Multi-source network threat aggregation analysis method, system and device facing attacker portrait, and storage medium

Abstract

The invention discloses an attacker portrait-oriented multi-source network threat aggregation analysis method, system and device, and a storage medium, and relates to the technical field of network security threat analysis, and the method comprises the steps: carrying out the multi-source evidence association and semantic aggregation of a standardized event, outputting an edge weight between entities through an evidence energy model, and constructing a threat relation graph; time sequence consistency, spatial dependence and semantic context information are fused, a traceable attention map neural network is constructed for representation learning and clustering, a high-credibility attack portrait and a structured portrait vector are generated, an adaptive risk calculation model is constructed, trend prediction and anti-fact simulation are performed, and a final risk score is obtained. And generating structured processing decision data. According to the method disclosed by the invention, the whole-process intelligent analysis from data perception to decision output is realized, so that threat identification has data uniformity, portrait credibility and risk quantizability, and a modeling, interpretable and reproducible analysis basis is provided for active defense.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security threat analysis, in particular to a multi-source network threat aggregation analysis method, system and device for attacker profiling and a storage medium. BACKGROUND

[0002] With the diversification and concealment of network space attack means, network threat detection technology has gradually developed from static analysis based on feature matching to intelligent analysis combining machine learning and big data driving. Traditional intrusion monitoring systems and security information and event management platforms can collect massive security logs, traffic data and host behavior information, realize preliminary attack detection and alarm linkage. However, single-source data analysis cannot fully reveal the multi-dimensional features and context association of attack behavior. In recent years, researchers have begun to explore threat analysis methods based on knowledge graph, graph neural network and multi-modal data fusion, through establishing semantic relationship between events, association structure between entities and attack chain tracing path, realizing visualization and structured expression of attacker behavior, and providing more explainable and intelligent support for security defense.

[0003] Existing multi-source network threat analysis methods still have significant limitations. Research only models single modal of logs, traffic or host data, lacks deep fusion of semantic consistency and time synchronization between heterogeneous data, resulting in incomplete reconstruction of attack chain. Existing threat profiling generation methods often rely on artificial feature engineering or static statistical clustering, cannot adaptively adjust feature weights and association structure for dynamically evolving attack behavior, and are difficult to form a reliable and quantifiable, traceable portrait representation. Risk assessment part mostly adopts fixed threshold or simple rule mapping, lacks dynamic risk deduction mechanism combining time series prediction and counterfactual simulation, and cannot predict and quantitatively analyze potential threat trends. Although some methods introduce graph neural network structure, they fail to model evidence energy and multi-source weight, ignore the differences in reliability and timeliness of different source data, resulting in low portrait reliability and unstable aggregation results. SUMMARY

[0004] In view of the above problems, the present application is proposed.

[0005] Therefore, the technical problem solved by the present application is that the existing multi-source network threat analysis method has the problems of insufficient multi-modal data fusion, low attack portrait reliability, lack of dynamic risk assessment, and inability to realize traceable risk decision based on evidence association.

[0006] To solve the above technical problems, the application provides the following technical scheme: a multi-source network threat aggregation analysis method for attacker portrait, comprising collecting multi-source data and preprocessing, and constructing a standardized event record set; multi-source evidence correlation and semantic aggregation are performed on the standardized events, the edge weight between entities is output by using an evidence energy model, and a threat relationship graph is constructed; multi-modal feature vectors of nodes and edges are extracted according to the threat relationship graph, time sequence consistency, spatial dependence and semantic context information are fused, and a multi-modal fusion vector is constructed; based on the multi-modal fusion vector and the evidence energy model, a traceable attention graph neural network is constructed for representation learning and clustering, a high-trust attack portrait and a structured portrait vector are generated; based on the high-trust attack portrait and the structured portrait vector, an adaptive risk calculation model is constructed, trend prediction and counterfactual simulation are performed to obtain a final risk score, and structured disposal decision data is generated.

[0007] As a preferred scheme of the multi-source network threat aggregation analysis method for attacker portrait, wherein: the collecting multi-source data and preprocessing comprises performing timestamp unification, character encoding normalization, field mapping, session recombination, denoising and deduplication on multi-source data from logs, traffic and host behavior, and constructing a standardized event record set; based on the source history hit rate, source reputation, timeliness and cross-source consistency of each record, output the data source basic credibility , determine the dynamic weight, expressed as: , Wherein, represents the dynamic weight of the record, represents the data source basic credibility, represents the difference between the record generation time and the current analysis time, represents the time decay coefficient, represents the number of independent occurrences of the same entity or event feature in different data sources, represents the cross-source amplification coefficient.

[0008] As a preferred scheme of the multi-source network threat aggregation analysis method for attacker portrait, wherein: the multi-source evidence correlation and semantic aggregation of the standardized events comprises cross-source entity recognition and field alignment on the standardized event record set of different sources, constructing an evidence energy model based on semantic features, outputting the correlation energy between entities and outputting the edge weight, and constructing a threat relationship graph.

[0009] As a preferred scheme of the attacker portrait-oriented multi-source network threat aggregation analysis method, wherein: the multi-modal feature vector of the node and the edge extracted according to the threat relationship graph comprises: according to the threat relationship graph structure, the attribute features, the time sequence features and the context semantic features of the nodes and the edges are extracted, and the multi-modal fusion mechanism is used to combine the multi-source data in a unified feature space.

