Network security situation prediction method and device based on machine learning, and medium

Abstract

The invention discloses a network security situation prediction method and device based on machine learning and a medium, and relates to the technical field of network security, and the method comprises the steps: obtaining multi-modal network security data, and constructing a multi-scale time sequence feature tensor; performing weight adjustment based on threat feature importance to generate a threat enhanced feature tensor; adaptive feature selection and time sequence correlation analysis are carried out on the threat enhancement feature tensor, and a threat correlation feature tensor is constructed; performing feature-entity mapping and situation evolution modeling in combination with the threat association feature tensor and the network entity identifier to generate an entity situation feature tensor; inputting the entity situation feature tensor into a deep neural network, and generating a situation representation vector sequence through multilayer nonlinear transformation; and performing multi-step situation deduction and threat propagation path analysis based on the situation representation vector sequence, and outputting a network security situation prediction result. According to the method, the accuracy of situation prediction is improved through multi-scale time sequence feature construction and threat importance adaptive weight adjustment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a method, device, and medium for predicting network security situation based on machine learning. Background Technology

[0002] With the rapid development of internet technology and the widespread adoption of network applications, cybersecurity threats are becoming increasingly complex and diverse. Traditional cybersecurity protection mainly relies on passive measures such as signature-based intrusion detection systems and firewalls, which are clearly insufficient when facing new attacks and unknown threats. Cybersecurity situational awareness, as an important means of proactive protection, has received widespread attention in recent years.

[0003] Existing situational awareness methods mainly include rule matching based on expert systems, anomaly detection based on statistical analysis, and pattern recognition based on data mining. In recent years, machine learning techniques have been widely applied in cybersecurity, with methods such as support vector machines, random forests, and deep learning used for malware detection and abnormal behavior identification. However, existing methods generally suffer from limited data processing capabilities, insufficient timeliness, and a lack of in-depth analysis of threat evolution patterns, making it difficult to meet the comprehensive situational awareness and prediction needs in complex network environments. Summary of the Invention

[0004] In view of the aforementioned existing problems, the present invention is proposed.

[0005] Therefore, this invention provides a machine learning-based method, device, and medium for predicting network security situation, which addresses the technical problems of lacking threat evolution analysis capabilities and low accuracy in comprehensive situation prediction.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: In a first aspect, the present invention provides a network security situation prediction method based on machine learning, which includes: acquiring multimodal network security data, extracting network entity identifiers and constructing a multi-scale temporal feature tensor; adjusting the weights of the multi-scale temporal feature tensor based on the importance of threat features to generate a threat enhancement feature tensor; Adaptive feature selection and temporal correlation analysis are performed on the threat enhancement feature tensor to construct a threat correlation feature tensor; By combining threat association feature tensors and network entity identifiers, feature-entity mapping and situation evolution modeling are performed to generate entity situation feature tensors; The entity situation feature tensor is input into a deep neural network, and a situation representation vector sequence is generated through multi-layer nonlinear transformation. Based on the situation representation vector sequence, multi-step situation simulation and threat propagation path analysis are performed to output network security situation prediction results.

[0007] As a preferred embodiment of the machine learning-based network security situation prediction method of this invention, the construction of a multi-scale temporal feature tensor includes: Establish a multi-scale parallel time window and extract time series statistical features within each time window; The time-series statistical features are standardized to construct standardized feature vectors for each time window; The standardized feature vectors are arranged according to the time series to form a time-feature matrix; Multi-scale temporal feature tensors are constructed by combining tensor dimensions of the time-feature matrix at different time scales.

[0008] As a preferred embodiment of the machine learning-based network security situation prediction method of this invention, the method includes: adjusting the weights of multi-scale temporal feature tensors based on the importance of threat features, which includes: Establish a threat feature importance mapping table and determine the threat importance weight of each feature component; Based on a pre-established baseline model of normal behavior, the abnormality score of each feature component in the multi-scale temporal feature tensor is calculated. Based on the threat importance weight and the anomaly score, the comprehensive threat score of each feature component is calculated; A feature enhancement weight matrix is ​​constructed based on the comprehensive threat score, and the multi-scale temporal feature tensor is enhanced element-wise to generate a threat enhancement feature tensor.

