Network security situation awareness method based on artificial intelligence

Abstract

The invention discloses a network security situation awareness method based on artificial intelligence, and the method comprises the following steps: collecting multi-source heterogeneous data, and generating a standardized data set; spatial-temporal feature decoupling is carried out, and spatial-temporal dimension features are separated; fusing the time-space cross attention, and outputting a fused time-space feature vector; constructing a causal inference engine, and outputting a dynamic causal graph and an anti-fact inference result set; constructing a dynamic risk propagation model, and outputting a whole asset risk value matrix and a risk propagation path diagram; generating a situation quantization matrix, constructing an adversarial training decision network, and outputting a defense strategy set verified by adversarial training; automatically generating a strategy; and a man-machine cooperative verification closed loop is realized. According to the method, dynamic reconstruction of a threat propagation path is realized through spatial-temporal feature decoupling and a causal reasoning engine, and a risk positioning error is reduced; and the adversarial training decision network is combined, so that the misjudgment rate of the defense strategy in the simulation APT attack test is reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and particularly relates to a network security situation awareness method based on artificial intelligence. BACKGROUND

[0002] The current network security situation awareness system generally adopts an analysis framework based on a rule engine or a machine learning model, which can realize basic threat detection, but directly fuses space-time dimension data, causing periodic traffic patterns and topological correlation characteristics to interfere with each other, reducing the sensitivity of anomaly detection; the existing risk propagation model relies on a preset rule library and cannot dynamically capture the causal transmission path of a new attack chain; the defense strategy generation lacks adversarial verification, and the misjudgment rate will increase when facing advanced escape techniques. SUMMARY

[0003] Therefore, the present application provides a network security situation awareness method based on artificial intelligence to solve the problems in the prior art.

[0004] In order to achieve the above purpose, the present application provides the following technical scheme:

[0005] A network security situation awareness method based on artificial intelligence, comprising the following steps:

[0006] Step 1: collecting multi-source heterogeneous data, and performing preprocessing and standardization operations on the collected data to generate a standardized data set;

[0007] Step 2: decoupling the space-time features of the preprocessed standardized data set to separate the space-time dimension features;

[0008] Step 3: fusing the space-time cross attention; and outputting the fused space-time feature vector;

[0009] Step 4: constructing a causal reasoning engine, establishing causal relationships between variables, inputting the space-time feature vector output in step 3 and the historical event log into the causal reasoning engine, and outputting a dynamic causal graph and a counterfactual reasoning result set;

[0010] Step 5: constructing a dynamic risk propagation model, calculating node risk and risk transmission, and based on the dynamic causal graph and the counterfactual reasoning result set, outputting a full asset risk value matrix and a risk propagation path graph;

[0011] Step 6: generating a situation quantization matrix, constructing an adversarial training decision network, converting risk into an operable index, and improving decision robustness through adversarial training; and finally outputting a defense strategy set verified by adversarial training;

[0012] Step 7: Based on the output-based situation quantization matrix, defense strategy, and real-time collected network state data, the complex analysis result is converted into intuitive operation guidance, and the strategy is automatically generated;

[0013] Step 8: Man-machine cooperative verification closed loop.

[0014] Further: The collection of multi-source heterogeneous data is mainly realized by deploying traffic probes, log collectors, and threat intelligence interfaces, which can comprehensively capture network traffic, device logs, and external threat data, and preliminarily integrate structured and unstructured data;

[0015] The collected data is cleaned, formatted, and unstructured logs are processed; at the same time, the asset label is associated and supplemented to generate a standardized data set.

[0016] Further: The processing of step 2 includes:

[0017] In the time dimension, the traffic indicators are counted by sliding window, and the periodic characteristics are extracted by Fourier transform;

[0018] In the spatial dimension, based on the network topology mapping asset location, the asset fingerprint is constructed; finally, the space-time features are separated into independent variables.

