An artificial intelligence-based network security situation awareness method

Abstract

The application discloses a network security situation awareness method based on artificial intelligence, comprising the following steps: collecting multi-source heterogeneous data to generate a standardized data set; decoupling space-time characteristics to separate space-time dimension characteristics; fusing space-time cross attention to output fused space-time characteristic vectors; constructing a causal reasoning engine to output a dynamic causal diagram and a counterfactual reasoning result set; constructing a dynamic risk propagation model to output a full asset risk value matrix and a risk propagation path diagram; generating a situation quantization matrix, constructing an adversarial training decision network, and outputting a defense strategy set verified by adversarial training; automatically generating a strategy; and man-machine collaborative verification closed loop. Through space-time characteristic decoupling and the causal reasoning engine, the application realizes dynamic reconstruction of a threat propagation path, reduces risk positioning error; in combination with the adversarial training decision network, the application makes the defense strategy have a reduced misjudgment rate in the simulation APT attack test.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a network security situation awareness method based on artificial intelligence. Background Technology

[0002] Current cybersecurity situation awareness systems generally adopt analysis frameworks based on rule engines or machine learning models. Although they can achieve basic threat detection, traditional methods directly integrate spatiotemporal dimension data, which leads to mutual interference between periodic traffic patterns and topological correlation features, reducing the sensitivity of anomaly detection. Existing risk propagation models rely on preset rule bases and cannot dynamically capture the causal transmission path of new attack chains. Defense strategy generation lacks adversarial verification, which increases the false positive rate when facing advanced evasion techniques. Summary of the Invention

[0003] Therefore, this invention provides a network security situation awareness method based on artificial intelligence to solve the problems in the prior art.

[0004] To achieve the above objectives, the present invention provides the following technical solution:

[0005] An artificial intelligence-based method for cybersecurity situational awareness includes the following steps:

[0006] Step 1: Collect multi-source heterogeneous data, and preprocess and standardize the collected data to generate a standardized dataset;

[0007] Step 2: Decouple the spatiotemporal features of the preprocessed standardized dataset and separate the spatiotemporal dimensional features;

[0008] Step 3: Fuse the spatiotemporal cross-attention; and output the fused spatiotemporal feature vector;

[0009] Step 4: Build a causal reasoning engine, establish causal relationships between variables, input the spatiotemporal feature vector and historical event logs output in Step 3 into the causal reasoning engine, and output a dynamic causal graph and a counterfactual reasoning result set;

[0010] Step 5: Construct a dynamic risk propagation model, calculate node risks and risk transmission, and output the total asset risk value matrix and risk propagation path diagram based on the dynamic causal graph and counterfactual reasoning result set;

[0011] Step 6: Generate a situation quantification matrix, construct an adversarial training decision network, transform risks into actionable indicators, and improve decision robustness through adversarial training; and finally output a set of defense strategies verified by adversarial training.

[0012] Step 7: Based on the output situation quantification matrix, defense strategy, and real-time network status data, transform the complex analysis results into intuitive operation guidelines and automatically generate strategies;

[0013] Step 8: Human-machine collaborative verification closed loop.

[0014] Furthermore: The collection of multi-source heterogeneous data is mainly achieved by deploying traffic probes, log collectors, and threat intelligence interfaces, which can comprehensively capture network traffic, device logs, and external threat data, and initially integrate structured and unstructured data;

[0015] The collected data is cleaned, formatted, and unstructured logs are processed; at the same time, asset tags are associated and supplemented to generate a standardized dataset.

[0016] Furthermore, step 2 includes the following processing:

[0017] In the time dimension, flow indicators are statistically analyzed using a sliding window, and periodic features are extracted using Fourier transform.

[0018] In the spatial dimension, asset fingerprints are constructed based on network topology mapping of asset locations; ultimately, spatiotemporal features are separated into independent variables.

