Redundant fragment calculation verification and edge loss recovery error correction method for attack traceability graph construction

Abstract

The invention discloses a redundancy fragment calculation verification and edge loss recovery error correction method for attack traceability graph construction, which relates to the technical field of network security, and comprises the following steps: S1, obtaining original network traffic and analysis logs from multi-source heterogeneous data, and constructing an initial attack traceability graph structure by adopting a graph neural network algorithm, obtaining a preliminary graph representation containing the dependency relationship between the nodes; s2, data layer field missing information and a logic layer behavior sequence are obtained according to a node dependency relationship in the preliminary graph representation, a conditional random field algorithm is adopted to judge the relevance between field missing and the behavior sequence, if the relevance is lower than a preset threshold value, a potential error region is marked, and the boundary of the error region is determined; according to the redundancy fragment calculation verification and edge loss recovery error correction method constructed by the attack traceability graph, high-precision attack path reconstruction and error source positioning are realized, the network security traceability efficiency and response capability are improved, and a reliable basis is provided for security defense in a complex network environment.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a method for redundant fragment calculation verification and edge loss recovery error correction in attack attribution graph construction. Background Technology

[0002] In the field of cybersecurity, attack attribution maps serve as a crucial tool for revealing the paths, methods, and impacts of cyberattacks, playing an irreplaceable role in ensuring information system security. Their core lies in reconstructing the full picture of an attack event through multi-dimensional data analysis, thereby providing a basis for defense and accountability. However, with the increasing complexity of cyberattack methods and the surge in data volume, constructing accurate and complete attack attribution maps faces significant challenges. Existing technological systems often struggle to fully guarantee the accuracy and integrity of data when dealing with complex attack scenarios, leading to potential deviations or even invalidity in attribution results. This challenge not only affects the reliability of security analysis but may also delay responses at critical moments. Currently, most attribution methods have significant limitations in data processing. Traditional methods typically focus on single-level data verification, such as only considering whether the data format is standardized, while ignoring the logical consistency and semantic rationality of data across different levels. This one-sided verification approach struggles to effectively identify deep-seated errors when facing complex attack scenarios. For example, some methods may only verify the integrity of data packets but fail to determine whether they conform to the logical context of the attack behavior, causing erroneous data to be mistakenly identified as legitimate information, thus affecting the construction of the attribution map. This limitation makes the system prone to overall analysis distortion due to error accumulation when processing large-scale, multi-source, heterogeneous data. A deeper technical challenge lies in constructing a multi-layered verification system to ensure comprehensive data accuracy. The first core technical factor is the verification of data correlation across different layers. Attack source maps involve not only raw network traffic but also parsed logs, event sequences, etc., which have complex dependencies between the data layer, logic layer, and semantic layer. For example, the data layer might detect a missing field in a data packet, but if the logic layer cannot determine whether this missing field disrupts the integrity of the attack path, it could lead to an incorrect reconstruction of the source map. This lack of correlation verification makes it difficult for the system to accurately locate the source of errors. Based on the inadequacy of correlation verification, the second core technical factor arises: the accuracy of error location. In complex attack scenarios, data errors may stem from various causes, such as data loss, tampering, or formatting abnormalities, but existing methods often only provide a general report of the existence of errors without offering detailed error location information. For example, during the attribution process of a distributed denial-of-service (DDoS) attack, the system may detect data anomalies on some nodes, but it cannot accurately distinguish whether the data loss is due to network jitter or deliberately forged abnormal data by the attacker. This inaccurate localization makes subsequent error correction and recovery extremely difficult, hindering the system's ability to quickly restore data integrity. Therefore, how to achieve data correlation verification within a multi-layered verification system and further provide accurate error localization information becomes a key issue in constructing a high-quality attack attribution graph. In real-world business scenarios, such as when a financial system suffers a complex network attack, the attribution graph needs to accurately reconstruct every step of the attacker's operation from intrusion to data theft.If the verification system cannot identify format errors in the data layer and inconsistencies in behavior in the logic layer, or cannot pinpoint the specific source of the error, the tracing results may misjudge the attack path, preventing the security team from taking timely and targeted measures. This problem is particularly prominent in scenarios involving multi-source data fusion and dynamic attacks. Summary of the Invention

[0003] The purpose of this invention is to provide a method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction, and to design a multi-level, highly correlated and accurately located verification system.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a method for redundant fragment calculation verification and edge loss recovery error correction in attack source tracing graph construction, comprising: S1, obtaining original network traffic and parsing logs from multi-source heterogeneous data, constructing an initial attack source tracing graph structure using a graph neural network algorithm, and obtaining a preliminary graph representation containing inter-node dependencies; S2, based on the node dependencies in the preliminary graph representation, obtaining missing data layer field information and logical layer behavior sequences, using a conditional random field algorithm to determine the correlation between missing fields and behavior sequences, and marking potential error regions if the correlation is lower than a preset threshold, thus determining the boundaries of error regions; S3, obtaining marked data from the error region boundaries, traversing multi-level dependencies within the marked data, and using a Bayesian network algorithm... S4. Based on the error type probability distribution, obtain the relevant node context data, adjust the source graph structure by iteratively updating the node weights, and judge the graph connectivity after weight adjustment. If the connectivity is improved, the adjustment is confirmed to be effective, and the optimized graph representation is determined. S5. Extract the key path sequence from the optimized graph representation, verify the semantic layer information within the path sequence, obtain the semantic consistency score, and determine whether the score meets the integrity requirements. If it does, output the path that passes the verification, and obtain the complete attack path reconstruction. S6. Based on the complete attack path reconstruction, obtain the abnormal node data in the path, locate the abnormal source through the backtracking algorithm, determine whether the source is due to network jitter or forgery, and determine the error source list.

[0005] Preferably, step S1 includes acquiring network traffic and parsing logs through multi-source heterogeneous data, processing them using standardized protocols to obtain traffic features and log structures in a unified format; embedding nodes into the traffic features and log structures using a graph neural network algorithm to obtain an initial graph representation of the dependencies between nodes; if the node connection strength in the initial graph representation is lower than a preset threshold, then filtering highly relevant nodes through topology analysis to obtain an optimized attack tracing graph; based on the optimized attack tracing graph, grouping nodes using a clustering algorithm to obtain a preliminary classification of attack paths; analyzing the dependencies between nodes through the preliminary classification of attack paths, and using association rule mining to determine key nodes for attack tracing; if the dependencies of key nodes conform to a preset attack pattern, then extracting the temporal features of attack events through time series analysis to obtain a complete sequence of attack tracing; and generating a dynamically updated graph of node dependencies based on the complete sequence of attack tracing to obtain real-time attack tracing results.

[0006] Preferably, step S2 includes obtaining missing field information from node dependencies, completing the data layer fields using a standardization method to obtain a completed field set; extracting the logic layer behavior sequence based on the completed field set, and generating a normalized representation of the behavior sequence using a sequence alignment method; calculating the conditional probability of each behavior in the sequence using a conditional random field algorithm to obtain the probability distribution of the behavior sequence; if there is a conditional probability below a preset threshold in the probability distribution of the behavior sequence, the corresponding behavior is marked as an abnormal behavior, and the boundary range of the abnormal behavior is determined; extracting the associated subgraph structure from the node dependencies based on the boundary range of the abnormal behavior to obtain the subgraph representation corresponding to the abnormal behavior; grouping the nodes using a graph clustering method to obtain the node grouping result of the abnormal behavior; analyzing the strength of the dependency relationship between nodes based on the node grouping result, generating a dynamically updated node dependency relationship graph, and obtaining the source tracing result of the abnormal behavior.

[0007] Preferably, step S3 includes: acquiring labeled data from the error region boundary; extracting multi-level dependencies using a data traversal method to obtain a hierarchical representation of the dependencies; constructing a Bayesian network model based on the hierarchical representation of the dependencies; inferring the conditional probability of the error type to obtain a probability distribution of the error type being lost or tampered; filtering the probability distribution using a preset threshold; if the conditional probability is lower than the preset threshold, it is marked as an abnormal error type, resulting in a set of abnormal error types; extracting the corresponding error boundary from the set of abnormal error types; dividing the node associations within the error boundary using a graph segmentation method to obtain a subset of node associations; analyzing the dependency strength between nodes based on the subset of node associations; calculating the distribution of dependency strength using a weighted average method to obtain a quantitative representation of dependency strength; if the dependency strength is lower than a preset threshold, it is determined to be a weak dependency, obtaining a set of nodes with weak dependencies; extracting associated labeled data from the set of nodes with weak dependencies; generating a source path for the error type using a data aggregation method to obtain a sequence representation of the source path.