[0010] As a preferred scheme of the attacker portrait-oriented multi-source network threat aggregation analysis method, wherein: the construction of the traceable attention graph neural network for representation learning and clustering comprises: taking the multi-modal fusion vector and the evidence energy as inputs, the information between nodes is weighted and aggregated by attention to form a hierarchical feature updating structure; high-density vector clusters are formed in the representation space by a clustering algorithm, and high-confidence attack portraits and structured portrait vectors are generated, and all attention weights and node features can be traced back to the original evidence.

[0011] As a preferred scheme of the attacker portrait-oriented multi-source network threat aggregation analysis method, wherein: a sub-score set is constructed according to the high-confidence attack portrait and the structured portrait vector, a basic risk score is calculated, and a trend correction factor is output by combining a short-term prediction result, which is represented as: , Among them, represents an adaptive risk base score, represents a normalized weight vector, represents a risk feature sub-score.

[0012] After outputting the trend correction factor, a trend correction factor is introduced, and the risk score is dynamically adjusted by combining the time series prediction result, which is represented as: , Among them, represents a trend correction factor, represents a trend amplification coefficient, represents a predicted risk value in a future time window, represents a basic risk score obtained by weighted summation.

[0013] As a preferred scheme of the attacker portrait-oriented multi-source network threat aggregation analysis method, wherein: the trend prediction and counterfactual simulation are performed to obtain a final risk score, which comprises: for a candidate disposal set, a risk reduction amount is generated by simulation respectively , the maximum risk reduction amount is taken, a confidence coefficient is combined, and the final risk score is output and represented as: , wherein, represents an adaptive risk score, represents a basic risk score.

[0014] and according to output a hierarchical disposal strategy and structured decision data.

[0015] Another object of the present application is to provide a multi-source network threat aggregation analysis system for attacker portrait, which can construct a traceable attention map neural network for representation learning and clustering through a multi-modal fusion vector and an evidence energy model, generate a high-trust attacker portrait and a structured portrait vector, and solve the problem of low trustworthiness of the current multi-source network threat analysis method.

[0016] As a preferred scheme of the multi-source network threat aggregation analysis system for attacker portrait, the system comprises a multi-source threat data fusion processing module, an association modeling and portrait generation module, and a risk quantification and decision output module; the multi-source threat data fusion processing module is used to collect and preprocess multi-source data from logs, traffic, and hosts, unify timestamps, fields, and coding formats, calculate dynamic trust weights, and construct a standardized event record set; the association modeling and portrait generation module is used to perform multi-source evidence association and semantic aggregation on the standardized events, construct a threat relationship graph, extract multi-modal feature vectors of nodes and edges, and perform representation learning and clustering through a traceable attention map neural network to generate a high-trust attacker portrait; and the risk quantification and decision output module is used to calculate an adaptive risk score based on the attacker portrait and its structured vector, obtain a final risk value by combining trend prediction and counterfactual simulation, and generate an executable hierarchical disposal strategy and structured decision data.

[0017] Still another object of the present application is to provide a multi-source network threat aggregation analysis device for attacker portrait, which comprises a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the steps of the multi-source network threat aggregation analysis method for attacker portrait.

[0018] Still another object of the present application is to provide a multi-source network threat aggregation analysis storage medium for attacker portrait, which stores a computer program, and the computer program is executed by a processor to implement the steps of the multi-source network threat aggregation analysis method for attacker portrait.

[0019] The present application has the following beneficial effects: The multi-source network threat aggregation analysis method for attacker portrait provided by the application forms a complete technical path in the aspects of data fusion, relationship modeling, portrait generation and risk decision-making by constructing a full-link aggregation and portrait analysis system of multi-source threat data. Through multi-source data collection and standardized preprocessing, the time, structure and semantics of heterogeneous security logs, traffic and host events are unified, laying a consistent foundation for subsequent cross-source analysis; the standardized events are associated and aggregated by the evidence energy model, a threat relationship graph based on quantifiable weights is established, and the structured mapping of multi-source evidence is realized; the multi-modal feature vectors of nodes and edges on the relationship graph are extracted, and the time sequence consistency and context semantic information are fused to construct a computable high-dimensional representation, realizing the effective fusion of multi-modal information in a unified space; the traceable attention map neural network is introduced for representation learning and clustering, so that different attack behaviors have obvious boundaries in the embedding space, forming a high-confidence attacker portrait and a structured portrait vector.

[0020] Finally, based on the portrait features, an adaptive risk calculation model is constructed, a trend prediction and counterfactual simulation mechanism is introduced, the risk evolution trend and the influence of disposal strategies are quantified, and dynamic calculation and closed-loop feedback of risk scores are realized. The technical scheme realizes intelligent analysis of the whole process from data perception to decision output, makes threat identification have data uniformity, portrait credibility and risk quantifiability, and provides a modelized, interpretable and reproducible analysis basis for active defense. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the application, the drawings needed in the embodiment description will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the application, and other drawings can be obtained by those skilled in the art without creative labor.

[0022] Figure 1 The overall flowchart of a multi-source network threat aggregation analysis method for attacker portrait provided by the embodiment 1 of the application. DETAILED DESCRIPTION

[0023] In order to make the above-mentioned purposes, features and advantages of the application more apparent and easy to understand, the specific embodiments of the application will be described in detail below with reference to the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the application, rather than all the embodiments. Based on the embodiments in the application, all other embodiments obtained by those skilled in the art without creative labor should be within the protection scope of the application.

