Intelligent computer vulnerability detection method and system based on AI technology

Abstract

The invention relates to the technical field of computer security, and discloses an intelligent computer vulnerability detection method and system based on the AI technology, and the method comprises the steps: obtaining network topology structure data, equipment interaction logs and authority change records; obtaining a vulnerability distribution matrix according to the network topology structure data and the device interaction log; obtaining a potential diffusion sequence according to the vulnerability distribution matrix; extracting multi-source data from the potential diffusion sequence to obtain uniform observation representation; classifying the observation unified representation to generate a preliminary propagation path diagram; obtaining a refined path diagram according to the initial propagation path diagram; key mode features are extracted from the refined path diagram, and an identification result is obtained; calculating a path fusion weight according to the identification result, obtaining a connection matrix element, and generating a final vulnerability propagation prediction map; and aiming at the final vulnerability propagation prediction map, obtaining an active pre-judgment sequence. According to the method, complete and visual visualization of the vulnerability propagation path can be realized.

Description

Technical Field

[0001] This invention relates to the field of computer security technology, and in particular to an intelligent method and system for detecting computer vulnerabilities based on AI technology. Background Technology

[0002] Currently, in the field of computer security, protecting systems from vulnerabilities has become a core task in maintaining the stability of digital infrastructure. As networks continue to expand, vulnerabilities not only directly expose system weaknesses but can also trigger chain reactions through complex connections, leading to serious risks to the entire network. This makes the timely detection and response to vulnerabilities particularly urgent.

[0003] In existing technologies, security detection methods primarily rely on rule matching, vulnerability scanning tools, or pattern recognition-based traffic analysis to detect anomalous behavior and potential vulnerabilities. These methods typically use fixed thresholds to mark abnormal nodes or events, but they struggle to adapt to the irregular propagation paths of vulnerabilities across different devices. In practical deployments, this leads to frequent missed detections or false positives. Furthermore, these methods often focus only on the surface characteristics of known vulnerabilities, failing to capture the gradual evolution of vulnerabilities within the network topology. They also struggle to integrate multiple observation dimensions such as device interactions, data flow, or permission changes, resulting in an incomplete understanding of the overall vulnerability propagation and making path visualization difficult to present intuitively.

[0004] However, existing technologies primarily rely on single features or rule thresholds for detection, which cannot adapt to the complex propagation paths of vulnerabilities across different nodes and devices. They also struggle to integrate multiple observation dimensions such as device interaction, data flow, or permission changes for comprehensive judgment, resulting in an incomplete understanding of the full picture of vulnerability propagation. Therefore, existing technologies suffer from the problem of failing to provide a complete, intuitive, and visual representation of vulnerability propagation paths. Summary of the Invention

[0005] This invention provides a computer vulnerability intelligent detection method and system based on AI technology to solve the problem of difficulty in providing a complete, intuitive and visual representation of vulnerability propagation paths.

[0006] Firstly, in order to solve the above-mentioned technical problems, the present invention provides an intelligent computer vulnerability detection method based on AI technology, comprising: Acquire network topology data, device interaction logs, and permission change records; Based on the network topology data and the device interaction logs, vulnerability feature vectors are extracted to obtain a vulnerability distribution matrix; Based on the vulnerability distribution matrix, a graph neural network is used to process the node connection relationships, calculate the propagation probability, and obtain the potential diffusion sequence. Multi-source data is extracted from the potential diffusion sequence, the multi-source data is denoised and classified, fragmented observation features are extracted, and a unified representation of the observations is obtained. The observed unified representation is classified to obtain anomaly patterns. If the anomaly pattern matches a preset vulnerability evolution path, a preliminary propagation path diagram is generated. Based on the preliminary propagation path diagram, the flow paths between nodes are analyzed and clustered to obtain a refined path diagram. Key pattern features are extracted from the refined path map and transformed into vector representations to obtain the recognition results; Calculate the path fusion weights based on the identification results and obtain the connection matrix elements. Calculate the matching degree with the preset propagation group identifier based on the connection matrix elements and generate the final vulnerability propagation prediction map. Alarm signals are generated for high-risk paths in the final vulnerability propagation prediction graph, and intervention points are determined through path backtracking mechanism to obtain proactive prediction sequences.

[0007] Secondly, the present invention provides an intelligent computer vulnerability detection system based on AI technology, comprising: The data acquisition module is used to acquire network topology data, device interaction logs, and permission change records; The vulnerability feature extraction module is used to extract vulnerability feature vectors based on the network topology data and the device interaction logs to obtain a vulnerability distribution matrix; The potential diffusion analysis module is used to calculate the propagation probability and obtain the potential diffusion sequence by processing the node connection relationship using a graph neural network based on the vulnerability distribution matrix. The multi-source data fusion module is used to extract multi-source data from the potential diffusion sequence, denoise and classify the multi-source data, extract fragmented observation features, and obtain a unified representation of the observations; An anomaly pattern classification module is used to classify the observation unified representation to obtain anomaly patterns. If the anomaly pattern matches a preset vulnerability evolution path, a preliminary propagation path diagram is generated. The path refinement module is used to analyze the flow paths between nodes and perform clustering and grouping based on the preliminary propagation path map to obtain a refined path map. The key pattern recognition module is used to extract key pattern features from the refined path map and convert the key pattern features into vector representations to obtain recognition results. The weight update module is used to calculate the path fusion weight based on the identification result and obtain the connection matrix elements, calculate the matching degree with the preset propagation group identifier based on the connection matrix elements, and generate the final vulnerability propagation prediction map. The result output module is used to generate alarm signals for high-risk paths in the final vulnerability propagation prediction graph, and to determine intervention points through a path backtracking mechanism to obtain an active prediction sequence.

[0008] Thirdly, the present invention also provides an electronic device, including a processor, a memory, and a computer program stored in the memory and configured to be executed by the processor, wherein the processor executes the computer program to implement the AI-based intelligent computer vulnerability detection system method described in any one of the above.

[0009] Fourthly, the present invention also provides a computer-readable storage medium comprising a stored computer program, wherein, when the computer program is executed, it controls the device where the computer-readable storage medium is located to execute the AI-based intelligent computer vulnerability detection system method described above.

[0010] Compared with the prior art, the present invention has the following beneficial effects: (1) This invention extracts and analyzes multi-dimensional features from network topology data, device interaction logs and permission change records to construct a vulnerability propagation prediction map. This not only realizes the complete and intuitive visualization of the vulnerability propagation path, but also identifies high-risk nodes in advance by actively predicting the sequence. This achieves the goal of improving the accuracy and response efficiency of vulnerability detection without relying on manual tracking and tedious analysis, and solves the problem of the difficulty in making a complete and intuitive visualization of the vulnerability propagation path in the prior art.

[0011] (2) This invention introduces a method for calculating path fusion weights and connection matrix elements to cluster and weightedly integrate the intensity distribution vectors of different propagation paths, effectively highlighting risk hotspot paths. Furthermore, it combines propagation group identifiers with similarity matching to ensure the scientific rigor and stability of vulnerability propagation prediction. Compared to traditional analysis methods that rely on a single path or indicator, this invention enables comprehensive evaluation under multi-path, multi-node interaction, avoiding misjudgments caused by localized information and improving the reliability and precision of prediction results.

[0012] (3) Based on the extraction of high-risk paths, this invention combines intervention point identification and alarm signal generation mechanisms to automatically output proactive prediction sequences, clearly configure adjustment priorities and monitoring frequencies, and realize closed-loop control of the entire process from risk identification to protection strategy deployment. This mechanism not only improves the pertinence and real-time performance of security strategies, but also provides clear intervention guidance for system maintenance personnel, significantly shortens the vulnerability handling cycle, and reduces the spread of potential attacks. Attached Figure Description

[0013] Figure 1This is a schematic diagram of the intelligent computer vulnerability detection method based on AI technology provided in the first embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of the AI-based intelligent computer vulnerability detection system provided in the second embodiment of the present invention. Detailed Implementation

[0014] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0015] See Figure 1 The first embodiment of the present invention provides a computer vulnerability intelligent detection method based on AI technology, including the following steps: S1, obtain network topology data, device interaction logs, and permission change records; S2, Based on the network topology data and the device interaction logs, extract vulnerability feature vectors to obtain a vulnerability distribution matrix; S3. Based on the vulnerability distribution matrix, a graph neural network is used to process the node connection relationship, calculate the propagation probability, and obtain the potential diffusion sequence. S4, extract multi-source data from the potential diffusion sequence, denoise and classify the multi-source data, extract fragmented observation features, and obtain a unified representation of the observations; S5, classify the unified representation of the observation to obtain anomaly patterns. If the anomaly pattern matches the preset vulnerability evolution path, generate a preliminary propagation path diagram. S6. Based on the preliminary propagation path diagram, analyze the flow paths between nodes and perform clustering to obtain a refined path diagram; S7. Extract key pattern features from the refined path map and convert the key pattern features into vector representations to obtain the recognition results; S8. Calculate the path fusion weight based on the identification result and obtain the connection matrix elements. Calculate the matching degree with the preset propagation group identifier based on the connection matrix elements and generate the final vulnerability propagation prediction map. S9, generate alarm signals for high-risk paths in the final vulnerability propagation prediction graph, and determine intervention points through path backtracking mechanism to obtain active prediction sequence.

