Security situation visualization system for ship network multi-modal data fusion

Abstract

The invention relates to a ship network multi-modal data fusion security situation visualization system, which comprises an edge layer, a collaboration layer and a central analysis layer, and is characterized in that the edge layer is used for locally acquiring and processing data, locally operating a model to perform anomaly detection, feature extraction and threat association analysis, and calculating gradient information update; the collaboration layer is used for initializing a model and distributing the model to each edge node, collecting gradient information update of each edge node, aggregating all gradient information update, generating a new model, and distributing the new model back to each edge node; and the central analysis layer is used for obtaining the index data formed after aggregation of the collaboration layer and carrying out visual display. Through the system, the core contradiction between data privacy and sharing is solved, data sharing is realized under the condition of ensuring data privacy, and the system has the advantages of enhancing the real-time response and defense capability of an edge side, reducing the risk and operation cost of a centralized framework and the like.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of ship system safety, in particular to a ship network multi-modal data fusion security situation visualization system. BACKGROUND

[0002] In the field of ships, in the process of security situation visualization of ship network, sensors, probes, log collectors (such as Syslog, NetFlow), security information and event management (SIEM) systems, etc. are used to collect massive raw data from multiple dimensions such as network, host, application, terminal, cloud, industrial control system, etc. Data types include asset data, vulnerability data, threat intelligence, security logs, user behavior data, network traffic data, etc. for data collection and fusion to provide comprehensive, multi-source data basis for subsequent analysis. Then, using Hadoop, Spark, etc. big data processing framework, massive, heterogeneous, high-speed data collected is cleaned, stored, associated and preliminarily processed. This is the basis for analyzing and processing big data in the face of data flood in complex scenarios such as industrial internet. Artificial intelligence and machine learning are used to provide key driving force for current situation awareness capability. For example: anomaly behavior detection, using unsupervised learning (such as clustering, isolation forest) or supervised learning model, establishing user, device or network normal behavior baseline, automatically identifying abnormal activities deviating from the baseline; threat detection and classification, applying deep learning (such as neural network), natural language processing (NLP) to analyze threat intelligence and logs, identifying known and unknown attack patterns (such as APT attack, ransomware); predictive analysis, using time series analysis, prediction model, etc. based on historical data and current situation, predicting future possible attack trends and risk points. Integrating internal and external threat intelligence sources (such as IP, domain name, file hash, attack TTPs), and correlating with internal data for analysis, achieving rapid identification and tracing of attackers, attack tools and attack methods, and threat intelligence analysis. Based on the collected and analyzed data, the overall security state of the network (such as risk score, security index) is comprehensively evaluated, the threat level faced by key assets is identified, and the future security situation development trend is predicted. Finally, using data visualization technology (such as heat map, topology map, timeline, 3D visualization, dashboard), complex network security situation (such as attack path, risk distribution, threat map) is intuitively presented to security operation personnel and decision makers, assisting in quick understanding and decision making, and realizing situation visualization.

[0003] The existing security situation visualization process has the following defects: Technology integration and compatibility issues arise in environments such as the Industrial Internet, which involve a large number of heterogeneous devices, systems, and protocols (such as OT / IT convergence). Seamlessly integrating situational awareness technology with big data, AI, IoT, and other technologies presents problems of incompatibility in interfaces, protocols, and data formats, leading to complex system integration and high maintenance costs.

[0004] The complexity and diversity of security threats, the increasingly sophisticated and covert attack methods (such as APTs, zero-day attacks, and supply chain attacks), and the ever-expanding attack surface (cloud, endpoint, and edge) mean that existing technologies have limited ability to identify new and unknown threats, and false positives and false negatives still exist, making it difficult to fully cope with the dynamically evolving threat environment.

[0005] Data security and privacy protection are critical issues. Situational awareness relies on the collection and analysis of massive amounts of data, which may contain sensitive business data and personal privacy information. Ensuring data security during collection, transmission, storage, and processing, while effectively utilizing data for security analysis and complying with increasingly stringent privacy regulations (such as GDPR and China's Personal Information Protection Law), is a major challenge. Situational awareness capabilities are insufficient. In terms of depth and breadth, some systems lack sufficient awareness of underlying networks and devices, especially in the OT (Operational Technology) domain, making it difficult to obtain sufficiently granular data. Regarding real-time performance and accuracy, achieving real-time and accurate analysis and early warning under massive data volumes remains challenging, as analysis delays can affect response speed. In terms of proactive defense capabilities, most systems still focus on "perception" and "alarms," ​​and the linkage and closed-loop handling capabilities with Automated Response and Alarm System (SOAR) need to be strengthened.