[0019] Further: When the space-time cross-attention fusion in step 3 is performed, a causal mask matrix needs to be constructed, and non-temporal dependencies are filtered to generate an attention weight matrix, highlighting the key associations in the space-time dimension; weighted combination of time and space features forms a unified space-time representation.

[0020] Further: The specific implementation process of step 4 is to scan the conditional independence between variables to generate an initial causal graph; simulate intervention operations to calculate the attack propagation probability change after intervention; recalculate the causal strength β every n minutes to reflect the causal effectiveness in the latest threat scenario; generate a weighted directed acyclic graph to label key causal paths.

[0021] Further: In step 5, when a new attack is detected, a virtual node is automatically inserted and the causal graph is updated, and the risk propagation network is reconstructed; the high-risk link is marked in the risk propagation path graph.

[0022] Further: The node risk calculation formula is: Node risk = Inherent vulnerability value × Threat exposure + Upstream risk transmission value;

[0023] The "threat exposure" is determined by asset importance + recent access frequency;

[0024] The risk transmission calculation formula is: Transmission value = Σ (Upstream node risk × Causal strength β × Path attenuation factor); wherein, the path attenuation factor decreases exponentially with the number of hops.

[0025] Further: the risk value matrix output by step 5 is subjected to situation quantification together with a propagation path and a defense action library to generate a multi-dimensional situation matrix; the multi-dimensional situation matrix includes a risk level, an attack surface width and a defense effectiveness.

[0026] Further: the adversarial training decision network adopts a bidirectional adversarial framework, including a basic perception layer, an adversarial generation module, a defense decision main network and a dynamic adversarial training mechanism.

[0027] The basic perception layer is an input interface and can access multi-source heterogeneous data streams; a feature encoder can compress high-dimensional sparse data into low-dimensional semantic representations.

[0028] The adversarial generation module can simulate advanced persistent threat behavior patterns and generate adversarial samples approximating real attacks.

[0029] The defense decision main network adopts a hierarchical architecture and outputs a three-dimensional risk vector; the hierarchical architecture includes a bottom layer, a middle layer and a top layer; the bottom layer is a multi-modal feature fusion layer; the middle layer is a hybrid time series modeling unit; and the top layer is a Bayesian inference guide engine.

[0030] The dynamic adversarial training mechanism includes: maximizing the classification accuracy of real samples and minimizing the misjudgment rate of adversarial samples; maximizing the error classification probability of the main network for synthetic samples; introducing an attention mechanism to focus on key adversarial dimensions; and inserting a gradient penalty term in the backpropagation phase.

[0031] Further: when automatically generating a strategy, a preset action can be triggered according to the risk level, and a suboptimal strategy can be recommended in combination with the adversarial training result.

[0032] The application has the following advantages: the application realizes dynamic reconstruction of threat propagation paths by decoupling spatiotemporal features and a causal reasoning engine, reduces risk positioning errors, and combines an adversarial training decision network to reduce the misjudgment rate of defense strategies in APT attack simulation tests.

[0033] Other features and advantages of the application will be set forth in the following description, and in part will become apparent to those skilled in the art from the description, or can be learned by practice of the application. BRIEF DESCRIPTION OF DRAWINGS

[0034] In order to more intuitively illustrate the prior art and the present application, exemplary drawings are given below. It should be understood that the specific shapes, structures shown in the drawings should not be regarded as limiting conditions in the implementation of the present application; for example, based on the technical concepts disclosed in the present application and the exemplary drawings, those skilled in the art can easily make routine adjustments or further optimizations to the increase / decrease / attribute division of certain units (components), specific shapes, positional relationships, connection modes, size ratio relationships, etc.

[0035] Figure 1 An implementation flowchart of an artificial intelligence-based network security situation awareness method is provided for an embodiment of the present application. DETAILED DESCRIPTION

[0036] The embodiments of the present application are illustrated by the specific embodiments below, and those skilled in the art can easily understand other advantages and effects of the present application from the content disclosed in the specification. Obviously, the described embodiments are part of the embodiments of the present application, not all the embodiments. It should be understood that these embodiments are only for further illustration of the present application, and cannot be understood as a limitation on the protection scope of the present application. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the protection scope of the present application.

