload characteristics, target response status, and related contextual information.

[0015] Based on network attack scenarios, unsupervised clustering algorithms (such as DBSCAN or K-Means) are used to cluster adversarial examples into scenarios, identifying N representative scenario adversarial examples. For each group of scenario adversarial examples, a directed graph-based causal inference model (such as causal Bayesian networks, Granger causality analysis, or structural causality model SCM) is employed to extract the causal dependency path between attack behavior and system response, constructing corresponding causal chains. Each causal chain consists of several stage nodes, where nodes represent the causal relationship between attack behavior elements and response events. Finally, the N groups of causal chains are unified into a causal chain set.

[0016] Furthermore, retrieving adversarial samples and mining causal chains based on network attack scenarios includes: For the aforementioned adversarial samples, sample clustering is performed based on network attack scenarios to determine N scenario adversarial samples; based on the N scenario adversarial samples, N sets of causal chains are mined; the N sets of causal chains are added to the causal chain set.

[0017] Specifically, based on attack behavior characteristics (such as attack entry point, propagation method, attack stage, target object, etc.) and scenario context information, adversarial samples are preprocessed to extract structured attack element sequences. Then, sample clustering methods based on network attack scenario semantics, such as vector clustering based on cosine similarity, graph neural network clustering, or semantic embedding clustering, are used to identify N different scenario adversarial samples, each representing a typical attack path and response process. For each scenario adversarial sample, based on the time series and behavioral triggering relationship between attack events and system responses, N sets of causal chains are constructed using causal chain mining algorithms (such as algorithms based on causal graph modeling, Granger causality testing, or structured causal models). Each causal chain consists of multiple stage nodes, and the relationships between nodes reflect the causal dependency between attack elements and response strategies. Finally, the N sets of causal chains are uniformly organized and added to a causal chain set.

[0018] Furthermore, the causal chain includes at least one stage node based on the network attack scenario, with network attack elements as the cause and response strategies as the effect. The attack elements are weighted based on element specificity, and the response strategy includes at least one spatiotemporal defense node, with each defense node corresponding to at least one micro-response strategy.

[0019] A causal chain contains at least one stage node based on a network attack scenario, used to describe the key triggering and response relationships of an attack event in different time series or logical stages. Each causal chain uses a network attack element as the cause and a response strategy as the effect, forming a causal path between attack and response. The network attack element includes, but is not limited to, the attack source IP, attack payload type, attack stage identifier (such as initial penetration, lateral movement, privilege escalation, etc.), and attack behavior characteristics (such as abnormal traffic, abnormal system calls, process injection, etc.).

[0020] The response strategy includes at least one spatiotemporally specific defense node. Each defense node corresponds to a specific response location (such as the host side, border gateway, application layer, etc.) and response timing (such as immediate response, delayed response, continuous monitoring, etc.) to implement specific defense actions. Each defense node is associated with at least one micro-response strategy, such as IP blocking, session interruption, access control adjustment, traffic redirection, sandbox isolation, or policy rollback, to achieve granular dynamic defense execution.

[0021] Based on the causal chain set, a policy generator is constructed and deployed in the network security center.

[0022] In the construction of the policy generator, based on the "attack element-defense node-micro response policy" path in the causal chain, the three core decision nodes of the policy generator are constructed in a modular manner: the first causal matching node is constructed, which, based on the attack element field in the causal chain, realizes the initial matching of the scenario attribution and policy triggering of the input attack event through embedding vector matching or feature template matching; the second judgment and positioning node is constructed, which, based on the fitness evaluation mechanism of the response policy, locates and marks the policy points with low fitness or that do not conform to the characteristics of the current network environment in the initial matching policy; the third combinatorial optimization node is constructed, which uses combinatorial optimization algorithms (such as genetic algorithms, reinforcement learning or greedy policies) to recombine and optimize the located policy points to obtain the optimal response policy combination in the current context.