[0006] The shortage of security talent and insufficient public awareness highlight the critical need for cybersecurity situational awareness systems to be effectively configured, analyzed, interpreted, and responded to by professionals. Currently, there is a severe shortage of personnel with expertise in both cybersecurity and data analysis / AI. Furthermore, enterprises' overall security awareness and understanding of the value of situational awareness need to be improved.

[0007] High costs and investment are required to build and maintain a comprehensive and efficient situational awareness platform. This requires huge investments in capital, technology and human resources, making it a high barrier to entry for small and medium-sized enterprises. Summary of the Invention

[0008] This invention proposes a security situation visualization system for ship network multimodal data fusion, which solves one or more of the above-mentioned problems.

[0009] To achieve the above objectives, the present invention provides the following technical solution: A security situation visualization system for ship network multimodal data fusion includes an edge layer, a collaboration layer, and a central analysis layer. At the edge layer, probes are deployed to collect data, and models are applied to perform preliminary anomaly detection and feature extraction, and gradient information is calculated and updated. In the collaboration layer, a server is set up to initialize the model and distribute it to each edge node. The server periodically collects the encrypted gradient information updates uploaded by each edge node, uses a secure aggregation algorithm to aggregate all gradient information updates, generates a new model, and distributes the updated model back to each edge node. The central analysis layer acquires and visualizes the indicator data aggregated from the collaboration layer to support macro-level decision-making.

[0010] In some implementations, the probe is a lightweight smart probe deployed at the network edge. The probe type may include a traffic probe or a log collection probe, and the data collected by the probe includes network traffic, device logs, and host behavior.

[0011] In some implementations... The model is a lightweight AI model; Based on local data and the current model, gradient information is calculated and updated. Local data can be data collected through deployed probes. The model has access to all global data. New data is used to optimize the model. Methods for calculating gradient information may include: deep optimization based on a self-controllable open-source computing framework, high-performance, highly scalable streaming computing, batch computing, and distributed retrieval capabilities, forming general-purpose batch computing frameworks and general data processing toolsets represented by MapReduce and Spark, and streaming computing and engineering processing toolsets represented by Flink, thereby providing distributed and secure analysis computing capabilities such as offline batch processing and real-time streaming processing.

[0012] In some implementations, global situation indicators include regional risk heatmaps and threat trends.

[0013] Compared with the prior art, the beneficial effects of the present invention are: This invention offers a groundbreaking solution to the conflict between data privacy and data sharing. Traditional centralized situational awareness relies on aggregating raw data, posing a significant risk of data leakage. Utilizing federated learning, this invention exchanges only encrypted model parameters (gradient updates), while raw, sensitive data (such as core business logs, user privacy information, and industrial control instructions) remains locally. This fundamentally resolves legal compliance concerns (such as GDPR and the Data Security Act) and trade secret worries related to data sharing, making it possible to establish security alliances between different enterprises and departments. It enables cross-organizational and cross-network domain threat intelligence collaboration while ensuring data privacy and security.

[0014] By breaking down "data silos" and enhancing global threat detection capabilities, this invention addresses the common problem of attackers exploiting vulnerabilities in the defenses of different systems for lateral movement. Through collaborative training, the local models of each participant can learn the characteristics of novel attack patterns encountered by other participants. For example, a new ransomware behavior pattern discovered by Company A can be indirectly "taught" to Company B's system through model updates, enabling earlier identification of similar attacks within Company B's network and achieving a "one-site discovery, global early warning" effect. This significantly enhances the ability to perceive and trace advanced, covert, and cross-domain attacks (such as APTs and supply chain attacks).