[0037] Please refer to Figure 1 An artificial intelligence-based network security situation awareness method includes the following steps:

[0038] Step 1: Collecting multi-source heterogeneous data, and pre-processing and standardizing the collected data.

[0039] By deploying traffic probes, log collectors and threat intelligence interfaces, network traffic, device logs and external threat data are comprehensively captured, and structured (such as syslog) and unstructured data (such as text logs) are preliminarily integrated. The collected data needs to be standardized to support subsequent analysis, so it enters the preprocessing stage.

[0040] The collected data is cleaned, formatted, and unstructured logs are processed through NLP. At the same time, based on DNS reverse resolution and CMDB association, asset labels are supplemented, and a standardized data set is generated. The pre-processed data needs to separate the space-time dimension features.

[0041] Step 2: Decoupling the space-time features of the pre-processed standardized data set, separating the space-time dimension features.

[0042] In the time dimension, the sliding window is used to count the traffic indicators (such as the number of connections per second), and the Fourier transform is used to extract periodic features. In the spatial dimension, based on the network topology mapping asset location, combined with CPE matching and port scanning, asset fingerprints are constructed. Finally, the space-time features are separated into independent variables, providing a focused perspective for time series modeling.

[0043] Step 3: Fuse the spatio-temporal cross-attention; construct a causal mask matrix to prevent future information leakage and filter non-temporal dependencies, generate an attention weight matrix that highlights key associations in the spatio-temporal dimensions; weight and combine temporal and spatial features to form a unified spatio-temporal representation; and output the fused spatio-temporal feature vector.

[0044] Step 4: Build a causal reasoning engine to establish causal relationships between variables, support counterfactual reasoning and risk attribution.

[0045] Input the spatio-temporal feature vector output from Step 3 and the historical event log into the causal reasoning engine, use the PC algorithm to scan the conditional independence between variables, generate an initial causal graph; simulate intervention operations (such as closing high-risk ports) to calculate the attack propagation probability changes after intervention; recalculate the causal strength β every hour to reflect the causal effectiveness in the latest threat scenario; generate a weighted directed acyclic graph (DAG) to label key causal paths; and output the dynamic causal graph (including nodes, edges, and causal strength β) and the counterfactual reasoning result set.

[0046] Step 5: Build a dynamic risk propagation model to quantify asset risk and simulate threat diffusion processes; input the causal graph and causal strength β output from Step 4, vulnerability library, and threat intelligence (providing inherent vulnerability scores); and calculate node risk and risk transmission. When a new attack is detected, automatically insert a virtual node and update the causal graph, reconstruct the risk propagation network, and finally output the full asset risk value matrix and risk propagation path graph.

[0047] High-risk links are marked in the risk propagation path graph.

[0048] The node risk calculation formula is: Node Risk = Inherent Vulnerability Value x Threat Exposure + Upstream Risk Transmission Value;

[0049] "Threat Exposure" is determined by asset importance + recent access frequency;

[0050] The risk transmission calculation formula is: Transmission Value = Σ (Upstream Node Risk x Causal Strength β x Path Attenuation Factor);

[0051] The path attenuation factor decreases exponentially with the number of hops (e.g., one hop 0.9, two hops 0.8);

[0052] Step 6: Generate a situation quantization matrix, build an adversarial training decision network, convert risk into actionable indicators, and improve decision robustness through adversarial training.

[0053] Based on the risk value matrix and propagation path output from Step 5 and the defense action library (isolation / throttling / honeypot / patching, etc.), perform situation quantization to generate a multi-dimensional situation matrix.

