Network security threat detection method, device, equipment and storage medium

Abstract

The application discloses a network security threat detection method, device and equipment and a storage medium, and comprises the following steps: acquiring multi-source security data, preprocessing the multi-source security data, and obtaining preprocessed multi-source security data; performing feature extraction on the preprocessed multi-source security data, associating the feature extraction result, and obtaining a multi-dimensional threat feature representation; constructing a threat knowledge graph according to the multi-dimensional threat feature representation, inputting the threat knowledge graph into a preset spatio-temporal graph neural network model, and obtaining a network security threat detection result. Since the application realizes the fusion of multi-source security data, and uses the preset spatio-temporal graph neural network model to jointly infer the time sequence and spatial dependence in the threat knowledge graph, the network security threat detection result is obtained, and compared with the prior art, the detection capability and efficiency of the network security threat are improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security threat detection method, apparatus, device, and storage medium. Background Technology

[0002] With the continuous improvement of informatization, the network environment is becoming increasingly complex, and various advanced persistent threats (APTs), zero-day attacks, and variant attacks are emerging one after another. Traditional network security detection methods mainly rely on signature-based detection, rule-based detection, traditional machine learning models, or simple deep learning models.

[0003] However, once cyber attackers use unknown signatures or zero-day vulnerabilities, the signature database cannot match them, resulting in limited detection capabilities for unknown threats. Furthermore, traditional machine learning algorithms (such as SVM and random forest) and simple neural networks often generate a large number of false alarms when distinguishing between normal behavior and advanced threats due to insufficient feature dimensions and lack of correlation between features. In addition, existing network security detection methods incur high computational costs when performing correlation analysis on large-scale, multi-source heterogeneous data, leading to detection delays and making it difficult to meet real-time protection requirements.

[0004] Therefore, there is an urgent need for a network security threat detection method that can improve the detection capability and efficiency of network security threats. Summary of the Invention

[0005] The main objective of this invention is to provide a method, apparatus, device, and storage medium for detecting network security threats, aiming to solve the technical problems of insufficient detection capability and real-time performance of existing technologies for network security threats.

[0006] To achieve the above objectives, the present invention provides a network security threat detection method, the method comprising the following steps:

[0007] Acquire multi-source security data and preprocess the multi-source security data to obtain preprocessed multi-source security data;

[0008] Feature extraction is performed on the preprocessed multi-source security data, and the feature extraction results are correlated to obtain a multi-dimensional threat feature representation;

[0009] A threat knowledge graph is constructed based on the multidimensional threat feature representation, and the threat knowledge graph is input into a preset spatiotemporal graph neural network model to obtain network security threat detection results.

[0010] Optionally, after the step of constructing a threat knowledge graph based on the multidimensional threat feature representation and inputting the threat knowledge graph into a preset spatiotemporal graph neural network model to obtain network security threat detection results, the method further includes:

[0011] Based on the meta-learning mechanism, gradient information is determined using the network security threat detection results.

[0012] The model parameters of the preset spatiotemporal graph neural network model are adaptively updated based on the gradient information to obtain the updated model parameters;

[0013] Based on the updated model parameters and the network security threat detection results, an adaptive detection strategy is generated through correlation reasoning.

[0014] The updated model parameters are adjusted according to the adaptive detection strategy.

[0015] Optionally, the step of acquiring multi-source security data and preprocessing the multi-source security data to obtain preprocessed multi-source security data includes:

[0016] Collect multi-source security data, including network traffic data, system log data, and terminal behavior data;

[0017] The network traffic data, the system log data, and the terminal behavior data are time-series aligned to obtain aligned multi-source security data.

[0018] The aligned multi-source security data is subjected to feature encoding processing to obtain encoded multi-source security data;

[0019] The encoded multi-source security data is normalized to obtain preprocessed multi-source security data.

[0020] Optionally, the step of extracting features from the preprocessed multi-source security data and correlating the feature extraction results to obtain a multi-dimensional threat feature representation includes:

[0021] A hierarchical feature extraction network model is established based on the Transformer architecture. The hierarchical feature extraction network model includes convolutional network layers, long short-term memory network layers, and graph network layers.

[0022] The hierarchical feature extraction network model is used to extract features from the preprocessed multi-source security data to obtain feature extraction results.

[0023] Based on the feature extraction results, a cross-modal attention mechanism is used to correlate the feature extraction results to obtain a multidimensional threat feature representation.

[0024] Optionally, the step of using the hierarchical feature extraction network model to extract features from the preprocessed multi-source security data and obtaining feature extraction results includes:

[0025] The convolutional network layer is used to extract features from the network traffic data in the preprocessed multi-source security data to obtain the first layer of features.

[0026] The long short-term memory network layer is used to extract features from the system log data in the preprocessed multi-source security data to obtain a second layer of features.

[0027] The graph network layer is used to extract features from the terminal behavior data in the preprocessed multi-source security data to obtain the third layer of features.

[0028] The first layer features, the second layer features, and the third layer features are used as the feature extraction results.

[0029] Optionally, the step of constructing a threat knowledge graph based on the multidimensional threat feature representation and inputting the threat knowledge graph into a preset spatiotemporal graph neural network model to obtain network security threat detection results includes:

[0030] Identify the network entities and interaction relationships in the multidimensional threat feature representation, and construct a threat knowledge graph based on the network entities and interaction relationships;

[0031] The temporal patterns of the threat knowledge graph are analyzed using the temporal convolution operator in the preset spatiotemporal graph neural network model.