[0015] Enhance real-time response and autonomous defense capabilities at the edge. Lightweight AI models are deployed at the edge (such as factory gateways and campus firewalls) and can perform real-time analysis at the data source. Once a serious anomaly is detected (such as abnormal device commands or internal lateral scans), pre-defined response actions (such as blocking connections, isolating devices, and issuing alarms) can be executed immediately locally without waiting for central instructions. This significantly reduces the MTTR (Mean Time To Response), making it particularly suitable for industrial control systems (ICS) with extremely high real-time requirements. It achieves millisecond-level local threat detection and initial response, reducing reliance on a central platform and improving overall response speed.

[0016] This reduces the risks and operational costs of a centralized architecture by transmitting only much smaller model update parameters, rather than TB / PB-level raw logs and traffic data, significantly saving network bandwidth. The coordination server does not need to store raw data; it only processes model parameters, reducing storage costs and the risk of large-scale data breaches due to a compromised central database. It also reduces the pressure on transmitting, storing, and centrally processing massive amounts of raw data, lowering bandwidth consumption, central storage costs, and the risk of single points of failure / attacks.

[0017] The system enhances scalability and adaptability, allowing new participants (enterprises or departments) to join simply by deploying a standards-compliant lightweight probe and connecting to the collaborative network, without requiring large-scale modifications to existing IT / OT systems. Its lightweight design enables it to adapt to various edge environments, from high-performance servers to resource-constrained embedded devices. The system is easily scalable and can flexibly adapt to network environments of different sizes and resource capabilities.

[0018] This invention promotes the co-construction and joint prevention and control of a secure ecosystem, providing a feasible solution for establishing security cooperation based on "technological mutual trust" among different stakeholders. Government regulatory agencies, critical infrastructure operators, and security vendors can use this framework to jointly build stronger regional or industry-wide security defense networks, enhancing the resilience of the overall cyberspace. It provides a solid technical foundation for building industry-level, city-level, and even national-level cybersecurity joint prevention and control systems. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of a security situation visualization system for ship network multimodal data fusion provided in some embodiments of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0021] This embodiment proposes a security situation visualization system for ship network multimodal data fusion, including an edge layer, a federated layer, and a central analysis layer (optional).

[0022] The edge layer is used for local data collection and processing, local model running for anomaly detection, feature extraction and threat correlation analysis, and integrated updating of gradient information; The collaboration layer sets up a coordination server. The operation of the coordination server includes initializing the model and distributing it to each edge node, collecting gradient information updates from each edge node, aggregating all gradient information updates, generating a new model, and distributing the new model back to each edge node. The central analysis layer is used to visualize the indicator data.

[0023] Combination Figure 1 As shown, the security situation visualization system based on the multimodal data fusion of ship networks can perform the following operations: 1. Comprehensive data collection and access (the foundation of "sensory perception") Situational awareness is predicated on "visibility," requiring coverage of data across all scenarios, including networks, assets, threats, and business operations, to avoid "data silos" that create blind spots in perception.

[0024] Core objective: To achieve "full-domain data coverage" and ensure no omissions or delays.

[0025] Key technical details: Data source types (must be fully covered): Network layer: Traffic data (NetFlow / IPFIX, PCAP raw traffic), network device logs (router / switch / SDN controller logs), network security device logs (firewall, WAF, IDS / IPS, VPN, anti-DDoS device logs); Asset layer: System logs (Syslog, Windows Event Log), configuration information (system version, port, process), and patch status of servers / terminals / IoT devices; Application layer: Business system logs (API call logs, transaction logs, access logs), middleware logs (Tomcat, Nginx, database logs); Threat layer: External threat intelligence (IOC indicators: malicious IP / domain / hash, vulnerability intelligence CVE, attack group TTPs), internal threat data (abnormal account operations, sensitive data access records); Environment layer: cloud platform data (ECS cloud server, Kubernetes container logs, cloud security group configuration), industrial control scenario data (SCADA protocol logs, PLC device status).

[0026] Data acquisition technology: Real-time data collection: Millisecond / second-level data collection is achieved through Agent (lightweight terminal agent), probes (network traffic probes, log collection probes), and API interfaces (cloud platform / security device open APIs); Offline data collection: For non-real-time data (such as audit logs and historical backups), data is retrieved periodically via FTP / SFTP; Protocol compatibility: Supports general protocols (Syslog, SNMP, NetFlow v9 / v10, CEF) and proprietary protocols (such as industrial control Modbus, DNP3, and cloud vendor private APIs).