[0019] Furthermore: In step 3, when the spatiotemporal cross-attention is fused, a causal mask matrix needs to be constructed, non-temporal dependencies are filtered out, an attention weight matrix is ​​generated, and key correlations in the spatiotemporal dimension are highlighted; time and space features are weighted and merged to form a unified spatiotemporal representation.

[0020] Furthermore, the specific implementation process of step 4 is as follows: scan the conditional independence between variables to generate an initial causal graph; simulate intervention operations and calculate the change in attack propagation probability after intervention; recalculate the causal strength β every n minutes to reflect the causal effectiveness under the latest threat scenario; generate a weighted directed acyclic graph and mark key causal paths.

[0021] Furthermore: In step 5, when a new type of attack is detected, virtual nodes are automatically inserted and the causal graph is updated to reconstruct the risk propagation network; high-risk links are marked in the risk propagation path graph.

[0022] Furthermore: The formula for calculating node risk is: Node Risk = Inherent Vulnerability Value × Threat Exposure Value + Upstream Risk Transmission Value;

[0023] "Threat exposure" is determined by the asset's importance plus the frequency of recent visits;

[0024] The risk transmission calculation formula is: Transmission value = Σ (Upstream node risk × Causality intensity β × Path decay factor); where the path decay factor decreases exponentially with the number of hops.

[0025] Further: The risk value matrix output from step 5, along with the propagation path and defense action library, is used to quantify the situation and generate a multi-dimensional situation matrix; the multi-dimensional situation matrix includes risk level, attack surface breadth, and defense effectiveness.

[0026] Furthermore: the adversarial training decision network adopts an offensive and defensive two-way adversarial framework, including a basic perception layer, an adversarial generation module, a defense decision main network, and a dynamic adversarial training mechanism;

[0027] The basic perception layer serves as the input interface, enabling access to multi-source heterogeneous data streams. The feature encoder can compress high-dimensional sparse data into low-dimensional semantic representations.

[0028] The adversarial generation module can simulate advanced persistent threat behavior patterns and generate adversarial samples that closely resemble real attacks.

[0029] The defense decision-making main network adopts a layered architecture and outputs a three-dimensional risk vector; the multi-layered architecture includes a bottom layer, a middle layer, and a top layer; the bottom layer is a multimodal feature fusion layer; the middle layer is a hybrid temporal modeling unit; and the top layer is a Bayesian inference engine.

[0030] The dynamic adversarial training mechanism includes: maximizing the classification accuracy of real samples and minimizing the misclassification rate of adversarial samples; maximizing the misclassification probability of the main network for synthetic samples; introducing an attention mechanism to focus on key adversarial dimensions; and inserting a gradient penalty term during the backpropagation stage.

[0031] Furthermore, when automatically generating strategies, it can trigger preset actions based on risk levels and recommend suboptimal strategies based on adversarial training results.

[0032] The present invention has the following advantages: The present invention achieves dynamic reconstruction of threat propagation path through spatiotemporal feature decoupling and causal reasoning engine, thereby reducing risk location error; combined with adversarial training decision network, the false positive rate of defense strategy is reduced in simulated APT attack test.

[0033] Other features and advantages of the invention will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the invention. Attached Figure Description

[0034] To more intuitively illustrate the prior art and this application, exemplary drawings are provided below. It should be understood that the specific shapes and structures shown in the drawings should not generally be regarded as limiting conditions for implementing this application; for example, based on the technical concept disclosed in this application and the exemplary drawings, those skilled in the art are capable of making conventional adjustments or further optimizations to the addition / reduction / classification, specific shapes, positional relationships, connection methods, size ratios, etc. of certain units (components).

[0035] Figure 1 This is a flowchart illustrating an implementation of an artificial intelligence-based network security situation awareness method, as provided in one embodiment of this application. Detailed Implementation

[0036] The following specific embodiments illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. It should be understood that these embodiments are merely for further explanation of the present invention and should not be construed as limiting the scope of protection of the present invention. Technical engineers in the field can make some non-essential improvements and adjustments to the present invention based on the above-described content. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0037] Please see Figure 1 An artificial intelligence-based method for cybersecurity situational awareness includes the following steps:

[0038] Step 1: Collect multi-source heterogeneous data and perform preprocessing and standardization operations on the collected data.