[0024] Embodiment 1, refer to Figure 1For an embodiment of the present application, a multi-source network threat aggregation analysis method facing an attacker portrait is provided, comprising: S1: Collect multi-source data and perform preprocessing, and construct a standardized event record set.

[0025] Further, first, unified access and standardized processing are performed for multi-source heterogeneous network threat data, so as to ensure that various structured, semi-structured and unstructured threat data can be associated and analyzed in the same semantic space. The data sources accessed by the system include but are not limited to: firewall logs, IDS / IPS alarm logs, host / endpoint security logs, network traffic data (PCAP), Web service access logs, honeypot monitoring data, vulnerability library information, dark web intelligence information, and real-time push data of a threat intelligence platform (ThreatFeed), etc.

[0026] For the above different source data, the system first completes protocol analysis and field extraction through a collection adapter, and then performs standardized conversion on timestamps, character encodings and field structures. All time fields are unified to the UTC time zone and recorded in the ISO-8601 format, the character set is unified to the UTF-8 encoding, and abnormal characters, escape characters and illegal control characters in the log fields are cleaned. In order to ensure the consistency and traceability of the data, the system uses a field mapping table to complete semantic mapping of cross-source fields, so that the key fields (such as source_ip, destination_ip, alert_type, timestamp, severity, etc.) of different log formats correspond to unified standardized field names.

[0027] It should be noted that after completing the basic cleaning and standardization, the system further performs session reorganization and behavior merging for network traffic and multi-event associated logs. Through a five-tuple (source IP, destination IP, source port, destination port, protocol type) and a time sliding window, the system aggregates traffic, identifies event records belonging to the same session, and deletes redundant data with repeated times and the same content, to form a high-quality standardized event record set. Each record is attached with a unique event ID, collection source identifier, collection time and original context reference link when generated, so as to ensure that the original evidence source can be traced back in the subsequent analysis process. At the same time, the system performs entity extraction on event text through regular expressions, NLP entity recognition and fingerprint matching algorithms, identifies candidate attack entities such as IP, domain name, file hash, username, certificate fingerprint, C2 communication identifier, and records the extraction confidence in the event metadata.

[0028] It should also be noted that after the formation of standardized event records, this step introduces a dynamic credibility weighting mechanism to measure the credibility of data from different sources and different time spans. This mechanism calculates the basic credibility of each record based on the historical hit rate of the data source, the reputation of the source, the timeliness of the data produced, and the cross-source consistency. Each record is given a dynamic weight through time decay and consensus amplification strategy, represented as: , wherein, represents the dynamic weight of the record (non-negative real number, recommended to be normalized to the interval 0-1), which represents the importance of the record in subsequent knowledge graph construction and feature aggregation; represents the basic credibility of the data source, with a value range of , which is calculated by multiple indicators such as historical hit rate, supplier reputation, false positive rate, and near-end stability; is the difference between the record generation time and the current analysis time (in hours or seconds), is the time decay coefficient (positive real number) to control the decay rate; is the cross-source consensus count, which represents the number of independent occurrences of the same entity or event feature in different data sources, reflecting the cross-source consistency of the evidence; is the cross-source amplification coefficient (non-negative real number), which is used to control the weight amplification degree of cross-source consensus. When , the formula only considers source credibility and time decay; when , consistent observations from multiple independent sources will be dynamically amplified to strengthen the multi-source consistency signal and improve the utilization of low credibility source clues.

[0029] In engineering implementation, the system can set the initial for different types of data sources: for example, high-confidence sources from enterprise-level SIEM systems are set to , and low-confidence sources from community intelligence sources are set to ; At the same time, different are set according to the type of evidence, such as hours for sandbox sample analysis, and hours for network alarm logs. In order to avoid abnormal weight soaring caused by cross-source amplification, ) Set adaptive upper bound (e.g. 5) and keep input parameters of each weight calculation in record metadata to support later explainability backtracking and weight reevaluation. For records with missing timestamp or abnormal format, system fills in with receive time minus average delay estimation and marks time_precision field as estimated, ensuring all records have time dimension to participate in decay calculation. The final output of normalized event record set contains weight calculation result and its full parameter meta information besides structured fields.

[0030] S2: Multi-source evidence correlation and semantic aggregation on normalized events, output edge weight between entities and build threat relationship graph using evidence energy model.

[0031] Further, map each normalized record according to the entities in its entity_candidates: if the record contains a single entity (such as IP, domain name, hash), create or update the corresponding entity node in the KG; if the record represents a behavioral relationship between entities (such as IP→domain name connection, or a certain host downloading a certain file), create or update the relationship edge between the two entities in the KG. Each edge must carry the complete evidence set when created, where each evidence item records the original event_id, source_id, ingest_time, extraction confidence and computed_w; the edge also maintains the time series attribute and the cumulative evidence energy E_sum. The node of the KG also maintains the node confidence, and is updated incrementally according to the following mathematical rules every time new evidence arrives.

[0032] It should be noted that, in order to quantify the contribution of a single record to the KG edge and node and ensure the coherence of the model, the edge weight update model associated with the is adopted. The following incremental update rule is used to update the edge weight smoothly: , where, represents the updated edge weight value between entity and entity , which reflects the latest estimation of the threat correlation strength between the two after the input of a new batch of evidence; represents the historical edge weight value of the two entities in the last iteration or the previous time window, reflecting the cumulative evidence contribution in the historical stage; is the global time decay coefficient; represents the time interval between the current time and the last update time. represents the energy contribution of the th new evidence source to the entity pair , represents the dynamic trust weight of the evidence source, The number of new evidence in the current update cycle.

