Optimization Methods for Deep Cybersecurity Data Protection Strategies Integrating Behavioral Analysis

Abstract

This invention discloses a method for optimizing deep network security data protection strategies based on integrated behavioral analysis, belonging to the field of network security data protection technology. The method includes the following steps: First, by constructing an access behavior time mapping table, the resource identifier, access timestamp, and access frequency of each access behavior are converted into a three-dimensional quantitative vector. Access behaviors with the same resource identifier and access frequencies below a set threshold in different time periods are aggregated and matched to determine the characteristics of multiple low-frequency interleaved access behaviors targeting the same resource object within non-contiguous time periods. Based on the determined characteristics of multiple low-frequency interleaved access behaviors, a cross-cycle risk assessment path with continuity and contextual relevance is constructed using time series backtracking, resource object merging strategies, and contextual semantic nesting mechanisms. This invention solves the problem of difficulty in identifying low-frequency interleaved attack behaviors and realizes intelligent optimization of cross-cycle risk modeling and protection strategies.

Description

Technical Field

[0001] This invention relates to the field of network security data protection technology, and more specifically to a method for optimizing deep network security data protection strategies by integrating behavioral analysis. Background Technology

[0002] Deep network security data protection strategy optimization integrating behavioral analysis refers to a comprehensive network security technology that dynamically adjusts and intelligently optimizes data protection strategies by modeling and analyzing multi-dimensional behavioral data such as user behavior, system behavior, and potential attacker behavior, and combining this with deep learning technology for feature extraction, pattern recognition, and threat perception of massive amounts of network data. Existing technologies typically involve deploying log collection modules, traffic analyzers, or sensor nodes to collect user operation logs, access behaviors, and system response information in real time. Behavioral analysis algorithms (such as clustering, anomaly detection, and frequency analysis) are then used to construct behavioral profiles, and these behavioral features are input into deep neural network models, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), or attention mechanism models, to identify potential threats and detect abnormal behavior. Based on the model output, a security policy optimization module, combined with a rule engine or reinforcement learning strategy, automatically generates or adjusts access control policies, firewall rules, and data encryption measures to address different types of security threats. The entire process generally includes six key stages: behavioral data collection, behavioral feature extraction, deep model analysis, security event identification, policy matching and optimization, and feedback adjustment. These stages form a closed-loop intelligent security protection system, enabling precise protection of data assets and dynamic policy adaptation, thereby improving the response speed and defense accuracy of network security systems against complex attack behaviors.

[0003] The existing technology has the following shortcomings:

[0004] When attack behaviors are deliberately broken down into multiple non-contiguous time periods, and each behavior accesses the same logical resource in a low-frequency, low-speed manner, the system processes these behaviors within different time windows. Because the behavioral characteristics of each access segment are locally within the "normal range," the system cannot establish cross-temporal correlations during behavioral modeling and deep analysis. Consequently, the policy optimization mechanism only executes default allow policies based on local low-risk outputs. Existing deep network security data protection policy optimization technologies that integrate behavioral analysis cannot construct cross-cycle risk assessment paths with continuity and contextual correlation based on the characteristics of multiple low-frequency, interleaved access behaviors to the same resource object within non-contiguous time periods. This prevents the generation of corresponding protection policies, leading to the gradual formation of attack chains over long periods without being identified. Ultimately, this results in missing policy responses, underestimated attack risks, and serious security risks such as data penetration, exposure of core assets, and overall failure of the policy system.

[0005] The information disclosed in the background section is only intended to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0006] The purpose of this invention is to provide a method for optimizing deep network security data protection strategies by integrating behavioral analysis, so as to solve the problems in the background art mentioned above.

[0007] To achieve the above objectives, the present invention provides the following technical solution: a method for optimizing deep network security data protection strategies by integrating behavioral analysis, specifically including the following steps:

[0008] S1. By constructing an access behavior time mapping table, the resource identifier, access timestamp and access frequency of each access behavior are converted into a three-dimensional quantitative vector. Access behaviors with the same resource identifier and access frequency below a set threshold in different time periods are aggregated and matched to determine the characteristics of multiple low-frequency interleaved access behaviors for the same resource object in non-continuous time periods.

[0009] S2. Based on the identified characteristics of multiple low-frequency interleaved access behaviors, a cross-cycle risk assessment path with continuity and contextual relevance is constructed using time series backtracking, resource object merging strategies, and contextual semantic nesting mechanisms.

[0010] S3. Using the constructed cross-cycle risk assessment path as input, a graph neural network and residual attention structure are used to generate path behavior aggregation parameters to characterize the logical strength of the access nodes within the path and the degree of anomaly of cross-time jumps.

[0011] S4. Construct a nonlinear mapping relationship based on path behavior aggregation parameters, output risk score values, and optimize the generation of three types of protection strategies: transparent record, enhanced verification, and frozen operation by comparing risk level judgment thresholds.

[0012] S5. Update the weight parameters of the nonlinear mapping relationship and the risk level judgment threshold based on the execution results of the protection strategy, and dynamically adjust the node relationship strength in the cross-cycle risk assessment path to achieve continuous optimization of the protection strategy.

[0013] Preferably, S1 is as follows:

[0014] By collecting raw log data of access behavior, the resource identifier, access timestamp and access frequency of each access behavior are extracted, and an access behavior time mapping table is constructed, with the resource identifier as the key indexing the corresponding access time and access frequency.

[0015] The resource identifier, access timestamp, and access frequency in the access behavior time mapping table are constructed into a three-dimensional quantitative vector. The access timestamp is numerically normalized according to a continuous time window, the access frequency is linearly mapped according to a set interval, and the resource identifier is vectorized through a unique encoding rule.

[0016] Based on all three-dimensional quantitative vectors, access behaviors with the same resource identifier and access frequency below a set threshold are identified in different time periods. By calculating the time interval between adjacent access behaviors, access behavior sequences with time intervals greater than the minimum non-continuous time threshold are aggregated and matched to determine the characteristics of multiple low-frequency interleaved access behaviors for the same resource object in non-continuous time periods. These multiple low-frequency interleaved access behavior characteristics are composed of time interval span, access frequency stability and resource identifier consistency, and are used to reflect the behavior pattern of attack behavior continuously acting on a single logical resource in a low-intensity manner across periods.

[0017] Preferably, S2 is as follows:

[0018] Based on the identified characteristics of multiple low-frequency interleaved access behaviors, access behaviors with the same resource identifier are arranged in ascending order by access timestamp. The backtracking time window length is set based on each set of access behavior sequences. The access behavior set covering multiple non-continuous time periods is extracted through time series backtracking operation, and an access behavior time linked list is constructed to represent the cross-period distribution state of access behaviors in the time dimension.

[0019] Based on the resource identifier corresponding to each access behavior in the access behavior time chain, a resource object merging strategy is executed using resource path structure similarity, namespace hierarchy mapping and visitor identifier consistency. The resource identifiers are normalized and a resource object logical graph is constructed, so that logically adjacent but differently encoded resource identifiers establish directed connection relationships in the graph, thereby realizing semantic integration between resources.

[0020] Based on the access behavior time chain and resource object logic graph, and based on the temporal sequence of access behaviors and the semantic continuity of resource identifiers, a context semantic nesting mechanism is invoked to combine access behaviors with consistent access frequency distribution patterns, strong repetition of access path structures, and unified namespaces of access targets into context nesting units. All context nesting units are then connected in chronological order to construct a cross-cycle risk assessment path with continuity and contextual relevance, which is used to characterize the fusion characteristics of attack behaviors across time spans and resource logic chains.

[0021] Preferably, S3 specifically includes the following steps:

[0022] S301. The constructed cross-cycle risk assessment path is transformed into graph structure data, in which each access node constructs an attribute vector with resource identifier, access timestamp and access frequency as feature dimensions, and constructs an adjacency matrix based on the time order and resource logical connection relationship between access nodes to form the input graph structure of the graph neural network.

[0023] S302. Graph structure processing is performed using graph neural networks and residual attention structures. In each round of propagation, node feature propagation and residual superposition operations are performed. Attention mechanism is introduced to allocate the weights of the connections between nodes and dynamically update the context representation of nodes. The path behavior representation vector of the access nodes in the cross-cycle risk assessment path is extracted.

[0024] S303. The path behavior representation vector is used to generate path behavior aggregation parameters through a vector aggregation function. The path behavior aggregation parameters consist of logical strength parameters and cross-time jump anomaly parameters. The logical strength parameters are used to characterize the resource dependency strength between access nodes, and the cross-time jump anomaly parameters are used to characterize the degree of time span change and access frequency mutation between access nodes.

[0025] Preferably, S302 is as follows:

[0026] In the initialization phase of the graph neural network, an initial feature representation is assigned to each access node. The initial feature representation consists of a vector composed of resource identifier encoding, access timestamp embedding, and access frequency value, and is combined with the adjacency matrix to establish the connection relationship graph between nodes.

