Layered self-adaptive endogenous security detection architecture

Abstract

The invention discloses a hierarchical adaptive endogenous security detection architecture, and belongs to the technical field of network security and anomaly detection. The architecture is constructed on a security detection copy and adopts a double-engine hierarchical topological structure comprising an upper-layer detection module and a lower-layer detection module. The upper-layer detection module is used as a lightweight heuristic high-throughput sensing unit and is used for executing coarse-grained screening and low-delay capturing of transient abnormal characteristics on a full-amount data stream based on a physical trusted measurement evaluation engine and a linear manifold boundary; the lower-layer detection module serves as a multi-dimensional space-time coupling deterministic logic arbitration engine, and executes high-order causal traceability and depth verification for suspected features by constructing a dynamic association map and a self-adaptive attention allocation mechanism. According to the method, a non-intrusive parallel mapping mechanism and a cascade progressive convergence mechanism are utilized, the problem that real-time performance and recall ratio are difficult to consider in traditional single-stage detection is effectively solved, and real-time blocking of remarkable violation behaviors and accurate positioning of hidden attack behaviors are achieved.

Description

Technical Field

[0001] This invention relates to the field of network security and anomaly detection technology, and in particular to a layered adaptive intrinsic security detection architecture. Background Technology

[0002] In the booming development of the Internet of Things (IoT) industry, sensor networks, as the basic architecture of the IoT perception layer, bear the important responsibility of collecting data and sensing the environment, providing solid data support for the widespread application of IoT. However, with the large-scale deployment of sensor nodes, especially in the context of pursuing cost-effectiveness and limited computing power, sensor networks face three challenges in data anomaly detection and data protection: large scene differences, high risk of false alarms and missed alarms, and data uncertainty. Traditional single-level detection methods only use single-dimensional detection logic. Due to the overly simple detection method, they cannot identify hidden anomalies in complex scenes, leading to missed alarms. At the same time, they are prone to misjudging objects that meet a single feature but are actually normal, leading to false alarms, which is difficult to meet the requirements of high security scenarios.

[0003] To address this, this invention proposes a hierarchical adaptive intrinsic security detection architecture. It constructs a dual-engine hierarchical topology structure of "upper-layer coarse-grained screening - lower-layer deep verification" and combines hierarchical verification and multi-dimensional verification strategies. Through the detection mechanism of "non-intrusive parallel mapping" and "cascaded progressive convergence", it provides a highly secure, low false alarm rate and highly interpretable anomaly detection scheme, effectively solving the problem that traditional single-level detection is difficult to balance real-time performance and recall. Summary of the Invention

[0004] To achieve efficient and reliable anomaly detection, this invention proposes a hierarchical adaptive intrinsic security detection architecture. This architecture is built on a security detection replica and adopts a dual-engine hierarchical topology with logically coupled upper-layer and lower-layer detection modules. The two-level modules realize targeted data flow and hierarchical detection tasks based on the security detection replica. Data association is established through "non-intrusive parallel mapping". The two-level modules are used to build a "cascaded progressive convergence" detection mechanism. Under the premise of ensuring time complexity, hierarchical computing power allocation is used to achieve real-time blocking of significant violations and accurate tracing of covert attack behaviors, achieving an intrinsic dynamic balance between detection real-time performance and recall rate.

[0005] Furthermore, the upper-layer detection module, as a low-latency, high-throughput primary sensing unit, aims to identify whether the data in the security detection replica deviates significantly from the normal range. It performs coarse-grained screening and labeling of transient anomaly features based on a lightweight heuristic algorithm. It embeds a physical credibility metric evaluation engine, which uses the inherent physical conservation laws of the system as the judgment criterion and quantifies the threat level by calculating the Euclidean distance offset between the state variables in the security detection replica and the boundary of the ideal physical manifold. The engine adopts a linear computational complexity architecture (O(n)) to ensure that the detection latency is lower than the system control cycle, which can meet the real-time detection requirements.

[0006] The upper-layer detection module specifically employs a simple and efficient difference verification algorithm for detection. This algorithm calculates the difference between the detected data and a preset normal baseline value, and marks data with a difference exceeding a preset threshold as potentially abnormal. The specific calculation formula is as follows: .