[0009] As a preferred embodiment of the machine learning-based network security situation prediction method of this invention, the adaptive feature selection and temporal correlation analysis of the threat enhancement feature tensor include: Based on the numerical distribution of each feature component in the threat enhancement feature tensor, an adaptive threshold algorithm is used to filter high threat-related features and construct a subset of core threat features; Perform temporal correlation analysis on a subset of core threat features and calculate the overall correlation strength between features; A threat feature association graph is constructed based on the comprehensive association strength. A threshold for association strength is set to filter strongly associated feature pairs and identify key threat feature combinations. A threat association feature tensor is constructed based on the combination of key threat features.

[0010] As a preferred embodiment of the machine learning-based network security situation prediction method of this invention, the method includes: combining threat association feature tensors and network entity identifiers to perform feature-entity mapping and situation evolution modeling, which includes: Construct a feature-entity association matrix based on the threat association feature tensor and entity identifier mapping table; Based on the feature-entity association matrix, the feature values ​​in the threat association feature tensor are assigned to the corresponding network entities to construct the entity threat information matrix at each time scale. Based on the entity threat information matrix at various time scales, the threat relationships between network entities are analyzed, and a threat propagation graph is constructed. By combining the temporal changes of the threat propagation graph and the entity threat information matrix, the comprehensive situational characteristics of each network entity are calculated, and an entity situational characteristic tensor is constructed.

[0011] As a preferred embodiment of the machine learning-based network security situation prediction method of the present invention, the generation of the situation representation vector sequence through multi-layer nonlinear transformation includes: The entity situation feature tensor is preprocessed and organized into a deep neural network input format according to the time series. The preprocessed time series data is input into a deep neural network, and time series feature learning and nonlinear transformation are performed through LSTM units to generate time series-aware feature representations. An attention mechanism is used to weight the temporal-aware feature representation at key time steps to generate an attention-enhanced feature representation. The attention-enhanced feature representation is mapped to the output layer to generate a sequence of situational representation vectors.

[0012] As a preferred embodiment of the machine learning-based network security situation prediction method of this invention, the method includes: performing multi-step situation deduction and threat propagation path analysis based on the situation representation vector sequence, which comprises: Based on the situation representation vector sequence, an encoder-decoder network is used for multi-step forward prediction to generate a forward situation prediction sequence. Based on the threat propagation graph and forward situation prediction sequence, a spatiotemporal graph convolutional network is used to analyze the threat propagation path and identify the key paths and nodes of threat spread. By combining the results of multi-step forward prediction and threat propagation path analysis, risk quantification assessment and early warning level determination are carried out to generate cybersecurity situation prediction results.

[0013] As a preferred embodiment of the machine learning-based network security situation prediction method of the present invention, the multimodal network security data includes network traffic data, system log data, and threat intelligence data.

[0014] In a second aspect, the present invention provides a computer device including a memory and a processor, wherein the memory stores a computer program, and the computer program, when executed by the processor, implements any step of the machine learning-based network security situation prediction method of the first aspect of the present invention.

[0015] Thirdly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein: when the computer program is executed by a processor, it implements any step of the machine learning-based network security situation prediction method of the first aspect of the present invention.

[0016] The beneficial effects of this invention are as follows: By constructing multi-scale temporal feature tensors and adaptively adjusting the weights of threat feature importance, this invention effectively improves the accuracy and robustness of network security situation prediction; by combining spatiotemporal graph convolutional networks with an encoder-decoder architecture, it achieves accurate identification of threat propagation paths and forward-looking prediction of multi-step situations; by mapping network entity identifiers and constructing entity situation feature tensors, it achieves entity-level refined perception and management of network security situations; and by using temporal correlation analysis and threat feature correlation graph construction, it can automatically discover hidden threat correlation patterns, thereby improving the ability to detect complex threats. Attached Figure Description

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a flowchart of a machine learning-based method for predicting cybersecurity posture.

[0019] Figure 2 A flowchart for constructing multi-scale temporal feature tensors for machine learning-based network security situation prediction methods.

[0020] Figure 3 A flowchart for constructing the threat correlation feature tensor for a machine learning-based cybersecurity situation prediction method. Detailed Implementation

[0021] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0022] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0023] Secondly, the term "an embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places throughout this specification does not necessarily refer to the same embodiment, nor is it a single embodiment or an embodiment selectively excluded from other embodiments.