[0054] The generation of the multi-dimensional posture matrix includes: risk level (based on risk value threshold division); attack surface breadth (number of assets under threat); defense effectiveness (coverage rate of existing control measures);

[0055] The purpose of the adversarial training decision network is to build an intelligent decision hub with dynamic game ability. By simulating the continuous confrontation between attacker strategies and defense models, the limitations of traditional static feature engineering are broken through, and active discovery and accurate response to unknown threats are realized.

[0056] The adversarial training decision network adopts a bidirectional attack and defense framework, including a basic perception layer, an adversarial generation module, a defense decision main network, and a dynamic adversarial training mechanism.

[0057] The basic perception layer is an input interface that can access multiple heterogeneous data streams, including standardized spatiotemporal feature vectors processed by steps 1-3, asset relationship graph embedding vectors, and threat intelligence metadata.

[0058] The feature encoder can compress high-dimensional sparse data into low-dimensional semantic representation, such as GraphSAGE processing graph data and BiLSTM encoding time series features.

[0059] The adversarial generation module can simulate advanced persistent threat (APT) behavior patterns and generate adversarial samples that approach real attacks.

[0060] Based on the GAN idea, an attack strategy generator is constructed, which inputs the historical attack success case library (including TTPs tactical labels); combined with the knowledge graph topology, it automatically combines the attack sequence along the "reconnaissance → lateral movement → privilege maintenance" path; outputs adversarial samples such as synthetic traffic features and pseudo-normal behavior trajectories.

[0061] The defense decision main network adopts a hierarchical architecture and outputs a three-dimensional risk vector, which is the attack type probability, the set of affected assets, and the emergency priority.

[0062] Among them, the bottom layer is a multi-modal feature fusion layer (fusing spatiotemporal features, graph association, and CVSS scores); the middle layer is a hybrid time series modeling unit (LSTM captures short-term mutations + Transformer focuses on long-term evolution); the top layer is a Bayesian inference engine (integrates confidence, correlation strength, and vulnerability severity to calculate risk probability distribution).

[0063] The dynamic adversarial training mechanism includes: maximizing the classification accuracy of real samples & minimizing the misclassification rate of adversarial samples; maximizing the error classification probability of the main network on synthetic samples; introducing an attention mechanism to focus on key adversarial dimensions (such as specific port scanning frequency, abnormal login period); and inserting a gradient penalty term in the backpropagation phase to prevent collapse.

[0064] And finally output the defense strategy set verified by the adversarial training.

[0065] Step 7: Based on the situation matrix output in step 6, the defense strategy and the real-time collected network state data, the complex analysis result is converted into intuitive operation guide, and the strategy is automatically generated.

[0066] The strategy is automatically generated according to the risk level to trigger the preset action, and the suboptimal strategy is recommended in combination with the adversarial training result.

[0067] Step 8: Man-machine cooperation verification closed loop, including expert verification and adjustment, experience feedback mechanism and closed loop verification mechanism.

[0068] Among them, the expert verification and adjustment is to audit and optimize the automatically generated strategy by the safety expert; the experience feedback mechanism is to feed back the manual decision experience to the cause and effect reasoning engine to optimize the dynamically updated strategy; the closed loop verification mechanism is to form the continuous iteration closed loop of "AI suggestion-human confirmation-model optimization".

[0069] The above only describes the preferred embodiments of the present application and does not limit the present application. Any modification, equivalent replacement and improvement made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A network security situation awareness method based on artificial intelligence, characterized in that, Includes the following steps: Step 1: Collect multi-source heterogeneous data, and preprocess and standardize the collected data to generate a standardized dataset; Step 2: Decouple the spatiotemporal features of the preprocessed standardized dataset and separate the spatiotemporal dimensional features; Step 3: Fuse the spatiotemporal cross-attention; and output the fused spatiotemporal feature vector; Step 4: Build a causal reasoning engine, establish causal relationships between variables, input spatiotemporal feature vectors and historical event logs into the causal reasoning engine, and output a dynamic causal graph and a counterfactual reasoning result set; Step 5: Construct a dynamic risk propagation model, calculate node risks and risk transmission, and output the total asset risk value matrix and risk propagation path diagram based on the dynamic causal graph and counterfactual reasoning result set; Step 6: Generate a situation quantification matrix and construct an adversarial training decision network to transform risks into actionable indicators and improve decision robustness through adversarial training; And finally output a set of defense strategies that have been validated through adversarial training; Step 7: Based on the output situation quantification matrix, defense strategy, and real-time network status data, transform the complex analysis results into intuitive operation guidelines and automatically generate strategies; Step 8: Human-machine collaborative verification closed loop.

2. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, The collection of multi-source heterogeneous data is mainly achieved by deploying traffic probes, log collectors, and threat intelligence interfaces, which can comprehensively capture network traffic, device logs, and external threat data, and initially integrate structured and unstructured data. The collected data is cleaned, formatted, and unstructured logs are processed; at the same time, asset tags are associated and supplemented to generate a standardized dataset.

3. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, The processing in step 2 includes: In the time dimension, flow indicators are statistically analyzed using a sliding window, and periodic features are extracted using Fourier transform. In the spatial dimension, asset fingerprints are constructed based on network topology mapping of asset locations; ultimately, spatiotemporal features are separated into independent variables.

4. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, In step 3, when the spatiotemporal cross-attention is fused, a causal mask matrix needs to be constructed, non-temporal dependencies are filtered out, an attention weight matrix is ​​generated, and key associations in the spatiotemporal dimension are highlighted. By weighting and merging temporal and spatial characteristics, a unified spatiotemporal representation is formed.

5. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, The specific implementation process of step 4 is as follows: scan the conditional independence between variables to generate an initial causal graph; simulate intervention operations and calculate the change in attack propagation probability after intervention; recalculate the causal strength β every n minutes to reflect the causal effectiveness under the latest threat scenario; generate a weighted directed acyclic graph and mark key causal paths.

6. The network security situation awareness method based on artificial intelligence according to claim 1, characterized in that, In step 5, when a new type of attack is detected, virtual nodes are automatically inserted and the causal graph is updated to reconstruct the risk propagation network. High-risk links are marked on the risk transmission path diagram.

7. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, The formula for calculating node risk is: Node risk = Inherent vulnerability value × Threat exposure + Upstream risk transmission value; "Threat exposure" is determined by the asset's importance and the frequency of recent visits; The formula for calculating risk transmission is: Transmission value = Σ (Upstream node risk × Causality intensity β × Path decay factor); where the path decay factor decreases exponentially with the number of hops.

8. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, Step 5 outputs a risk value matrix, propagation path, and defense action library to quantify the situation and generate a multi-dimensional situation matrix; the multi-dimensional situation matrix includes risk level, attack surface breadth, and defense effectiveness.

9. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, The adversarial training decision network adopts an offensive and defensive two-way adversarial framework, including a basic perception layer, an adversarial generation module, a defense decision main network, and a dynamic adversarial training mechanism. The basic perception layer serves as the input interface, enabling access to multi-source heterogeneous data streams. The feature encoder can compress high-dimensional sparse data into low-dimensional semantic representations. The adversarial generation module can simulate advanced persistent threat behavior patterns and generate adversarial samples that closely resemble real attacks. The defense decision-making main network adopts a hierarchical architecture and outputs a three-dimensional risk vector; The multi-layer architecture includes a bottom layer, a middle layer, and a top layer; The bottom layer is a multimodal feature fusion layer; The middle layer consists of hybrid temporal modeling units; The top layer is a Bayesian inference engine; The dynamic adversarial training mechanism includes: maximizing the classification accuracy of real samples and minimizing the misclassification rate of adversarial samples; maximizing the misclassification probability of the main network for synthetic samples; introducing an attention mechanism to focus on key adversarial dimensions; and inserting a gradient penalty term during the backpropagation stage.

10. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, When automatically generating strategies, it can trigger preset actions based on risk levels and recommend suboptimal strategies based on adversarial training results.

Images