[0027] In each round of graph neural network propagation, feature propagation is performed on the features of neighboring nodes received by the current node based on the adjacency matrix. Then, the propagated features are superimposed with the node's previous features to ensure the consistency of feature expression depth between rounds and preserve the original feature semantics.

[0028] Based on feature propagation and residual superposition, an attention mechanism is introduced. For each connection edge, the attention weight is calculated based on the feature vectors of the two end nodes. This is used to dynamically adjust the influence of adjacent nodes on the feature update of the current node. Finally, the context representation vector of each visited node is updated as the path behavior representation vector.

[0029] Preferably, S303 is as follows:

[0030] The path behavior representation vector of each access node in the cross-cycle risk assessment path is processed by vector stacking to form a multi-dimensional matrix structure, and a vector convergence function based on the combination of average pooling and weighted fusion is set to extract the overall feature representation of the path.

[0031] When executing the vector aggregation function, the weight ratio of each node vector in the aggregation process is adjusted based on the connection weight between nodes, and the overall feature representation vector of the path is calculated. Then, the dimensionality decomposition operation is performed on the overall feature representation vector of the path to extract the feature sub-vectors corresponding to the resource dependency dimension and the time jump dimension.

[0032] The resource dependency dimension feature vector is input into a graph convolutional network constructed based on node access sequences, and the output is a logical strength parameter; the time jump dimension feature vector is input into a time change awareness network, and the output is a cross-time jump anomaly parameter, which constitutes the path behavior aggregation parameter.

[0033] Preferably, S4 specifically includes the following steps:

[0034] S401. Based on path behavior aggregation parameters, a nonlinear mapping relationship is constructed. Logical strength parameters and cross-time jump anomaly parameters are used as input variables. A multi-dimensional nonlinear feature transformation process is constructed based on the multi-layer perceptual network structure and activation function. The risk score is output to quantify the potential attack risks of the access path in the two dimensions of resource dependence and time jump.

[0035] S402. Based on the risk score value, compare it with the predefined risk level judgment threshold to determine the position of the risk score value in the multi-level risk level interval. The risk level judgment threshold is used to construct multiple interval boundaries according to the distribution density of the risk score value to divide the trigger range of the three protection strategies: transparent recording, enhanced verification and freezing operation.

[0036] S403. Based on the risk level judgment threshold comparison results, optimize and generate the corresponding protection strategy. If the risk score is lower than the first threshold, generate a transparent record strategy. If it is between the first and second thresholds, generate an enhanced verification strategy. If it is higher than the second threshold, generate a freeze operation strategy. Output the strategy in the form of a strategy label associated with the risk score to form a closed loop of mapping relationship and strategy optimization.

[0037] Preferably, S401 specifically refers to:

[0038] The logical strength parameter and the cross-time jump anomaly parameter in the path behavior aggregation parameters are normalized to convert the two types of input variables into an expression form within a unified numerical range. The normalized logical strength parameter and the cross-time jump anomaly parameter are combined into a two-dimensional input vector, which is then input into the input layer of the multilayer perceptron to initialize the nonlinear feature mapping process.

[0039] By performing weighted calculation, nonlinear activation function processing, and hidden layer feature fusion operations through a multilayer perceptron structure, the input two-dimensional vector is transformed into a nonlinear mapping of high-dimensional feature representation in the multilayer network structure. The activation function adopts rectified linear units to enhance the model's ability to learn complex mapping relationships.

[0040] The high-dimensional feature representation in the output layer of the multilayer perceptron is mapped to a single risk score. This risk score is used to characterize the potential attack risk intensity of the path behavior aggregation parameters in the resource dependency dimension and time jump dimension, and serves as the basis for subsequent risk level determination and protection strategy generation.

[0041] Preferably, S5 is as follows:

[0042] The system collects the execution results of protection strategies and extracts the risk score and actual security status feedback corresponding to each transparent record, enhanced verification and freeze operation. By constructing an error evaluation model based on score deviation, it calculates the error distribution of the current nonlinear mapping relationship in different score intervals. Based on this error distribution, it performs backpropagation adjustment on the weight parameters in the multilayer sensing network structure to achieve adaptive updating of the nonlinear mapping relationship.

[0043] After updating the weight parameters of the nonlinear mapping relationship, the risk level judgment threshold is reconstructed based on the changes in the distribution of risk score values ​​before and after the update, combined with the error evaluation model. The positions of the first threshold and the second threshold are dynamically adjusted according to the latest score density to construct a segmented interval that better matches the score characteristics. This is used to finely divide the trigger boundaries of the three protection strategies: transparent recording, enhanced verification, and freezing operation.

[0044] By combining the statistical characteristics of high-risk paths in the strategy execution results, the behavioral participation intensity and collaborative correlation of access nodes in the cross-cycle risk assessment path are identified. The connection weights between nodes in the path structure are dynamically adjusted to improve the sensitivity of the node relationship strength model to the high-risk path structure, thereby achieving the collaborative optimization of the cross-cycle risk assessment path structure and nonlinear mapping relationship in the protection strategy generation mechanism.

[0045] The technical effects and advantages provided by the present invention in the above technical solution are as follows:

[0046] 1. This invention achieves accurate identification and modeling of multiple low-frequency, interleaved access behaviors to the same resource object within discontinuous time periods by constructing an access behavior time mapping table and a resource object logical graph. Through a time series backtracking mechanism and a contextual semantic nesting mechanism, it effectively restores the continuity of attack behavior across the cycle dimension and the logical connections in the resource chain, overcoming the technical bottleneck of traditional protection strategies that only model within a local time window and cannot identify distributed, covert attack behaviors. Simultaneously, by constructing a path behavior representation using graph neural networks and residual attention structures, it extracts deep behavioral features in the two dimensions of resource dependence and time jump, enhancing the risk identification's ability to characterize complex path structures and potential abnormal patterns, enabling accurate detection of attack behaviors at an early stage.

[0047] 2. This invention constructs a multi-layered sensing network to achieve nonlinear risk scoring mapping and introduces a dynamic reconstruction mechanism for scoring thresholds and a feedback optimization mechanism for protection strategies to ensure that the strategy response can adaptively cover new risk behaviors. By linking the scoring results with three types of protection strategies—transparent recording, enhanced verification, and freeze operations—and continuously adjusting the model weights and path node connection weights based on the actual strategy execution results, the protection system possesses end-to-end risk perception, response, and optimization capabilities. This method not only improves the accuracy of identifying cross-cycle attack chains but also achieves intelligent, dynamic, and sustainable optimization of the protection mechanism, effectively avoiding the underestimation of risks due to dispersed and low-frequency attack chains, and ensuring the long-term security and controllability of critical resources. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this invention. For those skilled in the art, other drawings can be obtained based on these drawings.

[0049] Figure 1 This is a flowchart illustrating the deep network security data protection strategy optimization method that integrates behavioral analysis, as described in this invention. Detailed Implementation

[0050] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that the description of this disclosure will be more complete and fully convey the concept of the exemplary embodiments to those skilled in the art.

[0051] This invention provides, for example Figure 1 The method for optimizing deep network security data protection strategies based on integrated behavioral analysis, as shown, specifically includes the following steps:

[0052] S1. By constructing an access behavior time mapping table, the resource identifier, access timestamp and access frequency of each access behavior are converted into a three-dimensional quantitative vector. Access behaviors with the same resource identifier and access frequency below a set threshold in different time periods are aggregated and matched to determine the characteristics of multiple low-frequency interleaved access behaviors for the same resource object in non-continuous time periods.

[0053] In this embodiment, S1 specifically refers to:

[0054] By collecting raw log data of access behavior, the resource identifier, access timestamp and access frequency of each access behavior are extracted, and an access behavior time mapping table is constructed, with the resource identifier as the key indexing the corresponding access time and access frequency.

[0055] This process is a crucial foundation for identifying cross-cycle attacks in fusion behavior analysis. The raw log data of access behavior typically originates from network boundary devices, servers, databases, or business system log systems, and may include user request records, API call logs, communication connection logs, etc., generally in structured or semi-structured text format. The resource identifier of the access behavior refers to the logical target object requested by the user, such as a URL path, database table name, interface name, resource ID, etc., used to uniquely locate the access target. The access timestamp records the specific time the access behavior occurred, generally in a standard time format accurate to the second or millisecond, and is often directly extracted from the time field in the log. Access frequency is a statistical value of the number of times a specific resource identifier is accessed within a unit time window, which can be obtained by counting the number of times a specific resource identifier appears within a sliding time window and then dividing by the time window length. The access behavior time mapping table is constructed as follows: Using the resource identifier as the primary key, an index structure is established. The timestamps of all access events under that resource identifier are associated with their corresponding frequency statistics to form a set of key-value pairs. During implementation, a hash table or nested dictionary structure can be used to support fast retrieval and frequency calculation, ultimately forming a time behavior-based mapping framework for subsequent behavior vectorization and risk identification. This mapping table serves as the input source for behavior aggregation and matching in subsequent feature extraction processes. Its accuracy and data structure design directly affect the continuity and completeness of attack path identification.