[0032] The topological features of the threat knowledge graph are obtained through the spatial convolution operator in the preset spatiotemporal graph neural network model;

[0033] The network security threat detection results are obtained based on the time-series pattern and the topological features.

[0034] Optionally, the step of obtaining network security threat detection results based on the time-series pattern and the topological features includes:

[0035] Threat scores are determined based on the temporal patterns and topological features;

[0036] Attack chain analysis is performed based on the threat knowledge graph and the threat score, and the attack chain path is determined based on the attack chain analysis results;

[0037] The threat score and the attack chain path are used as the results of network security threat detection.

[0038] Furthermore, to achieve the above objectives, the present invention also proposes a network security threat detection device, the device comprising:

[0039] The data acquisition module is used to acquire multi-source security data and preprocess the multi-source security data to obtain preprocessed multi-source security data.

[0040] The data processing module is used to extract features from the preprocessed multi-source security data and correlate the feature extraction results to obtain a multi-dimensional threat feature representation.

[0041] The result output module is used to construct a threat knowledge graph based on the multidimensional threat feature representation, and input the threat knowledge graph into a preset spatiotemporal graph neural network model to obtain network security threat detection results.

[0042] Furthermore, to achieve the above objectives, the present invention also proposes a network security threat detection device, the device comprising: a memory, a processor, and a network security threat detection program stored in the memory and executable on the processor, the network security threat detection program being configured to implement the steps of the network security threat detection method described above.

[0043] In addition, to achieve the above objectives, the present invention also proposes a storage medium storing a network security threat detection program, which, when executed by a processor, implements the steps of the network security threat detection method described above.

[0044] This invention discloses a method for acquiring multi-source security data, preprocessing the multi-source security data to obtain preprocessed multi-source security data, extracting features from the preprocessed multi-source security data, and associating the feature extraction results to obtain a multi-dimensional threat feature representation. A threat knowledge graph is constructed based on the multi-dimensional threat feature representation, and the threat knowledge graph is input into a preset spatiotemporal graph neural network model to obtain network security threat detection results. Because this invention extracts features from the preprocessed multi-source security data, associates the feature extraction results to obtain a multi-dimensional threat feature representation, constructs a threat knowledge graph based on the multi-dimensional threat feature representation, and uses a preset spatiotemporal graph neural network model to obtain network security threat detection results, compared to existing technologies, this invention achieves the fusion of multi-source security data and uses a preset spatiotemporal graph neural network model to perform joint reasoning on the temporal and spatial dependencies in the threat knowledge graph, thereby improving the detection capability and efficiency of network security threats. Attached Figure Description

[0045] Figure 1 This is a flowchart illustrating the first embodiment of the network security threat detection method of the present invention;

[0046] Figure 2 This is a schematic diagram of multimodal feature fusion in the network security threat detection method of the present invention;

[0047] Figure 3 This is a diagram showing the overall system architecture of the network security threat detection method of the present invention;

[0048] Figure 4 This is a flowchart illustrating the second embodiment of the network security threat detection method of the present invention;

[0049] Figure 5 This is a flowchart illustrating the third embodiment of the network security threat detection method of the present invention;

[0050] Figure 6 This is a schematic diagram illustrating the principle of the preset spatiotemporal graph neural network model in the network security threat detection method of the present invention;

[0051] Figure 7 This is a structural block diagram of the first embodiment of the network security threat detection device of the present invention;

[0052] Figure 8 This is a schematic diagram of the structure of a network security threat detection device for the hardware operating environment involved in the embodiments of the present invention.

[0053] The realization of the objective, functional features and advantages of the present invention will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0054] It should be understood that the specific embodiments described herein are for illustrative purposes only and are not intended to limit the scope of the invention.

[0055] This invention provides a method for detecting network security threats, referring to... Figure 1 , Figure 1 This is a flowchart illustrating the first embodiment of the network security threat detection method of the present invention.

[0056] In this embodiment, the network security threat detection method includes steps S10 to S30:

[0057] Step S10: Obtain multi-source security data and preprocess the multi-source security data to obtain preprocessed multi-source security data.

[0058] It should be noted that the executing entity in this embodiment can be a computer server device with data processing, network communication, and program execution functions applied in network security detection scenarios, such as a server, tablet computer, or personal computer, or an electronic device capable of performing the above functions (such as a network security threat detection device). The following uses a system containing a network security threat detection device (hereinafter referred to as the system) as an example to illustrate this embodiment and the following embodiments.

[0059] It should be explained that multi-source security data refers to a collection of raw data related to security incidents or potential threats collected from multiple different sources, levels, and formats during network security monitoring. Specifically, multi-source security data can include network traffic data, system log data, and endpoint behavior data.

[0060] It's worth noting that deep packet inspection (DPI) can be performed on network traffic through network devices (such as switches, routers, firewalls, and probes) to obtain network traffic data. Deep packet inspection refers to the data processing process that, after acquiring network packets, not only parses the packet header information (such as the 5-tuple, protocol type, and port), but also delves deeper into the payload layer to comprehensively examine and analyze application layer protocol formats, content characteristics, keywords, signatures, or behavioral patterns. Through this process, protocol characteristics, content characteristics, and abnormal behavior indicators relevant to threat detection can be extracted from network traffic.