[0016] In step S1, network topology data, device interaction logs, and permission change records are obtained.

[0017] Network topology data, including metrics such as the connectivity relationships between nodes, link density, and path latency, describes the global and local connectivity characteristics of the network structure. This data can be collected through network monitoring systems or management platforms, or obtained by periodically scanning network devices. Network topology data is used to build a node connectivity graph, providing a foundation for subsequent vulnerability propagation probability calculations.

[0018] Device interaction logs record communication events between devices in the system, including event timestamps, interaction types, communication frequencies, and device response codes. They are used to reflect real-time interaction behavior between nodes and are obtained through log collection tools.

[0019] Permission change logs, which include the addition, modification, or revocation of user, device, or process permissions, are used to reveal potential vulnerability exploitation paths and security policy adjustments. They are obtained from permission management systems or access control logs.

[0020] In step S2, based on the network topology data and the device interaction logs, vulnerability feature vectors are extracted to obtain a vulnerability distribution matrix, including: Step S21: parse the topology node associations in the network topology data to obtain node connection density and path delay indicators, and combine them with the interaction event sequence in the device interaction log to obtain event timestamps and device response codes, generating an initial data set.

[0021] Among these metrics, node connection density represents the average number of connections per node; for example, a node connecting to 8 child nodes has a density of 8. Path latency represents the transmission delay of data packets from the source node to the destination node, for example, an average of 200 milliseconds. Event timestamps record the time when each interaction event occurs, while device response codes indicate the operation status, such as 200 for success, 404 for request failure, and 500 for an error. The initial dataset gathers all of the above information.

[0022] Step S22: Extract the first vulnerability feature vector from the initial data set. If the node connection density exceeds a preset connection density threshold, adjust the association weight between the path delay index and the event timestamp to obtain the second vulnerability feature vector.

[0023] In one implementation, the initial dataset is parsed. From the network topology data, the normalized connection density of each node is calculated. The node connection density index is obtained by dividing the number of direct connections by the total number of nodes in the network and then multiplying by a percentage. The sliding window average latency, in milliseconds, is calculated based on device interaction logs, with the window size set to T=24 hours, yielding the path latency index. The standard deviation of the interaction event timestamps is extracted. After Z-score standardization of the above multi-dimensional features, standardized values ​​with zero mean and unit variance are obtained. These are combined to form a first vulnerability feature vector, wherein the dimensions of the vector include: node connection density, path latency index, and event timestamp standard deviation. The parameters in the Z-score standardization are calculated based on historical data.

[0024] If the node connection density exceeds a preset connection density threshold, the association weight between the path delay index and the event timestamp is dynamically adjusted, and the adjusted weight is applied to weight the first vulnerability feature vector to generate a second vulnerability feature vector.

[0025] For example, when the node connection density is 8, which is higher than the preset connection density threshold of 5, the path delay weight can be adjusted from 0.4 to 0.6, and the event timestamp weight can be reduced from 0.4 to 0.3 to enhance the sensitivity of latency to vulnerability propagation risk under high-density nodes. The preset connection density threshold is obtained based on historical data statistical quantiles. By collecting historical network topology data from the past 30 days, the connection density distribution of all nodes is calculated, and a higher quantile (such as the 90th or 95th percentile) is selected as the threshold.

[0026] Specifically, the weight adjustment follows these rules: when the node connection density is less than or equal to the preset connection density threshold, the initial weights of the path delay index and the event timestamp feature remain unchanged; when the node connection density is greater than the preset connection density threshold, the weights are adjusted according to the extent to which the node connection density exceeds the threshold, using an adjustment coefficient of 0.05.

[0027] The adjustment coefficients are determined through historical data regression analysis, using historical vulnerability propagation data as the target variable to fit a linear model. The weight of the path delay indicator does not exceed 0.8, and the weight of the event timestamp feature is not less than 0.2.

[0028] Step S23: Perform vector dimension mapping on the second vulnerability feature vector, fuse preset feature weight coefficients and vulnerability severity labels, and if the device response code indicates an anomaly, enhance the distribution weight of the matrix row aggregation to determine the third vulnerability feature vector.

[0029] The preset feature weight coefficients can be determined based on statistical analysis of historical vulnerability data. By statistically analyzing the contribution of each feature to the occurrence of the vulnerability over a period of time and normalizing it to form a weight vector, it is ensured that high-contribution features occupy a larger proportion in the vector mapping. The vulnerability severity label can be predefined according to a vulnerability scoring system (such as CVSS scoring) or security policy, classifying vulnerabilities into low, medium, and high levels to reflect the potential threat of the vulnerability to system security.

[0030] In one implementation, for the second vulnerability feature vector, firstly, vector dimension mapping is performed, and then principal component analysis is used to retain the main variations of the data through dimensionality reduction. Specifically, let the set of second vulnerability feature vectors be... Each vector is d-dimensional (e.g., 10-dimensional). First, calculate the covariance matrix of the vector set. ,in The mean of the vector is given. Then, eigenvalue decomposition is performed on the covariance matrix CCC to obtain the eigenvalues. and the corresponding set of feature vectors The top k principal components are selected based on the cumulative variance contribution rate. For example, three eigenvectors with a variance contribution rate of over 80% are selected. The original 10-dimensional vector is mapped to a 3-dimensional principal component space to obtain the dimensionality-reduced vector representation. This process achieves both dimensionality compression and preservation of the main variation information in the original vector.

[0031] After vector mapping, the dimensionality-reduced feature vectors are weighted using preset feature weights and vulnerability severity labels. The preset feature weights are obtained based on statistical analysis of historical vulnerability data. By analyzing the contribution of each feature to the occurrence of historical vulnerabilities and normalizing it to form a weight vector, the importance of high-contribution features is highlighted during weighted calculation. The vulnerability severity labels can be defined with reference to vulnerability scoring systems (such as CVSS scoring), classifying vulnerabilities into low, medium, and high levels, corresponding to different weighting coefficients to reflect the potential threat of vulnerabilities to system security.

[0032] When a device response code indicates an anomaly, the distribution weight of the matrix row aggregation is enhanced. Specifically, the feature vector set is aggregated at the node or device level, and the statistical distribution of abnormal events for each row (node) is calculated. For example, the ratio of the number of abnormal device response codes to the total number of responses is used as the anomaly ratio for that row. The distribution weight of the row aggregation can be initially set to 1 and dynamically adjusted based on the anomaly ratio. When the occurrence rate of abnormal codes exceeds 20%, the aggregation weight of that row is increased from 1 to 1.5, thereby more prominently reflecting the risk characteristics of abnormal nodes in the feature matrix.

[0033] The abnormal code occurrence rate is calculated by taking the number of abnormal response codes that occur within a certain time window and the total number of responses for a certain node or device.

[0034] Step S24: Construct a vulnerability distribution matrix based on the third vulnerability feature vector.

[0035] In this matrix, rows represent network nodes, columns represent feature dimensions, and element values ​​reflect the probability of vulnerability risk for a node under the corresponding feature dimension.

[0036] In one implementation, the third vulnerability feature vector of each node is first arranged in order according to the feature dimension to form the row vector of the matrix; then, each row vector is subjected to Min-Max normalization so that the vector element values ​​are mapped to the [0,1] interval; then, according to the abnormal indicators of the corresponding features of the node in the historical vulnerability occurrence record, such as the occurrence rate of abnormal codes, the degree of deviation of delay value and the number of abnormal permission change, the normalized vector elements are weighted and adjusted to calculate the vulnerability risk probability of each node under each feature dimension, thereby generating a complete vulnerability distribution matrix.

[0037] The weights are set based on historical data. For example, historical data from a past period (e.g., 6 months or 1 year) is collected, including the characteristic values ​​of each network node at each record, i.e., abnormal indicators from device interaction logs and permission change records (e.g., abnormal code occurrence rate, latency deviation, number of abnormal permission changes, etc.). It also includes tag data, i.e., whether a vulnerability exploit or security event actually occurred on the same node during the same period as the aforementioned characteristic data (represented by yes / no, 1 / 0). Subsequently, weights are determined based on statistical correlation analysis. The Pearson correlation coefficient between each abnormal indicator and the vulnerability occurrence tag is calculated. The calculated correlation coefficients or mutual information values ​​are then Softmax normalized so that the sum of all weights is 1. These normalized values ​​serve as the initial weights for each feature. The stronger the correlation, the higher the weight.