[0024] Reference Figures 1-3 As one embodiment of the present invention, this embodiment provides a network security situation prediction method based on machine learning, the flowchart of which is shown below. Figure 1 As shown, the method includes the following steps: S1: Acquire multimodal network security data, extract network entity identifiers, and construct multi-scale temporal feature tensors.

[0025] Specifically, the flowchart for constructing multi-scale temporal feature tensors is as follows: Figure 2 As shown, it includes the following steps: S1.1: Acquire multimodal network security data, extract network entity identifiers, and establish an entity identifier mapping table through entity association analysis.

[0026] In one embodiment, multimodal network security data includes network traffic data, system log data, and threat intelligence data. Network traffic data includes network connection records, packet statistics, and traffic behavior characteristics. System log data includes operating system logs, application logs, and security device logs. Threat intelligence data includes malicious IP addresses, malicious domain names, malicious file hashes, and attack behavior patterns.

[0027] Furthermore, establishing an entity identifier mapping table through entity association analysis includes: calculating the association strength of entity identifiers from different data sources based on the co-occurrence relationship of entity identifiers within a time window; filtering highly associated identifier pairs according to an association strength threshold; grouping multiple identifiers belonging to the same network entity using a clustering algorithm; assigning globally unique entity identifiers to each entity group; and constructing a mapping table between entity identifiers and global identifiers.

[0028] S1.2: Establish a multi-scale parallel time window and extract time series statistical features within each time window.

[0029] In another embodiment, the multi-scale parallel time window includes a short-term time window (e.g., 5 minutes), a medium-term time window (e.g., 30 minutes), and a long-term time window (e.g., 2 hours). Optionally, to balance real-time performance and accuracy, an ultra-short-term time window (e.g., 1 minute) can be added for rapid attack detection and emergency response.

[0030] Furthermore, firstly, entity-level time-series features are extracted, including individual behavioral characteristics of each network entity, such as the number of connections, data transmission volume, and number of abnormal events. Then, time-series statistical features are obtained by aggregating all entity-level time-series features, including the total number of connections, the total number of abnormal events, and the total amount of data transmission.

[0031] It should be noted that during the process of aggregating entity-level features into time-series statistical features, an entity contribution weight matrix is ​​established to record the contribution weight of each network entity to each time-series statistical feature component. The contribution weight is equal to the ratio of the network entity feature value to the total value of the corresponding time-series statistical feature component, providing an accurate weight basis for subsequent feature-entity mapping.

[0032] Preferably, this invention achieves a balance between computational efficiency and accuracy in situational awareness by employing a hierarchical mapping mechanism that combines entity-level feature extraction with temporal statistical aggregation. This technical approach of "extracting individual features first, then aggregating and statistically recording contribution weights" ensures that threat features, after optimization processes such as importance assessment and correlation analysis, can be accurately back-mapped to specific network entities through the entity contribution weight matrix. This achieves an organic unity from macro-level situational awareness to micro-level threat localization, improving the accuracy and practicality of network security situation prediction.

[0033] S1.3: Standardize the time series statistical features and construct standardized feature vectors for each time window.

[0034] It should be noted that standardization unifies the characteristics of different units and numerical ranges into the same numerical interval.

[0035] S1.4: Arrange the standardized feature vectors according to the time series to form a time-feature matrix.

[0036] S1.5: Based on different time scales, tensor dimensions of the time-feature matrix are combined to construct multi-scale temporal feature tensors.

[0037] It should be noted that the dimensional structure of the multi-scale temporal feature tensor is [N×T×D], where N represents the number of time scales, T represents the time step after unification of each time scale, and D represents the dimension of the temporal statistical features.

[0038] S2: Adjust the weights of the multi-scale temporal feature tensor based on the importance of threat features to generate a threat enhancement feature tensor.

[0039] Specifically, S2 includes the following steps: S2.1: Establish a threat feature importance mapping table and determine the threat importance weight of each feature component.

[0040] The process of establishing the threat feature importance mapping table includes: collecting historical attack sample and normal sample data to construct a labeled dataset; calculating the contribution of each feature component in distinguishing between attack samples and normal samples; assigning corresponding threat importance weights to each feature component based on the contribution calculation results; and storing the feature dimensions, feature components, and corresponding threat importance weights in a mapping table structure.