[0039] By deploying traffic probes, log collectors, and threat intelligence interfaces, network traffic, device logs, and external threat data are comprehensively captured, and structured (such as syslog) and unstructured (such as text logs) data are initially integrated. The collected data needs to be standardized to support subsequent analysis, so it enters the preprocessing stage.

[0040] The collected data is cleaned and formatted, and unstructured logs are processed using NLP. At the same time, asset tags are supplemented based on DNS reverse lookup and association with CMDB to generate a standardized dataset. The preprocessed data needs to be separated to separate spatiotemporal features.

[0041] Step 2: Decouple the spatiotemporal features of the preprocessed standardized dataset and separate the spatiotemporal dimension features.

[0042] In the time dimension, traffic metrics (such as connections per second) are statistically analyzed using a sliding window, and periodic features are extracted using Fourier transform. In the spatial dimension, asset locations are mapped based on network topology, and asset fingerprints are constructed by combining CPE matching and port scanning. Finally, the spatiotemporal features are separated into independent variables, providing a focused perspective for time series modeling.

[0043] Step 3: By fusing spatiotemporal cross-attention; constructing a causal mask matrix to prevent future information leakage and filter non-temporal dependencies, generating an attention weight matrix to highlight key correlations in the spatiotemporal dimension; weighted merging of temporal and spatial features to form a unified spatiotemporal representation; and outputting the fused spatiotemporal feature vector.

[0044] Step 4: Build a causal reasoning engine to establish causal relationships between variables and support counterfactual reasoning and risk attribution.

[0045] The spatiotemporal feature vector and historical event logs output from step 3 are input into the causal inference engine. The PC algorithm is used to scan the conditional independence between variables and generate an initial causal graph. The intervention operation (such as closing high-risk ports) is simulated, and the change in attack propagation probability after the intervention is calculated. The causal strength β is recalculated every hour to reflect the causal effectiveness under the latest threat scenario. A weighted directed acyclic graph (DAG) is generated and key causal paths are marked. The dynamic causal graph (including nodes, edges and causal strength β) and the counterfactual inference result set are output.

[0046] Step 5: Construct a dynamic risk propagation model to quantify asset risks and simulate the threat diffusion process; input the causal graph and causal strength β, vulnerability database, and threat intelligence (providing inherent vulnerability scores) output in Step 4; calculate node risks and risk transmission; when a new type of attack is detected, automatically insert virtual nodes and update the causal graph, reconstruct the risk propagation network, and finally output the full asset risk value matrix and risk propagation path diagram.

[0047] High-risk links are marked on the risk transmission path diagram.

[0048] The formula for calculating node risk is: Node risk = Inherent vulnerability value × Threat exposure + Upstream risk transmission value;

[0049] "Threat exposure" is determined by the asset's importance plus the frequency of recent visits;

[0050] The formula for calculating risk transmission is: Transmission value = Σ (Upstream node risk × Causality intensity β × Path decay factor);

[0051] The path decay factor decreases exponentially with the number of hops (e.g., 0.9 for one hop, 0.8 for two hops).

[0052] Step 6: Generate a situation quantification matrix and construct an adversarial training decision network to transform risks into actionable indicators and improve decision robustness through adversarial training.

[0053] Based on the risk value matrix, propagation path, and defense action library (isolation / rate limiting / honeypot / patching, etc.) output from step 5, situation quantification is performed to generate a multi-dimensional situation matrix.

[0054] The generated multi-dimensional situation matrix includes: risk level (classified based on risk value thresholds); attack surface breadth (number of threatened assets); and defense effectiveness (coverage of existing control measures).