[0008] Preferably, step S4 includes obtaining node context data from the error type probability distribution, grouping the context data using a clustering method to obtain a set of node context classifications; calculating the node weight for each classification based on the set of node context classifications, generating a weight distribution using a weighted average method to obtain a quantitative representation of the node weights; extracting the weight change trend from the quantitative representation of the node weights, predicting the direction of weight change using a trend analysis method to obtain a predicted sequence of weight changes; adjusting the node connections in the source graph structure for the predicted sequence of weight changes if the predicted value exceeds a preset threshold to obtain an adjusted graph structure; extracting connectivity indicators from the adjusted graph structure, calculating connectivity scores using a graph analysis method to obtain a quantitative representation of the connectivity scores; confirming the effectiveness of the graph structure adjustment based on the quantitative representation of the connectivity scores if the score is higher than a preset threshold to obtain an optimized source graph representation; extracting node association paths from the optimized source graph representation, generating an error source tracing sequence using a path analysis method to obtain the final set of source tracing paths.

[0009] Preferably, step S5 includes extracting key path sequences from the optimized graph representation, obtaining the associated paths between nodes using a graph traversal method, and obtaining a path sequence set; for the path sequence set, extracting semantic layer information for each path using a semantic analysis method, and generating a semantic information set; extracting semantic features from the semantic information set, calculating the similarity between semantic features using a vector space model, and obtaining a consistency score set; for the consistency score set, if the score meets a preset threshold, confirming that the path has semantic integrity, and obtaining a complete path subset; extracting path association features from the complete path subset, grouping the paths using a clustering analysis method, and generating a path cluster set; for the path cluster set, integrating the paths within the cluster using a path fusion method, and obtaining a reconstructed attack path set; extracting core paths from the reconstructed attack path set, verifying the logical consistency of the paths using a sequence analysis method, and obtaining the final attack path.

[0010] Preferably, step S6 includes obtaining abnormal node data from the reconstructed attack path, extracting node attribute sets using a graph traversal method to obtain an abnormal node dataset; analyzing the correlation between nodes using a backtracking algorithm based on the abnormal node dataset to generate a candidate node list of abnormal sources; obtaining network traffic data related to the nodes for the candidate node list, and determining network jitter if the traffic fluctuation exceeds a preset threshold to obtain a subset of network jitter sources; extracting data features of the remaining nodes from the candidate node list, analyzing the matching degree between features and forgery patterns using a support vector machine algorithm to determine whether it is data forgery, and obtaining a subset of forgery sources; generating a preliminary error source list by merging the subset of network jitter sources and the subset of forgery sources; verifying the logical consistency of the source nodes using a sequence analysis method for the preliminary error source list to obtain a final error source list; extracting context data of the source nodes from the final error source list, grouping the source nodes using a clustering analysis method to generate an abnormal source classification set.

[0011] Preferably, the method further includes S7: obtaining source-related data from the error source list, performing recovery operations on the related data, filling in missing parts using interpolation methods, judging the consistency of the recovered data, and if the consistency meets the standard, integrating it into the source tracing graph to obtain the final attack source tracing graph. Specifically, this includes obtaining source-related data from the error source list, extracting key features using principal component analysis, and generating a feature dataset; if the dimension of the feature dataset meets the requirements after comparison with a preset dimension threshold, grouping the feature dataset using a clustering analysis method to obtain a grouped dataset; generating node embedding vectors using a graph embedding algorithm based on the grouped dataset to obtain a node embedding set; extracting node correlation data from the node embedding set, and if the node correlation data meets the requirements after comparison with a preset correlation threshold, integrating it into the source tracing graph using a graph update algorithm to obtain an updated source tracing graph; analyzing the dependencies between nodes using a topological sorting method for the updated source tracing graph to obtain a dependency set; extracting context data from the dependency set, judging abnormal points in the context data using an anomaly detection method to obtain an anomaly point set; and adjusting the structure of the updated source tracing graph using a graph optimization algorithm based on the anomaly point set to obtain a high-quality source tracing graph.

[0012] Preferably, the method further includes S8: obtaining the overall event sequence from the final attack source map, verifying the reliability of the defense basis through sequence comparison, determining whether the verification result supports a rapid response, and determining the response basis set. Specifically, this includes obtaining the overall event sequence from the attack source map, calculating the event sequence features using a sequence comparison method to obtain a feature sequence set; classifying the sequence features using a support vector machine algorithm based on the feature sequence set, determining whether the classification result meets a preset reliability threshold, and determining a reliable feature subset; if the reliable feature subset meets the preset threshold, extracting the defense basis set using a sequence comparison method to obtain a preliminary defense basis set; and analyzing the attack path set using a topology analysis method based on the preliminary defense basis set to determine the path priority sequence.

[0013] Preferably, step S8 further includes extracting event timestamps from the path priority sequence, detecting timestamp anomalies through time series analysis methods to obtain an abnormal time point set; if the abnormal time point set is not empty, adjusting the correlation of nodes in the tracing graph through a graph update algorithm to obtain an updated attack path set; and generating a set of response criteria supported by a fast response based on the updated attack path set to determine the final response criteria set.

[0014] As can be seen from the above technical solution, the present invention has the following beneficial effects: This invention employs a redundant fragmentation calculation verification and edge recovery error correction method for attack source graph construction. Addressing the complexity of attack path reconstruction and error source localization in the cybersecurity field, it integrates graph neural networks, conditional random fields, Bayesian networks, and backtracking algorithms to construct and optimize attack source graphs, solving challenges such as missing fields, insufficient correlation of behavioral sequences, and error type inference in multi-source data parsing. First, an initial source graph is generated using a graph neural network. Potential error regions are identified based on conditional random fields, and the probability distribution of error types is inferred using a Bayesian network. Node weights are dynamically adjusted to optimize graph connectivity. Subsequently, semantic verification of key path sequences ensures path integrity, a backtracking algorithm accurately locates the source of anomalies, and interpolation methods are used to recover missing data, ultimately generating a high-quality source graph. This invention verifies the reliability of defense evidence through comprehensive event sequence comparison, supporting rapid response. Its core technical effect lies in achieving high-precision attack path reconstruction and error source localization, improving the efficiency and response capability of cybersecurity source tracing, and providing a reliable basis for security defense in complex network environments. Attached Figure Description

[0015] Figure 1 This is a flowchart of the redundant fragment calculation verification and edge loss recovery error correction method for attack tracing graph construction in this invention. Detailed Implementation

[0016] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0017] like Figure 1As shown, this invention provides a technical solution: a method for redundant fragment calculation verification and edge loss recovery error correction in attack source tracing graph construction, comprising: S1, obtaining original network traffic and parsing logs from multi-source heterogeneous data, constructing an initial attack source tracing graph structure using a graph neural network algorithm to obtain a preliminary graph representation containing inter-node dependencies; S2, obtaining missing data layer field information and logical layer behavior sequences based on node dependencies in the preliminary graph representation, using a conditional random field algorithm to determine the correlation between missing fields and behavior sequences, and marking potential error regions if the correlation is lower than a preset threshold to determine the error region boundaries; S3, obtaining marked data from the error region boundaries, traversing multi-level dependencies within the marked data, and inferring the error type distribution using a Bayesian network algorithm to obtain the error type probability distribution; S4, obtaining relevant node context data based on the error type probability distribution, adjusting the source tracing graph structure by iteratively updating node weights, and determining the graph connectivity after weight adjustment. S5. If connectivity is improved, the adjustment is confirmed to be effective, and the optimized graph representation is determined; S6. Extract the key path sequence from the optimized graph representation, verify the semantic layer information within the path sequence, obtain the semantic consistency score, and determine whether the score meets the integrity requirements. If it does, output the path that passes the verification, and obtain the complete attack path reconstruction; S7. Based on the complete attack path reconstruction, obtain the abnormal node data in the path, locate the abnormal source through the backtracking algorithm, determine whether the source is due to network jitter or forgery, and determine the error source list; S8. Obtain the source-related data from the error source list, perform recovery operations on the related data, use interpolation methods to fill in the missing parts, and determine the consistency of the recovered data. If the consistency meets the standard, integrate it into the tracing graph to obtain the final attack tracing graph; S9. Based on the final attack tracing graph, obtain the overall event sequence in the graph, verify the reliability of the defense basis through sequence comparison, determine whether the verification result supports a rapid response, and determine the response basis set.

[0018] This method first extracts raw network traffic and log information from multi-source heterogeneous data. It then analyzes the complex relationships between nodes using a graph neural network algorithm and constructs an initial attack attribution graph structure. This graph reveals the dependencies between event nodes and forms a preliminary graph representation. Subsequently, the system analyzes the matching degree between missing data fields and logical behavior sequences based on this graph representation, using a conditional random field model to measure the correlation between the two. When low-correlation regions are detected, these regions are marked as potential error regions, and their boundaries are further clarified. Within error regions, a Bayesian network is used to traverse and infer multi-level dependency paths, inferring the probability distribution of different types of errors. The system assesses the probability of various errors based on this distribution and, combined with node context information, optimizes the graph structure through dynamic iterative updates of node weights. After each iteration, the system checks the changes in graph connectivity to determine the effectiveness of the structural adjustment. Once the graph structure is optimized, the system extracts critical paths and analyzes their semantic hierarchy information, using a semantic consistency scoring mechanism to determine path integrity, thereby obtaining reliable attack path reconstruction results. Based on this, the system traces the source of abnormal nodes, determines whether they are caused by network jitter or malicious spoofing through backtracking analysis, and ultimately identifies a complete list of error sources. For these error sources, the system performs data recovery operations on their associated data, uses interpolation algorithms to fill in missing areas, and verifies the consistency of the recovered data. Data that meets the consistency standard is reintegrated into the source graph, forming a more complete final attack source graph structure. Finally, by comparing and analyzing the overall event sequence in the graph, the reliability and response efficiency of the current defense measures are determined.