[0061] It can obtain audit logs, security logs, operation logs, and alarm logs generated by servers, terminal hosts, security devices, operating systems, middleware, databases, or applications, standardize their formats, and obtain system log data.

[0062] This technology enables fine-grained recording of terminal behavior, yielding terminal behavior data. Fine-grained recording refers to high-resolution, item-level collection and recording of system or application behavior on the terminal side, covering, but not limited to, micro-level operational information such as process startup and exit, file read / write and deletion, registry or configuration changes, system call sequences, and user interaction events. This recording method can accurately reconstruct the complete behavioral trajectory of entities on the terminal, providing atomic-level data support for subsequent feature extraction and threat analysis.

[0063] In a specific implementation, multi-source security data can be collected, including network traffic data, system log data, and terminal behavior data. The network traffic data, system log data, and terminal behavior data are then time-aligned to obtain aligned multi-source security data. Feature encoding is performed on the aligned multi-source security data to obtain encoded multi-source security data. Finally, normalization is performed on the encoded multi-source security data to obtain preprocessed multi-source security data.

[0064] Understandably, time alignment processing can refer to aligning records from different data sources according to a unified time base, so that multi-source data collected in the same time window or at the same moment can establish a comparable time sequence relationship, eliminating time misalignment caused by clock deviation, acquisition delay or inconsistent sampling frequency.

[0065] Feature encoding processing can refer to transforming aligned multi-source security data into a numerical or vectorized representation that can be processed by machine learning models. This includes, but is not limited to, one-hot encoding of discrete features, numerical mapping of continuous features, embedding representation of text features, positional encoding of sequence features, and adjacency or attribute encoding for graph structure data.

[0066] Normalization can refer to scaling or adjusting the distribution of encoded multi-source security data to make features with different dimensions and value ranges comparable in subsequent calculations. Common methods include min-max normalization, Z-score standardization, or logarithmic transformation to avoid model bias or convergence difficulties caused by excessive numerical differences.

[0067] Step S20: Extract features from the preprocessed multi-source security data and correlate the feature extraction results to obtain a multi-dimensional threat feature representation.

[0068] To improve the detection rate of advanced persistent threats (APTs), reduce redundant computation, and ensure real-time performance, step S20 in the specific implementation includes steps S201 to S203:

[0069] Step S201: Establish a hierarchical feature extraction network model based on the Transformer architecture. The hierarchical feature extraction network model includes convolutional network layers, long short-term memory network layers, and graph network layers.

[0070] It should be explained that the Transformer architecture refers to a deep learning network structure that is entirely based on the self-attention mechanism. Its core is composed of alternating stacks of multi-head self-attention sub-layers and feedforward neural network sub-layers. By computing the dependencies between any positions in the input sequence in parallel, it achieves global context modeling. It can capture long-range dependencies and local features simultaneously without convolution or loop operations, and has the characteristics of being scalable, parallelizable, and easy to fuse multimodal data.

[0071] Step S202: Use the hierarchical feature extraction network model to extract features from the preprocessed multi-source security data to obtain feature extraction results.

[0072] In a specific implementation, the convolutional network layer can be used to extract features from the network traffic data in the preprocessed multi-source security data to obtain the first layer of features; the long short-term memory network layer can be used to extract features from the system log data in the preprocessed multi-source security data to obtain the second layer of features; the graph network layer can be used to extract features from the terminal behavior data in the preprocessed multi-source security data to obtain the third layer of features; and the first layer of features, the second layer of features, and the third layer of features are used as the feature extraction results.

[0073] Step S203: Based on the feature extraction results, the feature extraction results are correlated through a cross-modal attention mechanism to obtain a multi-dimensional threat feature representation.

[0074] To enhance the characterization of unknown threats and improve the detection rate of advanced persistent threats (APTs), in a specific implementation, the first-layer features, the second-layer features, and the third-layer features can be mapped to the same dimensional space; the correlation weights between the mapped first-layer features, second-layer features, and third-layer features are calculated through a cross-modal attention mechanism; a weighted fusion is performed on the first-layer features, second-layer features, and third-layer features based on the correlation weights to generate fused features; and the fused features are used as the representation of the multidimensional threat features.

[0075] It should be understood that multidimensional threat feature representation can refer to a comprehensive representation of key information of security threats from multiple complementary perspectives, such as network traffic dimension, temporal behavior dimension, and entity association dimension, in a unified high-dimensional vector space.

[0076] It should be noted that by using the "Transformer architecture + cross-modal attention" to map the heterogeneous features extracted from convolutional network layers, long short-term memory network layers, and graph network layers to a unified semantic space, the problem of inconsistent feature granularity and difficulty in direct fusion of traffic, log, and behavior data types in traditional methods is solved, thereby significantly reducing false positives caused by feature conflicts.