[0023] Furthermore, based on the set of causal chains, a policy generator is constructed, including: A first causal matching node is constructed by incorporating the causal chain set; the first causal matching node is then trained under supervision until convergence by integrating the adversarial information examples.

[0024] The causal chain set is embedded in the knowledge structure of the policy generator as the underlying support for policy generation and matching logic. Specifically, based on the causal chain set, a first causal matching node is constructed. The first causal matching node is used to identify and match input attack elements. After receiving network attack detection data, it can parse it and project it into the causal chain space to quickly determine the attack scenario path that is most similar or has the highest correlation with it.

[0025] The first causal matching node is trained under supervision by integrating adversarial examples. Specifically, attack feature sequences are extracted from the adversarial examples as input samples, and manually labeled or historical response strategies are used as supervisory labels. The node is trained using a supervised learning model (such as a multilayer perceptron (MLP), convolutional neural network (CNN), or graph neural network (GNN). During training, the deviation between the model output and the true label is evaluated using a loss function (such as cross-entropy or mean squared error), and parameters are continuously optimized using backpropagation and gradient descent mechanisms until the model reaches convergence conditions (such as the loss decreasing to a preset threshold or the accuracy on the validation set stabilizing). After training, the first causal matching node is able to identify unknown attack elements and can serve as the first decision module in the policy generation process to achieve rapid scene matching.

[0026] Furthermore, based on the set of causal chains, a policy generator is constructed, including: A second judgment and location node is constructed based on the degree of freedom of the attack elements, wherein the second judgment and location node is used to locate strategy points that are below a preset fitness; a third combination optimization node is constructed based on the combination optimization of strategy points; and a strategy generator is constructed based on the first causal matching node, the second judgment and location node and the third combination optimization node.

[0027] Based on the completion of the first causal matching node, the second judgment and positioning node and the third combination optimization node are further designed and integrated to realize the fitness evaluation and optimization reconstruction of the initial response strategy.

[0028] The second judgment and positioning node is used to judge and locate policy points with fitness scores below a preset threshold. When constructing the second judgment and positioning node, the degrees of freedom of attack elements are used as fluctuation variables; that is, the policy adaptation range is adjusted according to the degree of change of attack elements (such as attack path variability, attack source diversity, and attack phase ambiguity). The second judgment and positioning node receives the initial response policy output by the first causal matching node and, combined with current network environment parameters and historical policy effect data, scores the fitness of each policy point (i.e., the key decision position in the policy path). When the fitness scores of certain policy points are lower than a set threshold, they are identified as objects to be optimized and marked and located in the policy path, providing input for subsequent optimization processes.

[0029] The third combinatorial optimization node is used to optimize the combination of already located policy points. Based on the replaceable set of policy points, the third combinatorial optimization node constructs a policy combination space and introduces heuristic search algorithms (such as genetic algorithms, particle swarm optimization, reinforcement learning, or Monte Carlo tree search) to perform an iterative combinatorial optimization process within the feasible policy space to find policy combinations that are more responsive and effective in the current attack scenario.

[0030] The first causal matching node, the second judgment and positioning node, and the third combination optimization node are integrated into a strategy generator.

[0031] Furthermore, the first causal matching node is migrated and called, and based on the node output, the cascade training of the second judgment and positioning node and the third combination optimization node is performed to determine the policy generator.

[0032] After completing the supervised training of the first causal matching node, its network parameters and inference model are used as a pre-defined sub-module in the policy generator in a transfer learning manner. During actual operation, this sub-module receives attack element inputs from an intrusion detection system or event monitoring platform and outputs an initial response policy path and related scenario identification information. Based on this, the output of the first causal matching node is used as the training input for the second judgment and localization node and the third combined optimization node, executing a cascaded training process. Cascaded training refers to using the output of the first node as dynamic input for the training of subsequent nodes, constructing a linked optimization mechanism that allows subsequent nodes to perform end-to-end optimization adjustments based on real policy matching results and policy fitness feedback. Specifically, the initial policy path and attack scenario label output by the first causal matching node are used as input and passed to the second judgment and localization node. Based on the current network environment or historical defense feedback data, each policy point in the policy path is scored, and the second judgment and localization node is trained to identify low-fitness policy points. The localization result output by the second node is used as input and passed to the third combination optimization node. Combining the policy candidate set and the effect evaluation function, the node is trained to generate the optimal policy sequence in the policy combination space. By the deviation between the policy output and the preset target policy effect, an end-to-end joint loss function is constructed, and the gradient of the second and third nodes is updated synchronously until the set convergence criterion is reached on the validation set.