[0056] The resource identifier, access timestamp, and access frequency in the access behavior time mapping table are constructed into a three-dimensional quantitative vector. The access timestamp is numerically normalized according to a continuous time window, the access frequency is linearly mapped according to a set interval, and the resource identifier is vectorized through a unique encoding rule.

[0057] Constructing a three-dimensional quantitative vector from the resource identifier, access timestamp, and access frequency in the access behavior time mapping table is the core process for achieving structured modeling of behavioral features. During construction, the access timestamp is first normalized using a continuous time window. This can be done by pre-setting a time window length (e.g., 1 hour or 10 minutes), dividing the timestamp by the time window length and rounding it down to convert it into a relative time period number. This transforms the original absolute time into a time density value at a uniform scale, making different access behaviors comparable in the time dimension. Access frequency is processed using a set interval linear mapping method. Specifically, a maximum frequency threshold is set, and the actual frequency value is proportionally mapped to a continuous interval between 0 and 1 to eliminate the order-of-magnitude differences between the frequency distributions of different resources. Resource identifiers are vectorized using unique encoding rules, typically employing hash encoding, lexicographical indexing, or nested encoding based on resource semantic classification. Each resource identifier is mapped to a unique numerical number, ensuring that the same resource identifier always corresponds to the same vector component. Ultimately, the three-dimensional quantitative vectors are combined in the form of [resource identifier encoding, normalized time density value, and mapped frequency value] to form a structurally stable and scale-uniform vector representation, which facilitates subsequent operations such as behavioral feature aggregation, similarity calculation, and graph structure modeling. In practical implementation, the three-dimensional quantitative vectors can be stored using sparse matrices, tensor structures, or standard arrays, supporting parallel computing and batch analysis of large-scale access to behavioral data.

[0058] Based on all three-dimensional quantitative vectors, access behaviors with the same resource identifier and access frequency below a set threshold are identified in different time periods. By calculating the time interval between adjacent access behaviors, access behavior sequences with time intervals greater than the minimum non-continuous time threshold are aggregated and matched to determine the characteristics of multiple low-frequency interleaved access behaviors for the same resource object in non-continuous time periods. These multiple low-frequency interleaved access behavior characteristics are composed of time interval span, access frequency stability and resource identifier consistency, and are used to reflect the behavior pattern of attack behavior continuously acting on a single logical resource in a low-intensity manner across periods.

[0059] In the identification process based on all three-dimensional quantitative vectors, the resource identifier dimension of each vector is first filtered, and access behaviors with the same resource identifier are aggregated into a group. Then, it is determined whether these access behaviors meet the condition that the access frequency is below a preset threshold, filtering out high-frequency access data to highlight potential covert behaviors. Under the conditions of consistent resource identifiers and low frequency, the group of access behaviors is further sorted in ascending order according to the time density dimension, and the time interval between adjacent access behaviors is calculated pairwise. When the time interval is greater than the minimum discontinuous time threshold, it indicates that these behaviors have cross-period attributes in time, and can be classified as the same discontinuous access sequence. Multiple discontinuous segments may exist in the same group; therefore, each access sequence that meets the time interval condition is aggregated and matched as an independent subsequence. This aggregation method can re-establish logical connections between seemingly unrelated low-frequency behaviors, effectively identifying the behavioral characteristics of attackers hiding attack paths through time fragmentation, forming multiple low-frequency interleaved access behavior characteristics.

[0060] The access frequency threshold is used to distinguish between normal operations and low-frequency latent behaviors. Typically, a quantile or standard deviation multiple can be set based on the average resource access frequency distribution in the system as a dividing point to exclude routine operations. The minimum discontinuous time threshold is used to determine the "dispersion" of access behavior over time. This value should be higher than the typical user operation interval but lower than long periods of inactivity, ensuring that deliberately scattered behavioral chains are identified rather than natural access fluctuations. Aggregation matching integrates access behaviors that meet the three conditions of consistent resource identifiers, access frequency below the threshold, and time interval greater than the minimum discontinuous time threshold into a behavior sequence, thereby extracting multiple low-frequency interleaved access behavior features. In the feature representation, the time interval span measures the breadth of the attack's distribution over time, access frequency stability reflects whether the access intensity remains low, and resource identifier consistency confirms the consistency of the attack target. These three together constitute a descriptive model for cross-period latent attack behavior. This processing strategy has high robustness and strong generalization ability, and can effectively identify complex and hidden attack paths without relying on specific business rules.

[0061] S2. Based on the identified characteristics of multiple low-frequency interleaved access behaviors, a cross-cycle risk assessment path with continuity and contextual relevance is constructed using time series backtracking, resource object merging strategies, and contextual semantic nesting mechanisms.

[0062] In this embodiment, S2 specifically refers to:

[0063] Based on the identified characteristics of multiple low-frequency interleaved access behaviors, access behaviors with the same resource identifier are arranged in ascending order by access timestamp. The backtracking time window length is set based on each set of access behavior sequences. The access behavior set covering multiple non-continuous time periods is extracted through time series backtracking operation, and an access behavior time linked list is constructed to represent the cross-period distribution state of access behaviors in the time dimension.

[0064] To extract a set of access behaviors covering multiple non-contiguous time periods, the original access events need to be organized based on the defined characteristics of multiple low-frequency, interleaved access behaviors. Specifically, firstly, using resource identifiers as grouping criteria, sequences of access behaviors with consistent access targets are extracted from the original access data and sorted in ascending order by access timestamps to form a time-ordered sequence. Then, a fixed backtracking time window length is set, typically based on the periodicity of access behavior in the actual system, such as 72 hours, to capture the distribution characteristics of latent access behaviors. Starting from the current access point and tracing back, access behaviors occurring within this time window are continuously extracted, and this process is repeated in multiple non-contiguous windows, ultimately summarizing access events across multiple time periods to form a cross-period access set. This operation can be implemented using a sliding window scanning method combined with an event index structure, achieving high time coverage efficiency.

[0065] During time series backtracking, the backtracking time window length limits the time span for each action to be traced forward, and its length affects the sensitivity and scope of identifying latent attacks. Time series backtracking refers to extracting the sequence of access events from a previous period in reverse chronological order, starting from the current action, within an access sequence with the same resource identifier. The access behavior time linked list is a linear data structure built with timestamps as the main index, used to connect access behaviors within different time periods, maintaining the order and contextual logic between events. This linked list reflects the temporal distribution characteristics of access behaviors across periods, providing a basic sequence for subsequent resource merging and contextual nesting analysis. During construction, a doubly linked list structure combined with hash mapping can be used to improve query efficiency and connection flexibility.

[0066] Based on the resource identifier corresponding to each access behavior in the access behavior time chain, a resource object merging strategy is executed using resource path structure similarity, namespace hierarchy mapping and visitor identifier consistency. The resource identifiers are normalized and a resource object logical graph is constructed, so that logically adjacent but differently encoded resource identifiers establish directed connection relationships in the graph, thereby realizing semantic integration between resources.

[0067] To integrate multiple potentially related access targets, semantic connections between resource objects need to be constructed based on the resource identifiers corresponding to each access behavior in the access behavior time chain. The implementation involves first extracting path information for all resource identifiers, such as file paths, API call paths, or database table names. By calculating path structural similarity, resource identifiers with only partial differences in path naming structures are identified, such as call targets with different path levels or parameter formats. Combined with namespace hierarchy mapping, directories, modules, or category tags in the resource paths are expanded into hierarchical vectors to identify the logical hierarchical relationships of resources. Simultaneously, visitor identifiers are compared to determine if the same access entity operates on these resources. Based on these three types of data, a resource object merging strategy is executed, grouping semantically similar resource identifiers into the same logical access unit and assigning them a unified number or characteristic representation. Furthermore, a resource object logical graph is constructed, organizing the merged resource objects as nodes and building directed connections based on the order of resource operations and naming structure relationships to represent potential resource operation flows and logical paths.

[0068] Resource path structure similarity compares the semantics and hierarchical positions of nodes at each level in a resource identifier path, often measured by edit distance, longest common sub-path, or the angle between path vectors. Namespace hierarchical mapping involves hierarchically encoding named elements in a resource path according to a predefined semantic dictionary, thereby restoring the semantic position of the resource within the entire system. Visitor identifier consistency confirms whether the same entity accesses multiple resources at different times, aiding in determining the logical relevance between resources. Resource object merging strategies combine these three features, using decision rules or clustering algorithms to aggregate multiple resource identifiers with semantic similarity into a single logical access target, thus reducing analytical blind spots caused by path fragmentation. A resource object logical graph is a directed graph structure with resource objects as nodes and semantic path relationships as edges, capable of expressing the logical order and dependencies between multiple resources in the access chain. Directed connections reflect the directionality of resource access, such as from a control path to a manipulated resource or from an interface to a submodule, ensuring accurate reconstruction of the semantic topology of the attack chain during risk assessment.