[0038] In step S3, based on the vulnerability distribution matrix, a graph neural network is used to process the node connection relationships, calculate the propagation probability, and obtain the potential diffusion sequence, including: Step S31: Calculate the interaction delay factor based on the device interaction log and the device response code.

[0039] The interaction delay factor is obtained based on the delay data in the device interaction log.

[0040] In one implementation, the device interaction logs are first parsed to extract the event timestamps and corresponding device response codes for each communication. Then, for each pair of nodes (e.g., server A and router R1), the latency value for all interaction events is calculated, i.e., the event response time minus the request time, resulting in a latency set. Next, the average latency and standard deviation of this latency set are calculated. Then, the average latency is compared with a preset normal latency threshold (e.g., 200ms). If the average latency exceeds the threshold, it is weighted in the interaction latency factor to increase the risk weight of potentially abnormal nodes. The preset normal latency threshold is obtained based on historical network performance data. For example, if the average latency from server A to router R1 is 250ms, which is higher than the threshold of 200ms, the interaction latency factor can be set to 1.25 (250ms / 200ms). Furthermore, the proportion of abnormal response codes in the node's interactions is calculated; for example, if one abnormal response code is returned in five interactions, the abnormality rate is 20%, and this is combined with the latency factor to form a comprehensive interaction latency factor. Ultimately, the interaction delay factor can be represented as a vector [average delay normalized value × weight, abnormal response ratio × weight] to reflect the comprehensive response characteristics between nodes, which can be used for subsequent vulnerability propagation modeling and abnormal pattern identification.

[0041] Step S32: Obtain the node connection relationship graph based on the vulnerability distribution matrix. For the node pairs in the node connection relationship graph, use the propagation correlation coefficient between adjacent nodes in the graph neural network to obtain the preliminary propagation probability distribution.

[0042] The vulnerability distribution matrix provides the foundational data for constructing the node connection graph, while each node in the graph is labeled with its connection density and other characteristic information. The node connection graph is generated by parsing network topology data, recording the connection relationships and strengths between nodes. For example, in an enterprise intranet, server A connects to terminal C via router R1, forming the path A-R1-C. In the node connection graph, server A connects to 5 nodes, with a connection density of 5. For each node pair in the node connection graph, a graph neural network is used to calculate the propagation correlation coefficient between adjacent nodes.

[0043] It is worth noting that the graph neural network computation mentioned refers to using a graph convolutional network as the core structure. The input layer receives the multi-dimensional feature vector of each node (including connection density, latency, abnormal response rate, permission change indicators, etc.) and the adjacency matrix of the node connection graph. Subsequently, it passes through two graph convolutional layers. Each graph convolutional layer extracts the high-order features of the node and its neighbors through weighted neighbor aggregation and uses the ReLU activation function to increase the non-linear expressive power. After the graph convolutional layers, a fully connected layer is connected, which maps the aggregated features of each node to a fixed-dimensional propagation correlation coefficient vector and outputs the propagation probability value of each pair of adjacent nodes.

[0044] The model is trained using supervised learning. Training data is derived from historical network operation and maintenance records, including actual vulnerability propagation events between nodes and corresponding node characteristics. Known vulnerability propagation paths and actual propagation probabilities are used as supervision labels. The mean squared error (MSE) loss function is used for optimization, and the Adam optimizer is employed to iteratively train the model parameters until training converges. After training, the model can be used to predict the potential propagation probability of adjacent nodes in a new network topology, achieving a preliminary estimate of unknown vulnerability propagation paths.

[0045] This correlation coefficient feature is obtained by aggregating the features of neighboring nodes and is used to assess the likelihood of a vulnerability propagating between nodes. For example, the propagation correlation coefficient between server A and R1 can be calculated using the following formula: in, Let i represent the set of neighbors of node i. The feature vectors of the neighboring nodes, Let k be the connection weight between node i and its neighbor k. The feature vectors of the neighboring nodes, Let k be the connection weight between node l and its neighbor k. This represents the connection weight between node j and its neighbor node l. The sigmoid function maps aggregated values ​​to the [0,1] interval. After calculating the propagation correlation coefficient for each pair of nodes using this formula, a preliminary propagation probability distribution can be generated based on the weighted average of the propagation relationships between adjacent nodes. : in, This represents the propagation correlation coefficient between node i and node j calculated above. This is a weighting coefficient, which can be set based on network environment and historical transmission data experience. and Let $\frac{i}{j}$ be the mean risk probability vector of nodes $i$ and $j$ in the vulnerability distribution matrix corresponding to the feature dimensions. This is calculated by applying the formula to all adjacent node pairs. This allows us to obtain the initial propagation probability distribution of the entire network.

[0046] Step S33: Extract adjacent connection density indices from the node connection relationship graph. When the preliminary propagation probability distribution exceeds the preset preliminary propagation probability threshold, adjust the adjacent connection density indices to determine the preliminary identification sequence of high-risk nodes.

[0047] The process involves extracting a connection density index for each node from the node connection graph. This index represents the number of a node's neighbors and is a key characteristic that can be directly obtained from the graph. Combined with the preliminary propagation probability distribution, when the propagation probability of a node exceeds a preset preliminary propagation probability threshold, the connection density index of that node is adjusted to enhance its weight in risk assessment. The preset preliminary propagation probability threshold can be determined based on historical vulnerability propagation statistics, such as statistically analyzing the actual vulnerability propagation probability distribution of each node over the past 30 days and selecting a high quantile (e.g., the 85th or 90th percentile) as the threshold to identify high-risk nodes. In practical applications, this threshold can be flexibly adjusted according to the network environment and security policies.

[0048] The path extension factor reflects the risk amplification effect of a vulnerability propagating along a path in a network. It can be calculated based on the average latency between nodes, connection strength, and historical propagation frequency. For example, for a path... Path extension coefficient It can be calculated using the following formula: in, Let be the average delay from node i to node j. To preset the normal delay threshold, The ratio of historical vulnerability propagation frequency between node i and node j. and This is an empirical weighting coefficient. This coefficient reflects the amplifying effect of high delay or high propagation frequency in the path on risk.

[0049] The formula for adjusting node connection density, taking into account the path extension coefficient, is as follows: in, For the original connection density, This represents the adjusted connection density. This adjustment method amplifies the connection density of high-risk nodes during the assessment, making them more prominent in subsequent risk identification.

[0050] For example, in the initial propagation probability distribution, server A has a probability of 0.8, router R1 has a probability of 0.6, and the preset initial propagation probability threshold is 0.7. Since the probability of A exceeds the preset initial propagation probability threshold, its connection density index needs to be adjusted according to the path extension coefficient. Assuming the extension coefficient of the A-R1 path is 1.2, indicating that the risk propagation is amplified by 20%, then the connection density of A increases from 5 to 6 after adjustment, marking it as a high-risk node. Finally, the initial high-risk node identification sequence generated by this method is {A, R1}.

[0051] Step S34: Fuse the preliminary identification sequence of the high-risk nodes and the interaction delay factor, and calculate the node aggregation weight to obtain the potential boundary of the diffusion sequence.

[0052] The interaction latency factor is obtained based on latency data in the device interaction logs. For example, if the average latency from A to R1 is 250ms, which is higher than the normal value of 200ms, it indicates a potential anomaly. For abnormal response markers in the sequence, such as the response code 500 appearing three times in R1, a node aggregation weight can be calculated. The node aggregation weight reflects the comprehensive risk level of a single node under latency anomalies and erroneous responses. An example of its calculation formula is shown below: in, Let i be the aggregation weight. Let i be the average delay of node i. To preset a normal latency threshold, the normal latency threshold is determined based on the statistical quantiles of historical network operation and maintenance data. For example, if 95% of nodes have an average latency of ≤200ms, then the threshold is set to 200ms. The proportion of abnormal response codes appearing at node i. and These are empirical weighting coefficients.

[0053] The aggregation weight is calculated for each node in the preliminary high-risk node identification sequence and compared with a preset aggregation threshold. By comparison, the potential boundaries of the diffusion sequence can be determined. The preset aggregation threshold... The threshold can be obtained based on the statistical distribution of aggregated weights of historical nodes, for example, by selecting the 80th or 85th percentile as the threshold, to ensure the identification of potentially high-risk nodes. This threshold is consistent with the preset aggregated threshold in the subsequent step S35 to ensure uniformity of evaluation standards across steps.

[0054] The boundary expansion rule is as follows: when the aggregate weights of a node in the sequence and its direct neighbors all exceed a preset aggregation threshold... When these nodes and their neighboring nodes are included in the potential boundary range of the diffusion sequence, the adjacency determination between nodes is based on the node connection relationship graph. If node i and node j are directly connected by an edge in the graph, they are considered adjacent. For example, in the preliminary sequence {A,R1}, if the aggregation weights of A and R1 both exceed 1.3 (a set threshold), then it is checked whether their neighboring node C is directly connected to A or R1. If so, C is included in the potential diffusion sequence, resulting in the diffusion sequence {A,R1,C}, and the boundary of the potential diffusion sequence is dynamically determined.