[0033] To support the traceability and accurate forensics of edges, the evidence set of edges needs to be maintained and the evidence needs to be deduplicated and merged for each update: define the evidence energy of an edge as the sum of the weights of all evidence on the edge: , wherein, represents the evidence link set, represents the link, represents the credibility, represents the link set.

[0034] It should also be noted that when constructing candidate subgraphs based on KG, a dual strategy based on connected components (connectivity priority) and time window (time priority) is adopted: first, the skeleton of the subgraph is intercepted with the entity association edge weight as the threshold (the recommended initial value is 0.05-0.2); then, the connected components in the skeleton are divided again according to the evidence time sequence density (the connected components with long time span and internal dispersion are divided into multiple candidate subgraphs according to time clusters), so that the subsequent vectorization and clustering can better reflect short-term behavior chains. Each candidate subgraph is represented by its member entity set, edge set, evidence set, and time interval, and the cumulative evidence energy of the subgraph is calculated.

[0035] On the question of whether to merge (fuse) between candidate subgraphs, given two candidate subgraphs, define their evidence complementarity as: , wherein, represents the evidence set and complementarity value, represents the node set contained in graph and , respectively represents the evidence energy value of node in subgraph and , represents the overlapping energy contribution of node in the two subgraphs, which is used to capture the common evidence strength, represents the maximum energy value of node in the two subgraphs, and represent the two threat subgraphs to be compared.

[0036] If is high, it means that the two subgraphs have significant complementarity or overlap in entities and evidence, and the attack chain can be completed after fusion; if is low but the two subgraphs have significant continuity in time (for example With time difference within a threshold and there exists a tool chain or TTP similarity above a threshold , it can be determined that the timing is connectable and fusion is considered. Based on this, the fusion decision rule (Boolean criterion) is given: Fusion if and only if: , where, denotes the end time of subgraph denotes the start time of subgraph denotes the start time of subgraph denotes the time connection threshold, which is used to limit the maximum allowed time interval between subgraphs. When the time interval is less than the threshold, the system considers that the two belong to the same attack chain adjacent stage, denotes the energy complementarity threshold, denotes the tactical and technical and program similarity index, which is used to measure the similarity of two subgraphs in attack methods. Its calculation can be based on the MITREATT&CK model, and after representing the behavior sequence of each subgraph as a tactical vector, the cosine similarity or Jaccard similarity is calculated, denotes the TTP similarity threshold (TTPSimilarityThreshold), which is used to set the lower limit of the behavior similarity trigger condition, and the typical value is about 0.7.

[0037] Suggested initial value 0.25-0.4, Suggested initial value 0.6 (TTP similarity uses vector cosine similarity or Jaccard index), Suggested to be set as 24-72 hours according to the attack scenario. If the fusion condition is met, perform fusion: new subgraph , whose edge weight, evidence set and time interval are merged according to the following rules and the subgraph level evidence energy is recalculated and the timing consistency index (TCS below): , , (de-duplicate repeated evidence according to unique event_id); Edge weight is merged according to edge update formula (if the edge exists in both subgraphs, use the respective for renormalization); write the merging operation to the processing_trace of the edge, record the evidence items and criteria (EC value, TTP similarity, time difference) that trigger fusion.

[0038] To ensure that fusion does not introduce false merges, a dry-run is performed for each subgraph to be fused: a virtual fusion is simulated in memory , the change in Image Completeness Score (ICS, based on evidence quantity, temporal consistency, and toolchain diversity) is calculated , and the fusion is only actually submitted if and does not decrease the average evidence confidence of the subgraph. If a fusion is determined to be a false merge after manual or automated feedback, rollback is supported: the processing_trace is used to revert to the state before the fusion, and the source or rule that triggered the false fusion is penalized (e.g. lowering the or the trigger threshold) to enable adaptive governance.

[0039] In addition, a mechanism is introduced to handle negative evidence at the KG level: if evidence explicitly negating an association is present (e.g. a false positive confirmed by forensics or a misassociation indicated by a reconciliation rule), the edge weight is lowered and the negation event is recorded by the following weight reduction rule: , where is a penalty coefficient controlling the strength of the negative evidence weight reduction, is the number of negative evidence batches accumulated in the current time window, is the weight of the negative evidence, and is the cumulative weight of the trustworthiness of the negative evidence from different sources. Negative evidence can come from false alarm feedback, rule conflicts, or external intelligence validation failures.

[0040] S3: Multi-modal feature vectors are extracted from the nodes and edges of the threat graph, fusing temporal consistency, spatial dependency, and semantic context information to construct multi-modal fusion vectors.

[0041] Furthermore, features are extracted and organized hierarchically for each subgraph by node type and edge type. For network entities (IP, port, protocol), communication statistics are extracted: session count, average session length, maximum / minimum session length, data transfer volume quantiles, common destination port distribution, etc. For host / process entities, host indicators are extracted: process frequency, abnormal process launch count, privilege escalation attempt count, file access pattern statistics, etc. For file / sample hash entities, sample attributes are extracted: sandbox score, static feature labels, submission frequency. For log text data, semantic encoding is performed: text is mapped to fixed-length vectors using a pre-trained embedding model, and key terms, command snippets, and suspicious regular expression hits are extracted. Each type of feature is standardized with a uniform field name and data type, and the original field source and extraction confidence are recorded in the metadata to ensure traceability.