[0007] Furthermore, the upper-level detection uses difference calculation to perform analysis on the current data. The data corresponding to the security check copy The difference was calculated to obtain The value is then used for tolerance verification, comparing the difference with the preset tolerance. In comparison, when This indicates that the data is normal. Then proceed to the next layer for detection.

[0008] The upper-layer detection module also integrates a spatial heterogeneous tolerance configuration mechanism. Based on the noise characteristics of different spatial nodes in the distributed sensor network, it sets differentiated regional confidence intervals and tolerance thresholds according to the region where the sensor is located. The detection accuracy is optimized through regional tolerance adjustment, and the tolerance value ϵ can also be flexibly adjusted according to different scenarios and sensor types.

[0009] Furthermore, the lower-layer detection module, acting as a high-precision logical arbitration unit, performs deep deterministic verification based on multi-dimensional physical correlation on the suspected feature vectors marked by the upper-layer module after receiving the suspected abnormal data transmitted by the upper-layer detection module. The lower-layer detection module is equipped with a high-order spatiotemporal coupled inference engine, which constructs a dynamic correlation graph based on the multi-dimensional state data in the security detection copy. This engine integrates historical time-series prior distribution and physical kinematic constraint equations to generate a baseline correlation topology and has online incremental learning capabilities. It adaptively iterates the model parameters according to the distribution drift characteristics of the real-time data stream to adapt to the verification requirements of complex scenarios under non-stationary random processes.

[0010] Its core is to construct a correlation model by utilizing the correlation between multidimensional physical quantities (such as the linear relationship between temperature and humidity), and the specific model is as follows: The model uses historical physical quantity data collected over a long period of time as training samples and generates basic association rules by fitting the transfer function between various physical quantities.

[0011] Furthermore, T and H represent temperature and humidity, respectively, and a, b, and c are parameters fitted based on historical data. Then, the expected range of the correlation values ​​is set: .

[0012] Furthermore, the lower-level detection module verifies the data by calculating the deviation range. If the temperature and humidity data violate the historical propagation rules at a certain moment (e.g., the temperature rises but the humidity does not decrease accordingly), it is identified as abnormal. At the same time, the lower-level detection module embeds an adaptive attention allocation mechanism, assigning dynamic weight matrices to physical state variables of different dimensions in the security detection copy. This weight matrix is ​​determined based on the sensitivity coefficient of each state variable's impact on system stability. The sensitivity coefficient is obtained through inverse inversion and attribution analysis of historical abnormal events, and key variables exceeding a preset sensitivity threshold are given high priority calculation weights. In addition, the lower-level detection module also integrates a topological adjacency propagation analysis algorithm, which identifies the regional diffusion attributes of abnormal behavior by calculating the cross-correlation index of abnormal features among spatially adjacent nodes, in order to eliminate discrete misjudgments caused by single-point sensor drift.

[0013] During operation, the lower-level detection module calls real-time physical quantity data from the safety detection copy in real time to iteratively optimize the basic association rules to improve detection adaptability. In the safety detection copy corresponding to the environmental monitoring scenario, the lower-level detection module incorporates at least three physical quantity data such as temperature, humidity, air pressure, and pollutant concentration to participate in the association model construction, thereby enhancing the robustness and generalization of the model.

[0014] Furthermore, the upper-layer detection module and the lower-layer detection module are logically coupled, forming a collaborative link of "fast filtering - accurate verification" through the security detection copy. They do not exist in isolation, but rather complement each other as a whole. The upper-layer detection module completes the initial screening and marking of significant abnormal data in the security detection copy within 100 milliseconds using a low-complexity algorithm with linear computational complexity (O(n)). It quickly eliminates most normal data using difference verification and passes the suspected abnormal data to the lower-layer detection module. The lower-layer detection module performs multi-dimensional correlation analysis on the suspected abnormal data marked by the initial screening, combining high-order spatiotemporal coupling reasoning, adaptive attention allocation, and topological adjacency propagation analysis to accurately locate complex hidden anomalies and eliminate occasional fluctuations and noise interference.