[0055] Step S35: When the node aggregation weight of the potential boundary of the diffusion sequence is higher than the preset aggregation threshold, the potential boundary of the diffusion sequence is expanded to obtain a complete risk node diffusion sequence.

[0056] Specifically, the aggregate weight is first calculated for each node i within the potential boundary. , in, Let i be the average delay of node i. Set a preset normal latency threshold (e.g., 95% of nodes have an average latency of ≤200ms). The proportion of occurrences of abnormal response codes for node i. and This is an empirical weighting coefficient (which can be set to 0.5 depending on the network environment). Overall risk level of the mapping node.

[0057] Calculate the node aggregation weights With preset aggregation threshold In comparison, the threshold is calculated in step S34, and the 80th or 85th percentile is selected with reference to the historical node weight distribution statistics to ensure that the threshold is representative.

[0058] If the node aggregate weight > If a node is found to be adjacent to another node, then its neighboring nodes are included in the diffusion sequence. The determination of neighboring nodes is based on the node connection graph: if node i and node j have a direct edge connection in the graph, they are considered neighboring nodes.

[0059] In one implementation, the diffusion operation is performed according to the following steps: First, all boundary nodes above the threshold are included in the diffusion sequence; then, the neighboring nodes of each node are checked. If a neighboring node is not in the diffusion sequence and is directly connected to the current node, it is added to the sequence; the above steps are repeated for newly added nodes until all neighboring nodes of all nodes in the sequence have been traversed or the aggregate weight does not exceed the threshold, thus obtaining a complete risk node diffusion sequence.

[0060] Step S36: Extract the probability fusion vector from the complete risk node diffusion sequence, and calculate the path extension coefficient and connection density index in the probability fusion vector to determine the final propagation probability.

[0061] In one implementation, propagation-related numerical indicators, including the initial propagation coefficient, are first extracted node by node from the complete risk node propagation sequence. Connection density adjusted after steps S33 and S34 And the extension coefficient for measuring the amplification effect of path risk. These indicators are then combined into a vector to form the probability fusion vector of the node: Next, based on the probability fusion vector of node i, the final propagation probability is calculated. The specific calculation method is as follows: First, calculate the correlation between connection density and path extension coefficient. : Where cov represents covariance. and These are the standard deviations of the connection density and the elongation coefficient, respectively. If (Positive correlation) indicates that the higher the node connection density, the more significant the amplification of path risk, and its propagation probability value should be increased; if If the path amplification effect has no significant impact on node propagation (not positively correlated), the initial propagation probability can be retained or moderately attenuated, for example, by multiplying it by a coefficient of 0.9.

[0062] The final propagation probability is calculated using the following formula: in, This is an empirical amplification factor, which can be set based on network size and historical vulnerability propagation data (e.g., When the connection density is positively correlated with the path extension coefficient, the final propagation probability of a node is amplified, and vice versa.

[0063] For example, for node A, its fusion vector is [0.8, 6, 1.2], corresponding to a propagation coefficient of 0.8, an adjusted connection density of 6, and a path extension coefficient of 1.2, respectively. Logical analysis reveals a positive correlation between the extension coefficient and density, indicating that the node's propagation capability is amplified, thus calculating a final propagation probability of 0.85. If this value exceeds a preset threshold of 0.7, node A is confirmed to have a high risk of propagation and is included in the final risk assessment result, yielding the final propagation probability.

[0064] Step S37: When the final propagation probability exceeds the preset final propagation probability threshold, extract the vulnerability propagation path from the complete risk node diffusion sequence and integrate the risk node identifiers to generate a potential diffusion sequence.

[0065] Among them, the preset final propagation probability threshold is determined based on the statistical distribution of historical vulnerability propagation events, such as using the 90th percentile of the vulnerability propagation probability in the past 30 days.

[0066] In one implementation, when the final propagation probability of a certain node is higher than the preset final propagation probability threshold, it is marked as a candidate high-risk node, and the vulnerability propagation path is extracted from the directed weighted graph constructed by the complete risk node diffusion sequence. Specifically, starting from the candidate node, the edge weight is calculated by combining the propagation probability P, path extension coefficient E, and delay factor D of adjacent nodes. First, P, E, and D are respectively mapped to [0,1] by Min-Max normalization based on historical observations; then, the normalized values are linearly weighted by the weight coefficients a, b, and c obtained by least squares fitting to obtain the original score of the edge. The weighted calculation formula is as follows: Finally, apply the Min–Max monotonic mapping to score to obtain the edge weight w (0 < w ≤ 1), which represents the relative propagation intensity from the source node to the target node. Use the Yen optimal path search algorithm to extract several propagation paths with the highest scores, as follows: Extract the top K simple shortest paths. When searching, use the reciprocal of the edge weight or 1−w as the cost so that high-edge-weight paths are preferentially selected. At the same time, set an upper limit L_max for the path length to avoid overly long low-confidence paths. Further calculate the path score for each candidate path for sorting and screening. The path score comprehensively considers the path connectivity strength and node susceptibility: First, measure the path connectivity strength S_edge by the product of all edge weights of the path; second, calculate the node contribution S_node by the risk value of the nodes in the path (from the normalized and weighted node risk probability in step S24); finally, use S_edge × S_node as the total path score.

[0067] Ensure the rationality and risk significance of the propagation path. Subsequently, integrate the node risk identifiers involved in the path and form an ordered potential diffusion path according to the propagation direction. For example, when nodes A, R1, and C meet the threshold conditions and form a path A→R1→C, determine this path as the potential diffusion sequence, and mark the risk levels of each node in the sequence.

[0068] In step S4, extract multi-source data from the potential diffusion sequence, denoise and classify the multi-source data, and extract fragmented observation features to obtain a unified representation of the observations, including: Step S41: Obtain multi-source data from the potential diffusion sequence, clean and denoise the multi-source data to obtain a standardized dataset.

[0069] The multi-source data mainly includes device interaction logs and permission change records. First, redundant fields, such as duplicate timestamps or invalid IP addresses, are removed. Then, log entries missing key fields are deleted. Key fields must include at least the source IP, destination IP, port number, protocol type, and timestamp. Logs missing any of these key fields are considered invalid and deleted. Finally, the data format is standardized by using Coordinated Universal Time (UTC) format (YYYY-MM-DD HH:MM:SS), accurate to the second, to construct a standardized dataset.

[0070] Step S42: Cluster the standardized dataset, extract fragmented observation features to obtain interaction fragments and permission fragments, and combine the interaction fragments and permission fragments to obtain a set of observation dimension fragments.

[0071] For example, the K-means algorithm is used to classify interaction logs into different categories. The initial value of the number of clusters k is set to 4, the maximum number of iterations is 300, and the convergence tolerance is set to 1e-4. This algorithm represents the feature space of the data samples (such as interaction frequency, protocol type, permission change frequency, permission sensitivity, etc.) as feature vectors and completes the classification by iteratively minimizing the within-cluster squared error (SSE).

[0072] In one implementation, interaction logs are first categorized based on interaction frequency and protocol type: nodes with an average daily interaction count of 50 or more are classified as high-frequency interaction groups, while those with fewer than 50 interactions are classified as low-frequency interaction groups. Simultaneously, permission change records are categorized based on change frequency and permission sensitivity into high-risk change groups and regular change groups. For example, server A's interaction logs show 100 daily interactions with router R1, classifying it as a high-frequency interaction group, while its permission change records show the addition of highly sensitive database permissions, classifying it as a high-risk change group.

[0073] The above classification results are used to combine interaction-type fragments and permission-type fragments. The combination method is feature-level concatenation, which involves concatenating the interaction frequency feature and protocol type feature extracted from the interaction-type fragments with the permission change type feature and sensitivity feature from the permission-type fragments in the order of feature dimensions to form a multi-dimensional vector. This results in a set of observation dimension fragments containing information such as interaction frequency feature, protocol type feature, and permission change type feature. For example, if the interaction frequency is 100, the protocol type encoding is 3, and the permission sensitivity is 0.9, the concatenated vector will be [100, 3, 0.9].

[0074] Step S43: Based on the observation dimension fragment set, perform vector mapping and calculate the similarity of the vector mapping. When the similarity is higher than a preset similarity threshold, a unified representation of the observation is obtained.

[0075] In one implementation, features from observed fragments can be input into a Node2Vec-based graph embedding model. The model parameters include a random walk step size of 80, a random walk count of 10, a vector dimension of 128, a window size of 10, a minimum word frequency of 1, and walk return parameter p and forward parameter q set to 1.0 and 0.5, respectively, to balance local neighborhood structure and global topological relationships.