[0027] 2. Data preprocessing and standardization ("Sense" quality assurance) The raw data collected has problems such as "disorganized format, redundant noise, and missing or incomplete data", and needs to be preprocessed before it can be used for analysis.

[0028] Core objective: To improve data quality and achieve "data normalization," thereby removing obstacles for subsequent analysis.

[0029] Key technical details: Data cleaning: Remove dirty data (such as incorrect format, invalid values, duplicate logs), and complete missing fields (such as supplementing device names through reverse IP lookup). Data normalization: unify the log formats of different devices / systems into the platform standard format (such as a custom JSON structure), for example, map the different descriptions of "firewall blocking" and "WAF interception" to a unified "access denied" event type; Data enhancement: Supplementing contextual information, such as querying the IP's location through WHOIS, associating the device type corresponding to the IP in the asset database log ("192.168.1.100 → Core Database Server"), and marking whether the IP is malicious through threat intelligence ("1.2.3.4 → Ransomware C2 Server"). Data storage: A hybrid storage architecture is adopted (InfluxDB / Prometheus time-series databases store traffic / metric data, Elasticsearch document database stores log data, and MySQL relational database stores asset / configuration data), balancing query efficiency and storage cost.

[0030] 3. Multi-dimensional threat detection and correlation analysis (the core of "knowledge") This stage is the "brain" of situational awareness, which needs to identify "known threats" and "unknown threats" from massive amounts of data and reconstruct the attack chain (such as "phishing email → terminal infection → lateral movement within the internal network → data leakage").

[0031] Core objective: To achieve "accurate threat identification and attack scenario reconstruction" and avoid false positives and false negatives.

[0032] Key technical details: Known threat detection (feature matching): Rule Engine: Detects known attacks based on predefined rules (such as Snort rules and custom log matching rules), such as "'xp_cmdshell' call appears in the log and the source is not an administrator IP → suspected SQL injection privilege escalation"; Signature detection: Quickly locate known malicious behaviors by matching malicious code signatures (MD5 / SHA256) and malicious IP / domain blacklists (threat intelligence IOC).

[0033] Unknown threat detection (anomaly analysis): Behavioral baseline modeling: Establish a "normal behavior baseline" based on historical data (such as user login time range, server traffic peak, terminal process list). Deviating from the baseline will trigger an alarm (e.g.: "Employee account logged in from an overseas IP at 3 a.m. → abnormal login"). Machine Learning / Deep Learning: Unsupervised learning (such as K-Means clustering and Isolation Forest): used to discover unlabeled anomalies (such as unknown malicious traffic patterns and abnormal data transmission); Supervised learning (such as random forests and CNNs): Models are trained based on labeled attack samples to detect new variant threats (such as the file encryption behavior of ransomware). Deep learning (such as LSTM): used for anomaly detection in time-series data (such as traffic and log sequences) to identify long-term, covert attacks (such as slow data theft in APT attacks).

[0034] Threat correlation analysis: Multi-source data association: By using key fields such as "time, IP, account, asset ID", scattered logs / events are linked into an attack chain (e.g., "malicious process of terminal A → abnormal connection between terminal A and server B → export of sensitive files from server B → large-volume data transmission through the egress firewall"). Attack chain modeling: Based on the MITRE ATT&CK framework (attack tactics and techniques matrix), detected events are mapped to the "initial access → execution → persistence → lateral movement → data leakage" stages of ATT&CK to reconstruct the attack path and determine the attack intent.

[0035] 4. Situation assessment and visualization (support for "decision") By combining detected threats with asset importance, the current security posture is quantified and presented in an intuitive way to help administrators quickly understand the risks.

[0036] Core objective: To achieve "quantifiable, visualized, and understandable situational awareness" to support decision-making priorities.