[0033] The system performs real-time monitoring with network attack elements as the identification target, triggers the policy generator, executes multi-step decision-making for network attack scenario matching and response strategies, and determines the target response strategy. The multi-step decision-making includes a first causal matching of network attack element triggering and response strategies, a second judgment and positioning based on policy fitness, and a third combination optimization based on policy point combination optimization.

[0034] The real-time operational monitoring module deployed in the network security center receives real-time security event streams from multiple security components (including Intrusion Detection Systems (IDS), Host Monitoring Systems (HIDS), perimeter firewall logs, SIEM platforms, etc.) and analyzes and extracts the attack behavior characteristics contained therein. Attack elements include, but are not limited to, the attack source IP, the destination port, the attack type (such as SQL injection, lateral movement, denial of service), the attack path, the tools used, and the execution sequence.

[0035] After the attack elements are identified and standardized, the execution process of the policy generator is triggered. Once started, the policy generator dynamically generates and outputs response policies according to a preset multi-step decision structure. Specifically, using the identified attack elements as input, it calls the first causal matching node to match the attack scenarios in the causal chain set, determines the typical attack scenario path to which the current attack behavior belongs, and outputs an initial response policy accordingly. The initial response policy is then input to the second judgment and positioning node, which, based on a policy fitness evaluation mechanism (considering factors such as the current network structure state, existing defense configuration, and historical response effects), determines whether each policy point meets the current protection requirements. If there are identified low-fitness policy points, the third combination optimization node is triggered. Under the current attack scenario, it calls the policy point candidate library to perform combined iterative optimization of the policy points, outputting a more adaptable target response policy.

[0036] Furthermore, the multi-step decision-making process for implementing network attack scenario matching and response strategies includes: If network attack elements are detected, the target attack scenario is located by performing element attribution matching based on the network attack scenario according to the first causal matching node; the initial response strategy is determined by performing causal matching according to the target attack scenario; the initial response strategy is judged and the strategy point is located according to the second judgment and location node with a preset fitness as a constraint, and the location strategy point is determined; if the location strategy point is an empty set, the initial response strategy is used as the target response strategy.

[0037] When network attack elements are detected in real time, scenario-level identification is performed based on the first causal matching node. Specifically, based on the pre-built attack scenario causal chain set, the target attack scenario is accurately located by matching the characteristics of the input attack elements with the attack stage nodes in the causal chain (such as feature pattern similarity, attack path matching degree, time series similarity, etc.).

[0038] Based on the identified target attack scenario, causal path deduction is performed on the corresponding causal chain to invoke the corresponding response policy path and determine the initial response policy for the current scenario. The initial response policy is a default defense path trained based on historical adversarial samples, typically including several policy points (such as isolating hosts, blocking communication, rule adjustment, rate limiting policies, etc.) and their execution order. The initial response policy is input to the second judgment and positioning node for fitness evaluation; with a preset fitness threshold as a constraint, the second judgment and positioning node evaluates each policy point in the policy path one by one, comprehensively considering factors such as the current network structure status, available resources, and historical defense effect feedback, to calculate the fitness score of each policy point. If it is lower than the threshold, it is determined to be a policy point that needs optimization and is located. If the set of located policy points is empty in the evaluation result, it means that the initial response policy has sufficient response adaptability in the current environment and does not require further optimization. In this case, the initial response policy is directly used as the target response policy for subsequent policy issuance and network security management execution.