[0076] Next, cosine similarity is used to calculate the similarity between different observation fragments. A preset similarity threshold is calculated based on the similarity distribution of historical attack samples and normal samples, and ROC curve analysis is used to select a balance point between false positive and false negative rates. When the similarity is higher than the preset similarity threshold, the group of observation fragments is considered to exhibit consistency in the same semantic space, thereby generating a unified observation representation.

[0077] In step S5, the observed unified representation is classified to obtain anomaly patterns. If the anomaly pattern matches a preset vulnerability evolution path, a preliminary propagation path diagram is generated, including: Step S51: Based on the unified representation of observations, extract device interaction features and permission change features and classify them to obtain abnormal patterns.

[0078] It should be noted that, based on the unified representation of observations, device interaction features and permission change features are extracted. Device interaction features include indicators such as the frequency of interaction between nodes, protocol type, average response latency, and abnormal response ratio; permission change features include indicators such as newly added, modified, or deleted permission records, operation sensitivity level, and operation time interval. These features can be obtained by parsing the numerical mapping of corresponding dimensions in the unified representation vector. For example, dimensions 1 to 5 in the vector represent interaction frequency, protocol type, and latency, while dimensions 6 to 8 represent permission change type, sensitivity level, and number of changes.

[0079] Subsequently, the extracted device interaction features and permission change features are input into a random forest algorithm to jointly model these features and uncover potential anomaly patterns. The key parameters of the random forest algorithm are set as follows: the number of trees is 100, the maximum depth is 15, the minimum number of sample splits is 2, the maximum number of features is sqrt, the Gini coefficient is used as the node splitting criterion, and the Bootstrap sampling method is used to construct each decision tree. The training data comes from historical security event samples; for example, a training set contains 5000 labeled security event samples, of which 20% are anomalous.

[0080] Anomaly patterns can be identified through training and classification using random forests. These anomaly patterns are represented as combinations of node features, with each pattern containing information on high-frequency interaction nodes, abnormally delayed nodes, and high-risk permission change nodes. For example, in a company's network security system, the cleaned dataset contains 2000 interaction logs. Server S1 interacts with terminal T1 80 times daily, exhibiting a high-frequency interaction characteristic. Simultaneously, permission change records show that S1 gained write permissions to file server F1 within 24 hours, representing a high-risk change characteristic. Combining these features forms an anomaly pattern vector, which consists of the daily interaction count, protocol type number, and permission change count. For instance, the anomaly pattern vector for server S1 is [150, 3, 2], representing 150 daily interactions, protocol type number 3, and 2 permission changes, respectively.

[0081] Step S52: When the matching degree between the abnormal pattern and the preset vulnerability evolution path is higher than the preset matching degree threshold, the abnormal pattern is vector-mapped to obtain propagation path data.

[0082] The preset vulnerability evolution path vector is derived from historical vulnerability propagation data. By statistically analyzing the vulnerability evolution sequences that have occurred in the enterprise's internal network and vectorizing their features, a typical path representation is obtained. The vulnerability evolution path vector has the same dimension as the abnormal pattern vector.

[0083] The matching degree is obtained by calculating the cosine similarity between the anomaly pattern vector and the vulnerability evolution path vector. For example, the cosine similarity between S1 and the preset vulnerability evolution path is 0.82. The preset matching degree threshold is based on the distribution of cosine similarity between statistical historical anomaly patterns and actual vulnerability propagation paths, and a similarity value that balances the false positive rate and the false negative rate is selected as the threshold, for example, 0.8.

[0084] When the matching degree exceeds a preset threshold, the node is identified as a potential risk propagation node. Subsequently, the node's abnormal pattern vector is mapped in the feature space, and propagation path data is generated by weighted node calculation, combining its position in the network topology, its connection relationships with neighboring nodes, and its historical propagation probability. Specifically, based on the connection strength and propagation probability between nodes, the node is sequentially expanded to its possible propagation neighbors, forming a path sequence. Then, the nodes on the path are weighted and ranked according to their propagation capability indicators (such as extension coefficient and connection density). Specifically, a comprehensive propagation score is first calculated for each node. : in, The path extension coefficient of a node reflects its ability to amplify the propagation of vulnerabilities. The adjusted connection density of a node represents the number of its neighbors and its propagation potential. and These are weighting coefficients, which can be set based on historical data statistical analysis or network strategies, for example... This is to highlight the impact of the extension coefficient. Subsequently, the nodes on the path are ranked according to their comprehensive scores. Sort the data from highest to lowest to generate a weighted, sorted propagation sequence.

[0085] Step S53: Convert the propagation path data into a visual path diagram to obtain a preliminary propagation path diagram.

[0086] The propagation path data consists of propagation capability indicators (such as extension coefficient and adjusted connection density) of each node on the path, node feature vectors (including interaction frequency, protocol type number, number of permission changes, etc.), and propagation probability between nodes.

[0087] First, the multidimensional features of each node are transformed into dense vectors of uniform dimension using a fully connected neural network. The input dimension corresponds to the dimension of the original node feature vector, and the output dimension is a fixed uniform dimension (e.g., 128 dimensions). The fully connected neural network is trained unsupervised using an autoencoder structure, and the loss function is mean squared error (MSE). During the mapping process, the original feature vector is multiplied by the mapping matrix and a bias vector is added.

[0088] Subsequently, a preliminary propagation path graph is constructed based on the propagation relationships and probability values ​​between nodes. Each node is mapped to a node in the graph, and the node size or color is labeled according to its propagation capability index. If there is a non-zero propagation probability between nodes, an edge is added to the graph. The thickness or color of the edge is weighted according to the propagation probability between nodes to reflect the strength of potential vulnerability propagation; the direction of the edge indicates the possible direction of vulnerability propagation. The graph structure can be constructed using NetworkX or Gephi, dynamically generating nodes and edges in the graph based on their propagation probabilities and connectivity by traversing all node pairs.

[0089] In the generated preliminary propagation path diagram, nodes represent devices or terminals in the network, and the size or color of nodes can be marked according to the node propagation capability index; edges represent potential vulnerability propagation paths between nodes, and the thickness or color of edges can be displayed in a weighted manner according to the propagation probability between nodes.

[0090] In step S6, based on the preliminary propagation path diagram, the flow paths between nodes are analyzed and clustered to obtain a refined path diagram, including: Step S61: Obtain the first node flow data from the preliminary propagation path map, calculate the interaction frequency and correlation strength of the first node flow data, and generate the first node distribution set.

[0091] First, the node interaction frequency is normalized using the Min-Max method, mapping the daily interaction count to the [0,1] range to ensure that the characteristics of different nodes are comparable; then, the data transmission volume is considered. and interaction frequency The weighted combination method is used to calculate the association strength between nodes. The association strength can be calculated using the weighted combination method, as shown in the following formula: in, and Let be the weighting coefficient, satisfying It can be configured according to network security analysis needs, for example... ; This represents the maximum data transmission volume between nodes in the network. This weighted combination comprehensively reflects the interaction activity and data transmission characteristics of the nodes.

[0092] The above calculations can generate the first node distribution set.

[0093] For example, in a company's network security system, the preliminary path diagram shows that server S2 and terminal T3 interact 100 times daily, with a data transmission volume of 500MB. The association strength, calculated based on the interaction frequency and data volume, is 0.85, higher than the average level. By calculating the interaction frequency and association strength in the node flow data, a node distribution set can be generated. The node distribution set contains the feature vectors of all active nodes. For example, the feature vector of S2 is [100, 500, 0.85], representing the interaction frequency, data transmission volume, and association strength, respectively.

[0094] Step S62: Based on the first node distribution set, perform density clustering to group the nodes to obtain the grouped nodes. If the association strength of the grouped nodes is higher than the preset association strength threshold, then a data group set is obtained.

[0095] The preset association strength threshold is based on the association strength distribution of normal and abnormal samples in historical data. ROC curve analysis is used to select the balance point between false positive rate and false negative rate.

[0096] In one implementation, based on the first node distribution set, the DBSCAN algorithm is used to cluster the nodes, with key parameters including the neighborhood radius. and the minimum number of points MinPts, where The average neighbor distance can be determined based on the statistical distribution of normalized interaction frequency and association strength between nodes, for example, by selecting 1.2 times the average neighbor distance. The specific calculation method for the average neighbor distance is as follows: first, calculate the Euclidean distance from each node to all its neighbor nodes, and then calculate the average nearest neighbor distance for each node. Finally, take the overall average of the average distances of all nodes to obtain the average neighbor distance. MinPts can be set to 3 to 5 to ensure that each cluster contains at least a certain number of nodes. For each cluster group, calculate the average association strength of the nodes within the group. The calculation formula is as follows: Where n is the number of nodes in a cluster group. Let be the association strength of node i.

[0097] If average correlation strength If the correlation strength exceeds a preset threshold, the group of nodes is considered a data set for subsequent risk propagation analysis. For example, nodes S2, T3, and database D1 are grouped together due to their high interaction frequency and large data transmission volume. Their average correlation strength is 0.9, which is higher than the preset correlation strength threshold of 0.7, thus forming an effective data set.