[0041] In one embodiment, the threat importance weight ranges from [0.1, 2.0], with a larger weight value indicating greater importance of the feature component for threat identification. This range avoids the complete loss of feature information due to a weight of 0, while also preventing numerical instability caused by excessive amplification, thus ensuring the effectiveness of feature enhancement and the stability of the system.

[0042] Furthermore, to enhance the adaptability of the threat signature importance mapping table, a dynamic weight adjustment mechanism is established: dedicated threat importance weight configurations are set for different attack types (such as DDoS, APT, ransomware, etc.), and continuous optimization is carried out in combination with real-time threat intelligence and detection feedback results.

[0043] S2.2: Based on a pre-established baseline model of normal behavior, calculate the abnormality score of each feature component in the multi-scale temporal feature tensor.

[0044] The abnormality score is obtained by calculating the standardized distance between the current value of the feature component and the baseline of normal behavior. The standardized distance is calculated using the standard score method.

[0045] Specifically, the normal behavior baseline model establishes statistical baseline parameters for each time scale. The construction process is as follows: Normal network behavior data is collected within a preset time period. An outlier detection algorithm is used to identify and remove data samples from abnormal periods and attack events to ensure the purity of the baseline data. For each feature dimension of each time scale, statistical baseline parameters for the normal behavior data are calculated, including descriptive statistics such as mean and standard deviation. The statistical baseline parameters are periodically updated, adjusted based on newly collected normal behavior data. During the update process, contamination detection is performed on new data; only data that passes the detection is included in the baseline update, maintaining the adaptability and anti-contamination capability of the normal behavior baseline model.

[0046] Ideally, the normal behavior baseline model maintains multiple historical baseline versions (such as baselines for the past 7 days, 14 days, and 30 days), and baseline quality is evaluated by calculating the consistency of each version of the baseline. Simultaneously, categorized baselines are established based on business time period characteristics (working hours vs. non-working hours, weekdays vs. weekends) to improve the accuracy of anomaly detection.

[0047] It should be noted that the abnormality score is obtained by standardizing the deviation of the current feature value from the baseline mean of the corresponding time scale, combined with the baseline standard deviation. The higher the score, the greater the deviation from the normal behavior baseline.

[0048] S2.3: Calculate the comprehensive threat score for each feature component based on the threat importance weight and the anomaly score.

[0049] It should be noted that by combining the inherent threat importance of features with the current degree of anomaly through product operations, it is ensured that only feature components that have both high threat identification value and exhibit anomalies can obtain a high comprehensive threat score, thus realizing a dual threat assessment mechanism based on historical experience and real-time status.

[0050] S2.4: Construct a feature enhancement weight matrix based on the comprehensive threat score, and perform element-wise weighted enhancement on the multi-scale temporal feature tensor to generate a threat enhancement feature tensor.

[0051] Furthermore, the construction process of the feature enhancement weight matrix includes: constructing a feature enhancement weight matrix corresponding to the dimensional structure of the multi-scale temporal feature tensor; filling the corresponding positions of the feature enhancement weight matrix with the comprehensive threat score of each feature component as the weight value; adjusting the numerical range of the weight values ​​in the feature enhancement weight matrix by normalization or interval mapping to the range [0,1]; and performing element-wise multiplication between the multi-scale temporal feature tensor and the feature enhancement weight matrix to generate the threat enhancement feature tensor.

[0052] Among them, the threat enhancement feature tensor and the multi-scale temporal feature tensor have the same dimensional structure, and a larger weight value indicates that the feature component is more important for threat identification.

[0053] S3: Perform adaptive feature selection and temporal correlation analysis on the threat enhancement feature tensor to construct the threat correlation feature tensor.

[0054] Specifically, the flowchart for constructing the threat association feature tensor is as follows: Figure 3 As shown, it includes the following steps: S3.1: Based on the numerical distribution of each feature component in the threat enhancement feature tensor, an adaptive threshold algorithm is used to filter high threat-related features and construct a subset of core threat features.