[0019] This invention effectively identifies erroneous edges and nodes in attack attribution graphs caused by missing data, semantic inconsistencies, or misjudgments. Through multi-level algorithmic collaborative processing, it improves the robustness and accuracy of attribution graph construction. It accurately identifies potential error regions using a conditional random field model and enhances the accuracy of erroneous inferences using a Bayesian network model. Graph structure optimization uses graph connectivity as a criterion, contributing to improved logical integrity of the overall network graph. A path semantic consistency verification mechanism ensures the practical usability of the reconstructed paths, facilitating anomaly analysis and forensics. Simultaneously, interpolation techniques are used for data recovery, effectively supplementing information missing due to network anomalies or attacks, significantly improving the completeness and adaptability of the attack graph and enhancing the entire system's attribution analysis capabilities against Advanced Persistent Threat (APT) attacks.

[0020] S1 includes acquiring network traffic and parsing logs from multi-source heterogeneous data, processing them using standardized protocols to obtain traffic features and log structures in a unified format; using a graph neural network algorithm to embed nodes into the traffic features and log structures to obtain an initial graph representation of the dependencies between nodes; if the node connection strength in the initial graph representation is lower than a preset threshold, then highly relevant nodes are filtered through topology analysis to obtain an optimized attack source map; based on the optimized attack source map, clustering algorithms are used to group nodes to obtain a preliminary classification of attack paths; through the preliminary classification of attack paths, the dependencies between nodes are analyzed, and association rule mining is used to determine the key nodes for attack source tracing; if the dependencies of key nodes conform to a preset attack pattern, then time series analysis is used to extract the temporal features of attack events to obtain a complete sequence of attack source tracing; based on the complete sequence of attack source tracing, a dynamically updated graph of node dependencies is generated to obtain real-time attack source tracing results.

[0021] First, raw network traffic data and parsed logs are extracted from multiple heterogeneous data sources, including network layer packets, session connection records, user login operation records, and system event logs. All input data undergoes protocol standardization before entering the processing flow. This involves uniformly converting the data content of Transmission Control Protocol (TCP), User Datagram Protocol (UDP), and Hypertext Transfer Protocol (HTTP) to a single format. The source address, destination address, protocol type, timestamp, data length, and payload digest information of each record are extracted and constructed into a fixed-structure data vector. Each field is either numeric or categorical, with a consistent format to facilitate subsequent model recognition.

[0022] In the graph neural network embedding stage, each record in the data vector is abstracted as a graph node, and the relationships between nodes, such as data communication, behavior triggering, and log continuity, are represented as edges. For example, if source address A and destination address B have data packet communication, a directed edge from A to B is generated. The attributes attached to each edge include communication time, data volume, and protocol type. The graph neural network updates the node representation through a layer-by-layer propagation mechanism. Each node collects feature information from all neighboring nodes in the current layer and aggregates it with its own features. The aggregation method is to take a weighted average, with the weights initially being the mean and iteratively optimized. After the graph neural network converges, it outputs the high-dimensional feature representation of each node and calculates the connection strength between any two nodes. This strength is calculated using cosine similarity, which is the cosine value of the angle between the feature vectors of the two nodes after standardization. This value ranges from 0 to 1, with a larger value indicating a higher similarity between the nodes.

[0023] After calculating the strength of all connections, edges with connection strength values ​​below a preset threshold are filtered out. The threshold is determined as follows: First, the connection strength values ​​of all node pairs are collected, and the average and standard deviation of this set of values ​​are calculated. The average is set as the median, and the standard deviation as the fluctuation range. The threshold is set as the average minus 0.5 times the standard deviation. This setting ensures that most high-strength connections are retained while effectively eliminating weakly correlated connections. For example, if the average connection strength is 0.72 and the standard deviation is 0.15, the threshold is set to 0.72 minus 0.075, resulting in 0.645. Connections below 0.645 are considered invalid edges and are eliminated. After elimination, the remaining graph structure undergoes topological analysis, including node degree statistics. The number of edges retained for each node is used as its degree value. Nodes with a degree value greater than 3 and a distance of no more than 2 hops from high-degree nodes are retained as highly correlated nodes, forming a new graph structure.

[0024] Next, a clustering algorithm is used to group the remaining nodes. First, the K-means algorithm is used, initializing the number of clusters K to 10, and selecting 10 initial cluster centers. Grouping is then iterated based on the distance between each node's feature vector and the center. After each iteration, the center point of each group is recalculated until the affiliation of all nodes no longer changes or the maximum number of iterations reaches 100. Then, by calculating the silhouette coefficient of each cluster, the classification scheme with the largest mean silhouette coefficient is selected as the initial classification result for the final attack path.

[0025] In each categorized attack path, all connections between nodes are traversed, and information such as operation type, access resource identifier, and command call chain of connection events is extracted. The Apriori association rule mining algorithm is then used for frequent itemset mining. With a minimum support of 0.6 and a minimum confidence of 0.8, all combinations of node operation pairs are traversed, and operation sequences that meet the conditions are recorded. Nodes that appear repeatedly are identified as key nodes that are triggered multiple times during the attack.

[0026] The upstream and downstream path structure of each key node is compared with the system's predefined attack pattern template, which is summarized by experts based on historical attack cases. For example, a typical attack chain can be defined as three consecutive nodes: remote login, file tampering, and data transmission. If the current key node and its path match the structure perfectly, the attack path is confirmed as a typical path.

[0027] Finally, time series analysis is performed on each critical path that matches the attack pattern. The difference in operation timestamps across all nodes is analyzed. If the time interval between two adjacent nodes is within 5 minutes and there are no anomalous abrupt changes, and the total time span of all paths does not exceed 24 hours, then it is considered to have temporal logical consistency. This path is then considered the complete attack sequence. A dynamically updated graph of node dependencies is generated based on this sequence, i.e., directed edges are added from previous nodes to subsequent nodes, with edge attributes including time interval and operation type. Each graph update checks for circular dependencies or isolated nodes; if none exist, the update is valid, and the current graph is used as the real-time attack attribution result. Each graph update process is automatically triggered upon receiving new logs or traffic data, and the graph structure is updated within 1 second to ensure the system has real-time responsiveness.

[0028] The threshold for node connection strength is set to "the average connection strength minus 0.5 times the standard deviation," based on statistical analysis of the distribution characteristics of node dependency strength in the network. After processing by a graph neural network, actual network traffic and log data typically exhibit a concentrated distribution trend in node connection strength, with a small number of extremely weak connections representing noise or occasional behavior. Indiscriminately retaining all of these would introduce invalid information and interfere with the accurate representation of the graph structure. Therefore, to effectively remove noisy connections while preserving true dependencies, this implementation uses the average of all connection strengths to reflect the central tendency and calculates the standard deviation to represent the data fluctuation range. Setting the threshold to the average minus 0.5 times the standard deviation allows for the reasonable removal of weak connections in the low-value peripheral regions while preserving the core structural information to prevent accidental deletion, thus enhancing the accuracy and stability of the source graph. Choosing 0.5 as the standard deviation multiplier is a result of balancing the risk of accidental deletion with noise reduction capabilities in actual sample validation.

[0029] S2 includes: obtaining missing field information from node dependencies; completing the data layer fields using a standardization method to obtain a completed field set; extracting the logical layer behavior sequence based on the completed field set; generating a normalized representation of the behavior sequence using a sequence alignment method; calculating the conditional probability of each behavior in the normalized behavior sequence using a conditional random field algorithm to obtain the probability distribution of the behavior sequence; marking the corresponding behavior as an anomalous behavior if there is a conditional probability below a preset threshold in the probability distribution of the behavior sequence, and determining the boundary range of the anomalous behavior; extracting the associated subgraph structure from the node dependencies based on the boundary range of the anomalous behavior to obtain the subgraph representation of the anomalous behavior; grouping the nodes using a graph clustering method for the subgraph representation to obtain the node grouping results of the anomalous behavior; analyzing the strength of the dependency relationship between nodes based on the node grouping results, generating a dynamically updated node dependency relationship graph, and obtaining the source tracing results of the anomalous behavior.