[0069] Based on the access behavior time chain and resource object logic graph, and based on the temporal sequence of access behaviors and the semantic continuity of resource identifiers, a context semantic nesting mechanism is invoked to combine access behaviors with consistent access frequency distribution patterns, strong repetition of access path structures, and unified namespaces of access targets into context nesting units. All context nesting units are then connected in chronological order to construct a cross-cycle risk assessment path with continuity and contextual relevance, which is used to characterize the fusion characteristics of attack behaviors across time spans and resource logic chains.

[0070] The core objective of constructing a continuous and context-dependent cross-cycle risk assessment path is to semantically integrate previously scattered, fragmented, and time-spanning access behaviors, thereby revealing the implicit evolution of attack behaviors. Specifically, this is achieved by first extracting the temporal sequence of access behaviors from the access behavior timeline and extracting the semantic continuity between resource identifiers from the resource object logic graph. A two-dimensional time-semantic coordinate system is constructed to project access events onto the timeline and resource path space. Subsequently, a contextual semantic nesting mechanism is invoked to initially group access behaviors based on consistent access frequency distribution patterns, strong repetition in access path structures, and a unified namespace for access targets. Each group is considered a contextual nesting unit. These contextual nesting units are then ordered according to timestamp order and linearly connected to construct a cross-cycle risk assessment path. This path not only reflects the attacker's extension trend over time but also reveals their continuous manipulation of the resource logic chain, thus accurately characterizing the features of long-term, latent attacks.

[0071] The temporal sequence of access behaviors is determined by ascending order of access timestamps, used to identify the triggering order of behaviors on the timeline. The semantic continuity of resource identifiers is judged based on directed connections in the resource object logical graph, indicating whether multiple resources logically constitute a continuous operational flow. The contextual semantic nesting mechanism is a way to structure behavioral events according to semantic similarity and contextual relevance, which can be implemented using sliding window clustering and semantic nesting tree construction. Consistent access frequency distribution patterns mean that multiple access behaviors exhibit similar access frequency changes within the same period, which can be measured by the ratio of standard deviation to mean. Strong repetitive access path structures mean that resource paths appear repeatedly in multiple accesses, commonly judged by path substring matching algorithms. Access targets have a unified namespace, determined by parsing the resource path naming prefix and comparing its corresponding module or functional block. A contextual nesting unit defines a group of access behaviors that satisfy all three characteristics as a minimum semantic processing unit, providing a unified granular basis for subsequent path connection and risk modeling.

[0072] S3. Using the constructed cross-cycle risk assessment path as input, a graph neural network and residual attention structure are used to generate path behavior aggregation parameters to characterize the logical strength of the access nodes within the path and the degree of anomaly of cross-time jumps.

[0073] In this embodiment, S3 specifically includes the following steps:

[0074] S301. The constructed cross-cycle risk assessment path is transformed into graph structure data, in which each access node constructs an attribute vector with resource identifier, access timestamp and access frequency as feature dimensions, and constructs an adjacency matrix based on the time order and resource logical connection relationship between access nodes to form the input graph structure of the graph neural network.

[0075] Based on the construction of a cross-cycle risk assessment path, transforming the access behaviors within the path into graph-structured data requires expressing the semantic relationships between time and resources in the form of nodes and edges. Each access node consists of three dimensions: resource identifier, access timestamp, and access frequency. These three types of information are uniquely encoded, normalized to a time map, and linearly frequency quantized, then combined into a unified attribute vector to characterize the node's behavioral features. Edges in the graph are constructed according to two principles: first, the time order principle, i.e., if the access times of two nodes are consecutive, a time edge is established; second, the resource logical relationship principle, i.e., if the resource identifiers of two nodes have path dependencies or hierarchical relationships, a semantic edge is established. All connections between nodes are achieved by establishing an adjacency matrix, with the behavioral nodes as row and column indices, and matrix elements indicating whether there is a direct connection between nodes and its connection type. Finally, the graph data composed of node attribute vectors and the adjacency matrix is ​​input into a graph neural network, enabling the network to perceive the cross-cycle access behavior relationships constituted by time and resource semantics, laying the structural foundation for subsequent path representation and parameter generation.

[0076] S302. Graph structure processing is performed using graph neural networks and residual attention structures. In each round of propagation, node feature propagation and residual superposition operations are performed. Attention mechanism is introduced to allocate the weights of the connections between nodes and dynamically update the context representation of nodes. The path behavior representation vector of the access nodes in the cross-cycle risk assessment path is extracted.

[0077] S303. The path behavior representation vector is used to generate path behavior aggregation parameters through a vector aggregation function. The path behavior aggregation parameters consist of logical strength parameters and cross-time jump anomaly parameters. The logical strength parameters are used to characterize the resource dependency strength between access nodes, and the cross-time jump anomaly parameters are used to characterize the degree of time span change and access frequency mutation between access nodes.

[0078] By transforming the constructed cross-cycle risk assessment path into graph-structured data and utilizing graph neural networks and residual attention structures for deep processing, the core objective is to overcome the limitations of traditional behavioral analysis modeling based solely on linear sequences or local statistics. This allows for the capture of the global correlation of attack behaviors across complex time spans and resource interaction patterns. In real-world attack scenarios, attackers often use splitting and disguised access techniques to conceal behavioral continuity, making it difficult for conventional models to accurately identify their potential logical chains and temporal jump characteristics. Graph neural networks can fully utilize the resource logical connections and temporal relationships between access nodes, dynamically integrating information between nodes in each round of propagation, preserving the original semantics while enhancing the depth of expression. The residual attention structure further enhances the perception of key nodes and edge weights, effectively addressing the gradient decay and semantic dilution problems in multi-hop propagation. Based on this, the extraction and aggregation of path behavior representation vectors not only characterize the strength of resource dependencies and the degree of behavioral jump anomalies but also provide clear and quantifiable risk basis for subsequent strategy formulation. This modeling approach has a natural advantage in dealing with discontinuous, cross-cycle, and low-frequency interlaced attack behaviors. It can reconstruct the attack chain in the context of scattered behavioral fragments, accurately reveal potential threat paths, and thus achieve precise optimization and dynamic response of deep network security data protection strategies.

[0079] In this embodiment, S302 specifically refers to:

[0080] In the initialization phase of the graph neural network, an initial feature representation is assigned to each access node. The initial feature representation consists of a vector composed of resource identifier encoding, access timestamp embedding, and access frequency value, and is combined with the adjacency matrix to establish the connection relationship graph between nodes.

[0081] In the initialization phase of the graph neural network, an initial feature representation with semantic and numerical meaning needs to be constructed for each access node. This feature representation is composed of vectors. First, the resource identifier corresponding to the access node is extracted as a string and converted into a fixed-length integer vector using hash encoding or word embedding methods to ensure the resource dimension is trainable. Second, the access timestamp is transformed by a periodic function (such as sine or cosine encoding) or embedded and mapped through time window division, enabling the model to perceive the periodicity and rhythm of the behavior on the time axis. Third, the access frequency is standardized and converted into a continuous numerical value to represent the access density of the behavior within the time interval. For example, if a node's resource identifier is "data / api / user", the access timestamp is "2025-08-29 10:32:00", and the access frequency is 3 times / hour, then a resource embedding vector such as [0.12, 0.45, 0.88] and a time embedding such as [0.63, 0.77] can be generated through encoding, with a frequency value of 0.30. Finally, the three are concatenated to form a complete initial feature vector. Subsequently, edge connections are established based on whether there is a time sequence or resource dependency between nodes. An adjacency matrix is ​​constructed in the form of a Boolean matrix or a sparse matrix to establish the connection relationship graph between visiting nodes, enabling the graph neural network to perform feature propagation and structure learning during training.

[0082] In each round of graph neural network propagation, feature propagation is performed on the features of neighboring nodes received by the current node based on the adjacency matrix. Then, the propagated features are superimposed with the node's previous features to ensure the consistency of feature expression depth between rounds and preserve the original feature semantics.