[0098] Step S63: Convert the data group set into simplified paths to generate a refined path map.

[0099] In one implementation method, the nodes in the data group set are first sorted according to interaction frequency, data transmission volume, and association strength. During sorting, a weighted scoring method can be used to comprehensively calculate the total node score P by combining indicators such as interaction frequency X, data transmission volume Y, and node sensitivity Z. The formula for calculating the total score P is as follows: Where u, v, and w are weighting coefficients, set based on historical data statistics. If a high-frequency node conflicts with a high-sensitivity node, the node with the higher total score is retained first, thus ensuring that the ranking result takes into account both frequency and sensitivity. Low-relevance nodes are removed, that is, nodes whose relevance strength is lower than the preset relevance strength threshold in step S62. High-sensitivity nodes refer to those whose permission changes involve critical system resources or high-risk operations, such as adding permissions to the database, financial system, or core server; low-relevance nodes refer to those whose relevance strength is lower than the preset relevance strength threshold in step S62.

[0100] For example, NetworkX or Gephi can be used to map nodes and their interactions into a visual path graph, thus forming a refined path graph. In the generated refined path graph, nodes represent devices or terminals in the data group set. The size or color of nodes can be labeled according to a weighted score based on node sensitivity, interaction frequency, and association strength. Edges represent potentially high-risk interaction links between nodes, and the thickness or color of edges can be displayed according to a weighted score based on the association strength or propagation probability between nodes.

[0101] In step S7, key pattern features are extracted from the refined path map and converted into vector representations to obtain the recognition result, including: Step S71: Obtain the second node flow data from the refined path map, calculate the interaction frequency and correlation strength of the second node flow data, and generate the second node distribution set.

[0102] Specifically, second-node flow data is used to capture weak but potentially risky interactions between devices, such as low-frequency data exchanges or indirect connections, which are often overlooked in initial analysis. Interaction frequency is obtained by counting the number of communications between nodes daily or hourly, and correlation strength is used to quantify the closeness of the relationship between nodes; its calculation formula can be expressed as: in, This represents the association strength between node i and node j. The frequency of interaction between nodes. This represents the highest interaction frequency across the entire network, used for normalization. The amount of data transmitted between nodes. This represents the largest data volume across the entire network, used for normalization. This is a historical interaction pattern indicator, quantified by analyzing the stability, periodicity, and proportion of abnormal events in interactions between nodes over a past period. Its value ranges from [0,1], and it reflects the long-term association characteristics between nodes. These are the weighting coefficients.

[0103] By calculating the interaction frequency and association strength of all nodes, a second node distribution set can be generated, and the feature vector of each node can be represented as follows: This reflects their potential risk contribution. For example, server S2 communicates with terminal T3 20 times a day, with a relatively small amount of data. The association strength calculated by the above formula is 0.3, which is lower than the average level of 0.5. Step S72: Based on the second node distribution set, map the nodes and paths into a set of vector representations.

[0104] The Node2Ve algorithm is used to map nodes and their paths. Node2Ve training uses the Skip-gram model with 5 negative samples, a negative log-likelihood loss function, and the Adam optimizer with a learning rate of 0.01, undergoing 100 training iterations. When constructing the graph from the second node distribution set, edges are created based on the feature similarity between nodes (such as cosine similarity); edges are added when the similarity is higher than 0.7.

[0105] Specifically, the Node2Vec algorithm generates a sequence of nodes by performing a random walk with parameters (p, q). The parameters are set as follows: the random walk length l is 80, the number of walks r for each node is 10, the context window size k is 10, the return parameter p is 1, and the input parameter q is 1.

[0106] For the GraphSAGE algorithm, each node's neighboring nodes (k=5) are sampled, and the node's own features are aggregated with the features of its neighboring nodes. This aggregated data is then input into a multi-layer neural network to obtain the node's embedding vector. The training data consists of each node in the second node distribution set and its neighbor relationships. The labels can be the connection relationships between nodes or the attribute features of the prediction task.

[0107] After mapping, each node receives a vector representation of a fixed dimension, and path features are also obtained by combining node vectors. For example, the vector representation of server S2 is [0.2, 0.4, 0.1], representing its interaction frequency, data volume, and path location, respectively, while terminal T3 is [0.3, 0.3, 0.2].

[0108] Step S73: Calculate the Euclidean distance between nodes based on the vector representation set. If the Euclidean distance is lower than a preset Euclidean distance threshold, calculate the cosine similarity and generate a hidden path set.

[0109] The preset Euclidean distance threshold is determined through statistical analysis of historical node interaction data. The distance and similarity distribution of all node pairs are calculated, and the 90th percentile is selected as the Euclidean distance threshold (e.g., 0.5), and the 85th percentile is selected as the cosine similarity threshold (e.g., 0.8), which is then verified using ROC curves.

[0110] In one implementation method, firstly, the spatial difference between node vectors is measured using Euclidean distance. If the distance is lower than a preset Euclidean distance threshold, it indicates that the nodes are close in the vector space and may have potential unrecorded interaction relationships. Then, cosine similarity is calculated for node pairs that meet the criteria. If the cosine similarity is higher than a preset similarity threshold, the node pair is included in the hidden path set. The similarity threshold is obtained by statistically analyzing historical abnormal interaction patterns to balance the false positive rate and the false negative rate.

[0111] When generating the set of hidden paths, the potential paths can be reconstructed based on the graph topology using Dijkstra's shortest path algorithm, taking into account the original network topology. The input parameters of Dijkstra's algorithm include the set of nodes, the set of edges, and the edge weights. The edge weights are calculated by weighting the interaction frequency F between nodes, the data transmission volume D, and the association strength S. The specific weighting formula is as follows: Where M is the calculated edge weight, and d, e, and f are weight coefficients obtained based on historical experience. Then, the topological paths corresponding to similar nodes in the vector space are connected to generate a complete set of hidden paths.

[0112] Step S74: Based on the set of hidden paths, cluster and group the paths to obtain the identification results.

[0113] The hidden path set includes features for each path, such as Euclidean distance between nodes, cosine similarity, interaction frequency, and data transmission volume. These features are obtained through a second node distribution set and vector mapping. First, potential hidden paths are identified using Euclidean distance and cosine similarity. For example, the path from S2 to D1 via T3, despite its low interaction frequency (5 times per day), has a data volume of 100MB, indicating potential risk. Then, the DBSCAN algorithm is used to group the hidden path set, with parameters including a minimum sample size (MinPts) of 3 and a neighborhood radius. =0.5, the training data comes from historical network interaction records and known abnormal path labels. Historical abnormal path labels are used for supervised clustering adjustment to improve the accuracy of abnormal path identification. Parameters MinPts was determined through a historical data grid search, using the silhouette coefficient as an evaluation metric to select the optimal parameter combination for cluster density and separation. Further analysis of the path characteristics of each cluster group can serve as a basis for identifying potential abnormal paths, ultimately generating hidden path identification results.

[0114] In step S8, the path fusion weights are calculated based on the identification results to obtain the connection matrix elements. The matching degree with the preset propagation group identifier is calculated based on the connection matrix elements to generate the final vulnerability propagation prediction map, including: Step S81: Obtain path grouping labels based on the recognition results, extract node weight coefficients from the path grouping labels, and obtain a weight adjustment sequence.

[0115] Each path in the identification result set is assigned a group label, such as "low-frequency detour" or "database penetration," to identify the path type and potential risk patterns. For each path, the node weight coefficient is calculated through the following steps: First, the number of interactions, data transmission volume, and association strength of each node in the path are statistically analyzed, and these indicators are normalized using the Min-Max method. Then, considering the relative importance of the node in the path, such as the proportion of the path length or the node's topological centrality, the normalized indicators are weighted and summed to generate the node's comprehensive weight coefficient. Finally, the weight coefficients of all nodes in the path are arranged according to path order or topological order to form a weight adjustment sequence. Step S82: Based on the weight adjustment sequence, determine whether the node weight coefficient exceeds a preset coefficient threshold. If it exceeds the preset coefficient threshold, use the K-means clustering algorithm to process the weight adjustment sequence and generate an intensity distribution vector. If it does not exceed the preset coefficient threshold, directly determine the intensity distribution vector.

[0116] The preset coefficient threshold is calculated based on the 75th percentile of the historical node weight coefficient distribution, and the node weight coefficient reflects the risk contribution of each node in the path.