[0037] Key technical details: Situational quantitative indicators: Threat dimensions: Threat level (high / medium / low, based on CVSS score and attack impact range), number of threats (real-time alerts, cumulative attack count), and threat type distribution (percentage of ransomware / phishing / injection attacks). Asset Dimension: Asset Risk Value (core assets × threat level weighted, e.g., "core database + high-risk vulnerability = risk value 90"), Asset Affected Ratio (number of attacked assets / total assets). Protection dimensions: vulnerability remediation rate (number of patched vulnerabilities / total number of vulnerabilities), alarm response timeliness (average response time).

[0038] Visualization format: Macro-level situation: Network topology map (marking attacked nodes and threat propagation paths), security situation dashboard (real-time risk values, top threat types, and core asset status), heat map (displaying threat density by region / asset type); Micro-level details: Attack chain timeline (showing the sequence of events at each stage of the attack), threat details page (including IOC, attack source, affected assets, and remediation recommendations), and report export (daily / weekly reports, including situation trends and remediation status).

[0039] Participants (enterprises or departments) only need to deploy the corresponding probes to access the collaborative network and form edge nodes.

[0040] All of the above-mentioned undisclosed matters can be implemented using existing technologies, so they will not be elaborated here.

[0041] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0042] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

[0043] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A secure posture visualization system for ship network multi-modal data fusion, characterized in that, The edge layer, the collaborative layer and the central analysis layer are included, The edge layer is used for local collection and processing of data, local running of a model for anomaly detection, feature extraction and threat correlation analysis, and calculation of gradient information update; The collaborative layer is used for initialization of the model and distribution to each edge node, collection of gradient information update of each edge node, aggregation of all gradient information updates, generation of a new model, and distribution of the new model back to each edge node; The central analysis layer obtains index data formed after aggregation of the collaborative layer for visual display.

2. The security situation visualization system of ship network multi-modal data fusion according to claim 1, wherein The edge layer includes probes deployed at network edges of each participant, and operations performed by the probes include local collection and processing of data, local running of a model for anomaly detection, feature extraction and threat correlation analysis, and calculation of gradient information update; Aggregation of all gradient updates adopts a secure aggregation algorithm; The index data includes a regional risk heat map and a threat trend.

3. The secure situation awareness visualization system for ship network multi-modal data fusion of claim 2, wherein, Types of data sources include: Network layer: traffic data, network device logs, network security device logs; Asset layer: system logs, configuration information and patch status of associated devices; Application layer: business system logs and middleware logs; Threat layer: external threat intelligence and internal threat data; Environment layer: cloud platform data and industrial control scene data.

4. The secure situation awareness visualization system for ship network multi-modal data fusion of claim 2 or 3, wherein, Data collection approaches include real-time collection, offline collection and protocol adaptation.

5. The secure situation awareness visualization system for ship network multi-modal data fusion of claim 1 or 2, wherein, The data processing process includes the following steps: Data cleaning; Data normalization; Data enhancement; Data storage.

6. The secure situation awareness visualization system for ship network multi-modal data fusion of claim 1 or 2, wherein, The anomaly detection includes Behavior baseline modeling: a baseline is established based on historical data, and deviation from the baseline triggers an alarm; Machine learning and deep learning: unsupervised learning is used to discover unlabeled anomalies; Through supervised learning, a model is trained based on labeled attack samples to detect new variant threats; deep learning is used for anomaly detection of time series data to identify long-term hidden attacks.

7. The secure situation awareness visualization system for ship network multi-modal data fusion of claim 1 or 2, wherein, The feature extraction includes a rule engine and signature detection, the rule engine detects known attacks based on predefined rules, and the signature detection quickly locates known malicious behavior through malicious code signature, malicious IP or domain name blacklist matching.

8. The secure situation awareness visualization system for ship network multi-modal data fusion of claim 1 or 2, wherein, The threat correlation analysis includes Multi-source data correlation: through key fields including time, IP, account and asset ID, scattered events are connected into attack chains; Attack chain modeling: based on the MITRE ATT&CK framework, detected events are mapped to ATT&CK, attack paths are restored, and attack intentions are determined.

9. The secure situation awareness visualization system for shipboard network multi-modal data fusion of claim 1, wherein, The collaborative layer sets up a coordination server, and operations of the coordination server include initialization of the model and distribution to each edge node, collection of gradient information update of each edge node, aggregation of all gradient information updates, generation of a new model, and distribution of the new model back to each edge node.

Images