[0055] The purpose of adversarial training decision networks is to build an intelligent decision-making center with dynamic game-playing capabilities. By simulating the continuous confrontation between attacker strategies and defense models, it breaks through the limitations of traditional static feature engineering and achieves proactive discovery and precise response to unknown threats.

[0056] The adversarial training decision network adopts a two-way adversarial framework, including a basic perception layer, an adversarial generation module, a defense decision main network, and a dynamic adversarial training mechanism.

[0057] The basic perception layer serves as the input interface, enabling access to multi-source heterogeneous data streams, including standardized spatiotemporal feature vectors processed in steps 1-3, asset relationship graph embedding vectors, and threat intelligence metadata.

[0058] Feature encoders can compress high-dimensional sparse data into low-dimensional semantic representations. For example, GraphSAGE processes graph data, and BiLSTM encodes temporal features.

[0059] The adversarial generation module can simulate the behavioral patterns of advanced persistent threats (APTs) and generate adversarial samples that closely resemble real attacks.

[0060] An attack strategy generator is built based on the GAN concept. It takes a historical successful attack case library (including TTPs tactical tags) as input, combines the knowledge graph topology, and automatically combines attack sequences along the path of "reconnaissance → lateral movement → privilege maintenance". It outputs adversarial samples such as synthetic traffic features and pseudo-normal behavior trajectories.

[0061] The main network for defense decision-making adopts a layered architecture and outputs a three-dimensional risk vector, which includes the probability of attack type, the set of affected assets, and the emergency response priority.

[0062] The bottom layer is a multimodal feature fusion layer (integrating spatiotemporal features, graph association, and CVSS score); the middle layer is a hybrid temporal modeling unit (LSTM captures short-term mutations + Transformer focuses on long-term evolution); and the top layer is a Bayesian inference engine (combining confidence, association strength, and vulnerability severity to calculate the risk probability distribution).

[0063] The dynamic adversarial training mechanism includes: maximizing the classification accuracy of real samples and minimizing the misclassification rate of adversarial samples; maximizing the probability of the main network misclassifying synthetic samples; introducing an attention mechanism to focus on key adversarial dimensions (such as the scanning frequency of specific ports and abnormal login periods); and inserting gradient penalty terms during the backpropagation stage to prevent collapse.

[0064] And finally output a set of defense strategies that have been validated through adversarial training.

[0065] Step 7: Based on the situation matrix and defense strategy output in Step 6 and the real-time network status data, the complex analysis results are transformed into intuitive operation guidelines, and strategies are automatically generated.

[0066] The automatic strategy generation triggers preset actions based on the risk level and recommends suboptimal strategies based on the results of adversarial training.

[0067] Step 8: Human-machine collaborative verification closed loop, including expert verification and adjustment, experience feedback mechanism and closed loop verification mechanism.

[0068] Among them, expert verification and adjustment means that security experts review and optimize the automatically generated strategies; the experience feedback mechanism feeds human decision-making experience back into the causal reasoning engine to optimize the dynamically updated strategies; and the closed-loop verification mechanism forms a continuous iterative closed loop of "AI suggestion - human confirmation - model optimization".