[0042] It should be noted that the above features organized by type are divided into several "modal blocks" - typical modalities include: network communication modality, host behavior modality, file / sample modality, semantic text modality, topology modality, time series modality, etc. For each modal block, internal cleaning and preprocessing of the modalities is performed: numerical features are truncated for outliers and scaled by quantile, sparse count features are standardized after logarithmic transformation, categorical features are encoded with a consistent scheme (such as uniform hashing or ordered mapping), and text modalities are embedded into vectors and normalized. For feature columns with many missing values, the mean / median of similar entities is used to fill in or regression filling is used according to entity type; for completely missing modalities (e.g. no file samples in a subgraph), the modalities are represented by zero vectors or explicit missing placeholders in the vector of the subgraph, and the missing proportion is recorded for subsequent weight adjustment reference.

[0043] It should also be noted that after completing the internal preprocessing of each modal block, in order to ensure that the fused vector can reflect the discriminability and stability of the current threat scenario, the system calculates and assigns the weight of each modality according to the following steps: (1) Calculate the discriminability index of the modality on the available historical data or near real-time window (if the history is labeled, use AUC / information gain / SHAP, etc. as the index, otherwise use unsupervised representative indicators such as modality cohesion, correlation with subgraph TCS, and improvement of clustering profile coefficient as an approximation of discriminability); (2) Calculate the time stability index of the modality to evaluate the statistical stability of the modality in the recent window (e.g. volatility of feature mean and variance); (3) Calculate the data integrity score of the modality (based on missing proportion and enrichment success rate); (4) Combine the discriminability, stability, and integrity three quantitative scores into an original modality score according to a pre-defined rule - the specific method is to linearly normalize the three to the same interval, then multiply or weighted average the original score according to the pre-set weight; (5) Normalize the original scores of all modalities (e.g. normalize based on the sum or do softmax normalization) to get the final modality weight. The intermediate values of each step are written into the processing_trace of the subgraph for review and backtracking. This process makes the modality weight reflect "whether it has discriminability in the current scenario, whether it is reliable in time, and whether the data is complete enough", so that when fused, it can more targetedly amplify valuable modality signals and suppress noise.

[0044] Further, after determining the modal weights, the system scales the feature vectors within each modal block according to the modal weights, and then performs dimension reduction and feature compression on the scaled modal vectors. The dimension reduction can use principal component analysis or a trained autoencoder. The dimension reducer is trained in advance according to sample distribution during the development stage and the version number is recorded; the number of dimensions retained after dimension reduction is set based on the trade-off between interpretability and model complexity, and the specific parameters are recorded in processing_trace. The output of the dimension reduction is a low-dimensional representation vector for each modality. These low-dimensional vectors are then concatenated in a fixed order to form a preliminary fusion vector of the subgraph. In addition, the system simultaneously calculates and attaches the topological summary features and the time sequence consistency score TCS of the subgraph, and these summary information and the fusion vector are combined to form the final feature package of the subgraph.

[0045] It should be noted that, in order to enhance robustness and interpretability, two types of correction are implemented in the fusion stage: one is confidence correction based on evidence traceability, which reduces the weight of the final fusion vector for those modal components whose main supporting evidence comes from low-trust sources; the other is weight adjustment based on time window, which reduces the overall vector by a certain coefficient and labels low time sequence consistency in the output when the TCS of the subgraph is very low. This step ensures that all correction operations are traceable: each correction records the trigger condition, the involved evidence list, the correction coefficient, and the vector summary after correction in processing_trace.

[0046] S4: Based on the multi-modal fusion vector and the evidence energy model, a traceable attention map neural network is constructed for representation learning and clustering, to generate a high-trust attack portrait and a structured portrait vector.

[0047] Further, in the data preparation stage, the system represents each candidate subgraph as a local graph data structure: a node set, an edge set, and subgraph-level features. To meet the performance requirements of batch training and online inference, a graph mini-batch processing method based on sampling is used: subgraph sampling is performed on large graphs, and subgraph blocks with a fixed maximum number of nodes and edges are obtained for each training / inference batch. The sampler should give higher sampling priority to high-evidence-energy edges and low-evidence but high-TCS time-sequential edges to ensure that critical attack chains are preserved during training.

[0048] It should be noted that in terms of model structure, a multi-layer traceable attention graph neural network is adopted, and the message aggregation of each layer combines node features, edge evidence vectors and time difference quantitative information. Each layer performs the following three-step operation: node feature linear mapping → neighbor information aggregation based on edge traceable attention weighting → nonlinear update and normalization. In implementation, multi-head attention can be used to improve stability and normalization is performed on each head. Layer-norm and dropout are performed after each layer to improve training stability. The number of layers is usually 2-4 layers; the hidden dimension can be 128 or 256 as the default value, which is adjusted according to data size and computing power.

[0049] It should also be noted that in order to ensure traceability and explainability, the original contribution information must be preserved in the engineering implementation of attention calculation: for each node v, the top-K neighbor attention weights and the corresponding evidence list are saved to show the evidence link of "why the node is aggregated to the portrait" when outputting or reviewing the portrait. The edge evidence vector should be normalized before entering the attention, and the edge weight and the number of evidence should be included in the attention input to distinguish different contribution modes of single strong evidence and multi-source weak evidence.