[0055] In one embodiment, a multi-criteria feature selection strategy is employed: First, threat intensity is selected based on the distribution of feature values, with an adaptive threshold set to the preset quantile of all feature values ​​in the threat enhancement feature tensor, preferably between 70% and 80%, and the default is 75%. Second, information content is selected based on feature variance and information entropy, filtering out features with excessively small variance (less than 10% of the overall variance) or excessively low information entropy to avoid interference from redundant and noisy features in subsequent analysis. Finally, a protection mechanism is set up for specific high-risk feature types (such as malicious IP access, virus alerts, abnormal login behavior, etc.), forcibly including them in the core threat feature subset even if their numerical or information content indicators do not meet the selection criteria.

[0056] Preferably, this multi-criteria screening strategy considers both the threat relevance of features and their informational value and domain importance, ensuring that the selected subset of core threat features possesses high threat relevance, high information content, and domain integrity.

[0057] S3.2: Perform temporal correlation analysis on the subset of core threat features and calculate the comprehensive correlation strength between features.

[0058] Specifically, the overall correlation strength is calculated by combining cross-correlation analysis and temporal delay detection, as follows: For each pair of features in the core threat feature subset, the cross-correlation number is calculated within a preset time delay range, where the preset time delay range is adaptively set according to the time window length. By finding the maximum value of the cross-correlation number and its corresponding optimal delay time, the temporal correlation strength and delay relationship between features are determined. When the optimal delay time is positive, a directed correlation relationship is established, with the preceding feature being the predecessor feature of the following feature. When the delay time is zero, it indicates that the two features are synchronously correlated. For each feature pair, the temporal correlation strength is calculated at multiple time scales, and the overall correlation strength is obtained through weighted fusion.

[0059] Furthermore, to ensure the statistical significance of the association strength, a statistical significance test was performed on the overall association strength of each feature pair, and its corresponding p-value was calculated. Only significant associations with p-values ​​less than 0.05 were retained, and incidental correlations were filtered out to ensure the reliability of subsequent analyses.

[0060] It should be noted that cross-correlation analysis can not only identify the degree of correlation between features, but also reveal the temporal sequence relationship between features, providing a basis for attack chain reconstruction and threat evolution analysis.

[0061] S3.3: Construct a threat feature association graph based on comprehensive association strength, set an association strength threshold to filter strongly associated feature pairs, and identify key threat feature combinations.

[0062] Specifically, the threat feature association graph uses core threat features as nodes, temporal association relationships as directed edges, and edge weights as comprehensive association strength, forming a weighted directed graph structure.

[0063] Furthermore, edges in the threat feature association graph are filtered based on an association strength threshold. Edges with a comprehensive association strength exceeding the threshold are retained as strong associations, while weak associations are filtered out, resulting in a strongly associated feature subgraph. Connected subgraph identification is then performed on the strongly associated feature subgraph, and each connected subgraph is identified as a candidate threat feature combination. The association strength threshold is set using a quantile method, selecting the 80th quantile of the comprehensive association strength distribution as the threshold to ensure that significant strong associations are retained.

[0064] Furthermore, attack chain analysis is performed on each candidate threat feature combination: the in-degree and out-degree of each node in the combination are calculated, and directed paths between nodes within the combination are identified using a graph traversal algorithm. Directed paths with a length not less than a preset minimum number of nodes are defined as potential attack chains. Candidate threat feature combinations containing at least one potential attack chain are selected as key threat feature combinations.

[0065] In one embodiment, the preset minimum number of nodes can be set to 2-5 nodes, preferably 3 nodes. In practical applications, this parameter can be dynamically adjusted based on historical attack data analysis results and expert experience.

[0066] Preferably, the present invention constructs a threat feature association graph and filters strongly correlated feature pairs based on adaptive thresholds, aggregating scattered single threat features into threat feature combinations with inherent relationships, and identifies potential attack chain paths through graph structure analysis, thereby realizing the transformation from isolated feature detection to systemic threat pattern recognition, improving the accuracy of identifying complex multi-stage attacks and the interpretability of attack behavior.

[0067] S3.4: Construct a threat association feature tensor based on the combination of key threat features.

[0068] Specifically, the time-series data of the core threat feature subset is organized into a threat association feature tensor, maintaining the same time structure as the threat enhancement feature tensor, to provide input data for subsequent analysis.

[0069] S4: Combine threat association feature tensor and network entity identifier to perform feature-entity mapping and situation evolution modeling, and generate entity situation feature tensor.

[0070] Specifically, S4 includes the following steps: S4.1: Construct a feature-entity association matrix based on the threat association feature tensor and entity identifier mapping table.