[0083] In the propagation process of a graph neural network, each round of information transmission is based on the connections between nodes. The adjacency matrix identifies all neighboring nodes of the current node and collects their feature representations in the current propagation round. Feature propagation is achieved through weighted averaging or weighted aggregation. For example, each neighboring node is assigned a propagation weight, and its features are fused accordingly to form the aggregated features of the current node. After feature propagation, the current node performs residual superposition of this aggregated feature with the feature representation retained in the previous round of propagation; that is, the two vectors are added element-wise to obtain a new node representation. This residual superposition process can alleviate the information degradation problem in deep propagation, ensuring that the node retains its original semantics after multiple rounds of propagation, while simultaneously fusing structural features from neighboring nodes. For example, in the third round of propagation, if an accessing node receives the feature aggregation result of three neighboring nodes as vector A, and its own feature from the previous round is vector B, then the node feature in the current round will be the sum of A and B, forming a new node representation for the next round of propagation. In this way, each node gradually aggregates information from its context structure to form a deep expression of the logical relationships and cross-time patterns in the access path.

[0084] Based on feature propagation and residual superposition, an attention mechanism is introduced. For each connection edge, the attention weight is calculated based on the feature vectors of the two end nodes. This is used to dynamically adjust the influence of adjacent nodes on the feature update of the current node. Finally, the context representation vector of each visited node is updated as the path behavior representation vector.

[0085] After feature propagation and residual superposition, introducing an attention mechanism can enhance the selective absorption of features from neighboring nodes by each accessing node, avoiding information dilution caused by indiscriminate aggregation. Specifically, for each connecting edge in the graph structure, the current feature vectors of the nodes at both ends are extracted, and these two sets of vectors are concatenated and input into an attention weight generation function. This function can employ a multilayer perceptron or a dot-product attention structure. This function generates a real-valued weight based on factors such as semantic relevance, temporal density, and resource logic relationships between nodes, used to measure the importance of neighboring node features to the current node's feature update. During node feature update, the features of neighboring nodes are multiplied by their corresponding attention weights, and then aggregated to update the current node's context representation vector. This context representation vector is defined as a path behavior representation vector, used to represent the node's logical role and semantic state in a cross-period path. For example, if a node is connected to three neighboring nodes in the graph structure, the attention mechanism might assign weights of 0.1, 0.6, and 0.3, indicating that the three neighboring nodes contribute different proportions to the current node's feature expression. This weighted update method not only enhances the ability to express the semantics of access behavior in a more refined way, but also improves the accuracy of identifying key nodes in complex attack chains.

[0086] In this embodiment, S303 specifically refers to:

[0087] The path behavior representation vector of each access node in the cross-cycle risk assessment path is processed by vector stacking to form a multi-dimensional matrix structure, and a vector convergence function based on the combination of average pooling and weighted fusion is set to extract the overall feature representation of the path.

[0088] The purpose of stacking the path behavior representation vectors of each access node in the cross-cycle risk assessment path is to unify the discrete node behavior representations into a structured input, facilitating subsequent feature extraction operations at the full path level. Specifically, the path behavior representation vectors of each node are arranged row-wise according to the chronological order of access nodes in the path, constructing a multi-dimensional matrix structure. Each row corresponds to an access node, and each column corresponds to a semantic feature dimension. This matrix preserves the behavioral information and temporal sequence of each node in the path. To extract the overall risk features of the entire path in both the time and resource dimensions, a vector convergence function based on a combination of average pooling and weighted fusion is defined. First, average pooling extracts the global statistical features of each feature dimension. Then, weighted fusion of node vectors is performed using predefined importance weights to strengthen the dominant role of key nodes in the overall path features. For example, in a path containing ten access nodes, if the first three nodes occur during a sensitive resource access period, the fusion weight of the first three rows can be artificially set higher than that of other nodes to enhance the model's ability to perceive abnormal high-risk behavior segments. This combined convergence method takes into account both the overall importance of the path and the importance of its local components, and can effectively support the subsequent risk scoring and strategy generation logic.

[0089] When executing the vector aggregation function, the weight ratio of each node vector in the aggregation process is adjusted based on the connection weight between nodes, and the overall feature representation vector of the path is calculated. Then, the dimensionality decomposition operation is performed on the overall feature representation vector of the path to extract the feature sub-vectors corresponding to the resource dependency dimension and the time jump dimension.

[0090] When executing the vector aggregation function, the weight ratio of each node vector in the aggregation process is adjusted according to the connection weights between access nodes in the path. This is to more accurately reflect the actual contribution of each node in the overall risk assessment. Specifically, in the path graph structure, the connection weight of each edge represents the logical strength or the degree of time jump anomaly between two nodes. This weight can be used to adjust the fusion ratio of the corresponding node vectors. In implementation, the weight factor of each node is first calculated based on the connection weights of the nodes. Then, the path behavior representation vector of each node is multiplied by this factor and input into the aggregation function to complete the weighted integration of the entire path vector, outputting the overall path feature representation vector. This vector is a high-dimensional composite behavior expression that contains risk information of all key access behaviors in the path. To further analyze the source of behavioral features and their dimensional attributes, a dimensionality decomposition operation is performed on the overall path feature representation vector, splitting it into two feature sub-vectors: resource dependency dimension and time jump dimension, according to a preset indexing rule. The feature vectors of the resource dependency dimension are used to characterize the strength of the logical association between accessing nodes in terms of resource usage, such as whether adjacent nodes access the same service or database; the feature vectors of the time jump dimension are used to reflect the degree of abrupt change in the access interval between nodes, such as the time when a node is accessed is several hours or days apart from the time of the previous node. Through this dimensional decomposition method, more granular discrimination criteria can be provided for different types of attack behaviors, and clear feature support can be provided for subsequent risk scoring mechanisms.

[0091] The resource dependency dimension feature vector is input into a graph convolutional network constructed based on node access sequences, and the output is a logical strength parameter; the time jump dimension feature vector is input into a time change awareness network, and the output is a cross-time jump anomaly parameter, which constitutes the path behavior aggregation parameter.

[0092] To conduct an in-depth analysis of key behavioral patterns in the cross-cycle risk assessment path, the feature vectors of the resource dependency dimension are first input into a graph convolutional network (GCNN) built based on the node access sequence. This GCNN constructs a graph structure according to the node order in the access path, where each node represents an access behavior, indicating a logical sequence or resource reference relationship. During propagation, the GCNN extracts structural features and interdependencies between accessing nodes through multi-layer convolution operations and enhances non-linear expressive power through activation functions, ultimately outputting a logical strength parameter to characterize the strength of resource dependencies between nodes. For example, if multiple accessing nodes sequentially access different tables in the same database, the GCNN will extract their potential data dependency chains and strengthen the connection strength on the path. Next, the feature vectors of the time jump dimension are input into a time-change-aware network for processing. This network employs a time-aware recursive structure, dynamically modeling behavioral jump features by combining time interval information between accessing nodes, thereby identifying abnormal large-span time jumps or sudden changes in access frequency. By focusing on time features through recursive operations and attention mechanisms, the network ultimately outputs a cross-time jump anomaly parameter to quantify the degree of anomalies in the time distribution among accessing nodes in the path. For example, if a user repeatedly accesses data resources that are far removed from their previous behavior within a short period of time, this parameter will increase significantly. Ultimately, by combining the logical strength parameter and the cross-time jump anomaly parameter, a complete path behavior aggregation parameter is formed, serving as the core indicator for subsequent risk assessment and strategy optimization.

[0093] S4. Construct a nonlinear mapping relationship based on path behavior aggregation parameters, output risk score values, and optimize the generation of three types of protection strategies: transparent record, enhanced verification, and frozen operation by comparing risk level judgment thresholds.

[0094] In this embodiment, S4 specifically includes the following steps:

[0095] S401. Based on path behavior aggregation parameters, a nonlinear mapping relationship is constructed. Logical strength parameters and cross-time jump anomaly parameters are used as input variables. A multi-dimensional nonlinear feature transformation process is constructed based on the multi-layer perceptual network structure and activation function. The risk score is output to quantify the potential attack risks of the access path in the two dimensions of resource dependence and time jump.

[0096] S402. Based on the risk score value, compare it with the predefined risk level judgment threshold to determine the position of the risk score value in the multi-level risk level interval. The risk level judgment threshold is used to construct multiple interval boundaries according to the distribution density of the risk score value to divide the trigger range of the three protection strategies: transparent recording, enhanced verification and freezing operation.

[0097] In comparing risk scores with predefined risk level thresholds, it's necessary to first statistically analyze risk scores from a large number of historical access behaviors, using distribution density curves to divide different risk level intervals. Specifically, kernel density estimation or histogram analysis can be used to model the distribution characteristics of the scores, thereby determining the boundaries of low-risk, medium-risk, and high-risk intervals. For example, when scores are mainly concentrated between 0.2 and 0.6, 0.4 can be set as the medium-risk threshold, and the portion above 0.6 can be set as the high-risk boundary. During system operation, the risk score generated for each access path is mapped to the corresponding interval to determine whether the current behavior falls under the protection category of transparent recording, enhanced verification, or freeze operation, thus enabling targeted policy responses. This comparison mechanism provides a quantitative basis for protection decisions, avoiding the risk of misjudgment or omission due to subjective judgment.