[0050] Furthermore, the training of representation learning adopts a hybrid loss: the weighted sum of reconstruction loss or contrastive loss and clustering-friendly loss. The offline training phase preferably follows the following process: first, pre-train the graph-level representation using an autoencoder / variational autoencoder or graph autoencoder, so that the representation can preserve local structure and semantic information; then, fine-tune the representation by performing a deep clustering algorithm on the pre-trained representation to form more compact clusters. During training, the intra-cluster / inter-cluster distance, silhouette coefficient and correlation with TCS can be evaluated after each epoch to adjust the coefficients and model learning rate. In the online incremental learning scenario, small batch online fine-tuning is used and full retraining is performed periodically to balance new sample adaptation and model stability.

[0051] It should be noted that the clustering module adopts a two-stage process: first, all subgraph representation vectors are reduced by an autoencoder and normalized, and then a Gaussian mixture model or density-based clustering is used to perform preliminary clustering to obtain an adaptive number of clusters; then, DEC or cluster center fine-tuning is used to refine the preliminary clusters to make the cluster centers more discriminative. After clustering, the portrait integrity score is calculated for each cluster, which integrates the average evidence energy, average TCS and tool chain diversity of the cluster to select only high-ICS clusters as high-confidence portraits in subsequent steps. Low-ICS clusters are labeled as candidates for manual review and enter the downstream manual review queue, while triggering possible subgraph subdivision or rollback strategies.

[0052] It should also be noted that in order to ensure the feasibility of large-scale deployment, the following engineering measures are adopted in implementation: neighbor sampling and mini-batch training are used to reduce memory occupation; commonly used subgraph representations are cached and refreshed according to the change increment when the KG is updated; parameter server or Horovod framework is used for distributed training, and version number and training log are written when the model is updated; in the online inference path, for each new candidate subgraph, the cached neighbor representation is read first and only the changed part is aggregated locally to achieve low latency.

[0053] The clustered clusters and their representations, itemized ICS, and explanatory information are derived into intermediate portrait candidates, and these candidates are delivered to step five according to the credibility level for intent reasoning, risk scoring, and disposal suggestions.

[0054] S5: Based on the high-confidence attack portrait and the structured portrait vector, an adaptive risk calculation model is constructed, trend prediction and counterfactual simulation are performed to obtain the final risk score, and structured disposal decision data is generated.

[0055] Furthermore, comprehensive portrait intent reasoning and risk quantitative evaluation are performed to realize dynamic perception of attacker activities, risk level quantification, and operable disposal strategy generation. This step not only continues the credibility calculation, evidence energy mapping, and multi-modal feature fusion mechanism of the previous modules, but also constructs a closed-loop system in the time dimension and decision level, extending threat discovery from static recognition to dynamic evaluation and response. The system first receives the high-confidence attack portrait set output by step four, each portrait containing its node feature vector, edge weight distribution, subgraph evidence energy, time consistency score, portrait integrity score, and associated dynamic weight and source credibility. After data access, the system automatically constructs an attack intent probability model in the knowledge graph environment, taking the semantic features of the portrait, attack stage behavior sequence, and time distribution pattern as input variables. Based on the Bayesian inference framework, the system calculates the conditional probability for different attack purposes (such as information theft, control diffusion, lateral movement, system destruction, etc.), and extracts the dominant evidence path based on this to ensure the traceability and explainability of the analysis results. Through the output of the intent reasoning module, the system can make prior inference on the tactical layer behavior of the portrait, providing directional weight constraints for risk scoring.

[0056] It should be noted that after obtaining the probability distribution of attack intent, the system enters the risk quantification stage, which calculates the threat intensity of the portrait by calculating the sub-score of multiple dimensions. Define a standardized sub-score vector, where each sub-score represents a feature dimension, including (portrait integrity), (time consistency), (evidence energy intensity), (command control feature strength), (transversal penetration activity), (outbound tendency), and (average credibility weighting). After normalization, each sub-score is linearly combined with a weight vector to form the base risk score : , wherein denotes the adaptive base risk score, denotes the normalized weight vector, denotes the risk feature sub-score value, . This calculation framework not only preserves the interpretability of feature contribution, but also dynamically adjusts the weights by training historical event samples or expert experience, thus making the risk model adaptive. Subsequently, in order to reflect the changing trend of the portrait risk on the time axis, the system uses a short-term prediction module to perform trend prediction on the time series of and event frequency, generating a predicted risk value . According to the difference between the prediction result and the current base risk, a trend correction factor is constructed: , wherein denotes the trend correction factor, denotes the trend amplification coefficient, denotes the predicted risk value in the future time window, denotes the base risk score obtained by weighted summation, when the prediction result shows an upward trend of threat, this correction factor will dynamically increase the risk score, so that the risk score reflects the potential change trend in the future period, realizing the dynamic quantification of time-sensitive risk.

[0057] After the temporary risk is calculated, the system further enters the counterfactual simulation and adaptive correction link to evaluate the potential contribution of different disposal measures to risk reduction. For each portrait, a candidate disposal set is defined, each corresponding to a type of executable defense action (such as blocking IP, isolating host, closing port, locking account, etc.). The system constructs a knowledge graph snapshot in memory, performs graph structure change simulation for each candidate measure, recalculates the corresponding sub-score vector and obtains the adjusted base risk . The relative risk reduction ratio of each measure is defined as: , wherein denotes the risk offset rate corresponding to the risk branch or portrait sample, denotes the risk offset rate corresponding to the risk branch or portrait sample. a risk baseline score in a risk branch or a local image group, represents a very small positive number.