[0071] Preferably, constructing the feature-entity association matrix includes: determining the target network entity set based on the entity identifier mapping table; extracting the entity contribution weights corresponding to each feature component of the threat-related feature tensor from the entity contribution weight matrix saved in step S1; calculating the threat feature distribution of each network entity by proportionally allocating the entity contribution weights and the values ​​of the threat-related feature components based on the entity contribution weights and the values ​​of the threat-related feature components, where the entity threat feature value is equal to the product of the threat-related feature component value and the corresponding contribution weight of the entity; and organizing the threat feature distribution of each network entity by entity and feature dimensions to construct the feature-entity association matrix.

[0072] S4.2: Based on the feature-entity association matrix, the feature values ​​in the threat association feature tensor are assigned to the corresponding network entities to construct entity threat information matrices at various time scales.

[0073] Furthermore, threat feature values ​​for each network entity on different threat association feature components are obtained based on the feature-entity association matrix. These threat feature values ​​are grouped by network entity to form threat feature vectors for each network entity. The above allocation process is then performed on the threat association feature tensors at each time scale to obtain network entity threat feature vectors at different time scales. Finally, the network entity threat feature vectors at each time scale are arranged in a time series to construct an entity threat information matrix.

[0074] Preferably, this invention constructs a multi-timescale entity threat information matrix, simultaneously capturing short-term threat events, medium-term threat trends, and long-term threat evolution patterns, thus overcoming the limitations of traditional methods' single-timescale analysis and providing multi-dimensional time-series information support for situation prediction.

[0075] S4.3: Based on the entity threat information matrix at various time scales, analyze the threat relationships between network entities and construct a threat propagation graph.

[0076] Furthermore, the similarity of threat feature vectors among network entities is calculated, and cosine similarity or Pearson correlation coefficient is used to measure the similarity of threat patterns among network entities. Based on the network topology and communication relationships between network entities, potential threat propagation paths are determined. Combining threat feature similarity and propagation path information, the threat association strength between network entities is calculated. A threat association strength threshold is set to filter strongly associated network entity pairs, and a threat propagation graph is constructed with network entities as nodes and threat association strength as edge weights. Modeling the relationships between network entities through the threat propagation graph not only considers the threat characteristics of the entities themselves but also incorporates the network topology and threat propagation patterns, making the situational analysis more comprehensive and accurate.

[0077] S4.4: Combining the temporal changes of the threat propagation graph and the entity threat information matrix, calculate the comprehensive situation characteristics of each network entity and construct the entity situation characteristic tensor.

[0078] Furthermore, based on the threat propagation graph, the topological characteristics of each network entity in the threat propagation network are analyzed, such as node degree, betweenness centrality, and clustering coefficient. Based on the temporal changes of the entity threat information matrix, the changing trends and fluctuations of the threat characteristics of each network entity are calculated. The topological characteristics and temporal change characteristics are integrated, and a comprehensive situational feature vector for each network entity is constructed through weighted summation or feature concatenation. The comprehensive situational feature vectors of each network entity are organized according to time scale and time series to form an entity situational feature tensor.

[0079] Through the above technical solutions, this step achieves accurate entity mapping of multi-source threat features, situation modeling at multiple time scales, and networked threat propagation analysis, and constructs a high-quality entity situation feature tensor, providing an effective data foundation for subsequent deep neural network processing and situation inference.

[0080] S5: Input the entity situation feature tensor into a deep neural network, and generate a situation representation vector sequence through multi-layer nonlinear transformation.

[0081] Specifically, the entity situation feature tensor is preprocessed and organized into a time-series input format for a deep neural network. The preprocessed time-series data is then input into the deep neural network, where time-series feature learning and nonlinear transformation are performed using LSTM units to generate a time-series-aware feature representation. An attention mechanism is used to weight the time-series-aware feature representation at key time steps to generate an attention-enhanced feature representation. Finally, the attention-enhanced feature representation is mapped to the output layer to generate a situation representation vector sequence.

[0082] S6: Performs multi-step situational simulation and threat propagation path analysis based on situational representation vector sequences, and outputs network security situational prediction results.

[0083] Specifically, S6 includes the following steps: S6.1: Based on the situation representation vector sequence, an encoder-decoder network is used to perform multi-step forward prediction to generate a forward situation prediction sequence.