[0077] For example, refer to Figure 2 The figure illustrates a multimodal feature fusion process. The system first collects input data from three sources: terminal behavior data, network traffic data, and system log data. This data is then fed into the CNN (Convolutional Network Layer), LSTM (Long Short-Term Memory Network Layer), and GNN (Graph Network Layer) branches in the feature extraction area for feature extraction. The CNN branch primarily processes network traffic data, extracting its spatial features; the LSTM branch processes system log data, capturing its time-series features; and the GNN branch analyzes terminal behavior data to understand the relationships between entities. The extracted features are then fused in the feature fusion area using a cross-modal attention mechanism. This mechanism calculates the correlation weights between features from different modalities. Finally, based on these correlation weights, the features are fused through a feature concatenation layer to form an output representation (multi-dimensional threat feature representation), providing a foundation for subsequent threat detection and analysis. This improves the detection rate of Advanced Persistent Threats (APTs) and zero-day attacks while reducing the false positive rate, achieving intelligent correlation analysis of multi-source security data.

[0078] Step S30: Construct a threat knowledge graph based on the multidimensional threat feature representation, and input the threat knowledge graph into a preset spatiotemporal graph neural network model to obtain network security threat detection results.

[0079] It should be understood that a threat knowledge graph can be a representation method that organizes entities related to cyberattacks and their interactions in a graph structure, providing a semantic and topological foundation for threat reasoning.

[0080] It should be explained that the preset spatiotemporal graph neural network model can be a computational model based on graph neural networks, which combines temporal and spatial feature extraction techniques to reason and classify threat knowledge graphs, infer potential threat patterns, and generate threat scores.

[0081] Furthermore, the network security threat detection results are the output of a pre-set spatiotemporal graph neural network model, which is represented by information such as threat scores and attack chain paths. This is used to intuitively present the detected threats and their evolution process, which can help security analysts quickly locate and respond to threats.

[0082] For example, refer to Figure 3 The input layer in the diagram represents the noise-reduced alarm data stream (multi-dimensional threat feature representation) received by the system. This data stream contains time-series information and topological relationships. The graph construction module transforms alarm events into a graph structure (threat knowledge graph), where nodes represent alarms and edges represent the relationships between alarms. Critical vulnerability alarms are assigned higher weights. The spatiotemporal graph convolutional layer (ST-GCN), in this implementation, represents a preset spatiotemporal graph neural network model: this layer is the core of the system, responsible for processing the graph structure data. It combines temporal and spatial convolutions; temporal convolution is used to analyze the time-series patterns of alarms, such as detecting high-frequency attack periods; spatial convolution is used to capture the topological relationships between alarm nodes, such as attack chains with the same source IP. The attention mechanism dynamically adjusts the importance weights of different alarms to ensure that critical alarms (such as alarms related to critical vulnerabilities) occupy a more important position in the analysis. The output layer is used to finally output the associated alarm groups (attack chain paths) and threat scores, such as "attack chain probability: 85%".

[0083] This embodiment discloses the acquisition of multi-source security data, preprocessing the multi-source security data to obtain preprocessed multi-source security data, extracting features from the preprocessed multi-source security data, and associating the feature extraction results to obtain a multi-dimensional threat feature representation. A threat knowledge graph is constructed based on the multi-dimensional threat feature representation, and the threat knowledge graph is input into a preset spatiotemporal graph neural network model to obtain network security threat detection results. Because this embodiment extracts features from the preprocessed multi-source security data, associates the feature extraction results to obtain a multi-dimensional threat feature representation, constructs a threat knowledge graph based on the multi-dimensional threat feature representation, and uses a preset spatiotemporal graph neural network model to obtain network security threat detection results, compared to existing technologies, this embodiment achieves the fusion of multi-source security data and uses a preset spatiotemporal graph neural network model to perform joint reasoning on the temporal and spatial dependencies in the threat knowledge graph, thereby improving the detection capability and efficiency of network security threats.

[0084] refer to Figure 4 , Figure 4 This is a flowchart illustrating the second embodiment of the network security threat detection method of the present invention.

[0085] Based on the first embodiment described above, in this embodiment, after step S30, steps S40 to S70 are further included:

[0086] Step S40: Based on the meta-learning mechanism, determine gradient information using the network security threat detection results.

[0087] Step S50: Adaptively update the model parameters of the preset spatiotemporal graph neural network model based on the gradient information to obtain the updated model parameters.

[0088] Step S60: Perform correlation reasoning based on the updated model parameters and the network security threat detection results to generate an adaptive detection strategy.

[0089] Step S70: Adjust the updated model parameters according to the adaptive detection strategy.

[0090] It should be understood that the meta-learning mechanism can refer to a set of learning strategies in threat detection scenarios that can quickly calculate the direction of model parameter updates using a small number of newly emerging threat samples, enabling the model to have the ability to "learn and learn again".

[0091] Furthermore, gradient information can refer to the parameter gradient obtained during the meta-learning process based on the backpropagation of the error between the network security threat detection results and the true labels, which is used to indicate how to adjust the model weights.

[0092] It should be noted that association reasoning can refer to the joint analysis of updated model parameters with historical or real-time detection results, and the derivation of the most reasonable model parameters at present through graphs or attention methods.

[0093] Furthermore, an adaptive detection strategy can refer to a detection configuration derived from correlational inference that can dynamically adjust to changes in the threat environment. It can include gradient information, model adjustment direction, and hyperparameters (such as meta-learning rate and number of iterations). The updated model parameters are adjusted using gradient information, model adjustment direction, and hyperparameters. An adaptive detection strategy can enable the system to respond instantly to new attack methods or data distribution shifts without relying on manual retraining, maintaining a high detection rate and reducing false positives.