[0117] For example, the weight coefficient of S2 is 0.6 (based on 20 communications per day), T3 is 0.4 (due to indirect association), and D1 is 0.8 (due to large data volume), forming a weight adjustment sequence [0.6, 0.4, 0.8]. The system first compares the weight of each node in the sequence with a preset coefficient threshold of 0.5 to determine whether clustering analysis is needed. If the threshold is exceeded, the K-means clustering algorithm is used to assign the sequence nodes to different clusters, generating corresponding intensity distribution vectors. The specific algorithm parameters are set as follows: the number of clusters K is determined by the elbow rule, the SSE under different K values ​​is calculated, and the K value corresponding to the inflection point of the SSE curve is selected; or K=3 is set based on historical risk pattern experience; the k-means method is used for initialization to ensure a uniform distribution of initial centers; the maximum number of iterations is set to 300; and Euclidean distance is used as the distance metric. After clustering is completed, the mean of the node weights within each cluster is used as the cluster intensity value, and intensity distribution vectors are generated sequentially to capture the distribution pattern of node weights. If the threshold is not exceeded, the weight adjustment sequence will be directly used as the intensity distribution vector for subsequent path risk assessment and node priority ranking.

[0118] Step S83: Calculate the path fusion weights based on the intensity distribution vector, and generate connection matrix elements based on the path fusion weights.

[0119] The intensity distribution vector reflects the risk contribution of each node in the path. For example, in the sequence [0.6, 0.4, 0.8], 0.6 and 0.8 belong to a high-intensity cluster with a center value of 0.7; 0.4 is a low-intensity cluster, generating a fusion vector [0.7, 0.4] to highlight the risk hotspots. The determination of cluster intensity can be based on a threshold or cluster center value. For example, clusters with a center value higher than 0.5 are considered high-intensity clusters, and those lower than 0.5 are considered low-intensity clusters. If the weights of all path nodes are low, such as [0.3, 0.2, 0.4], the original sequence vector is used directly to maintain the original distribution characteristics. The path fusion weight is calculated by weighted averaging or summing the vector elements to integrate the influence of high- and low-risk nodes in the path, obtaining the overall risk weight of a single path. Specifically, each element in the fusion vector is multiplied by the weight ratio of its corresponding node, and then summed to obtain the overall risk weight of the single path. For example, the vector [0.7, 0.4] yields a fusion weight of 0.55, reflecting the overall risk level of nodes in the path.

[0120] Subsequently, connection matrix elements are generated based on the fusion weights of each path. The rows and columns of the connection matrix represent the starting and ending nodes of the path, respectively, and the values ​​of the matrix elements are the fusion weights of the corresponding paths, used to quantify the intensity of risk transmission between nodes. For example, if the fusion weight of the path from node A to node B is 0.55, then the matrix element AB = 0.55, forming a node connection matrix that can be used for subsequent propagation analysis.

[0121] Step S84: Calculate the correlation between the connection matrix elements and the preset propagation group identifier. If the correlation is higher than the preset correlation threshold, then fuse the new extraction mode based on the connection matrix elements to obtain the final vulnerability propagation prediction map.

[0122] The elements of the connection matrix are determined by path fusion weights and node association factors, with a preset relevance threshold obtained through statistical analysis of historical vulnerability propagation data. The node association factor is calculated by analyzing the historical interaction strength, data transmission volume, and topological proximity between nodes in the path. For example, the matrix element from S2 to D1 is 0.55 (path fusion weight) multiplied by 0.9 (node ​​association factor), resulting in 0.495, which is recorded in the corresponding row and column of the matrix to form a complete network risk representation. Subsequently, the correlation between the connection matrix elements and the preset propagation group identifier is calculated using vector inner product to assess the degree of matching between the risk distribution between nodes and known propagation patterns. When the correlation exceeds the preset relevance threshold of 0.7, newly extracted abnormal patterns or hidden path information are fused with the original matrix to update the node weights and path connection relationships, thereby generating the final vulnerability propagation prediction map.

[0123] In step S9, alarm signals are generated for high-risk paths in the final vulnerability propagation prediction graph, and intervention points are determined through a path backtracking mechanism to obtain an active prediction sequence, including: Step S91: Based on the final vulnerability propagation prediction map, extract high-risk paths and determine path priorities.

[0124] In one implementation method, a comprehensive risk score is first calculated for each path in the final vulnerability propagation prediction graph. This score is obtained by weighting the weights of each node on the path, the propagation probabilities between nodes, and the path length. Specifically, the weight of each node on the path is multiplied by its propagation probability to the next node, and the sum is used to obtain the total risk value of the path. This value is then divided by the path length to normalize longer paths, thereby obtaining the comprehensive risk score for that path.

[0125] Subsequently, the comprehensive risk scores of all paths are sorted from highest to lowest, with the path with the highest score identified as a high-risk path and assigned the highest priority. For example, in an enterprise network, path S4, passing through R2 to D1, has the largest product of node weight and propagation probability, and is therefore marked as a high-risk path with the highest priority; paths S3 to T1 to D2 have lower scores and are marked as lower priority. After sorting, a specific priority label can be assigned to each path, forming a path priority sequence.

[0126] Step S92: Based on the path priority, determine the location of the intervention point of the high-risk path and generate an alarm signal.

[0127] First, the nodes of each high-risk path are analyzed, and the key indicators of each node in the path are calculated, including node weight, propagation probability, and coverage of downstream nodes. Node weight is calculated based on the risk score contributed by the node in the path; propagation probability is determined based on the final propagation probability of the node in the complete risk node diffusion sequence; downstream coverage is calculated by counting the number of subsequent nodes that the node can directly or indirectly influence.

[0128] The principle for determining intervention points is as follows: select the node with the highest overall risk contribution on the path as the intervention point, and ensure that the protection or monitoring of this node can maximize the prevention of vulnerability propagation. For example, in the path S4-R2-D1, node R2 has the highest weight and the highest probability of propagation to downstream node D1, therefore R2 is identified as the intervention point.

[0129] Subsequently, an alarm signal is generated based on the location of the intervention point, including the node identifier, the potential risk level, and recommended protective measures (such as traffic monitoring, access restrictions, or patch updates).

[0130] Step S93: Based on the alarm signal and the location of the intervention point, obtain the active prediction sequence.

[0131] First, the intervention points for each high-risk path are ranked based on their overall risk contribution, including node weight, propagation probability, and coverage of downstream nodes. Then, the ranked intervention points are arranged sequentially to form a proactive prediction sequence. In this sequence, the nodes at the front represent those with the greatest impact on vulnerability propagation and are given the highest priority for intervention, while the nodes at the back represent those with lower potential risk or those indirectly affected. For example, in the path S4-R2-D1, node R2 is ranked first in the proactive prediction sequence due to its highest weight and propagation probability, while S4 and D1 follow. The system can prioritize monitoring or protecting R2, thereby maximizing the blocking of vulnerability propagation.

[0132] In summary, this invention provides an AI-based intelligent detection method for computer vulnerabilities, which can solve the problem of difficulty in providing a complete, intuitive, and visual representation of vulnerability propagation paths.

[0133] Reference Figure 2 The second embodiment of the present invention provides a computer vulnerability intelligent detection system based on AI technology, comprising: The data acquisition module is used to acquire network topology data, device interaction logs, and permission change records; The vulnerability feature extraction module is used to extract vulnerability feature vectors based on the network topology data and the device interaction logs to obtain a vulnerability distribution matrix; The potential diffusion analysis module is used to calculate the propagation probability and obtain the potential diffusion sequence by processing the node connection relationship using a graph neural network based on the vulnerability distribution matrix. The multi-source data fusion module is used to extract multi-source data from the potential diffusion sequence, denoise and classify the multi-source data, extract fragmented observation features, and obtain a unified representation of the observations; An anomaly pattern classification module is used to classify the observation unified representation to obtain anomaly patterns. If the anomaly pattern matches a preset vulnerability evolution path, a preliminary propagation path diagram is generated. The path refinement module is used to analyze the flow paths between nodes and perform clustering and grouping based on the preliminary propagation path map to obtain a refined path map. The key pattern recognition module is used to extract key pattern features from the refined path map and convert the key pattern features into vector representations to obtain recognition results. The weight update module is used to calculate the path fusion weight based on the identification result and obtain the connection matrix elements, calculate the matching degree with the preset propagation group identifier based on the connection matrix elements, and generate the final vulnerability propagation prediction map. The result output module is used to generate alarm signals for high-risk paths in the final vulnerability propagation prediction graph, and to determine intervention points through a path backtracking mechanism to obtain an active prediction sequence.

[0134] It should be noted that the AI-based intelligent computer vulnerability detection system provided in this embodiment of the invention is used to execute all the process steps of the AI-based intelligent computer vulnerability detection method in the above embodiment. The working principles and beneficial effects of the two are one-to-one, so they will not be described again.