[0098] In this process, the risk score is input as a continuous variable into the judgment process, while the risk level judgment threshold constitutes multiple independent interval boundaries. Its function is to discretize the continuous score values ​​into policy trigger signals. The transparent recording interval covers access behaviors with risk scores below the first threshold; these behaviors are considered trusted paths and only log recording is performed. The reinforced verification interval covers behaviors between the first and second thresholds, requiring additional multi-factor verification to improve security. The freeze operation interval corresponds to access behaviors with scores above the second threshold, immediately interrupting their subsequent requests to resources. The risk level judgment threshold is not set as a fixed constant but is dynamically trained and optimized based on the distribution characteristics of the score values, thus ensuring that its segmentation capability is consistent with the actual attack distribution. This mechanism effectively improves the system's recognition rate for long-term, low-frequency, interleaved attack behaviors.

[0099] S403. Based on the risk level judgment threshold comparison results, optimize and generate the corresponding protection strategy. If the risk score is lower than the first threshold, generate a transparent record strategy. If it is between the first and second thresholds, generate an enhanced verification strategy. If it is higher than the second threshold, generate a freeze operation strategy. Output the strategy in the form of a strategy label associated with the risk score to form a closed loop of mapping relationship and strategy optimization.

[0100] When optimizing and generating corresponding protection strategies based on the risk level threshold comparison results, the system uses the risk score as input, combined with a preset first threshold and a second threshold, to execute conditional branch judgments. Access behaviors with scores below the first threshold are considered low-risk behaviors, and the system generates a transparent logging policy, which records all access behaviors in full but does not interfere with their execution process, for use in subsequent security audits and anomaly detection model training. When the score is between the first and second thresholds, the behavior is judged as medium-risk, and the system generates a strengthened verification policy, enhancing access control strength by triggering mechanisms such as dynamic password verification, human-machine verification, or authorization approval. If the score exceeds the second threshold, the behavior is identified as high-risk, and the system generates a freeze operation policy, which immediately blocks the access process and freezes the state of associated resources to prevent the potential attack chain from expanding further. The protection strategy is output in the form of a tag that maps one-to-one with the risk score, forming a clear basis for policy execution and ensuring that the response actions are traceable and consistent.

[0101] The first and second thresholds are two key numerical boundaries used to delineate risk level intervals. Their setting is based on statistical results of risk score distribution from a large amount of historical access behavior. The first threshold is defined as the upper bound of low-risk risk scores, typically set between the low-density, high-frequency segment and the medium-density transition segment of the score distribution. It is used to identify access behaviors that are stable, regular, and low-sensitivity in terms of both resource dependence and time jump anomalies. The second threshold is defined as the lower bound of high risk, set between the high-density, low-frequency segment and the extreme offset segment of the score distribution. It is used to identify high-risk access paths with disordered logical structures or frequent time jumps. The score interval between the two is considered the range of unstable behavior, used to trigger a medium-level response strategy. The first and second thresholds can be set using dynamic clustering analysis, quantile methods, or adaptive boundary learning based on model training errors. During operation, they can be dynamically adjusted according to updates in the risk scores to adapt to distribution drift caused by changes in attack methods.

[0102] In the aforementioned policy generation process, transparent record policy tags are used to identify low-risk access paths, typically including an access identifier, timestamp, and score value, for security audit data archiving and behavioral model accuracy optimization. Enhanced verification policy tags include the required verification method, the available permission level after successful verification, and isolation measures after verification failure, used to dynamically adjust the authentication process and resource permission distribution logic. Freeze operation policy tags include the freeze type, freeze scope, and trigger reason, used for rapid response to potential high-risk attack events. All policy tags, after generation, are paired with their corresponding risk score values ​​to form key-value pairs, stored in the protection policy library, achieving a closed-loop linkage between policy configuration and scoring results. Simultaneously, this mapping relationship can be used to train the risk assessment model, improving its accuracy in identifying policy boundaries and further enhancing the intelligent evolution capability of the entire security policy system.

[0103] In this embodiment, S401 specifically refers to:

[0104] The logical strength parameter and the cross-time jump anomaly parameter in the path behavior aggregation parameters are normalized to convert the two types of input variables into an expression form within a unified numerical range. The normalized logical strength parameter and the cross-time jump anomaly parameter are combined into a two-dimensional input vector, which is then input into the input layer of the multilayer perceptron to initialize the nonlinear feature mapping process.

[0105] When normalizing the logical strength parameter and the cross-time jump anomaly parameter in the path behavior aggregation parameters, methods such as min-max normalization or Z-score standardization can be used to transform these two raw indicators into a unified numerical range, such as between 0 and 1, ensuring their units are consistent to adapt to the input requirements of the multilayer perceptron network. The logical strength parameter reflects the tightness of resource dependencies between accessing nodes and is usually calculated from the node connection frequency or resource co-occurrence probability in the graph structure. The cross-time jump anomaly parameter reflects abrupt changes in time span and abnormal fluctuations in access frequency, and is usually measured based on the time interval between adjacent accesses and the rate of change of access frequency. After normalization, the two parameters are used as two-dimensional feature vectors input to the input layer of the multilayer perceptron network to initiate the nonlinear feature mapping process. This approach can improve the model's ability to stably perceive input variables and avoid network learning bias due to excessive numerical differences. For example, in a single detection, a logic strength of 0.9 indicates high resource dependence, while a cross-time jump anomaly of 0.2 indicates relatively stable time changes. The vector formed after normalization can accurately express the basic risk characteristics of the path, which is beneficial for subsequent multi-layer feature extraction and risk scoring.

[0106] By performing weighted calculation, nonlinear activation function processing, and hidden layer feature fusion operations through a multilayer perceptron structure, the input two-dimensional vector is transformed into a nonlinear mapping of high-dimensional feature representation in the multilayer network structure. The activation function adopts rectified linear units to enhance the model's ability to learn complex mapping relationships.

[0107] When processing a two-dimensional input vector using a multilayer perceptron structure, the vector is first fed into the input layer of the perceptron. Each hidden layer contains several neurons, and each node is fully connected to the nodes in the previous layer. Trainable weight coefficients are assigned to each connection pathway. Weighted calculation is performed in each layer, linearly combining the input vector with the corresponding weights and adding a bias term to form an intermediate expression value. Subsequently, a nonlinear activation function is used to activate the intermediate expression value. Rectified linear units (RLUs) are recommended as the activation function, as they offer advantages such as computational efficiency, gradient stability, and sparse activation when handling nonlinear relationships, effectively enhancing the perceptron's expressive power in handling complex mapping relationships. In the multilayer structure, the output of the previous layer serves as the input of the next layer. Layer-by-layer feature abstraction and fusion operations complete the nonlinear mapping from the original two-dimensional vector to a high-dimensional latent space. For example, the input logic strength parameter and cross-time jump anomaly parameter are 0.7 and 0.3, respectively. After transformation by a three-layer perceptron network, they can be mapped into a ten-dimensional vector. Each dimension captures the combined features of different risk factors, thus providing a sufficient semantic representation basis for subsequent risk scoring calculations. In this way, the model can extract hidden risk structural features from limited inputs, thereby improving overall discrimination performance.

[0108] The high-dimensional feature representation in the output layer of the multilayer perceptron is mapped to a single risk score. This risk score is used to characterize the potential attack risk intensity of the path behavior aggregation parameters in the resource dependency dimension and time jump dimension, and serves as the basis for subsequent risk level determination and protection strategy generation.

[0109] In mapping high-dimensional feature representations from the output layer of a multilayer perceptron to a single risk score, an output node containing a single neuron is set up to receive all high-dimensional feature values ​​from the previous hidden layer. The final output is calculated through weighted summation and bias shift. This output is the risk score, used to quantify the potential attack risk intensity reflected by the resource dependency and time jump dimensions in the path behavior aggregation parameters. To enhance the model's expressive power and numerical stability, the output node is typically used with activation functions such as Sigmoid or Softplus to limit the score within a certain range, facilitating comparison and analysis by subsequent risk level determination mechanisms. This process compresses multidimensional complex features into a risk quantification result that can directly participate in protection decisions, thus achieving effective connection between data and strategy. For example, a ten-dimensional feature vector generated after processing by the perceptron is mapped to a risk score of 0.82, indicating that the path has a high risk tendency in terms of resource access continuity and time jump anomalies, making it necessary to mark it as a high-risk object. This mapping mechanism enables a unified measurement from behavioral characteristics to attack probability, giving the entire protection system a refined response capability.

[0110] S5. Update the weight parameters of the nonlinear mapping relationship and the risk level judgment threshold based on the execution results of the protection strategy, and dynamically adjust the node relationship strength in the cross-cycle risk assessment path to achieve continuous optimization of the protection strategy.