[0094] This embodiment discloses a meta-learning mechanism that uses network security threat detection results to determine gradient information; adaptively updates the model parameters of a preset spatiotemporal graph neural network model based on the gradient information to obtain updated model parameters; performs correlation reasoning based on the updated model parameters and the network security threat detection results to generate an adaptive detection strategy; and adjusts the updated model parameters according to the adaptive detection strategy. Compared with existing technologies, the meta-learning mechanism in this embodiment only requires a small number of new threat samples to calculate gradient information and complete adaptive updates of model parameters, significantly shortening the window period from the appearance of a zero-day attack to the effective response of the model, and improving the detection rate of unknown or variant attacks. In addition, the adaptive detection strategy can optimize the preset spatiotemporal graph neural network model in real time as data distribution drifts or attack methods evolve, avoiding model performance degradation over time and ensuring stable and reliable detection results under long-term operation.

[0095] refer to Figure 5 , Figure 5 This is a flowchart illustrating the third embodiment of the network security threat detection method of the present invention.

[0096] Based on the above embodiments, in this embodiment, step S30 further includes steps S301 to S304:

[0097] Step S301: Determine the network entities and interaction relationships in the multidimensional threat feature representation, and construct a threat knowledge graph based on the network entities and interaction relationships.

[0098] Understandably, the multidimensional threat signature representation can be parsed to determine the network entities and interaction relationships within it. Network entities can refer to hosts, user accounts, processes, files, IP addresses, and domain names, while interaction relationships can include communication, access, dependency, parent-child processes, file read / write, and privilege escalation.

[0099] In a practical implementation, network entities can be used as nodes in a threat knowledge graph, and interaction relationships can be used as edges in the threat knowledge graph. Attribute vectors from multi-dimensional threat feature representations can be retained on both nodes and edges, thereby forming a computable threat knowledge graph that can be directly input into a preset spatiotemporal graph neural network model.

[0100] Step S302: Analyze the temporal patterns of the threat knowledge graph using the temporal convolution operator in the preset spatiotemporal graph neural network model.

[0101] Understandably, a temporal convolution operator can refer to a computational unit in a pre-defined spatiotemporal graph neural network model that performs one-dimensional causal convolution on the node features of a threat knowledge graph along the time dimension, in order to capture the dynamic patterns of node states changing over time.

[0102] It should be noted that time-series patterns can refer to the periodic, trending, or sudden regularities of node or edge attributes in a threat knowledge graph on the timeline.

[0103] Step S303: Obtain the topological features of the threat knowledge graph through the spatial convolution operator in the preset spatiotemporal graph neural network model.

[0104] Understandably, a spatial convolution operator can refer to a computational unit that aggregates the features of nodes and their neighboring nodes in a pre-defined spatiotemporal graph neural network model, used to extract local topological relationships in the threat knowledge graph structure.

[0105] It should be noted that topological features can refer to structural attributes determined by the connection relationships between nodes in the threat knowledge graph (such as adjacency matrix, edge weight, path length), reflecting the static or dynamic interaction patterns between network entities.

[0106] Step S304: Obtain network security threat detection results based on the time sequence pattern and the topological features.

[0107] In a specific implementation, a threat score can be determined based on the temporal pattern and the topological features; attack chain analysis can be performed based on the threat knowledge graph and the threat score, and the attack chain path can be determined based on the attack chain analysis results; the threat score and the attack chain path can be used as the network security threat detection results.

[0108] To reduce false alarms and improve detection confidence, after the step of determining the threat score based on the temporal pattern and the topological features, the method further includes: matching the threat score with historical attack patterns in the threat knowledge graph to obtain a matching result; correcting the threat score based on the matching result to obtain a corrected threat score; and using the corrected threat score for attack chain analysis.

[0109] It should be noted that if the current threat score closely matches historical attack patterns, the threat score will be increased to enhance confidence in the authenticity of the attack and prevent false negatives. The revised threat score is used as a node weight in attack chain backtracking, making the final generated attack path more focused and coherent, facilitating security personnel to quickly locate the complete attack chain.

[0110] Furthermore, the matching results can be used to update historical patterns in the threat knowledge graph, enabling the knowledge base to evolve automatically and improving the system's efficiency in identifying similar attacks in the future.

[0111] It should be explained that attack chain analysis can refer to the process of tracing and reconstructing the complete behavioral sequence of an attacker from the initial intrusion to the final target, based on a threat knowledge graph, in chronological or causal order, and identifying the technologies, tools, and affected entities used at each stage.

[0112] An attack chain path can refer to a directed sequence output by attack chain analysis, which is a network entity and its interaction relationship connected in chronological or logical order. It is used to visually present the attacker's gradual penetration route in the system.