[0015] If the detection results require further confirmation, multiple rounds of lower-level detection can be performed as necessary, using different rule models for verification. The two-level modules complement each other to improve the overall detection efficiency and accuracy. Its core technical feature is to build a collaborative detection link between the two-level modules through a secure detection copy, achieving functional complementarity between rapid filtering of significant anomalies and accurate location of complex anomalies. The detection effect is guaranteed by the "non-intrusive parallel mapping" and "cascaded progressive convergence" mechanisms. The hierarchical design of the dual-engine hierarchical topology ensures the real-time performance and reliability of the system, making it suitable for diverse application scenarios and possessing good scalability. Attached Figure Description

[0016] Figure 1 This is a detailed flowchart of the hierarchical adaptive intrinsic security detection architecture in this invention. Detailed Implementation

[0017] The technical solution of the present invention will now be described in detail with reference to the accompanying drawings.

[0018] This invention proposes a hierarchical adaptive intrinsic security detection architecture, the process of which is described below. Figure 1 It includes a logically coupled upper-layer detection module and a lower-layer detection module. The two modules achieve data interaction and connection based on the security detection copy and undertake the layered detection task: the upper-layer detection module, as a low-latency, high-throughput primary sensing unit, is used to perform coarse-grained screening and labeling of transient anomaly features on the full data stream in the security detection copy; the lower-layer detection module, as a high-precision logical arbitration unit, is used to perform deep deterministic verification based on multi-dimensional physical correlation on the suspected anomaly data screened by the upper-layer detection module.

[0019] Traditional single-level detection methods often suffer from false positives or false negatives due to their oversimplification. This invention addresses this by employing a two-level module progressive verification approach, rigorously screening data in the security detection copy layer by layer according to preset anomaly definitions. This effectively reduces both false positive and false negative rates, making it suitable for high-security scenarios. Its core technical feature is the construction of a dual-engine hierarchical topology structure of "upper-level coarse-grained screening - lower-level deep verification." The two-level modules achieve directional data flow and layered detection based on the security detection copy, achieving a balance in detection performance through a "non-intrusive parallel mapping" and "cascaded progressive convergence" detection mechanism.

[0020] The upper-layer detection module, as a low-latency, high-throughput primary sensing unit, aims to identify whether the data in the security detection replica deviates significantly from the normal range. It performs coarse-grained screening and labeling of transient anomalies based on a lightweight heuristic algorithm. It embeds a physical credibility metric evaluation engine, which uses the inherent physical conservation laws of the system as the decision criterion and quantifies the threat level by calculating the Euclidean distance offset between the state variables in the security detection replica and the boundary of the ideal physical manifold. The engine adopts a linear computational complexity architecture (O(n)) to ensure that the detection latency is lower than the system control cycle, which can meet the real-time detection requirements.

[0021] The upper-layer detection module specifically employs a simple and efficient difference verification algorithm for detection. This algorithm calculates the difference between the detected data and a preset normal baseline value, and marks data with a difference exceeding a preset threshold as potentially abnormal. The specific calculation formula is as follows: .

[0022] Furthermore, the upper-level detection uses difference calculation to perform analysis on the current data. The data corresponding to the security check copy The difference was calculated to obtain The value is then used for tolerance verification, comparing the difference with the preset tolerance. In comparison, when This indicates that the data is normal. Then proceed to the next layer for detection.

[0023] The upper-layer detection module integrates a spatial heterogeneous tolerance configuration mechanism. Based on the noise characteristics of different spatial nodes in a distributed sensor network, it sets differentiated regional confidence intervals and tolerance thresholds according to the sensor's location. Detection accuracy is optimized through regional tolerance adjustment. It can also be flexibly adjusted according to different scenarios and sensor types.

[0024] Furthermore, the linear computational complexity (O(n)) of the upper-layer detection makes it extremely low in computational overhead, making it suitable as a preliminary screening step in scenarios with high real-time requirements. For example, in greenhouse monitoring, a small tolerance range can be set based on historical data to adapt to environments with relatively stable temperature changes; at the same time, the tolerance can be dynamically adjusted based on the fluctuation range of historical data to improve sensitivity to sudden anomalies; for sensor networks with spatial distribution characteristics, different tolerance values ​​can be set according to regions based on the spatial heterogeneous tolerance configuration mechanism to further optimize detection accuracy.

[0025] As a high-precision logical arbitration unit, the lower-layer detection module receives suspected abnormal data transmitted from the upper-layer detection module and performs deep deterministic verification based on multi-dimensional physical correlation on the suspected feature vector marked by the upper layer. The lower-layer detection module is equipped with a high-order spatiotemporal coupled inference engine, which constructs a dynamic correlation graph based on the multi-dimensional state data in the security detection copy. This engine integrates historical time-series prior distribution and physical kinematic constraint equations to generate a baseline correlation topology and has online incremental learning capabilities. It adaptively iterates the model parameters according to the distribution drift characteristics of the real-time data stream to adapt to the verification requirements of complex scenarios under non-stationary random processes.