[0030] In this implementation, starting from the node dependencies in the attack attribution graph, the data field set of each node is traversed one by one. For each field, an integrity check is performed to determine if any field values ​​are missing. The criteria for determining a missing field are: the field content is empty, the field value is an abnormal placeholder, or the field value does not conform to the predefined type or value range of the field. If any condition is met, the field is marked as missing. The system performs standardization processing on all missing fields. For each missing field, the system searches the upstream and downstream nodes of the node containing the field to extract non-missing values ​​of the same field, counts the occurrence frequency of each value, and selects the value with the highest occurrence frequency as the completion value for the field. If the field is a continuous numerical value, the average value of the field in adjacent nodes is taken and rounded down to obtain the completion result. If it is an enumerated field, the enumerated value with the highest occurrence frequency is selected. If multiple values ​​have the same frequency, they are selected in lexicographical order to ensure the determinism and consistency of the completion process. After all completion operations are completed, a complete set of nodes is generated.

[0031] Subsequently, based on the complete set of nodes in the field, the system extracts the corresponding operational behaviors of the nodes according to the topological order in the attack tracing graph, constructing a logical layer behavior sequence. The construction rules for the behavior sequence are as follows: the behavior of each node consists of three items in its field: operation type, execution command, and resource access type, and the time order is determined by the timestamp field in the field. The behaviors of all nodes are sorted in order from earliest to latest time to form a complete behavior sequence. Then, the behavior sequence is normalized by using a dynamic time warping method to map behavior sequences of different lengths to a uniform time interval. Behavior alignment is completed by calculating the minimum cost path, making different behavior sequences comparable. The core parameter of this process is the time warping window, which is set to 5 minutes, meaning that if the time difference between two behaviors is less than 5 minutes, they are considered alignable behaviors.

[0032] After the behavior sequence is normalized, a Conditional Random Field (CRF) algorithm is used for sequence modeling and inference analysis. In the modeling phase, the system trains a CRF model based on historical normal behavior data. The modeling objective is to maximize the joint probability of the entire behavior sequence and learn the conditional probability distribution of each behavior under its preceding and following contexts. In the inference phase, the system calculates the conditional probability of each behavior node in the current behavior sequence under the trained model and outputs a probability sequence of the same length as the behavior sequence. If the conditional probability of a behavior node is lower than a set threshold, it is considered an abnormal behavior that does not conform to normal behavior patterns.

[0033] The process of setting the conditional probability threshold is as follows: During the training phase, the conditional probability distribution of each behavior in a typical context is statistically analyzed from normal behavior samples. The mean and standard deviation of this distribution are calculated, and the threshold is set to the mean minus 0.3 times the standard deviation. This setting ensures that approximately the lowest 15% of the probability values ​​in the behavior distribution are identified as anomalies, balancing recognition sensitivity and false alarm rate. For example, if the mean conditional probability of behaviors in the training data is 0.85 and the standard deviation is 0.1, then the final threshold is set to 0.85 minus 0.03, resulting in 0.82. During the inference phase, any behavior node with a conditional probability lower than 0.82 is marked as an abnormal behavior.

[0034] The system then aggregates all marked anomalous behavior nodes according to their temporal continuity. If multiple anomalous behaviors occur within a time interval of 3 minutes, they are considered to belong to the same anomalous behavior region. The boundary range of the anomalous behavior is defined by starting with the first anomalous behavior and ending with the last. Based on the node numbers involved in the boundary range, the system extracts these nodes and their upstream and downstream one-hop adjacent nodes from the original node dependency graph to form a subgraph. All related edges are also extracted simultaneously, forming the subgraph representation corresponding to the anomalous behavior.

[0035] Based on the subgraph representation, the system employs a graph clustering algorithm optimized by modularity for node grouping. The clustering algorithm first calculates the modularity index of the subgraph; a higher modularity indicates a clearer community structure within the graph. The algorithm aims to maximize modularity by iteratively adjusting the node grouping labels, ultimately converging to a set of node groups with optimal modularity. Each group represents a set of nodes that are highly related in behavior.

[0036] After acquiring node groups, the system analyzes the strength of dependencies between nodes within and between groups. The dependency strength calculation includes three dimensions: First, communication frequency, counting the number of communications between two nodes; more than 10 communications are considered high-frequency connections. Second, behavioral similarity; if two nodes perform the same type of operation and occur in adjacent time periods, 1 point is awarded. Third, time interval stability; if the time difference between the actions of two nodes fluctuates within 2 minutes within 5 minutes, 1 point is awarded. The three scores are added together, with a total score of 3 being the highest. Node pairs with a total score higher than 2 points are considered to have strong dependencies. Based on the dependency strength score, the system updates the node dependency graph, increasing the edge weight between strongly dependent node pairs to 1 and decreasing the edge weight between weakly dependent node pairs to 0.3. Edges with a score less than 1 point are removed. This results in a dynamically updated node dependency graph, serving as the source-tracing output for this round of abnormal behavior, ensuring the structure reflects the true dependencies and improving the accuracy and reliability of subsequent tracking and analysis.

[0037] S3 includes: acquiring labeled data from error region boundaries; extracting multi-level dependencies using a data traversal method to obtain a hierarchical representation of the dependencies; constructing a Bayesian network model based on the hierarchical representation of the dependencies; inferring the conditional probability of error types to obtain the probability distribution of error types as lost or tampered; filtering the probability distribution using a preset threshold; if the conditional probability is lower than the preset threshold, it is marked as an abnormal error type, resulting in a set of abnormal error types; extracting the corresponding error boundaries from the set of abnormal error types; dividing the node associations within the error boundaries using a graph segmentation method to obtain a subset of node associations; analyzing the dependency strength between nodes based on the subset of node associations; calculating the distribution of dependency strength using a weighted average method to obtain a quantitative representation of dependency strength; if the dependency strength is lower than the preset threshold, it is determined to be a weak dependency, obtaining a set of nodes with weak dependencies; extracting the associated labeled data from the set of nodes with weak dependencies; generating the source path of the error type using a data aggregation method to obtain a sequence representation of the source path.

[0038] In this implementation, the system first retrieves the marked abnormal behavior nodes from the defined error region boundaries as labeling data. This labeling data includes the abnormal node's unique identifier, behavior timestamp, behavior type, field characteristics, and information about its upstream and downstream directly related nodes. The system then uses a data traversal method, starting from the abnormal node and expanding backward and forward layer by layer along the directed edges in the graph structure. At each layer, the system retrieves the previous and next hop dependent nodes, constructing a complete multi-level dependency path. This process is implemented recursively. During the traversal, the dependency node numbers at each layer and their dependencies with the previous layer are recorded as a hierarchical mapping table, ultimately resulting in a complete dependency hierarchy representation structure. The first layer consists of abnormal nodes, the second layer of their direct dependent nodes, and so on. Each layer contains node numbers and the corresponding dependency path structure.

[0039] After obtaining the dependency hierarchy representation, the system constructs a Bayesian network model based on this structure. The model construction process includes three parts: variable node definition, dependency structure setting, and conditional probability learning. First, each node appearing in the dependency path is defined as a random variable node in the Bayesian network, and the value of this variable indicates whether the node's behavior state is erroneous. Second, based on the upstream and downstream connections of each layer in the dependency hierarchy representation structure, directed edges are constructed in the Bayesian network, forming an acyclic directed graph structure. Third, the system statistically analyzes the frequency of different error types under various dependency structures in historical error behavior sample data to calculate the conditional probability when the node behavior is "missing" or "tampered with." For example, if the statistics show that the probability of a missing error is 0.7 and a tampering error is 0.2 under a certain dependency structure, with the rest being normal, the system uses this as the conditional probability distribution for that structure. The Bayesian network model makes inferences based on this probability structure. After inputting the currently observed abnormal node label data, it outputs the conditional probability that the node belongs to "missing" or "tampered" under the current dependency structure.

[0040] The Bayesian inference results are then filtered to determine if any anomalous error types exist. The criterion is as follows: if the conditional probability of an error type at a node is lower than a set threshold, the node is considered to have a risk of structural incompleteness, abnormal dependencies, or information disturbance, and is thus classified as an anomalous error type. This conditional probability threshold is set at 0.4. It is determined as follows: in large-scale sample analysis, the mean of the conditional probability distribution of all normal error types (i.e., error types that the system model can accurately predict) is 0.75, and the standard deviation is 0.1. Therefore, the threshold is set as the mean minus 0.35, i.e., 0.75 minus 0.35 equals 0.4. This threshold effectively identifies low-confidence error types while avoiding mislabeling within the normal fluctuation range, thus achieving high identification sensitivity and accuracy.

[0041] After identifying the abnormal error type, the system extracts the corresponding error boundary from the Bayesian model, including all nodes marked as abnormal error types and their directly related upstream and downstream nodes. Subsequently, the system constructs a subgraph structure within the error boundary and uses a graph segmentation method to divide the nodes within this region. The graph segmentation algorithm adopts a minimum cut set-based approach. First, it calculates the edge weight for each edge in the subgraph, with the edge weight calculated as the interaction frequency between nodes multiplied by the behavior consistency score. The interaction frequency is calculated by dividing the number of interactions between node pairs in historical samples by the total number of records. The behavior consistency score is 1 when the operation types of two nodes are consistent and 0 when they are inconsistent. The system performs graph segmentation with the goal of minimizing the total weight of the cut edges, ultimately dividing the subgraph into several subsets, each subset being a locally structured structure with strong inter-node correlation.