[0111] In this embodiment, S5 specifically refers to:

[0112] The system collects the execution results of protection strategies and extracts the risk score and actual security status feedback corresponding to each transparent record, enhanced verification and freeze operation. By constructing an error evaluation model based on score deviation, it calculates the error distribution of the current nonlinear mapping relationship in different score intervals. Based on this error distribution, it performs backpropagation adjustment on the weight parameters in the multilayer sensing network structure to achieve adaptive updating of the nonlinear mapping relationship.

[0113] During the collection of protection strategy execution results, the risk score value corresponding to each generated transparent record, enhanced verification, and freeze operation can be recorded, and actual security status feedback information can be collected simultaneously, such as whether data leakage has occurred, whether illegal command execution has occurred, or whether it has been misjudged as abnormal behavior. To determine the accuracy of the nonlinear mapping relationship in risk scoring, an error evaluation model based on scoring deviation needs to be constructed. This model compares the consistency between the score value and security feedback, and statistically analyzes the judgment deviation within different scoring intervals. For example, in samples with scores in the medium range, if most are judged as "enhanced verification" but no security issues are subsequently found, it indicates that there is a tendency for over-defense in this scoring interval, and the error is too high. In this way, the average and variance of the error are calculated in the low, medium, and high scoring intervals respectively, forming an error distribution map, which serves as an important reference for adjusting the nonlinear mapping structure. Then, based on the gradient change of the error distribution, the weight parameters in the perception network structure are corrected layer by layer using a backpropagation mechanism, making the subsequent mapping relationship more closely match the actual risk performance, achieving adaptive optimization of the nonlinear mapping relationship.

[0114] In this technical process, the "risk score" refers to the quantitative result output by the perception network, reflecting the potential attack risks of the access path in terms of resource dependence and time jump dimensions; the "actual security status feedback" comes from system detection components or manually labeled records, indicating whether the current access behavior has caused a security incident; "scoring bias" represents the error measure between the predicted score and the actual risk; the "error evaluation model" is used to statistically attribute the error characteristics of different scoring intervals to provide direction for parameter updates; "error distribution" refers to the probability statistics of misjudgment and missed judgment in different scoring intervals, reflecting the strength of the current model's recognition ability in each scoring segment; "backpropagation adjustment" refers to the calculation process of adjusting the neural network weights based on the error signal; and the "nonlinear mapping relationship" reflects the nonlinear response mechanism between input features and risk scores, continuously approximating the actual risk model through training. Through the synergistic application of these technical elements, the accuracy of risk scoring and the response precision of protection strategies can be effectively improved.

[0115] After updating the weight parameters of the nonlinear mapping relationship, the risk level judgment threshold is reconstructed based on the changes in the distribution of risk score values ​​before and after the update, combined with the error evaluation model. The positions of the first threshold and the second threshold are dynamically adjusted according to the latest score density to construct a segmented interval that better matches the score characteristics. This is used to finely divide the trigger boundaries of the three protection strategies: transparent recording, enhanced verification, and freezing operation.

[0116] After updating the weight parameters of the nonlinear mapping relationship, the risk level judgment threshold can be reconstructed based on the distribution changes of risk scores in different numerical intervals before and after the update. This process first compares the historical and current score distributions to identify trends in score density, such as a significant increase or decrease in sample concentration within a certain score segment. Combined with the previously established error evaluation model, it determines whether the original threshold still possesses reasonable discriminative power in the new score structure. If the original first threshold is found to classify a large number of low-risk samples as enhanced verification areas, or the second threshold leads to an increased frequency of misjudgments as high-risk, the threshold position can be dynamically fine-tuned to better reflect the actual density distribution of the current scores. The adjustment method can be based on quantile weighting, for example, setting the first threshold to the top 30% cumulative probability points in the latest score distribution and the second threshold to the bottom 20% cumulative probability points, ensuring that the score boundaries triggered by each type of protection strategy accurately correspond to the score change trend. Ultimately, a new segmentation interval is formed, achieving refined boundary division for the three types of protection strategies: transparent recording, enhanced verification, and freeze operations, improving the rationality and differentiation of strategy responses.

[0117] The technical features involved in this process include: "risk score distribution change," which analyzes the shift in score density based on changes in the number of historical and current score samples across different intervals; "error evaluation model," a statistical model used to assist in judging the effectiveness of strategy matching in each score segment; "dynamic adjustment of the positions of the first and second thresholds," which adjusts the positions of two key thresholds in real time based on the score density peak and error concentration area; "segmented interval reconstruction," which divides the risk score into three protection level intervals using the new thresholds as boundaries; and "strategy trigger boundary," which determines the protection strategy type corresponding to each risk level. This mechanism ensures higher decision consistency in strategy division based on the model's output score, avoiding strategy mismatch problems caused by score changes, thereby achieving a more intelligent and robust cybersecurity protection system.

[0118] By combining the statistical characteristics of high-risk paths in the strategy execution results, the behavioral participation intensity and collaborative correlation of access nodes in the cross-cycle risk assessment path are identified. The connection weights between nodes in the path structure are dynamically adjusted to improve the sensitivity of the node relationship strength model to the high-risk path structure, thereby achieving the collaborative optimization of the cross-cycle risk assessment path structure and nonlinear mapping relationship in the protection strategy generation mechanism.

[0119] To enhance the ability of cross-cycle risk assessment paths to identify high-risk access behaviors, the connection weights between access nodes in the path structure can be dynamically optimized by combining the characteristics of paths identified as high-risk in the strategy execution results. This is achieved by statistically analyzing multiple path samples marked as high-risk and extracting the intensity of behavioral participation and the degree of collaborative association of access nodes at different risk levels. Behavioral participation intensity can be measured by the frequency of a node's appearance in the path and its centrality in the overall graph structure, while the degree of collaborative association can be assessed based on the alternating access relationships of nodes to the same target resource or logical module. Furthermore, a connection weight adjustment function is introduced to adjust the connection weights between each access node and other nodes based on the core role it plays in high-risk paths. For example, if a node is in a critical jump position in multiple freeze operation strategy paths, its outgoing edge connection weight can be increased to enhance the graph model's sensitivity to its propagation behavior. This strategy helps the model pay more attention to the structural characteristics of historically identified dangerous behaviors in subsequent risk scoring stages, thereby improving the accuracy and response efficiency of protection strategy matching.

[0120] The key technical features involved in this process include: "statistical characteristics of high-risk paths," which refers to extracting node behavior and structural attributes through feature analysis of access path samples marked as high-risk; "behavioral participation intensity of access nodes," which refers to the activity level of a single node in high-risk behaviors, such as its positional importance and frequency within the path; "degree of collaborative association," which refers to the tightness of the relationship between multiple nodes jointly participating in forming a potential attack chain; "dynamic adjustment of connection weights," which adjusts the weights of edges in the graph structure to reflect the differences in risk propagation capabilities between nodes; "node relationship strength model," which is the parameter system constituting the connection strength in the path graph; and "collaborative optimization mechanism," which refers to jointly adjusting the path structural features and the risk mapping model to create a closed-loop feedback between the path representation and the scoring mechanism. This mechanism ensures that risk identification not only relies on a static scoring model but also adaptively learns the dynamic changes in high-risk behaviors through the path structure, achieving a more robust and timely strategy generation system.

[0121] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented using software, the above embodiments can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions or computer programs. When the computer instructions or computer programs are loaded or executed on a computer, all or part of the processes or functions according to the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. Computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired or wireless means (e.g., infrared, wireless, microwave, etc.). A computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more sets of available media. Available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media. Semiconductor media can be solid-state drives.

[0122] It should be understood that in the various embodiments of this application, the order of the above-mentioned processes does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0123] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0124] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0125] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0126] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0127] The above are merely specific embodiments of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for optimizing deep network security data protection policy with fusion behavior analysis, characterized in that, Specifically comprising the following steps: S1, by constructing an access behavior time mapping table, converting the resource identifier, access timestamp and access frequency of each access behavior into a three-dimensional quantitative vector, aggregating and matching the access behaviors with the same resource identifier and the access frequency lower than the set threshold in different time periods, and determining the characteristics of the multiple low-frequency interleaved access behaviors for the same resource object in the non-continuous time period; S2, according to the determined multiple low-frequency interleaved access behavior characteristics, using time series backtracking, resource object merging strategy and context semantic nesting mechanism to construct a cross-cycle risk assessment path with continuity and context association; S3, taking the constructed cross-cycle risk assessment path as input, using graph neural network and residual attention structure to generate path behavior aggregation parameters, which are used to describe the logical strength of the access nodes in the path and the abnormal degree of cross-time jump; S4, based on the path behavior aggregation parameters, constructing a nonlinear mapping relationship, outputting a risk score value, and comparing it with the risk level determination threshold to optimize the generation of three protection strategies: transparent record, verification and freezing operation; S5, combining the execution results of the protection strategies to update the weight parameters of the nonlinear mapping relationship and the risk level determination threshold, and dynamically regulating the node relationship strength in the cross-cycle risk assessment path, so as to realize the continuous optimization of the protection strategies.