[0026] Its core is to construct a correlation model by utilizing the correlation between multidimensional physical quantities (such as the linear relationship between temperature and humidity), and the specific model is as follows: The model uses historical physical quantity data collected over a long period of time as training samples and generates basic association rules by fitting the transfer function between various physical quantities.

[0027] Furthermore, T and H represent temperature and humidity, respectively, and a, b, and c are parameters fitted based on historical data. Then, the expected range of the correlation values ​​is set: Furthermore, the lower-level detection module verifies the data by calculating the deviation range. If the temperature and humidity data violate the historical transmission rules at a certain moment (such as the temperature rising but the humidity not decreasing accordingly), it is identified as abnormal. At the same time, the lower-level detection module embeds an adaptive attention allocation mechanism, which assigns dynamic weight matrices to physical state variables of different dimensions in the security detection copy. The weight matrix is ​​determined based on the sensitivity coefficient of each state variable's impact on system stability. The sensitivity coefficient is obtained by inverse inversion and attribution analysis of historical abnormal events, and key variables that exceed the preset sensitivity threshold are given high priority calculation weights.

[0028] Furthermore, the lower-level detection module integrates a topological adjacency propagation analysis algorithm. By calculating the cross-correlation index of abnormal features among spatially adjacent nodes, it identifies the regional diffusion attributes of abnormal behavior, thereby eliminating discrete misjudgments caused by single-point sensor drift.

[0029] During operation, the lower-level detection module calls real-time physical quantity data from the safety detection copy in real time, and iteratively optimizes the basic association rules by relying on online incremental learning capabilities to improve detection adaptability. In the safety detection copy corresponding to the environmental monitoring scenario, the lower-level detection module incorporates at least three physical quantity data such as temperature, humidity, air pressure, and pollutant concentration into the association model construction to enhance the robustness and generalization of the model. At the same time, the lower-level detection module calls historical data from the safety detection copy and uses trend fitting algorithms to compare the trend characteristics such as the slope and fluctuation amplitude of the current suspected abnormal data with the historical data, and further reduces misjudgments by combining spatial correlation analysis.

[0030] The upper-layer detection module and the lower-layer detection module are logically coupled, forming a collaborative link of "fast filtering - accurate verification" through the security detection copy. They do not exist in isolation, but rather complement each other as a whole. The upper-layer detection module completes the initial screening and marking of significant abnormal data in the security detection copy within 100 milliseconds using a low-complexity algorithm with linear computational complexity (O(n)). It quickly eliminates most normal data using difference verification and passes the suspected abnormal data to the lower-layer detection module. The lower-layer detection module performs multi-dimensional correlation analysis on the suspected abnormal data marked by the initial screening, combining high-order spatiotemporal coupling reasoning, adaptive attention allocation, and topological adjacency propagation analysis to accurately locate complex hidden anomalies and eliminate occasional fluctuations and noise interference.

[0031] If the detection results require further confirmation, multiple rounds of lower-level detection can be performed as necessary, using different rule models for verification. The two-level modules complement each other to improve the overall detection efficiency and accuracy. Its core technical feature is to build a collaborative detection link between the two-level modules through a secure detection copy, achieving functional complementarity between rapid filtering of significant anomalies and accurate location of complex anomalies. It utilizes hierarchical computing power allocation to ensure time complexity, achieving an endogeneous dynamic balance between detection real-time performance and recall. The hierarchical design of the dual-engine hierarchical topology ensures the system's real-time performance and reliability, making it suitable for diverse application scenarios and possessing good scalability.

[0032] The organic combination of upper-layer and lower-layer detection enables this method to efficiently handle different types of anomalies. Upper-layer detection quickly identifies significant anomalies and achieves real-time blocking, while lower-layer detection accurately locates complex and hidden anomalies, enabling precise source tracing. The two complement each other and improve the overall detection performance.