[0113] For example, refer to Figure 6 , Figure 6 This is a schematic diagram illustrating the principle of the preset spatiotemporal graph neural network model in the network security threat detection method of this invention. The diagram shows how the system dynamically transforms entities such as IP addresses and users into graph nodes, defining edge relationships using different line types, such as traffic and log associations. Next, through spatiotemporal convolution operations, spatial convolution uses a neighborhood aggregation formula to fuse information about nodes and their neighbors, capturing topological association features. Different colors represent aggregation weights for different relationships. Temporal convolution analyzes the time-series patterns of alarm events using a sliding window (e.g., temporal convolution kernel size K=5, sliding window size T=10). In this embodiment, the preset spatiotemporal graph neural network model consists of three layers of ST-GCN (Dynamic Graph Neural Network). Data is processed through three layers of ST-GCN, with the dimensionality decreasing layer by layer to extract higher-level spatiotemporal features (data sequentially passes through three layers of ST-GCN, with the dimensionality decreasing from 128 to 64, and then from 64 to 32, extracting higher-level spatiotemporal features layer by layer). Finally, the attack chain visualization module draws the attack path, the anomaly scoring output module quantifies the threat level, and the threat classification head classifies the threat type. The entire process effectively integrates spatiotemporal characteristics, enhancing the ability to detect complex cybersecurity threats.

[0114] In a specific implementation, the topological features (spatial dimension) and the temporal pattern (time dimension) can be concatenated along the node dimension to form a comprehensive feature vector for each network entity. Based on the comprehensive feature vector, a binary classification output is performed by the anomaly detection head in the two output heads of the preset spatiotemporal graph neural network model to determine whether the entity behavior is abnormal and output the anomaly probability. Based on the comprehensive feature vector, a multi-classification output is performed by the threat classification head in the two output heads of the preset spatiotemporal graph neural network model to output the threat category probability. The anomaly probability of the anomaly detection head is normalized to obtain a threat score in the range of 0-1 (a higher score indicates a greater anomaly confidence). Based on the threat category probability output by the threat classification head, combined with the entity relationships in the threat knowledge graph, the upstream and downstream paths of nodes whose threat scores exceed a preset threshold are traced back to extract and form attack chain information (node ​​sequence and corresponding threat category).

[0115] The formula for calculating the threat score is as follows:

[0116] ;

[0117] Where W and b are learnable parameters, The above is a comprehensive feature vector, where σ is the Sigmoid function with an output range of (0, 1). The closer the value is to 1, the higher the threat level.

[0118] This embodiment discloses the determination of network entities and interaction relationships in the multidimensional threat feature representation, and the construction of a threat knowledge graph based on the network entities and interaction relationships; the analysis of the temporal patterns of the threat knowledge graph using the temporal convolution operator in the preset spatiotemporal graph neural network model; the acquisition of the topological features of the threat knowledge graph using the spatial convolution operator in the preset spatiotemporal graph neural network model; and the acquisition of network security threat detection results based on the temporal patterns and topological features. Compared with the prior art, this embodiment uses joint decision-making based on temporal patterns and topological features, utilizing both causal evidence in the time dimension and structural evidence in the spatial dimension, thereby improving the reliability and accuracy of network security threat detection results.

[0119] Furthermore, this embodiment of the invention also proposes a storage medium storing a network security threat detection program, which, when executed by a processor, implements the steps of the network security threat detection method described above.

[0120] Reference Figure 7 , Figure 7 This is a structural block diagram of the first embodiment of the network security threat detection device of the present invention.

[0121] like Figure 7As shown, the network security threat detection device proposed in this embodiment of the invention includes: a data acquisition module 801, a data processing module 802, and a result output module 803.

[0122] The data acquisition module 801 is used to acquire multi-source security data and preprocess the multi-source security data to obtain preprocessed multi-source security data.

[0123] The data processing module 802 is used to extract features from the preprocessed multi-source security data and correlate the feature extraction results to obtain a multi-dimensional threat feature representation.

[0124] The result output module 803 is used to construct a threat knowledge graph based on the multidimensional threat feature representation, and input the threat knowledge graph into a preset spatiotemporal graph neural network model to obtain network security threat detection results.

[0125] The data acquisition module 801 is further configured to collect multi-source security data, including network traffic data, system log data, and terminal behavior data; perform time-series alignment processing on the network traffic data, system log data, and terminal behavior data to obtain aligned multi-source security data; perform feature encoding processing on the aligned multi-source security data to obtain encoded multi-source security data; and perform normalization processing on the encoded multi-source security data to obtain preprocessed multi-source security data.

[0126] The data processing module 802 is further configured to establish a hierarchical feature extraction network model based on the Transformer architecture, the hierarchical feature extraction network model including convolutional network layers, long short-term memory network layers and graph network layers; use the hierarchical feature extraction network model to extract features from the preprocessed multi-source security data to obtain feature extraction results; based on the feature extraction results, associate the feature extraction results through a cross-modal attention mechanism to obtain a multi-dimensional threat feature representation.

[0127] The data processing module 802 is further configured to: use the convolutional network layer to extract features from the network traffic data in the preprocessed multi-source security data to obtain a first layer of features; use the long short-term memory network layer to extract features from the system log data in the preprocessed multi-source security data to obtain a second layer of features; use the graph network layer to extract features from the terminal behavior data in the preprocessed multi-source security data to obtain a third layer of features; and use the first layer of features, the second layer of features, and the third layer of features as the feature extraction results.