[0084] In one embodiment, a sequence of situation representation vectors is input into the encoder portion of an encoder-decoder network. The encoder processes each vector in the input sequence sequentially to generate a context representation vector. The decoder initializes based on this context representation vector and outputs situation prediction vectors for future time steps in stages according to a set number of prediction steps. During each output, the decoder employs an attention mechanism to focus on relevant information from the historical sequence. After completing the preset number of calculation steps, the decoder arranges the multiple output situation prediction vectors in chronological order to form a forward situation prediction sequence.

[0085] S6.2: Based on the threat propagation graph and forward situation prediction sequence, a spatiotemporal graph convolutional network is used to analyze the threat propagation path and identify the key paths and nodes of threat spread.

[0086] Furthermore, the spatiotemporal graph convolutional network receives the threat propagation graph and the forward situation prediction sequence as input. It extracts the spatial features of each network entity in the threat propagation graph through graph convolution operations and extracts the temporal features of the forward situation prediction sequence through temporal convolution operations. After fusing the spatial and temporal features, a fully connected layer performs a nonlinear mapping on the fused features and uses a softmax function for normalization to obtain the probability values ​​of each propagation path in the threat propagation graph. Paths with probability values ​​exceeding a preset propagation probability threshold are selected as critical paths. Simultaneously, critical nodes are identified based on their importance in the propagation process.

[0087] The preset propagation probability threshold is set based on historical threat propagation statistics and network topology complexity.

[0088] S6.3: Combining multi-step forward prediction results and threat propagation path analysis results, perform risk quantification assessment and early warning level determination to generate cybersecurity situation prediction results.

[0089] Specifically, the risk quantification assessment is based on a comprehensive calculation of forward situation prediction results, critical path propagation probability values, and the importance of critical nodes. First, the forward situation prediction results for each network entity are weighted and aggregated according to node importance to obtain the overall network threat level. Second, the overall propagation risk is calculated based on the critical path propagation probability values ​​and the importance of path endpoints. Finally, the overall network threat level and overall propagation risk are normalized and then linearly combined according to preset weights to generate a comprehensive risk score. The weights are set according to the relative importance of the network threat level and propagation risk in the security assessment.

[0090] Furthermore, the warning level determination compares the comprehensive risk score with a preset level threshold, outputting the corresponding warning level. The level threshold is determined based on the quantile distribution of historical comprehensive risk scores. Finally, the warning level, related network entities, identified critical paths, and critical nodes are integrated to generate a cybersecurity situation prediction result.

[0091] Preferably, this invention learns historical situation evolution patterns and makes multi-step predictions for the future through an encoder-decoder network, effectively capturing the temporal patterns and trends of situation development. By combining spatial topology analysis and temporal prediction of threat propagation paths with a spatiotemporal graph convolutional network, dynamic path identification and key node localization of threat propagation are achieved, providing precise spatial positioning and propagation direction guidance for threat prevention and control.

[0092] This embodiment also provides a computer device applicable to the machine learning-based network security situation prediction method, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the machine learning-based network security situation prediction method proposed in the above embodiment.

[0093] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0094] This embodiment also provides a storage medium storing a computer program, which, when executed by a processor, implements the machine learning-based network security situation prediction method proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0095] In summary, this invention effectively improves the accuracy and robustness of network security situation prediction by constructing multi-scale temporal feature tensors and adaptively adjusting the weights of threat feature importance; it achieves accurate identification of threat propagation paths and forward-looking prediction of multi-step situations through spatiotemporal graph convolutional networks combined with an encoder-decoder architecture; it realizes entity-level refined perception and management of network security situation through network entity identifier mapping and entity situation feature tensor construction; and it can automatically discover hidden threat association patterns and improve the ability to detect complex threats through temporal correlation analysis and threat feature association graph construction.

[0096] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A machine learning-based method for predicting network security situation, characterized in that: include: Acquire multimodal network security data, extract network entity identifiers, and construct multi-scale temporal feature tensors; The multi-scale temporal feature tensor is weighted and adjusted based on the importance of threat features to generate a threat enhancement feature tensor. Adaptive feature selection and temporal correlation analysis are performed on the threat enhancement feature tensor to construct a threat correlation feature tensor; By combining the threat association feature tensor and the network entity identifier, feature-entity mapping and situation evolution modeling are performed to generate an entity situation feature tensor; The entity situation feature tensor is input into a deep neural network, and a situation representation vector sequence is generated through multi-layer nonlinear transformation. Based on the situation representation vector sequence, multi-step situation deduction and threat propagation path analysis are performed to output network security situation prediction results.