[0058] and take the maximum value A credibility factor is introduced to reflect the reliability of the simulation model and the effectiveness of historical treatment. The final adaptive risk score is calculated as follows: , wherein, represents the final comprehensive risk score, represents the fluctuation suppression coefficient, represents the maximum offset value.

[0059] Finally, the calculated will be used to make a hierarchical treatment decision. When , the system triggers an emergency blocking strategy (PO level) and directly issues it to the safety automation arrangement system for execution; when , an isolation or blocking suggestion (P1 level) is generated and pushed to the safety operation center at the same time; when , it is marked as a medium risk (P2 level) and needs to be assessed manually before execution; if , it is listed for monitoring and observation (P3 level). While outputting the treatment suggestion, the system will generate a structured command package, which includes recommended actions, expected risk reduction percentage, execution impact range, rollback conditions, necessary approval levels, and a list of corresponding evidence event IDs. The command package is output in JSON-LD format and can be directly connected to SOAR platforms, firewalls, EDR or SIEM systems, realizing the full-process closed loop from threat perception to automatic response.

[0060] It should also be noted that, in addition, to ensure the credibility and engineering feasibility of the results, the system generates a complete interpretable data package at each risk calculation and treatment output. This data package includes: sub-item scores and weight distribution, trend correction parameters, simulation evaluation logs, risk classification results and treatment commands, model and parameter version numbers, normalized reference values and time windows used, and other information, which are recorded in the processing_trace file to ensure that the entire calculation process can be completely reproduced for external audit or judicial evidence. The counterfactual simulation results of the system and the real treatment feedback form a long-term linkage closed loop, which automatically corrects the model parameters in subsequent cycles, so that the risk assessment gradually approaches the real threat evolution characteristics, and finally forms a threat risk adaptive assessment system with dynamic self-learning ability.

[0061] Embodiment 2, one embodiment of the application, provides an attacker portrait-oriented multi-source network threat aggregation analysis system, comprising a multi-source threat data fusion processing module, an association modeling and portrait generation module, and a risk quantification and decision output module.

[0062] The multi-source threat data fusion processing module is used for collecting and preprocessing multi-source data from logs, traffic and hosts, unifying timestamps, fields and coding formats, calculating dynamic trust weights and constructing a standardized event record set; the association modeling and portrait generation module is used for performing multi-source evidence association and semantic aggregation on the standardized events, constructing a threat relationship graph, extracting multi-modal feature vectors of nodes and edges, and performing representation learning and clustering through a traceable attention graph neural network to generate a high-trust attacker portrait; and the risk quantification and decision output module is used for calculating an adaptive risk score based on the attack portrait and its structured vector, obtaining a final risk value by combining trend prediction and counterfactual simulation, and generating an executable hierarchical disposal strategy and structured decision data.

[0063] The embodiment also provides a computer device comprising a memory and a processor, the memory storing a computer program, and the processor implementing the attacker portrait-oriented multi-source network threat aggregation analysis method proposed in the above embodiment when executing the computer program.

[0064] The embodiment also provides a computer readable storage medium having a computer program stored thereon, and the computer program is executed by a processor to implement the attacker portrait-oriented multi-source network threat aggregation analysis method proposed in the above embodiment.

[0065] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the application or parts of the technical solutions that essentially contribute to the prior art can be embodied in the form of software products. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device) to execute all or part of the steps of the method described in the embodiments of the application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0066] The logic and / or steps represented in the flow diagrams or otherwise described herein, for example, can be considered as a sequence of executable instructions, and can be embodied in any computer-readable medium for use by or in connection with an instruction execution system, apparatus, or device, such as a computer-based system, processor-containing system, or other system that can fetch the instructions from the instruction execution system, apparatus, or device and execute the instructions. In the context of this specification, a "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The computer-readable medium can be, for example but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, device, or propagation medium.

[0067] More specific examples (a non-exhaustive list) of the computer-readable medium include the following: an electrical connection (electronic) having one or more wires, a portable computer diskette (magnetic), a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, and a portable compact disc read-only memory (CDROM). Additionally, the computer-readable medium can also be paper or another suitable medium upon which the program is printed, as the program can be electronically captured, for example via an optical scanner, then compiled, interpreted, or otherwise processed, and stored in a computer memory in a form that can be later executed by a computer. In some embodiments, the computer-readable medium can be non-transitory.

[0068] It should be understood that aspects of the application can be implemented in hardware, software, firmware or combinations thereof. In the above embodiments, various steps or methods can be implemented in software or firmware that is stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, any of the following technologies, known in the art, or combinations thereof, can be used: a discrete logic circuit having logic gates for implementing logic functions upon data signals, an application specific integrated circuit having appropriate combinational logic gates, a programmable gate array (PGA), a field programmable gate array (FPGA), or the like.

[0069] It should be noted that the above-mentioned embodiments are merely used to illustrate the technical solutions of the present application, but not limit the present application, although the present application has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present application can be modified or equivalent replaced, without departing from the spirit and scope of the technical solutions of the present application, and all of them should be covered in the scope of claims of the present application.