[0128] This device embodiment discloses the acquisition of multi-source security data, preprocessing the multi-source security data to obtain preprocessed multi-source security data, extracting features from the preprocessed multi-source security data, associating the feature extraction results to obtain a multi-dimensional threat feature representation, constructing a threat knowledge graph based on the multi-dimensional threat feature representation, and inputting the threat knowledge graph into a preset spatiotemporal graph neural network model to obtain network security threat detection results. Because this device embodiment extracts features from the preprocessed multi-source security data, associates the feature extraction results to obtain a multi-dimensional threat feature representation, constructs a threat knowledge graph based on the multi-dimensional threat feature representation, and uses a preset spatiotemporal graph neural network model to obtain network security threat detection results, compared to existing technologies, this device embodiment achieves the fusion of multi-source security data and uses a preset spatiotemporal graph neural network model to perform joint reasoning on the temporal and spatial dependencies in the threat knowledge graph, thereby improving the detection capability and efficiency of network security threats.

[0129] Based on the first embodiment of the network security threat detection device of the present invention, a second embodiment of the network security threat detection device of the present invention is proposed.

[0130] In this embodiment, the result output module 803 is further configured to: determine gradient information based on the network security threat detection result using a meta-learning mechanism; adaptively update the model parameters of the preset spatiotemporal graph neural network model according to the gradient information to obtain updated model parameters; perform correlation reasoning based on the updated model parameters and the network security threat detection result to generate an adaptive detection strategy; and adjust the updated model parameters according to the adaptive detection strategy.

[0131] Other embodiments or specific implementations of the network security threat detection device of the present invention can be referred to the above-described method embodiments, and will not be repeated here.

[0132] This application provides a network security threat detection device, which includes: at least one processor; and a memory communicatively connected to the at least one processor; wherein the memory stores instructions executable by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the network security threat detection method in the first embodiment described above.

[0133] The following is for reference. Figure 8This document illustrates a structural diagram of a network security threat detection device suitable for implementing embodiments of this application. The network security threat detection device in these embodiments may include, but is not limited to, mobile terminals such as mobile phones, laptops, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Description), PMPs (Portable Media Players), and in-vehicle terminals (e.g., in-vehicle navigation terminals), as well as fixed terminals such as digital TVs and desktop computers. Figure 8 The cybersecurity threat detection device shown is merely an example and should not impose any limitations on the functionality and scope of use of the embodiments of this application.

[0134] like Figure 8 As shown, a network security threat detection device may include a processing unit 1001 (e.g., a central processing unit, a graphics processing unit, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory 1002 or a program loaded from a storage device 1003 into a random access memory 1004. The random access memory 1004 also stores various programs and data required for the operation of the network security threat detection device. The processing unit 1001, the read-only memory 1002, and the random access memory 1004 are interconnected via a bus 1005. An input / output interface 1006 is also connected to the bus. Typically, the following systems can be connected to the input / output interface 1006: input devices 1007 including, for example, a touchscreen, touchpad, keyboard, mouse, image sensor, microphone, accelerometer, gyroscope, etc.; output devices 1008 including, for example, a liquid crystal display (LCD), speaker, vibrator, etc.; storage devices 1003 including, for example, magnetic tape, hard disk, etc.; and communication devices 1009. Communication device 1009 allows the network security threat detection device to communicate wirelessly or wiredly with other devices to exchange data. While the figure shows network security threat detection devices with various systems, it should be understood that implementing or possessing all of the systems shown is not required. More or fewer systems may be implemented alternatively.

[0135] Specifically, according to the embodiments disclosed in this application, the processes described above with reference to the flowcharts can be implemented as computer software programs. For example, embodiments disclosed in this application include a computer program product comprising a computer program carried on a computer-readable medium, the computer program containing program code for performing the methods shown in the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via a communication device, or installed from storage device 1003, or installed from read-only memory 1002. When the computer program is executed by processing device 1001, it performs the functions defined in the methods of the embodiments disclosed in this application.

[0136] The network security threat detection device provided in this application, employing the network security threat detection method described in the above embodiments, can solve the technical problems of insufficient detection capability and real-time performance of existing technologies for network security threats. Compared with the prior art, the beneficial effects of the network security threat detection device provided in this application are the same as those of the network security threat detection method provided in the above embodiments, and other technical features of this network security threat detection device are the same as those disclosed in the method of the previous embodiment, and will not be repeated here.

[0137] It should be understood that the various parts disclosed in this application can be implemented using hardware, software, firmware, or a combination thereof. In the description of the above embodiments, specific features, structures, materials, or characteristics can be combined in any suitable manner in one or more embodiments or examples.

[0138] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0139] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or system that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or system. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or system that includes that element.

[0140] The sequence numbers of the above embodiments of the present invention are for descriptive purposes only and do not represent the superiority or inferiority of the embodiments.

[0141] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as read-only memory / random access memory, magnetic disk, optical disk) and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0142] The above are merely preferred embodiments of the present invention and are not intended to limit the scope of the present invention. Any equivalent structural or procedural transformations made based on the description and drawings of the present invention, or direct or indirect applications in other related technical fields, are similarly included within the protection scope of the present invention.