[0033] The anomaly detection mechanism is based on clear physical rules and thresholds, and has good interpretability. For example, the detection results can be directly verified through difference analysis, Euclidean distance offset calculation, or association rule verification process, providing clear criteria for anomaly judgment for operation and maintenance personnel. The mechanism can adjust thresholds and rules according to the needs of different scenarios, such as changing the tolerance range ϵ, association model parameters a, b, c, or regional confidence interval, so as to adapt to the detection requirements of different environments. In addition, it can be combined with edge computing devices to further optimize detection efficiency.

[0034] This invention demonstrates excellent adaptability in heterogeneous scenarios. In industrial equipment monitoring, the tolerance range and sensitivity threshold can be dynamically adjusted according to the equipment's operating status. In environmental monitoring, it can be combined with more physical quantities (such as air pressure and light intensity) to enhance detection capabilities and fully leverage the advantages of the high-order spatiotemporal coupling inference engine and adaptive attention allocation mechanism.

[0035] In summary, the hierarchical adaptive intrinsic security detection architecture proposed in this invention constructs a dual-engine hierarchical topology structure of "upper-layer coarse-grained screening - lower-layer deep verification," combining hierarchical verification and multi-dimensional verification strategies. Through a detection mechanism of "non-intrusive parallel mapping" and "cascaded progressive convergence," it provides a highly secure, low-false-report, and highly interpretable anomaly detection scheme, effectively solving the problem that traditional single-level detection struggles to balance real-time performance and recall.

Claims

1. A layered adaptive intrinsic security detection architecture, characterized in that, include: A dual-engine hierarchical topology built on top of a security detection replica comprises logically coupled upper-layer and lower-layer detection modules. The upper-layer detection module, acting as a low-latency, high-throughput primary sensing unit, is configured to perform coarse-grained screening and labeling of transient anomalies in the full data stream within the security detection replica based on a lightweight heuristic algorithm. The lower-layer detection module, acting as a high-precision logical arbitration unit, is configured to perform deep deterministic verification based on multi-dimensional physical correlations on the suspected feature vectors labeled by the upper layer. This architecture establishes a "non-intrusive parallel mapping" through the security detection replica and constructs a "cascaded progressive convergence" detection mechanism using two-level modules. While ensuring time complexity, it achieves real-time blocking of significant violations and accurate tracing of covert attack behaviors through hierarchical computing power allocation, achieving an endogenous dynamic balance between detection real-time performance and recall rate.

2. The hierarchical adaptive intrinsic security detection architecture according to claim 1, characterized in that, The upper-layer detection module embeds a physical reliability measurement and evaluation engine. This engine uses the inherent physical conservation laws of the system as the judgment criterion and quantifies the threat level by calculating the Euclidean distance offset between the state variables in the security detection replica and the boundary of the ideal physical manifold. The engine adopts a linear computational complexity architecture (O(n)) to ensure that the detection latency is lower than the system control cycle, and integrates a spatial heterogeneous tolerance configuration mechanism to dynamically map differentiated regional confidence intervals and tolerance thresholds for the noise characteristics of different spatial nodes in the distributed sensor network.

3. The hierarchical adaptive intrinsic security detection architecture according to claim 1, characterized in that, The lower-level detection module is equipped with a high-order spatiotemporal coupled inference engine. After receiving the suspected anomaly vectors transmitted by the upper-level detection module, the engine constructs a dynamic association graph based on the multi-dimensional state data in the security detection copy. The engine integrates historical time-series prior distribution and physical kinematic constraint equations to generate a baseline association topology and has online incremental learning capabilities. It adaptively iterates the model parameters according to the distribution drift characteristics of the real-time data stream to adapt to the verification requirements of complex scenarios under non-stationary random processes.

4. The hierarchical adaptive intrinsic security detection architecture according to claim 1, characterized in that, The lower-level detection module embeds an adaptive attention allocation mechanism, assigning dynamic weight matrices to physical state variables of different dimensions in the security detection replica. This weight matrix is ​​determined based on the sensitivity coefficient of each state variable's impact on system stability. The sensitivity coefficient is obtained through inverse inversion and attribution analysis of historical abnormal events, and key variables exceeding a preset sensitivity threshold are given high priority calculation weights. Simultaneously, this module integrates a topological adjacency propagation analysis algorithm, which identifies the regional diffusion attributes of abnormal behavior by calculating the cross-correlation index of abnormal features among spatially adjacent nodes, thereby eliminating discrete misjudgments caused by single-point sensor drift.

Images