[0039] Furthermore, if the positioning strategy point is not empty, the third combination optimization node is triggered to perform optimization iteration under the combination of positioning strategy points to determine the optimization strategy point; based on the optimization strategy point, the initial response strategy is replaced to determine the target response strategy.

[0040] If the location strategy point is not empty, it indicates that there is a strategy point in the initial response strategy that does not meet the requirements of the current network environment. At this time, the third combination optimization node is automatically triggered to perform optimization iteration under the combination of location strategy points to determine the optimal strategy point. Specifically, the combination optimization node takes the location strategy point as the optimization target and searches for the optimal strategy alternative combination by performing multiple rounds of strategy recombination and performance evaluation in the strategy point candidate set.

[0041] Optionally, for each location strategy point, a set of alternative strategies that meet the same response objective is retrieved from the strategy knowledge base to form a candidate strategy point set. The candidate strategy points include defense action configuration parameters of different dimensions (such as isolation method, blocking range, execution sequence, etc.). Based on the candidate strategy point set, multiple sets of strategy point combination schemes are constructed and quickly evaluated through the strategy effect simulation module. According to the scoring results of each combination strategy, the set of optimized strategy points with the highest comprehensive score is selected as the alternative to the original location strategy point. The optimized strategy points replace the corresponding strategy point positions in the original initial response strategy to form the updated complete response strategy path, and the final target response strategy is determined.

[0042] Network security management is carried out in accordance with the target response strategy.

[0043] Based on the target response policy, the network security center issues commands and executes protection measures, driving the corresponding defense control components to complete policy deployment in sequence according to the policy points defined in the policy path.

[0044] Furthermore, after conducting network security management according to the target response strategy, it includes: As the target response strategy is executed, response monitoring and bias determination are performed simultaneously; if the response direction bias or response vector deviation is greater than the preset deviation amount, non-directional early warning and feedback adjustment of the strategy are executed.

[0045] Throughout the entire process of executing the target response strategy, the system synchronously activates the response monitoring module to track the strategy execution effect in real time and determine the bias of the response direction and response vector. Response direction bias refers to the deviation of the actual defensive behavior after strategy execution from the original designed protection target or response path. For example, the actual blocking direction may differ from the expected target communication path, or the main defense node may not be triggered. Response vector bias, on the other hand, refers to a significant deviation between the changes in key system parameters (such as CPU load, network traffic, and number of session connections) caused by strategy execution and the expected impact of the strategy.

[0046] By evaluating the response direction bias and response vector deviation, a non-directional early warning mechanism is triggered when either deviation exceeds a preset threshold, issuing a risk alert via the security center interface or API. Simultaneously, the system activates a feedback adjustment mechanism to make local adjustments to the original response strategy based on the current deviation information. This includes, but is not limited to, fine-tuning strategy point priorities, dynamically switching strategy execution paths, or rapidly switching to backup response strategies, ensuring the stability of the defense effect and optimal utilization of system resources.

[0047] In summary, the embodiments of this application have at least the following technical effects: First, adversarial information samples are retrieved to mine causal chains based on network attack scenarios. Next, a policy generator is constructed and deployed in the network security center based on these causal chains. Then, real-time monitoring is performed using network attack elements as identification targets, triggering the policy generator to execute multi-step decision-making for network attack scenario matching and response strategies, determining the target response strategy. This multi-step decision-making includes a first causal matching based on the triggering and response strategies of network attack elements, a second judgment based on policy fitness, and a third combination optimization based on policy point combination optimization. Finally, network security management is performed based on the target response strategy. This solves the technical problem in existing technologies where network attack response strategy generation relies on static rules, leading to inaccurate and ineffective response strategies. It achieves the technical effect of improving network security protection by intelligently generating adaptive response strategies through multi-step decision-making.