[0042] For each node-related subset, the system further calculates the dependency strength between its internal nodes. Dependency strength is defined as the tightness of the relationship between node pairs, calculated using a weighted average method. The dependency strength value consists of three indicators: interaction frequency score, behavioral similarity score, and event time interval stability score. The interaction frequency score is calculated based on the proportion of node pairs appearing in the data; a frequency higher than 0.05 earns 1 point, otherwise 0 points. Behavioral similarity scores 1 point when the operation types are consistent, and 0 points when they are inconsistent. Event time interval stability refers to whether the standard deviation of the operation interval time of the node pair across multiple samples is less than 2 minutes; less than 2 minutes earns 1 point, and greater than 5 minutes earns 0 points. The sum of the three scores divided by 3 yields the final dependency strength value. The average dependency strength values ​​of all node pairs are then used as the quantitative representation of the dependency strength of that subset.

[0043] The quantified representation of dependency strength is compared with a threshold. If the average dependency strength value is below 0.5, the set of nodes is determined to be a set of weak dependencies. This threshold is set based on the fact that the average value of strong dependency samples in the tested network is 0.65, and the standard deviation is 0.1. Accordingly, the threshold is set to 0.65 minus 0.15, which equals 0.5, ensuring that weak dependency nodes can be accurately distinguished from secondary connections outside the main dependency chain.

[0044] Finally, the system extracts all nodes associated with the abnormal error type and their behavioral records from the set of weakly dependent nodes, and constructs a source tracing path for the error type using a data aggregation method. The data aggregation process includes three steps: selecting the path start point, organizing the node order, and generating the path. The path start point is the first node with a dependency strength greater than 0.7 in the forward reachable path of the abnormal node. Subsequently, intermediate nodes are arranged sequentially according to the dependency direction until the path terminates, forming an ordered sequence of nodes for the source tracing path. The final generated source tracing path sequence not only reflects the structural origin of the abnormal error type but also provides a basis for subsequent graph repair and edge weight adjustment. This source tracing path has a complete logical chain, a clear node order, and behavioral evidence support, providing direct support for attack behavior localization and evidence collection.

[0045] S4 includes: obtaining node context data from the error type probability distribution; grouping the context data using a clustering method to obtain a set of node context classifications; calculating the node weight for each classification based on the set of node context classifications; generating a weight distribution using a weighted average method to obtain a quantitative representation of the node weights; extracting the weight change trend from the quantitative representation of node weights; predicting the direction of weight change using a trend analysis method to obtain a predicted sequence of weight changes; adjusting the node connections in the source graph structure for the predicted sequence of weight changes if the predicted value exceeds a preset threshold to obtain an adjusted graph structure; extracting connectivity indicators from the adjusted graph structure; calculating the connectivity score using a graph analysis method to obtain a quantitative representation of the connectivity score; confirming the effectiveness of the graph structure adjustment based on the quantitative representation of the connectivity score if the score is higher than a preset threshold to obtain an optimized source graph representation; extracting node association paths from the optimized source graph representation; generating an error source tracing sequence using a path analysis method to obtain the final set of source tracing paths.

[0046] In this implementation, the system first obtains the context data of all identified nodes from the error type probability distribution generated in the previous stage. This context data includes, but is not limited to, the node's position number in the attack tracing graph, the specific behavior type undertaken by the node, the timestamp of the behavior, the number of incoming and outgoing edges of the node, the edge weights of all connected edges, the identifiers of its adjacent nodes, and the frequency information of the node's appearance in previous tracing paths. The system performs structured processing on the context information of each node, constructing a fixed-dimensional feature vector. The values ​​of each dimension are processed using standardization methods, such as normalizing edge weights to between 0 and 1, converting timestamps to relative time differences, and normalizing frequencies to the maximum value, to eliminate the influence of different scales on the clustering results. The system inputs all node feature vectors into the K-means clustering algorithm, setting the initial number of clusters to 10 and using Euclidean distance as the clustering distance metric. In each iteration, the cluster centers are updated and node categories are reassigned. The maximum number of iterations is set to 100, until the classification results stabilize or the iteration limit is reached, at which point the final clustering result is output. The result is a set of node context classifications, where each cluster category represents a group of nodes that exhibit high consistency in contextual features.

[0047] Next, the system calculates the node weights for each cluster. The weight of each node is determined by the following formula: weight equals the sum of the edge weights of all connected edges to that node, multiplied by its frequency in the most recent 10 rounds of path propagation, plus the inverse hierarchical score of the node's current level. The hierarchical value is defined as the inverse of the node's depth position in the graph, with the topmost node assigned a value of 5 and the bottommost node assigned a value of 1. Nodes closer to the graph source have larger hierarchical values, indicating a higher degree of dominance in path propagation. The weights of each node are averaged across all clusters to obtain the average weight value for each cluster, forming a quantitative representation of the node weights—a mapping table between a cluster number and its average weight value.

[0048] Based on the weight quantification results, the system further performs trend prediction processing on the node weights. The system uses a three-step moving average prediction method, taking the average weight value of each type of node in the current round and the previous two rounds as input, and calculating the difference between the weight in the current round and the average of the previous three rounds. If the direction of change is consistent for three consecutive rounds, and the change value exceeds 0.2, then the weight of that type of node is considered to have a significant trend. Each item in the prediction sequence represents the direction of weight change and its magnitude in future rounds for a type of node, used to subsequently determine whether the graph structure needs adjustment. The 0.2 change threshold is set based on the following logic: In historical experimental data, changes in classification weights less than 0.2 are insufficient to cause substantial impacts on structural connectivity or path changes; therefore, fluctuations less than 0.2 are considered normal, while fluctuations exceeding this range indicate that the structure may be unbalanced.

[0049] When the weight change of a certain type of node in the prediction sequence is greater than +0.2 or less than -0.2, the system triggers the graph structure adjustment mechanism. The system first extracts the entire set of nodes under that category and checks the objects and weights of the edges connecting each node. If the target node of the node's outgoing edge appears less than 3 times in the last 10 rounds of the path, and the current edge weight is less than 0.3, the system removes the edge connection. Simultaneously, the system searches for frequently co-occurring nodes in the node's historical interaction records. If no connection is established and both appear together in the historical path at least 5 times, a new connection edge is established between them, with an initial edge weight of 0.5. The edge weights of 0.3 and 0.5 are set based on the fact that the average edge weight of most effective connections in the sample graph structure is 0.45, with a standard deviation of 0.1. Edges below the mean of 0.15 are considered weak connections, and 0.3 is set as the lower limit for removal. Newly created edges are set slightly higher than the mean of 0.5 to increase their likelihood of participating in path construction in the early stages of graph updates.

[0050] After structural adjustments are completed, the system calculates the connectivity score for the newly generated graph structure. The connectivity score is quantified using two metrics: the first is the number of nodes in the largest connected subgraph divided by the total number of nodes in the graph, reflecting the overall connectivity of the graph structure; the second is the reciprocal of the average shortest path length between all nodes in the graph, indicating the compactness of path propagation. These two scores are weighted equally to obtain the total connectivity score. The system sets a connectivity confirmation threshold of 0.6. This value is derived from connectivity statistical analysis in multiple rounds of experiments. When the coverage of the largest connected subgraph is below 60%, most paths have broken or isolated nodes, and the reciprocal of the average path length is below the set threshold, indicating a decrease in information propagation efficiency. Therefore, 0.6 is set as the critical value for judging the success of structural optimization.

[0051] When the connectivity score is greater than or equal to 0.6, the system confirms the effectiveness of the graph structure adjustment in this round and saves the graph structure as the optimized source tracing graph representation for the current round. The system then performs path extraction on this optimized graph, starting from all nodes marked as abnormal or with significant weight changes. Using a depth-first traversal algorithm, it visits each node layer by layer along the dependency paths, recording all paths without loops. The endpoint of each path is a leaf node that cannot be further dependent on. The system normalizes the node order in each path to ensure the path direction matches the dependency direction and removes redundant paths. Finally, it outputs a set of error source tracing paths with a clear structure and complete logic, which is used as input data for subsequent error correction calculations, path comparisons, and attack event reconstruction.

[0052] S5 includes extracting key path sequences from the optimized graph representation, obtaining the associated paths between nodes using a graph traversal method, and obtaining a path sequence set; for the path sequence set, using semantic analysis methods to extract semantic layer information for each path, generating a semantic information set; extracting semantic features from the semantic information set, calculating the similarity between semantic features using a vector space model, and obtaining a consistency score set; for the consistency score set, if the score meets a preset threshold, confirming that the path has semantic integrity, and obtaining a complete path subset; extracting path association features from the complete path subset, grouping the paths using a clustering analysis method, and generating a path cluster set; for the path cluster set, integrating the paths within the cluster using a path fusion method, obtaining a reconstructed attack path set; extracting core paths from the reconstructed attack path set, verifying the logical consistency of the paths using a sequence analysis method, and obtaining the final attack path.