[0069] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A network security situation awareness method based on artificial intelligence, characterized in that, Includes the following steps: Step 1: Collect multi-source heterogeneous data, and preprocess and standardize the collected data to generate a standardized dataset; Step 2: Decouple the spatiotemporal features of the preprocessed standardized dataset and separate the spatiotemporal dimensional features; Step 3: Fuse the spatiotemporal cross-attention; and output the fused spatiotemporal feature vector; In step 3, when the spatiotemporal cross-attention is fused, a causal mask matrix needs to be constructed, non-temporal dependencies are filtered out, an attention weight matrix is ​​generated, and key associations in the spatiotemporal dimension are highlighted. By weighting and merging temporal and spatial characteristics, a unified spatiotemporal representation is formed; Step 4: Build a causal reasoning engine, establish causal relationships between variables, input spatiotemporal feature vectors and historical event logs into the causal reasoning engine, and output a dynamic causal graph and a counterfactual reasoning result set; The specific implementation process of step 4 is as follows: scan the conditional independence between variables to generate an initial causal graph; simulate intervention operations and calculate the change in attack propagation probability after intervention; recalculate the causal strength β every n minutes to reflect the causal effectiveness under the latest threat scenario; generate a weighted directed acyclic graph and mark key causal paths. Step 5: Construct a dynamic risk propagation model, calculate node risks and risk transmission, and output the total asset risk value matrix and risk propagation path diagram based on the dynamic causal graph and counterfactual reasoning result set; Step 6: Generate a situation quantification matrix and construct an adversarial training decision network to transform risks into actionable indicators and improve decision robustness through adversarial training; And finally output a set of defense strategies that have been validated through adversarial training; Step 7: Based on the output situation quantification matrix, defense strategy, and real-time network status data, transform the complex analysis results into intuitive operation guidelines and automatically generate strategies; Step 8: Human-machine collaborative verification closed loop; The formula for calculating node risk is: Node risk = Inherent vulnerability value × Threat exposure + Upstream risk transmission value; "Threat exposure" is determined by the asset's importance and the frequency of recent visits; The formula for calculating risk transmission is: Transmission value = Σ (Upstream node risk × Causality intensity β × Path decay factor); where the path decay factor decreases exponentially with the number of hops.

2. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, The collection of multi-source heterogeneous data is mainly achieved by deploying traffic probes, log collectors, and threat intelligence interfaces, which can comprehensively capture network traffic, device logs, and external threat data, and initially integrate structured and unstructured data. The collected data is cleaned, formatted, and unstructured logs are processed; at the same time, asset tags are associated and supplemented to generate a standardized dataset.

3. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, The processing in step 2 includes: In the time dimension, flow indicators are statistically analyzed using a sliding window, and periodic features are extracted using Fourier transform. In the spatial dimension, asset fingerprints are constructed based on network topology mapping of asset locations; ultimately, spatiotemporal features are separated into independent variables.

4. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, In step 5, when a new type of attack is detected, virtual nodes are automatically inserted and the causal graph is updated to reconstruct the risk propagation network. High-risk links are marked on the risk transmission path diagram.

5. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, Step 5 outputs a risk value matrix, propagation path, and defense action library to quantify the situation and generate a multi-dimensional situation matrix; the multi-dimensional situation matrix includes risk level, attack surface breadth, and defense effectiveness.

6. The network security situation awareness method based on artificial intelligence according to claim 1, characterized in that, The adversarial training decision network adopts an offensive and defensive two-way adversarial framework, including a basic perception layer, an adversarial generation module, a defense decision main network, and a dynamic adversarial training mechanism. The basic perception layer serves as the input interface, enabling access to multi-source heterogeneous data streams. The feature encoder can compress high-dimensional sparse data into low-dimensional semantic representations. The adversarial generation module can simulate advanced persistent threat behavior patterns and generate adversarial samples that closely resemble real attacks. The defense decision-making main network adopts a hierarchical architecture and outputs a three-dimensional risk vector; The multi-layer architecture includes a bottom layer, a middle layer, and a top layer; The bottom layer is a multimodal feature fusion layer; The middle layer consists of hybrid temporal modeling units; The top layer is a Bayesian inference guidance engine; The dynamic adversarial training mechanism includes: maximizing the classification accuracy of real samples and minimizing the misclassification rate of adversarial samples; maximizing the misclassification probability of the main network for synthetic samples; introducing an attention mechanism to focus on key adversarial dimensions; and inserting a gradient penalty term during the backpropagation stage.

7. The method for network security situation awareness based on artificial intelligence according to claim 1, characterized in that, When automatically generating strategies, it can trigger preset actions based on risk levels and recommend suboptimal strategies based on adversarial training results.

Images