2. The method of claim 1, wherein the method further comprises: S1 is specifically: By collecting the original log data of access behavior, extracting the resource identifier, access timestamp and access frequency of each access behavior, and constructing an access behavior time mapping table, the access time and access frequency corresponding to the resource identifier are taken as the key index; The resource identifier, access timestamp and access frequency in the access behavior time mapping table are constructed into a three-dimensional quantitative vector, wherein the access timestamp is numerically normalized according to the continuous time window, the access frequency is linearly mapped according to the set interval, and the resource identifier is vectorized by the unique coding rule; Based on all three-dimensional quantitative vectors, the access behaviors with the same resource identifier and the access frequency lower than the set threshold in different time periods are identified, the time interval between adjacent access behaviors is calculated, the access behavior sequence with time interval greater than the minimum non-continuous time threshold is aggregated and matched, and then the characteristics of the multiple low-frequency interleaved access behaviors for the same resource object in the non-continuous time period are determined, which are composed of time interval span, access frequency stability and resource identifier consistency, and are used to reflect the behavior mode of attack behavior continuously acting on a single logical resource in a low-intensity manner in a cross-cycle.

3. The method of claim 1, wherein the method further comprises: S2 is specifically: According to the determined multiple low-frequency interleaved access behavior characteristics, the access behaviors with the same resource identifier are arranged in ascending order of access timestamp, a backtracking time window length is set based on each group of access behavior sequence, an access behavior set covering multiple non-continuous time periods is extracted through time series backtracking operation, and an access behavior time linked list is constructed, which is used to represent the cross-cycle distribution state of access behavior in time dimension; Based on the resource identifier corresponding to each access behavior in the access behavior time chain table, resource object merging strategies are performed using resource path structure similarity, namespace level mapping and visitor identifier consistency, resource identifiers are normalized, resource object logical graphs are constructed, logically adjacent but encoded different resource identifiers are connected in the graph, and semantic integration between resources is realized. Based on the access behavior time chain table and the resource object logical graph, based on the time sequence relationship between the access behaviors and the semantic continuity of the resource identifiers, the context semantic nesting mechanism is called, the access behaviors with consistent access frequency distribution patterns, strong access path structure repetition and uniform namespace of access targets are combined into context nesting units, and all context nesting units are sequentially connected in time order to construct a cross-period risk assessment path with continuity and context association, which is used to represent the fusion characteristics of attack behaviors in time span and resource logical chain.

4. The method of claim 1, wherein the method further comprises: S3 specifically includes the following steps: S301, converting the constructed cross-period risk assessment path into a graph structure data, wherein each access node is constructed as a three-dimensional quantitative vector with resource identifier, access timestamp and access frequency as feature dimensions, and an adjacency matrix is constructed according to the time sequence and resource logical connection relationship between the access nodes to form the input graph structure of the graph neural network; S302, using the graph neural network and the residual attention structure to process the graph structure, performing node feature propagation and residual superposition operation in each round of propagation, while introducing an attention mechanism to allocate the weight of the connection between nodes, and dynamically updating the context representation of the node, and extracting the path behavior representation vector of the access node in the cross-period risk assessment path; S303, generating a path behavior aggregation parameter by a vector convergence function, the path behavior aggregation parameter is composed of a logical intensity parameter and a cross-time jump abnormal parameter, the logical intensity parameter is used to describe the resource dependence strength between access nodes, and the cross-time jump abnormal parameter is used to describe the time span change and access frequency mutation degree between access nodes.

5. The method of claim 4, wherein the method further comprises: S302 specifically includes: In the initialization stage of the graph neural network, an initial feature representation is assigned to each access node, the initial feature representation is composed of a three-dimensional quantitative vector composed of resource identifier encoding, access timestamp embedding and access frequency value, and a connection relationship graph between nodes is established combined with the adjacency matrix; In each round of graph neural network propagation, the feature propagation operation is performed on the received adjacent node features of the current node according to the adjacency matrix, and then the propagated features and the previous round features of the node are calculated by residual superposition to ensure the depth consistency of the feature expressions of the upper and lower rounds and retain the original feature semantics; Based on the feature propagation and residual superposition, an attention mechanism is introduced to calculate the attention weight according to the feature vectors of the two end nodes of each connection edge, so as to dynamically adjust the influence proportion of the adjacent nodes on the feature update of the current node, and finally update the context representation vector of each access node as the path behavior representation vector.

6. The method of claim 4, wherein the method further comprises: S303 specifically includes: The path behavior representation vector of each access node in the cross-period risk assessment path is subjected to vector stacking processing to form a multi-dimensional matrix structure, and a vector convergence function based on an average pooling and weighted fusion combination mode is set to extract the overall path feature representation; During the execution of the vector convergence function, the weight proportion of each node vector in the convergence process is adjusted based on the connection weight between nodes, and the overall path feature representation vector is calculated. Then, a dimension decomposition operation is performed on the overall path feature representation vector to extract feature sub-vectors corresponding to the resource dependency dimension and the time jump dimension; The resource dependency dimension feature sub-vector is input into the graph convolution network constructed based on the node access sequence to output a logical strength parameter; the time jump dimension feature sub-vector is input into the time variation perception network to output a cross-time jump anomaly parameter, forming a path behavior aggregation parameter.

7. The method of claim 1, wherein the method further comprises: S4 specifically comprises the following steps: S401, based on the path behavior aggregation parameter, a nonlinear mapping relationship is constructed, the logical strength parameter and the cross-time jump anomaly parameter are taken as input variables, a multi-dimensional nonlinear feature transformation process is constructed relying on a multi-layer perception network structure and an activation function, and a risk score value is output, which is used to quantify the potential attack risk of the access path in the resource dependency and time jump dimensions; S402, according to the comparison between the risk score value and the pre-defined risk level determination threshold, the belonging position of the risk score value in the multi-level risk level interval is determined, wherein the risk level determination threshold is constructed with multiple interval boundaries according to the distribution density of the risk score value, which is used to divide the trigger range of three types of protection strategies, i.e., transparent record, strengthened verification and freezing operation; S403, the corresponding protection strategy is generated according to the comparison result of the risk level determination threshold, if the risk score value is lower than the first threshold, a transparent record strategy is generated, if it is between the first threshold and the second threshold, a strengthened verification strategy is generated, and if it is higher than the second threshold, a freezing operation strategy is generated, and the strategy label form is associated with the risk score value to output, forming a mapping relationship and a strategy optimization linkage closed loop.

8. The method of claim 7, wherein the method further comprises: S401 specifically comprises: The logical strength parameter and the cross-time jump anomaly parameter in the path behavior aggregation parameter are normalized to convert the two types of input variables into expression forms in a unified numerical interval, and the normalized logical strength parameter and cross-time jump anomaly parameter are combined into a two-dimensional input vector, which is input into the input layer of the multi-layer perception network to initialize the nonlinear feature mapping process; The two-dimensional input vector is subjected to weight weighting calculation, nonlinear activation function processing and hidden layer feature fusion operation through the multi-layer perception network structure to complete the nonlinear mapping of high-dimensional feature expression in the multi-layer network structure, wherein the activation function adopts a rectified linear unit to enhance the learning ability of the model to complex mapping relationships; The high-dimensional feature expression in the output layer of the multi-layer perception network is mapped to a single risk score value, which is used to represent the potential attack risk strength of the path behavior aggregation parameter in the resource dependency dimension and the time jump dimension, and serves as the basis for subsequent risk level determination and protection strategy generation.

9. The method of claim 1, wherein the method further comprises: S5 specifically comprises: The protection strategy execution result is collected, and the risk score value and actual security state feedback corresponding to each transparent record, reinforcement verification and freezing operation are extracted. An error evaluation model based on score deviation is constructed, the error distribution of the current nonlinear mapping relationship in different score intervals is calculated, the weight parameters in the multi-layer perception network structure are adjusted by backward propagation based on the error distribution, and the adaptive update of the nonlinear mapping relationship is realized. After the weight parameter update of the nonlinear mapping relationship is completed, the risk rating determination threshold is reconstructed according to the risk score value distribution change before and after the update, the positions of the first threshold and the second threshold are dynamically adjusted according to the latest score density, the segmented interval more conforming to the score characteristics is constructed, and the trigger boundary of the three protection strategies of transparent record, reinforcement verification and freezing operation is finely divided. Combined with the statistical characteristics of the high-risk path in the strategy execution result, the behavior participation intensity and the cooperative correlation degree of the access nodes in the cross-period risk assessment path are identified, the connection weight between the nodes in the path structure is dynamically regulated, the sensitivity of the node relationship strength model to the high-risk path structure is improved, and the cross-period risk assessment path structure and the nonlinear mapping relationship are cooperatively optimized in the protection strategy generation mechanism.

Images