Claims

1. An attacker-profile-oriented multi-source network threat aggregation analysis method, characterized in that, The method comprises the following steps: Collecting and preprocessing multi-source data, and constructing a standardized event record set; Correlating and aggregating multi-source evidence of standardized events, outputting edge weights between entities using an evidence energy model, and constructing a threat relationship graph; Extracting multi-modal feature vectors of nodes and edges according to the threat relationship graph, fusing time sequence consistency, spatial dependence and semantic context information, and constructing multi-modal fusion vectors; Based on the multi-modal fusion vectors and the evidence energy model, a traceable attention graph neural network is constructed for representation learning and clustering to generate high-confidence attack portraits and structured portrait vectors; Based on the high-confidence attack portraits and structured portrait vectors, an adaptive risk calculation model is constructed to predict trends and simulate counterfactuals to obtain a final risk score, and structured disposal decision data is generated.

2. The attacker-profiled multi-source network threat aggregation analysis method of claim 1, wherein: The collecting and preprocessing multi-source data comprises: Performing timestamp unification, character encoding normalization, field mapping, session recombination, denoising and deduplication on multi-source data from logs, traffic and host behavior to construct a standardized event record set; Based on the source history hit rate, source reputation, timeliness and cross-source consistency of each record, the data source basic credibility is output , the dynamic weight is determined, which is represented as: ， wherein, represents a dynamic weight of a record, represents a data source base trustworthiness, represents a difference between a record generation time and a current analysis time, represents a time decay coefficient, represents a number of independent occurrences of the same entity or event feature in different data sources, represents a cross-source amplification coefficient.

3. The attacker-profile-oriented multi-source network threat aggregation analysis method according to claim 1 or 2, characterized in that: The correlating and aggregating multi-source evidence of standardized events comprises: Performing cross-source entity recognition and field alignment on standardized event record sets from different sources, constructing an evidence energy model based on semantic features, outputting correlation energy between entities and edge weights, and constructing a threat relationship graph.

4. The attacker-profiled multi-source network threat aggregation analysis method of claim 3, wherein: The extracting multi-modal feature vectors of nodes and edges according to the threat relationship graph comprises: According to the structure of the threat relationship graph, attribute features, time sequence features and context semantic features of nodes and edges are extracted, and multi-modal fusion mechanism is used to weight and combine multi-source data in a unified feature space.

5. The attacker profile oriented multi-source network threat aggregation analysis method according to any one of claims 1, 2, 4, characterized in that: The constructing traceable attention graph neural network for representation learning and clustering comprises: Taking multi-modal fusion vectors and evidence energy as input, attention-weighted aggregation is performed on the information between nodes to form a hierarchical feature update structure; Through clustering algorithm, high-density vector clusters are formed in the representation space to generate high-confidence attack portraits and structured portrait vectors, and all attention weights and node features can be traced back to the original evidence.

6. The attacker-profiled multi-source network threat aggregation analysis method of claim 5, wherein: According to the high-confidence attack portraits and structured portrait vectors, a sub-score set is constructed, a basic risk score is calculated, and a trend correction factor is output by combining short-term prediction results, which is represented as: ， wherein, denotes an adaptive risk base score, denotes a normalized weight vector, denotes a risk characteristic sub-score; After outputting the trend correction factor, the trend correction factor is introduced, and the risk score is dynamically adjusted combined with the time series prediction result, which is represented as: ， wherein, represents a trend correction factor, represents a trend amplification coefficient, represents a predicted risk value within a future time window, represents a base risk score obtained by weighted summation.

7. The attacker profile oriented multi-source network threat aggregation analysis method according to any one of claims 1, 2, 4, 5, characterized in that: The trend prediction and counterfactual simulation to obtain the final risk score comprises: For the candidate set of treatments, simulations are performed to generate risk reduction amounts , taking the maximum risk reduction amount , combining the confidence coefficient , outputting a final risk score represented as: ， wherein, represents an adaptive risk score, represents a base risk score; and in accordance with Output the stratification treatment strategy and structured decision data.

8. An attacker profile-oriented multi-source network threat aggregation analysis system employing the attacker profile-oriented multi-source network threat aggregation analysis method according to any one of claims 1 to 7. It comprises a multi-source threat data fusion processing module, an association modeling and portrait generation module, and a risk quantification and decision output module; The multi-source threat data fusion processing module is used for collecting and preprocessing multi-source data from logs, traffic and host, unifying timestamps, fields and encoding formats, calculating dynamic confidence weights and constructing a standardized event record set; The association modeling and portrait generation module is used for correlating and aggregating multi-source evidence of standardized events, constructing a threat relationship graph, extracting multi-modal feature vectors of nodes and edges, and generating high-confidence attacker portraits through traceable attention graph neural network for representation learning and clustering; The risk quantification and decision output module is used for calculating an adaptive risk score based on the attack portrait and its structured vector, obtaining a final risk value in combination with trend prediction and counterfactual simulation, and generating an executable hierarchical treatment strategy and structured decision data. 9.A computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the computer device is configured to perform the method according to any one of claims 1-8 when the computer program is executed by the processor. The processor implements the steps of the attack-portrait-oriented multi-source network threat aggregation analysis method of any one of claims 1-7 when executing the computer program.

10. A computer-readable storage medium having stored thereon a computer program, characterized in that, The computer program is executed by the processor to implement the steps of the attack-portrait-oriented multi-source network threat aggregation analysis method of any one of claims 1-7.

Images