[0135] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A computer vulnerability intelligent detection method based on AI technology, characterized in that, include: Acquire network topology data, device interaction logs, and permission change records; Based on the network topology data and the device interaction logs, vulnerability feature vectors are extracted to obtain a vulnerability distribution matrix; Based on the vulnerability distribution matrix, a graph neural network is used to process the node connection relationships, calculate the propagation probability, and obtain the potential diffusion sequence. Multi-source data is extracted from the potential diffusion sequence, the multi-source data is denoised and classified, fragmented observation features are extracted, and a unified representation of the observations is obtained. The observed unified representation is classified to obtain anomaly patterns. If the anomaly pattern matches a preset vulnerability evolution path, a preliminary propagation path diagram is generated. Based on the preliminary propagation path diagram, the flow paths between nodes are analyzed and clustered to obtain a refined path diagram. Key pattern features are extracted from the refined path map and transformed into vector representations to obtain the recognition results; Calculate the path fusion weights based on the identification results and obtain the connection matrix elements. Calculate the matching degree with the preset propagation group identifier based on the connection matrix elements and generate the final vulnerability propagation prediction map. Alarm signals are generated for high-risk paths in the final vulnerability propagation prediction graph, and intervention points are determined through path backtracking mechanism to obtain proactive prediction sequences.

2. The intelligent computer vulnerability detection method based on AI technology according to claim 1, characterized in that, The step of extracting vulnerability feature vectors based on the network topology data and the device interaction logs to obtain a vulnerability distribution matrix includes: The topology node associations in the network topology data are analyzed to obtain node connection density and path delay indicators. Combined with the interaction event sequence in the device interaction log, event timestamps and device response codes are obtained to generate an initial data set. Extract a first vulnerability feature vector from the initial dataset. If the node connection density exceeds a preset connection density threshold, adjust the association weight between the path delay index and the event timestamp to obtain a second vulnerability feature vector. The second vulnerability feature vector is mapped to a vector dimension and the preset feature weight coefficients and vulnerability severity labels are fused. If the device response code indicates an anomaly, the distribution weight of the matrix row aggregation is enhanced to determine the third vulnerability feature vector. Construct a vulnerability distribution matrix based on the third vulnerability feature vector.

3. The intelligent computer vulnerability detection method based on AI technology according to claim 2, characterized in that, The step of processing node connections using a graph neural network based on the vulnerability distribution matrix, calculating the propagation probability, and obtaining the potential diffusion sequence includes: Based on the device interaction logs and the device response codes, the interaction delay factor is calculated. Based on the vulnerability distribution matrix, a node connection graph is obtained. For the node pairs in the node connection graph, the propagation correlation coefficient between adjacent nodes in a graph neural network is used to obtain a preliminary propagation probability distribution. The adjacent connection density index is extracted from the node connection relationship graph. When the initial propagation probability distribution exceeds the preset initial propagation probability threshold, the adjacent connection density index is adjusted to determine the initial identification sequence of high-risk nodes. By fusing the preliminary identification sequence of the high-risk nodes and the interaction delay factor, and calculating the node aggregation weight, the potential boundary of the diffusion sequence is obtained; When the node aggregation weight of the potential boundary of the diffusion sequence is higher than the preset aggregation threshold, the potential boundary of the diffusion sequence is expanded to obtain a complete risk node diffusion sequence; From the complete risk node diffusion sequence, a probability fusion vector is extracted, and the path extension coefficient and connection density index in the probability fusion vector are calculated to determine the final propagation probability. When the final propagation probability exceeds a preset final propagation probability threshold, the vulnerability propagation path is extracted from the complete risk node propagation sequence and the risk node identifier is integrated to generate a potential propagation sequence.

4. The intelligent computer vulnerability detection method based on AI technology according to claim 1, characterized in that, The process of extracting multi-source data from the potential diffusion sequence, denoising and classifying the multi-source data, extracting fragmented observation features, and obtaining a unified representation of the observations includes: Multi-source data is obtained from the potential diffusion sequence, and the multi-source data is cleaned and denoised to obtain a standardized dataset. The standardized dataset is clustered and grouped to extract fragmented observation features, resulting in interaction fragments and permission fragments. The interaction fragments and permission fragments are then combined to obtain a set of observation dimension fragments. Based on the set of observation dimension fragments, vector mapping is performed and the similarity of the vector mapping is calculated. When the similarity is higher than a preset similarity threshold, a unified representation of the observation is obtained.

5. The intelligent computer vulnerability detection method based on AI technology according to claim 1, characterized in that, The unified representation of the observations is classified to obtain anomaly patterns. If the anomaly pattern matches a preset vulnerability evolution path, a preliminary propagation path diagram is generated, including: Based on the unified representation of the observations, device interaction features and permission change features are extracted and classified to obtain abnormal patterns; When the matching degree between the abnormal pattern and the preset vulnerability evolution path is higher than the preset matching degree threshold, the abnormal pattern is vector-mapped to obtain propagation path data. The propagation path data is converted into a visual path diagram to obtain a preliminary propagation path diagram.

6. The intelligent computer vulnerability detection method based on AI technology according to claim 1, characterized in that, The step of analyzing the flow paths between nodes and performing clustering based on the preliminary propagation path map to obtain a refined path map includes: The flow data of the first node is obtained from the preliminary propagation path diagram. The interaction frequency and correlation strength of the flow data of the first node are calculated to generate the distribution set of the first node. Based on the first node distribution set, the nodes are grouped by density clustering to obtain grouped nodes. If the association strength of the grouped nodes is higher than a preset association strength threshold, a data group set is obtained. The data group set is converted into simplified paths to generate a refined path map.

7. The intelligent computer vulnerability detection method based on AI technology according to claim 1, characterized in that, The step of extracting key pattern features from the refined path map and converting the key pattern features into vector representations to obtain recognition results includes: The second node flow data is obtained from the refined path map, the interaction frequency and correlation strength of the second node flow data are calculated, and a second node distribution set is generated. Based on the second node distribution set, the nodes and paths are mapped to a set of vector representations; Based on the set of vector representations, calculate the Euclidean distance between nodes. If the Euclidean distance is lower than a preset Euclidean distance threshold, calculate the cosine similarity and generate a set of hidden paths. Based on the set of hidden paths, the paths are clustered and grouped to obtain the identification results.

8. The intelligent computer vulnerability detection method based on AI technology according to claim 1, characterized in that, The step of calculating path fusion weights based on the identification results and obtaining connection matrix elements, calculating the matching degree with preset propagation group identifiers based on the connection matrix elements, and generating a final vulnerability propagation prediction map includes: Based on the recognition results, path group labels are obtained, and node weight coefficients are extracted from the path group labels to obtain a weight adjustment sequence. Based on the weight adjustment sequence, determine whether the node weight coefficient exceeds a preset coefficient threshold. If it exceeds the preset coefficient threshold, use the K-means clustering algorithm to process the weight adjustment sequence and generate an intensity distribution vector. If it does not exceed the preset coefficient threshold, directly determine the intensity distribution vector. Path fusion weights are calculated based on the intensity distribution vector, and connection matrix elements are generated based on the path fusion weights. Calculate the correlation between the elements of the connection matrix and the preset propagation group identifier. If the correlation is higher than the preset correlation threshold, then a new extraction mode is fused based on the elements of the connection matrix to obtain the final vulnerability propagation prediction map.

9. The intelligent computer vulnerability detection method based on AI technology according to claim 1, characterized in that, The process of generating alert signals for high-risk paths in the final vulnerability propagation prediction graph and determining intervention points through a path backtracking mechanism to obtain an active prediction sequence includes: Based on the final vulnerability propagation prediction graph, high-risk paths are extracted and path priorities are determined; Based on the path priority, determine the location of intervention points for the high-risk paths and generate alarm signals; Based on the alarm signal and the location of the intervention point, an active prediction sequence is obtained.

10. A computer vulnerability intelligent detection system based on AI technology, characterized in that, include: The data acquisition module is used to acquire network topology data, device interaction logs, and permission change records; The vulnerability feature extraction module is used to extract vulnerability feature vectors based on the network topology data and the device interaction logs to obtain a vulnerability distribution matrix; The potential diffusion analysis module is used to calculate the propagation probability and obtain the potential diffusion sequence by processing the node connection relationship using a graph neural network based on the vulnerability distribution matrix. The multi-source data fusion module is used to extract multi-source data from the potential diffusion sequence, denoise and classify the multi-source data, extract fragmented observation features, and obtain a unified representation of the observations; An anomaly pattern classification module is used to classify the observation unified representation to obtain anomaly patterns. If the anomaly pattern matches a preset vulnerability evolution path, a preliminary propagation path diagram is generated. The path refinement module is used to analyze the flow paths between nodes and perform clustering and grouping based on the preliminary propagation path map to obtain a refined path map. The key pattern recognition module is used to extract key pattern features from the refined path map and convert the key pattern features into vector representations to obtain recognition results. The weight update module is used to calculate the path fusion weight based on the identification result and obtain the connection matrix elements, calculate the matching degree with the preset propagation group identifier based on the connection matrix elements, and generate the final vulnerability propagation prediction map. The result output module is used to generate alarm signals for high-risk paths in the final vulnerability propagation prediction graph, and to determine intervention points through a path backtracking mechanism to obtain an active prediction sequence.

Images