[0048] Example 2, based on the same inventive concept as the intelligent response strategy adaptive generation method in the foregoing examples, such as... Figure 2 As shown, this application provides an intelligent response strategy adaptive generation system, wherein the system includes: Mining Module 11: Retrieves adversarial samples to mine causal chain sets based on network attack scenarios; Generator Construction Module 12: Constructs a policy generator based on the causal chain sets and deploys it in the network security center; Policy Determination Module 13: Performs real-time monitoring with network attack elements as the identification target, triggers the policy generator, executes multi-step decision-making for network attack scenario matching and response strategies, and determines the target response strategy. The multi-step decision-making includes a first causal matching based on the triggering and response strategies of network attack elements, a second judgment and positioning based on policy fitness, and a third combination optimization based on policy point combination optimization; Management Module 14: Performs network security management based on the target response strategy.

[0049] Furthermore, the mining module 11 is used to perform the following methods: For the aforementioned adversarial samples, sample clustering is performed based on network attack scenarios to determine N scenario adversarial samples; based on the N scenario adversarial samples, N sets of causal chains are mined; the N sets of causal chains are added to the causal chain set.

[0050] Furthermore, the mining module 11 is used to perform the following methods: The causal chain includes at least one stage node based on a network attack scenario, with network attack elements as the cause and response strategies as the effect. The attack elements are weighted based on element specificity, and the response strategy includes at least one spatiotemporal defense node, with each defense node corresponding to at least one micro-response strategy.

[0051] Furthermore, the generator building module 12 is used to perform the following methods: A first causal matching node is constructed by incorporating the causal chain set; the first causal matching node is then trained under supervision until convergence by integrating the adversarial information examples.

[0052] Furthermore, the generator building module 12 is used to perform the following methods: A second judgment and location node is constructed based on the degree of freedom of the attack elements, wherein the second judgment and location node is used to locate strategy points that are below a preset fitness; a third combination optimization node is constructed based on the combination optimization of strategy points; and a strategy generator is constructed based on the first causal matching node, the second judgment and location node and the third combination optimization node.

[0053] Furthermore, the generator building module 12 is used to perform the following methods: The first causal matching node is migrated and called. Based on the node output, the second judgment and positioning node and the third combination optimization node are cascaded and trained to determine the policy generator.

[0054] Furthermore, the strategy determination module 13 is used to perform the following method: If network attack elements are detected, the target attack scenario is located by performing element attribution matching based on the network attack scenario according to the first causal matching node; the initial response strategy is determined by performing causal matching according to the target attack scenario; the initial response strategy is judged and the strategy point is located according to the second judgment and location node with a preset fitness as a constraint, and the location strategy point is determined; if the location strategy point is an empty set, the initial response strategy is used as the target response strategy.

[0055] Furthermore, the strategy determination module 13 is used to perform the following method: If the positioning strategy point is not empty, the third combination optimization node is triggered to perform optimization iteration under the combination of positioning strategy points to determine the optimization strategy point; based on the optimization strategy point, the initial response strategy is replaced to determine the target response strategy.

[0056] Furthermore, the management module 14 is used to perform the following methods: As the target response strategy is executed, response monitoring and bias determination are performed simultaneously; if the response direction bias or response vector deviation is greater than the preset deviation amount, non-directional early warning and feedback adjustment of the strategy are executed.

[0057] It should be noted that the order of the embodiments described above is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. Furthermore, the above description focuses on specific embodiments of this specification. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired results. In some implementations, multitasking and parallel processing are possible or may be advantageous.

[0058] The above description is only a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the protection scope of this application.

[0059] This specification and accompanying drawings are merely illustrative examples of this application and are intended to cover any and all modifications, variations, combinations, or equivalents within the scope of this application. Clearly, those skilled in the art can make various alterations and modifications to this application without departing from its scope. Therefore, if such modifications and modifications fall within the scope of this application and its equivalents, this application intends to include such modifications and modifications.

Claims

1. An adaptive generation method for intelligent response strategies, characterized in that, The method includes: Retrieve adversarial samples and mine causal chain sets based on network attack scenarios; Based on the causal chain set, a policy generator is constructed and deployed in the network security center; The system performs real-time monitoring with network attack elements as the identification target, triggers the policy generator, executes multi-step decision-making for network attack scenario matching and response strategies, and determines the target response strategy. The multi-step decision-making includes a first causal matching of the triggering and response strategies of network attack elements, a second judgment and positioning based on policy fitness, and a third combination optimization based on policy point combination optimization. Network security management is carried out in accordance with the target response strategy.