Claims

1. A network security threat detection method, characterized by, The method comprises: acquiring multi-source security data, and preprocessing the multi-source security data to obtain preprocessed multi-source security data; performing feature extraction on the preprocessed multi-source security data, and associating the feature extraction result to obtain a multi-dimensional threat feature representation; constructing a threat knowledge graph according to the multi-dimensional threat feature representation, inputting the threat knowledge graph into a preset spatio-temporal graph neural network model, and obtaining a network security threat detection result; The step of performing feature extraction on the preprocessed multi-source security data and associating the feature extraction result to obtain a multi-dimensional threat feature representation comprises: establishing a hierarchical feature extraction network model based on a Transformer architecture, the hierarchical feature extraction network model comprising a convolution network layer, a long short-term memory network layer and a graph network layer; performing feature extraction on the preprocessed multi-source security data using the hierarchical feature extraction network model to obtain a feature extraction result; based on the feature extraction result, associating the feature extraction result through a cross-modal attention mechanism to obtain a multi-dimensional threat feature representation; The step of constructing a threat knowledge graph according to the multi-dimensional threat feature representation and inputting the threat knowledge graph into a preset spatio-temporal graph neural network model to obtain a network security threat detection result comprises: determining network entities and interaction relationships in the multi-dimensional threat feature representation, and constructing a threat knowledge graph based on the network entities and the interaction relationships; analyzing the time sequence mode of the threat knowledge graph through a time convolution operator in the preset spatio-temporal graph neural network model; obtaining the topological features of the threat knowledge graph through a space convolution operator in the preset spatio-temporal graph neural network model; obtaining a network security threat detection result based on the time sequence mode and the topological features.

2. The network security threat detection method of claim 1, wherein, After the step of constructing a threat knowledge graph according to the multi-dimensional threat feature representation and inputting the threat knowledge graph into a preset spatio-temporal graph neural network model to obtain a network security threat detection result, the method further comprises: determining gradient information using the network security threat detection result based on a meta-learning mechanism; adaptively updating model parameters of the preset spatio-temporal graph neural network model according to the gradient information to obtain updated model parameters; performing associated reasoning according to the updated model parameters and the network security threat detection result to generate an adaptive detection strategy; adjusting the updated model parameters according to the adaptive detection strategy.

3. The network security threat detection method of claim 1, wherein, The step of acquiring multi-source security data and preprocessing the multi-source security data to obtain preprocessed multi-source security data comprises: collecting multi-source security data, the multi-source security data comprising network traffic data, system log data and terminal behavior data; performing time sequence alignment processing on the network traffic data, the system log data and the terminal behavior data to obtain aligned multi-source security data; performing feature encoding processing on the aligned multi-source security data to obtain encoded multi-source security data; performing normalization processing on the encoded multi-source security data to obtain preprocessed multi-source security data.

4. The network security threat detection method of claim 1, wherein, The step of utilizing the hierarchical feature extraction network model to perform feature extraction on the preprocessed multi-source security data to obtain a feature extraction result comprises: performing feature extraction on network flow data in the preprocessed multi-source security data by utilizing the convolution network layer to obtain first layer features; performing feature extraction on system log data in the preprocessed multi-source security data by utilizing the long short-term memory network layer to obtain second layer features; performing feature extraction on terminal behavior data in the preprocessed multi-source security data by utilizing the graph network layer to obtain third layer features; taking the first layer features, the second layer features and the third layer features as the feature extraction result.

5. The network security threat detection method of claim 1, wherein, The step of obtaining a network security threat detection result based on the time sequence pattern and the topological features comprises: determining a threat score according to the time sequence pattern and the topological features; performing attack chain analysis based on the threat knowledge graph and the threat score, and determining an attack chain path according to the attack chain analysis result; taking the threat score and the attack chain path as the network security threat detection result.

6. A network security threat detection apparatus, characterized by, The apparatus comprises: a data acquisition module configured to acquire multi-source security data, and perform preprocessing on the multi-source security data to obtain preprocessed multi-source security data; a data processing module configured to perform feature extraction on the preprocessed multi-source security data, and associate feature extraction results to obtain multi-dimensional threat feature representation; a result output module configured to construct a threat knowledge graph according to the multi-dimensional threat feature representation, and input the threat knowledge graph into a preset spatio-temporal graph neural network model to obtain a network security threat detection result; the data processing module is further configured to establish a hierarchical feature extraction network model based on a Transformer architecture, the hierarchical feature extraction network model comprising a convolution network layer, a long short-term memory network layer and a graph network layer; utilize the hierarchical feature extraction network model to perform feature extraction on the preprocessed multi-source security data to obtain feature extraction results; and associate the feature extraction results by a cross-modal attention mechanism based on the feature extraction results to obtain multi-dimensional threat feature representation; the result output module is further configured to determine network entities and interaction relationships in the multi-dimensional threat feature representation, and construct a threat knowledge graph based on the network entities and the interaction relationships; analyze a time sequence pattern of the threat knowledge graph by a time convolution operator in the preset spatio-temporal graph neural network model; obtain topological features of the threat knowledge graph by a space convolution operator in the preset spatio-temporal graph neural network model; and obtain a network security threat detection result based on the time sequence pattern and the topological features.

7. A network security threat detection device, comprising: The device comprises a memory, a processor and a network security threat detection program stored on the memory and executable on the processor, the network security threat detection program being configured to implement the steps of the network security threat detection method according to any one of claims 1 to 5.

8. A storage medium, characterized by The storage medium has stored thereon a network security threat detection program which, when executed by the processor, implements the steps of the network security threat detection method according to any one of claims 1 to 5.

Images