[0053] In this implementation, the system first obtains the key path sequence from the optimized source graph structure. Starting with nodes identified as abnormal or exhibiting significant weight changes, the system uses a depth-first traversal algorithm to recursively search downwards along the dependent edges of the graph, finding all reachable terminal nodes. Terminal nodes are those with no outgoing edges or whose outgoing edge weights are below 0.2. During the traversal, the system records the node numbers encountered, forming a path sequence. Each path is an ordered list of nodes, and all paths form a path sequence set. The system performs semantic analysis on each path in the path sequence set. First, it extracts key fields such as behavior type, operation object, resource name, access method, operation command, and behavior timestamp for each node in the path. Using template rules, it generates a unified semantic description text, such as "Node A performs operation C on target B at time T," forming a complete semantic expression sequence for the path. The set of semantic expressions for all paths constitutes the semantic information set.

[0054] Next, the system extracts features from the semantic information set, performs Chinese word segmentation on each semantic text sequence, removes stop words, and uses the Term Frequency-Inverse Document Frequency (TF-IDF) model to calculate the importance weight of each word, generating a semantic vector for each path with a uniform 300-dimensional dimension, which serves as the input to the vector space model. The system calculates the cosine similarity of the semantic vectors between each pair of paths, with similarity values ​​ranging from 0 to 1, where a value closer to 1 indicates greater semantic similarity. The similarity values ​​between all path pairs form a consistency score set. The system sets a semantic consistency threshold of 0.75, meaning that if the semantic similarity score between any two paths is greater than or equal to 0.75, the path pair is considered semantically consistent. This threshold setting is based on statistical analysis results. In a large number of real attack samples, after manually scoring the semantic consistency of different attack paths, it was found that paths with a similarity score above 0.75 accounted for over 85% of those with a manual consistency score of 4 or higher (out of 5). Therefore, 0.75 was set as the minimum score to ensure semantic similarity.

[0055] When a path pair meets the semantic consistency threshold, the system classifies these two paths into a subset of complete paths. The system then extracts structural feature parameters from this subset, including path length (i.e., number of nodes), the time span between the earliest and latest timestamps, the proportion of duplicate nodes in the path relative to the total number of nodes, and the proportion of nodes with the same operation type in the path, forming a feature vector. The system uses a hierarchical clustering algorithm for path clustering, employing a minimum distance merging strategy. In each iteration, it merges the two most structurally similar path clusters until all paths are grouped into K clusters. The optimal value of K is determined by maximizing the silhouette coefficient, ultimately generating a set of path clusters.

[0056] Perform a path fusion operation on each path cluster in the path cluster set. The fusion process includes three steps: First, merge the node sets of all paths within the cluster and remove duplicates to form a complete node set; second, if multiple edges exist between the same pair of start and end nodes on different paths, retain the edge with the largest edge weight and remove the remaining duplicate edges; third, fuse the timestamp information of all paths, taking the earliest start time and the latest end time among all paths as the time interval of the fused path, finally generating a fused path with a unified structure and integrated information. All fused paths constitute the set of reconstructed attack paths.

[0057] Based on this, the core path is extracted, and the criterion is the path containing the most nodes with critical operational behaviors. Critical operational behaviors include four categories: remote connection, privilege escalation execution, sensitive file access, and persistent injection. The system determines whether a node belongs to a critical operational behavior through behavioral field matching rules, with the number of critical nodes in the path serving as the selection criterion. The selected core path undergoes logical consistency verification. The system uses a sequence pattern matching algorithm to map the behavior types of path nodes to stages, sequentially mapping node operation types to the five stages of the attack stage model: detection, breach, diffusion, control, and propagation. If the mapped stage sequence is consistent with the standard order defined by the attack model, and there are no jumps or stage reversals, the path is deemed to have complete logical consistency.

[0058] S6 includes: obtaining abnormal node data from the reconstructed attack path; extracting node attribute sets using a graph traversal method to obtain an abnormal node dataset; analyzing the relationships between nodes using a backtracking algorithm based on the abnormal node dataset to generate a candidate node list for abnormal sources; obtaining network traffic data related to the nodes for the candidate node list, and determining network jitter if traffic fluctuations exceed a preset threshold, thus obtaining a subset of network jitter sources; extracting data features of the remaining nodes from the candidate node list, analyzing the matching degree between features and forgery patterns using a support vector machine algorithm to determine whether it is data forgery, thus obtaining a subset of forgery sources; generating a preliminary error source list by merging the subset of network jitter sources and the subset of forgery sources; verifying the logical consistency of the source nodes using a sequence analysis method for the preliminary error source list, thus obtaining a final error source list; extracting context data of the source nodes from the final error source list, grouping the source nodes using a clustering analysis method, and generating an abnormal source classification set.

[0059] In this implementation, firstly, all nodes identified as abnormal by the system are extracted from the reconstructed attack path set. This anomaly determination is based on the path structure analysis and behavior recognition results generated in the previous steps. Subsequently, the system collects attributes for each abnormal node using a graph traversal method, including all structural and semantic fields such as the node's behavior type, execution timestamp, operation object identifier, path sequence number, upstream and downstream node numbers, and their edge weights, constructing an abnormal node dataset. This dataset serves as the basis for subsequent error source analysis. The system further uses each abnormal node as a starting node and employs a backtracking algorithm to trace its dependent paths upstream, traversing all upstream nodes that can affect the node's behavior. The backtracking scope includes direct and indirect dependencies. After deduplicating the upstream nodes involved in all backtracking paths, a candidate node list for anomaly sources is formed.

[0060] For each node in the candidate node list, the system extracts its network traffic data during the attack, including the number of connections established per minute, average packet size, connection duration, data volume per communication, and peak transmission rate. The system employs a sliding window analysis method, setting the window width to 5 minutes and the step size to 1 minute, to statistically analyze the traffic fluctuation rate across all time slices. The fluctuation rate is calculated as the ratio of the difference in data volume between the current window and the previous window to the data volume of the previous window. An anomaly threshold for traffic fluctuation is set at 20%. If the fluctuation rate of a node exceeds 20% of the average for three consecutive sliding windows, it is identified as a network jitter node. This threshold is based on statistical analysis of normal transmission and abnormal bursts of behavior in large-scale real-world network scenarios, which can identify potential short-term abnormal transmission behavior while avoiding misjudging short-term fluctuations in normal business operations as anomalies.

[0061] For nodes not identified as network jitter, the system further extracts their behavioral features, including but not limited to the extraction results of operation command keywords, target resource characteristics, request path hierarchy, request packet to response packet ratio, source IP hopping frequency, and latency distribution of similar operations, forming a unified behavioral feature vector. This feature vector is input into a trained support vector machine model, which outputs a classification label indicating whether a node belongs to data forgery and its confidence score. The system sets a confidence threshold of 0.85 for forgery judgment; that is, only when the confidence score is higher than 0.85 is the node marked as a source node of data forgery, ensuring the accuracy of the identification results. This threshold was selected based on the results of cross-validation experiments and is the optimal value that balances classification accuracy and false positive rate, with an average identification accuracy of 93.4% on the training set.

[0062] The identified subsets of network jitter sources and forged sources are merged, and duplicate nodes are removed to form a preliminary list of error sources. For each node in the list, the system performs logical consistency verification based on the attack path structure. This involves considering the node's dependencies within the path and the phase order specified in the attack model (e.g., the probing phase should precede the penetration phase, and lateral movement should follow privilege escalation). The system uses phase mapping rules to verify whether there are logical errors in the node's behavior. If the node order violates the phase logic, it is removed. The remaining nodes form the final list of error sources.

[0063] Based on the final list of error sources, the system further extracts contextual behavior data for each node. This contextual data includes its co-occurrence frequency with other nodes, the proportion of nodes participating in the same operation session, shared resource invocation, and the relative position of behavior execution time. All information is standardized to form a feature vector. The system uses K-means clustering to cluster these feature vectors, with an initial cluster size K set to 5, a maximum number of iterations of 50, and Euclidean distance as the distance metric, ultimately forming a set of anomaly source classifications. This clustering step helps identify behavioral patterns of different error sources, providing a basis for subsequent source tracing and rollback, responsibility attribution, and strategy optimization.

[0064] S7 includes obtaining source-related data from the error source list, extracting key features using principal component analysis, and generating a feature dataset; if the dimension of the feature dataset meets the requirements after comparison with a preset dimension threshold, then the feature dataset is grouped using a clustering analysis method to obtain a grouped dataset; based on the grouped dataset, a graph embedding algorithm is used to generate node embedding vectors to obtain a node embedding set; node correlation data is extracted from the node embedding set, and if the node correlation data meets the requirements after comparison with a preset correlation threshold, then it is integrated into the source graph using a graph update algorithm to obtain an updated source graph; for the updated source graph, a topological sorting method is used to analyze the dependencies between nodes to obtain a dependency set; context data is extracted from the dependency set, and anomaly detection methods are used to identify anomalies in the context data to obtain an anomaly set; based on the anomaly set, a graph optimization algorithm is used to adjust the structure of the updated source graph to obtain a high-quality source graph.