2. The intelligent response strategy adaptive generation method as described in claim 1, characterized in that, Retrieve adversarial samples and mine causal chain sets based on network attack scenarios, including: For the aforementioned adversarial samples, sample clustering is performed based on network attack scenarios to determine N scenario adversarial samples; Based on the N adversarial examples in the scenarios, N sets of causal chains are mined; Add the N sets of causal chains to the causal chain set.

3. The intelligent response strategy adaptive generation method as described in claim 2, characterized in that, The causal chain includes at least one stage node based on a network attack scenario, with network attack elements as the cause and response strategies as the effect. The attack elements are weighted based on element specificity, and the response strategy includes at least one spatiotemporal defense node, with each defense node corresponding to at least one micro-response strategy.

4. The intelligent response strategy adaptive generation method as described in claim 1, characterized in that, Based on the causal chain set, a policy generator is constructed, including: The first causal matching node is constructed by building the causal chain set; By integrating the aforementioned adversarial examples, the first causal matching node is subjected to supervised training until convergence.

5. The intelligent response strategy adaptive generation method as described in claim 4, characterized in that, Based on the causal chain set, a policy generator is constructed, including: Using the degrees of freedom of the attack elements as fluctuations, a second judgment and positioning node is constructed, wherein the second judgment and positioning node is used to locate strategy points that are below a preset fitness. By combining and optimizing strategy points, a third combination optimization node is constructed; A strategy generator is constructed based on the first causal matching node, the second judgment and positioning node, and the third combination optimization node.

6. The intelligent response strategy adaptive generation method as described in claim 5, characterized in that, The first causal matching node is migrated and called. Based on the node output, the second judgment and positioning node and the third combination optimization node are cascaded and trained to determine the policy generator.

7. The intelligent response strategy adaptive generation method as described in claim 5, characterized in that, The multi-step decision-making process for implementing network attack scenario matching and response strategies includes: If network attack elements are detected, the target attack scenario is located by performing element attribution matching based on the network attack scenario, according to the first causal matching node. Based on the target attack scenario, an initial response strategy is determined by causal matching. Based on the second judgment and positioning node, and with a preset fitness as a constraint, the initial response strategy is judged and the strategy point is located to determine the positioning strategy point; If the location strategy points are an empty set, the initial response strategy will be used as the target response strategy.

8. The intelligent response strategy adaptive generation method as described in claim 7, characterized in that, If the positioning strategy point is not empty, the third combination optimization node is triggered to perform optimization iteration under the combination of positioning strategy points and determine the optimization strategy point. Based on the optimization strategy points, the initial response strategy is replaced to determine the target response strategy.

9. The intelligent response strategy adaptive generation method as described in claim 1, characterized in that, After performing network security management according to the target response strategy, the following is included: Response monitoring and bias determination are performed simultaneously as the target response strategy is executed; If either the response direction bias or the response vector deviation is greater than the preset deviation, the non-directional early warning and feedback adjustment of the execution strategy will be implemented.

10. An intelligent response strategy adaptive generation system, characterized in that, The system is used to implement the intelligent response strategy adaptive generation method according to any one of claims 1-9, the system comprising: Mining module: retrieves adversarial samples and mines causal chain sets based on network attack scenarios; Generator building module: Based on the causal chain set, build a policy generator and deploy it in the network security center; Strategy determination module: Real-time monitoring is performed with network attack elements as the identification target, triggering the strategy generator to perform multi-step decision-making on network attack scenario matching and response strategies, and determining the target response strategy. The multi-step decision-making includes a first causal matching based on the triggering and response strategies of network attack elements, a second judgment and positioning based on strategy fitness, and a third combination optimization based on strategy point combination optimization. Management module: Performs network security management based on the target response strategy.

Images