2. The machine learning-based network security situation prediction method as described in claim 1, characterized in that: The construction of the multi-scale temporal feature tensor includes: Establish a multi-scale parallel time window and extract time series statistical features within each time window; The time-series statistical features are standardized to construct standardized feature vectors for each time window; The standardized feature vectors are arranged in a time series to form a time-feature matrix; Multi-scale temporal feature tensors are constructed by combining tensor dimensions of the time-feature matrix at different time scales.

3. The machine learning-based network security situation prediction method as described in claim 1, characterized in that: The weight adjustment of the multi-scale temporal feature tensor based on the importance of threat features includes: Establish a threat feature importance mapping table and determine the threat importance weight of each feature component; Based on a pre-established baseline model of normal behavior, the abnormality score of each feature component in the multi-scale temporal feature tensor is calculated. Based on the threat importance weight and the anomaly score, the comprehensive threat score of each feature component is calculated; Based on the comprehensive threat score, a feature enhancement weight matrix is ​​constructed, and the multi-scale temporal feature tensor is enhanced element-wise to generate a threat enhancement feature tensor.

4. The machine learning-based network security situation prediction method as described in claim 1, characterized in that: Adaptive feature selection and temporal correlation analysis of the threat enhancement feature tensor include: Based on the numerical distribution of each feature component in the threat enhancement feature tensor, an adaptive threshold algorithm is used to filter high threat-related features and construct a subset of core threat features; A temporal correlation analysis was performed on the subset of core threat features to calculate the overall correlation strength between the features; Based on the comprehensive correlation strength, a threat feature correlation graph is constructed, and a correlation strength threshold is set to filter strongly correlated feature pairs and identify key threat feature combinations. A threat association feature tensor is constructed based on the combination of key threat features.

5. The machine learning-based network security situation prediction method as described in claim 1, characterized in that: The feature-entity mapping and situation evolution modeling by combining the threat association feature tensor and the network entity identifier includes: Construct a feature-entity association matrix based on the threat association feature tensor and entity identifier mapping table; Based on the feature-entity association matrix, the feature values ​​in the threat association feature tensor are assigned to the corresponding network entities to construct the entity threat information matrix at each time scale. Based on the entity threat information matrix at various time scales, the threat relationships between network entities are analyzed, and a threat propagation graph is constructed. By combining the temporal changes of the threat propagation graph and the entity threat information matrix, the comprehensive situational characteristics of each network entity are calculated, and an entity situational characteristic tensor is constructed.

6. The machine learning-based network security situation prediction method as described in claim 1, characterized in that: The process of generating the situation representation vector sequence through multi-layer nonlinear transformation includes: The entity situation feature tensor is preprocessed and organized into a deep neural network input format according to the time series. The preprocessed time series data is input into a deep neural network, and time series feature learning and nonlinear transformation are performed through LSTM units to generate time series-aware feature representations. An attention mechanism is used to weight the temporally-aware feature representation at key time steps to generate an attention-enhanced feature representation. The attention-enhanced feature representation is mapped to the output layer to generate a sequence of situational representation vectors.

7. The machine learning-based network security situation prediction method as described in claim 1, characterized in that: Multi-step situational simulation and threat propagation path analysis based on the aforementioned situational representation vector sequence includes: Based on the situation representation vector sequence, an encoder-decoder network is used to perform multi-step forward prediction to generate a forward situation prediction sequence. Based on the threat propagation graph and the forward situation prediction sequence, a spatiotemporal graph convolutional network is used to analyze the threat propagation path and identify the key paths and nodes of threat spread. By combining the results of multi-step forward prediction and threat propagation path analysis, risk quantification assessment and early warning level determination are carried out to generate cybersecurity situation prediction results.

8. The machine learning-based network security situation prediction method as described in claim 1, characterized in that: The multimodal network security data includes network traffic data, system log data, and threat intelligence data.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the machine learning-based network security situation prediction method according to any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the machine learning-based network security situation prediction method according to any one of claims 1 to 8.

Images