[0065] In this implementation, the system first extracts the source-related data corresponding to each error source node from the error source list generated in the previous steps. This data contains multiple dimensions, including the upstream and downstream connection relationships of the node, the node connection frequency, the type of behavior performed by the node and its time interval, the protocol type used, the length of the communication data packet, and the structural position of the node in the attack path. These dimensions are combined to form an original feature vector, which is then input into the principal component analysis model for dimensionality reduction. Specifically, this process includes constructing a sample covariance matrix, performing eigenvalue decomposition, and selecting principal components with a cumulative contribution rate greater than or equal to 90% as key features. If the number of principal components is not less than fifteen, satisfying the system's preset dimensionality threshold condition, the feature dataset is considered to have sufficient information to support subsequent calculations. This fifteen-dimensional threshold is an empirical value determined through principal component analysis experiments on multiple attack graph datasets, ensuring both feature integrity and avoiding redundant information from affecting analysis efficiency.

[0066] After meeting the dimensionality threshold, the system uses a density-based clustering algorithm to group the feature dataset. The DBSCAN algorithm is selected for clustering, with a neighborhood radius of 0.3 and a minimum sample size of ten. Specifically, it searches for neighborhood points within a radius of 0.3 centered on any data point. If the number of neighborhood points is not less than ten, that point is considered the core point, and a cluster is formed. The DBSCAN clustering algorithm can effectively identify cluster structures of arbitrary shapes and handle noisy points, making it suitable for attacking the behavioral distribution characteristics of nodes. The radius and sample size parameters were determined through iterative experiments on real datasets, maximizing the separation of data points with dissimilar features and maintaining high clustering accuracy.

[0067] After clustering, the system constructs a subgraph structure based on each cluster and then performs graph embedding representation on the nodes within it. Graph embedding employs the DeepWalk method based on random walks, generating ten random walk paths for each node, with each path being forty steps long. An embedding vector for each node is generated by constructing a node sequence and training it using a skip-word model. The embedding vector dimension is set to 128 dimensions, representing a balance between graph structure representation accuracy and computational efficiency. The embedding vectors of all nodes form a node embedding set. The system then calculates the cosine similarity of all node pairs to evaluate the structural and semantic relationships between nodes. If the similarity value is not lower than 0.85, the node pair is considered to be related. This node association threshold is set after statistical analysis of the similarity of node pairs with dependencies in the historical graph structure, effectively filtering out truly dependent node pairs while avoiding structural noise interfering with the graph update process.

[0068] For node pairs that meet the correlation criteria, the system integrates them into the original attack tracing graph using a graph update algorithm. The integration process includes adding new nodes, updating edge connections between existing nodes, assigning weights to edges, and labeling dependency directions, ultimately forming an updated tracing graph structure. This updated graph structure is then analyzed for structural dependencies using a topological sorting method. Starting from the initial node, all dependency paths are sorted sequentially to generate a set of node dependencies for the entire graph. The system further extracts contextual information from this dependency set, such as node path depth, consistency of execution order of behavioral nodes, path span, and time consistency. This information is standardized and then input into the anomaly detection module for judgment.

[0069] The anomaly detection module employs the Isolation Forest algorithm to partition the sample space using several random binary trees, identifying anomalies. The system sets an anomaly score threshold of 0.65; if the anomaly score of a node or path exceeds this threshold, it is marked as an anomaly and added to the anomaly set. This threshold is determined based on statistical results of the historical distribution of anomaly behavior node scores, accurately identifying low-frequency anomalies while avoiding misjudgments of normal nodes. Finally, the system performs structural adjustments on the nodes in the anomaly set. Specific methods include weakening the edge weights of anomaly nodes, removing redundant connections, reconstructing path structures with jump dependencies, and performing local optimization on critical paths when necessary. This graph structure optimization process ensures that the final high-quality source graph possesses characteristics such as clear structure, accurate dependencies, complete path loops, and minimized error points, providing an accurate and reliable graphical foundation for subsequent attack chain analysis and emergency response.

[0070] S8 includes obtaining a complete event sequence from the attack attribution graph, calculating event sequence features using sequence alignment methods to obtain a feature sequence set; classifying sequence features using a support vector machine algorithm based on the feature sequence set, determining whether the classification results meet a preset reliability threshold, and identifying a reliable feature subset; if the reliable feature subset meets the preset threshold, extracting a set of defense criteria using sequence alignment methods to obtain a preliminary defense criteria set; based on the preliminary defense criteria set, analyzing the attack path set using topology analysis methods to determine the path priority sequence; extracting event timestamps from the path priority sequence, detecting timestamp anomalies using time series analysis methods to obtain an abnormal time point set; if the abnormal time point set is not empty, adjusting the node correlation of the attribution graph using a graph update algorithm to obtain an updated attack path set; and generating a set of response criteria supporting a rapid response based on the updated attack path set to determine the final response criteria set.

[0071] In this implementation, the system first extracts a complete event sequence from the constructed attack attribution graph. This sequence consists of node behaviors from all attack paths arranged in ascending order of timestamps. Node behavior data includes the specific operation type triggered by each node, the trigger time, upstream and downstream dependent nodes, the execution result, and its topological position in the graph. The system traverses all attack paths in the graph using a breadth-first search algorithm, generating a complete event sequence sorted by time. Subsequently, the system applies a sequence alignment algorithm to this sequence to extract event features, specifically using edit distance calculation to evaluate the minimum number of transformation operations between behaviors in each event sequence, including insertion, deletion, and replacement operations. By mapping each sequence to a fixed-length vector, the system extracts a set of feature vectors comprising multiple dimensions such as behavior length, behavior transformation frequency, abnormal behavior ratio, and key node distribution density, forming a feature sequence set.

[0072] The feature sequence set is input into a support vector machine (SVM) classification model, which is trained on a large number of labeled historical attack paths and normal paths. For each feature vector, the model outputs its classification result and a confidence score. The system sets a confidence threshold of 0.75, meaning that only sequences identified as attack paths with a confidence score of not less than 0.75 are included in the trusted feature subset. This threshold is set after cross-validation on multiple real sample sets, selecting a confidence threshold that maximizes recall while maintaining a false positive rate of less than 0.15, ensuring that the retained sequences have high confidence and low noise discrimination capabilities. For this trusted feature subset, the system performs sequence alignment again to identify common behavioral features, such as frequently occurring operation patterns, commonly dependent upstream nodes, and similar operation time intervals. The results are extracted as a preliminary defense basis set, recording key behavioral nodes, inter-node dependency patterns, and path entry features.

[0073] Next, the system employs topology analysis to analyze the attack path structure corresponding to the preliminary defense basis set. The topology analysis process includes performing node connectivity analysis, path depth analysis, key node count statistics, and calculating the average degree of nodes within each path for each path, thereby constructing a path priority scoring model. The scoring criteria are set as follows: the proportion of key nodes in the path has a weight of 0.4, the path length has a weight of 0.3, and the frequency of the path's starting node in historical attacks has a weight of 0.3. The system calculates the total score for each path and generates a ranking, forming a path priority sequence. Subsequently, the system extracts the timestamp information of all nodes from this sequence, assembling a time series and performing fluctuation analysis. The analysis method is sliding window detection, with a window size set to 5 events. If the maximum and minimum time difference within the window exceeds twice the average time interval of the entire sequence, the event at the center of the window is marked as an abnormal time point. This threshold is based on the experimental finding that time fluctuations exceeding twice the average often correspond to forged, inserted, or abnormally triggered attack behaviors; therefore, setting twice as the boundary can maximize the identification of atypical behaviors and avoid false alarms.

[0074] If the set of abnormal time points is not empty, the system adjusts the connection structure of the nodes before and after the abnormal points using a graph structure update algorithm based on the path position of the abnormal points. Update methods include adding reasonable but missing dependency edges, deleting isolated edges, and reweighting nodes, forming an updated set of attack paths. After the update, the system uses the new path set as a basis to perform path structure comparison analysis and key behavior matching, generating a set of defense suggestions supporting rapid response, including path blocking strategies, node isolation actions, and time window restriction strategies, which are then summarized into the final response basis set.

[0075] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. A method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction, characterized in that, include: S1. By obtaining raw network traffic and parsing logs from multi-source heterogeneous data, a graph neural network algorithm is used to construct an initial attack tracing graph structure, resulting in a preliminary graph representation containing the dependencies between nodes. S2. Based on the node dependencies in the preliminary graph representation, obtain the missing data layer field information and the logical layer behavior sequence. Use the conditional random field algorithm to determine the correlation between the missing fields and the behavior sequence. If the correlation is lower than the preset threshold, mark it as a potential error area and determine the boundary of the error area. S3. Obtain labeled data from the boundary of the error region, traverse the multi-level dependencies within the labeled data, and use the Bayesian network algorithm to infer the error type distribution to obtain the error type probability distribution. S4. Based on the error type probability distribution, obtain the relevant node context data, adjust the traceability graph structure by iteratively updating the node weights, determine the graph connectivity after weight adjustment, and if the connectivity is improved, confirm that the adjustment is effective and determine the optimized graph representation. S5. Extract the critical path sequence from the optimized graph representation, verify the semantic layer information within the path sequence, obtain the semantic consistency score, determine whether the score meets the integrity requirements, and if it does, output the path that passes the verification to obtain the complete attack path reconstruction. S6. Reconstruct the complete attack path, obtain abnormal node data in the path, locate the source of the anomaly through the backtracking algorithm, determine whether the source is due to network jitter or forgery, and determine the list of error sources.

2. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 1, characterized in that: S1 includes: By acquiring network traffic and parsing logs from multi-source heterogeneous data, and processing them using standardized protocols, a unified format of traffic characteristics and log structure is obtained. A graph neural network algorithm is used to embed nodes into traffic features and log structure to obtain an initial graph representation of the dependencies between nodes; If the node connection strength represented by the initial graph is lower than a preset threshold, then highly relevant nodes are filtered through topology analysis to obtain an optimized attack tracing graph. Based on the optimized attack source map, a clustering algorithm is used to group the nodes to obtain a preliminary classification of the attack paths; By initially classifying attack paths, analyzing the dependencies between nodes, and using association rule mining, the key nodes for attack tracing are identified. If the dependencies of critical nodes match the preset attack pattern, then the temporal characteristics of the attack events are extracted through time series analysis to obtain the complete sequence of attack tracing. Based on the complete sequence of attack attribution, a dynamically updated graph of node dependencies is generated to obtain real-time attack attribution results.

3. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 1, characterized in that: S2 includes: The missing field information is obtained from the node dependency relationship, and the data layer fields are completed using a standardized processing method to obtain the completed field set; Based on the completed field set, extract the logical layer behavior sequence and generate a normalized representation of the behavior sequence using the sequence alignment method; For the normalized representation of the behavior sequence, the conditional random field algorithm is used to calculate the conditional probability of each behavior in the sequence, and the probability distribution of the behavior sequence is obtained. If there is a conditional probability below a preset threshold in the probability distribution of the behavior sequence, then the corresponding behavior is marked as an abnormal behavior, and the boundary range of the abnormal behavior is determined. Based on the boundary range of the abnormal behavior, the associated subgraph structure is extracted from the node dependency relationship to obtain the subgraph representation corresponding to the abnormal behavior; For the subgraph representation, a graph clustering method is used to group the nodes to obtain the grouping results of nodes with abnormal behavior; Based on the node grouping results, the strength of the dependency relationships between nodes is analyzed, a dynamically updated node dependency graph is generated, and the source tracing results of abnormal behavior are obtained.

4. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 1, characterized in that: S3 includes: The labeled data is obtained from the boundary of the error region, and the multi-level dependency relationship is extracted by the data traversal method to obtain the hierarchical representation of the dependency relationship; Based on the hierarchical representation of dependencies, a Bayesian network model is constructed to infer the conditional probability of error types, and the probability distribution of error types as loss or tampering is obtained. For probability distributions, a preset threshold is used for filtering. If the conditional probability is lower than the preset threshold, it is marked as an abnormal error type, thus obtaining a set of abnormal error types. From the set of abnormal error types, extract the corresponding error boundaries, and use a graph partitioning method to divide the node associations within the error boundaries to obtain a subset of node associations; Based on the subsets of node associations, the dependency strength between nodes is analyzed, and the distribution of dependency strength is calculated using a weighted average method to obtain a quantitative representation of dependency strength. For the quantitative representation of dependency strength, if the dependency strength is lower than a preset threshold, it is determined to be a weak dependency relationship, and the set of nodes with weak dependencies is obtained. From a set of nodes with weak dependencies, we extract associated labeled data, use data aggregation methods to generate source paths for error types, and obtain a sequence representation of the source paths.

5. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 1, characterized in that: S4 includes: Node context data is obtained from the error type probability distribution, and the context data is grouped using a clustering method to obtain a set of node context classifications. Based on the classification set of the node context, calculate the node weight for each category, and generate the weight distribution using a weighted average method to obtain a quantitative representation of the node weight; The trend of weight change is extracted from the quantified representation of node weights, and the trend analysis method is used to predict the direction of weight change, thus obtaining the predicted sequence of weight change. For a predicted sequence with weight changes, if the predicted value exceeds a preset threshold, the node connections in the source graph structure are adjusted to obtain the adjusted graph structure. Connectivity indices are extracted from the adjusted graph structure, and graph analysis methods are used to calculate connectivity scores to obtain a quantitative representation of the connectivity scores. Based on the quantitative representation of connectivity score, if the score is higher than the preset threshold, the graph structure adjustment is confirmed to be effective, and an optimized source graph representation is obtained. Node association paths are extracted from the optimized source graph representation, and error source sequences are generated using path analysis methods to obtain the final source path set.

6. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 1, characterized in that: S5 includes: Extract the key path sequence from the optimized graph representation, and use the graph traversal method to obtain the associated paths between nodes to obtain a set of path sequences. For the set of path sequences, semantic analysis methods are used to extract the semantic layer information of each path and generate a semantic information set; Semantic features are extracted from the semantic information set, and the similarity between semantic features is calculated using a vector space model to obtain a set of consistency scores. For a set of consistency scores, if the score meets a preset threshold, the path is confirmed to have semantic integrity, and a subset of complete paths is obtained. Path association features are extracted from a subset of complete paths, and paths are grouped using cluster analysis to generate a set of path clusters. For a set of path clusters, a path fusion method is used to integrate the paths within the clusters to obtain a reconstructed set of attack paths; The core path is extracted from the reconstructed attack path set, and the path logic consistency is verified by sequence analysis to obtain the final attack path.

7. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 1, characterized in that: S6 includes: Abnormal node data is obtained from the reconstructed attack path, and the node attribute set is extracted using a graph traversal method to obtain the abnormal node dataset. Based on the abnormal node dataset, a backtracking algorithm is used to analyze the relationships between nodes and generate a list of candidate nodes for the source of the anomaly. For the candidate node list, obtain the network traffic data related to the node. If the traffic fluctuation exceeds the preset threshold, it is judged as network jitter, and the subset of network jitter sources is obtained. Extract the data features of the remaining nodes from the candidate node list, use the support vector machine algorithm to analyze the matching degree between the features and the forgery pattern, determine whether it is data forgery, and obtain the forgery source subset; By merging subsets of network jitter sources and subsets of spoofed sources, a preliminary list of error sources is generated; For the initial list of error sources, sequence analysis is used to verify the logical consistency of the source nodes, thus obtaining the final list of error sources. The context data of the source nodes are extracted from the final list of error sources, and the source nodes are grouped using cluster analysis to generate an anomaly source classification set.

8. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 1, characterized in that, It also includes S7, retrieving source-related data from the error source list, performing recovery operations on the related data, filling in missing parts using interpolation methods, judging the consistency of the recovered data, and if the consistency meets the standard, integrating it into the source graph to obtain the final attack source graph, specifically including: Obtain source-related data from the error source list, extract key features using principal component analysis, and generate a feature dataset. If the dimension of the feature dataset meets the requirements after comparison with the preset dimension threshold, then the feature dataset is grouped by cluster analysis to obtain the grouped dataset. Based on the grouped dataset, a graph embedding algorithm is used to generate node embedding vectors, resulting in a node embedding set. Node correlation data is extracted from the node embedding set. If the node correlation data meets the requirements after comparison with the preset correlation threshold, it is integrated into the source graph through the graph update algorithm to obtain the updated source graph. For updating the source graph, a topological sorting method is used to analyze the dependencies between nodes to obtain a dependency set; Context data is extracted from the dependency set, and anomalies in the context data are identified using anomaly detection methods to obtain an anomaly set. Based on the set of outliers, a graph optimization algorithm is used to adjust and update the structure of the source graph to obtain a high-quality source graph.

9. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 8, characterized in that, This also includes S8, obtaining the complete event sequence from the final attack source map, verifying the reliability of the defense basis through sequence comparison, determining whether the verification results support a rapid response, and determining the set of response basis, specifically including: The overall event sequence is obtained from the attack attribution graph, and the event sequence features are calculated using sequence alignment methods to obtain a feature sequence set; Using the feature sequence set, the support vector machine algorithm is used to classify the sequence features, determine whether the classification result meets the preset reliability threshold, and determine the reliable feature subset; If the reliable feature subset meets the preset threshold, the defense basis set is extracted by sequence alignment method to obtain the preliminary defense basis set; Based on the initial defense criteria set, the attack path set is analyzed using topology analysis to determine the path priority sequence.

10. The method for redundant fragment calculation verification and edge loss recovery error correction in attack tracing graph construction according to claim 9, characterized in that: S8 further includes: Event timestamps are extracted from the path priority sequence, and time series analysis methods are used to detect timestamp anomalies to obtain a set of abnormal time points; If the set of abnormal time points is not empty, the correlation between nodes in the source graph is adjusted by the graph update algorithm to obtain the updated attack path set; Based on the updated attack path set, generate a set of response criteria supported by the rapid response, and determine the final set of response criteria.

Images