Comprehensive safety index evaluation method based on multi-task learning

Abstract

The invention provides a comprehensive security index evaluation method based on multi-task learning, and belongs to the technical field of network security management, and the method comprises the steps: synchronously collecting original data from a plurality of heterogeneous security data sources; a multi-task learning neural network model is constructed, and the model comprises a shared feature coding network for outputting shared features; the at least two heterogeneous task decoding networks are used for respectively mapping the shared features into preliminary security assessment results with different attributes; the fusion network is used for carrying out weighted fusion on the preliminary security assessment result to generate a comprehensive security index; using the multi-source security data set to train the multi-task learning neural network model; and inputting real-time security data of a to-be-evaluated system into the trained model, and outputting a comprehensive security index. The method has the advantages that the shared feature coding network can extract high-level feature representations with commonality from different data sources, and feature engineering dependence for a single data source or a single task is avoided.

Description

Technical Field

[0001] This invention belongs to the field of network security management technology, specifically relating to a comprehensive security indicator evaluation method based on multi-task learning. Background Technology

[0002] Security assessment of information systems is a core component of cybersecurity management. Its goal is to quantify or qualitatively analyze the potential security risks of target systems or network assets, thereby providing a basis for security decisions. An accurate and comprehensive security assessment is crucial for prioritization, resource allocation, and risk mitigation.

[0003] With the rapid development of information technology, cybersecurity threats are becoming increasingly complex and diverse, and single defense methods or assessment dimensions are no longer sufficient to fully reflect the security status of a system. Enterprise networks typically deploy a variety of security devices and software, such as firewalls, intrusion detection systems, vulnerability scanners, and security information and event management systems. These devices continuously generate massive amounts of heterogeneous security data, including network traffic logs, host system events, vulnerability reports, and various security alerts.

[0004] Therefore, there is an urgent need in this field for a solution that can automatically and adaptively fuse multi-source heterogeneous security data and effectively coordinate multiple heterogeneous security assessment tasks to generate accurate, reliable, and unified comprehensive security indicators. Summary of the Invention

[0005] In view of this, the present invention addresses the shortcomings of the prior art by providing a comprehensive security index evaluation method based on multi-task learning. To solve the above-mentioned technical problems, the technical solution adopted by the present invention includes: synchronously collecting raw data from multiple heterogeneous security data sources, cleaning, aligning and extracting features from the raw data, and constructing a multi-source security dataset containing multi-dimensional feature vectors and their corresponding real labels. A multi-task learning neural network model is constructed, comprising: a shared feature encoding network that encodes the input multi-dimensional feature vector and outputs shared features; at least two heterogeneous task decoding networks, including a regression task decoding network that outputs continuous risk values ​​and a classification task decoding network or a binary classification task decoding network that outputs discrete classification probabilities, used to map the shared features to preliminary security assessment results of different attributes; and a fusion network that performs weighted fusion of the preliminary security assessment results based on an attention mechanism to generate a comprehensive security index. The multi-task learning neural network model is trained using the multi-source security dataset. The training process includes: calculating a multi-task loss function, which is obtained by weighted summation of the loss functions of each task's decoding network and the loss function of the comprehensive security index output by the fusion network; using a gradient surgery algorithm to resolve gradient conflicts between tasks; and dynamically adjusting the weights of the losses for each task. The real-time security data of the system to be evaluated is input into the trained multi-task learning neural network model, and the comprehensive security index is output through the fusion network.

[0006] Furthermore, a method for synchronously collecting raw data from multiple heterogeneous security data sources, performing data cleaning, alignment, and feature extraction on the raw data, and constructing a multi-source security dataset containing multi-dimensional feature vectors and their corresponding real labels includes: Raw data is collected synchronously from network traffic mirroring, host system logs, vulnerability scanner reports, and alarm data from the security information and event management system. The collected raw data is cleaned, denoised, and formatted; a timestamp-based windowing method is used to associate and align data from different data sources within the same time window to form a unified time-series data sample. Extract multi-dimensional feature vectors from each aligned time-series data sample; the features include numerical features, categorical features, and sequence features. One-hot encoding is used for categorical features, and normalization is used for numerical features.

[0007] Furthermore, methods for shared feature encoding networks to encode multi-dimensional feature vectors from input and output shared features include: The shared feature encoding network is implemented using a Transformer architecture based on a self-attention mechanism; A learnable special classification label [CLS] is added to the beginning of the input feature vector sequence to form an enhanced input sequence. ,in The feature vector within the time window, The vector corresponding to the special classification label; The enhanced input sequence X is input into the Transformer architecture, which contains N encoder layers, each of which contains a multi-head self-attention sublayer and a feedforward neural network sublayer, and employs residual connections and layer normalization. The self-attention sublayer in each encoder layer captures the relationship between features at different positions in the sequence through the following process: the multi-head self-attention sublayer performs a linear transformation on the input sequence X to obtain the query matrix. Key matrix Sum matrix Then calculate the self-attention weights: in, It is the dimension of the key vector. This is the scaling factor; After processing by N layers of encoders, the vector corresponding to the [CLS] label output by the last encoder layer is taken as the output feature of the shared feature coding network, denoted as h.

[0008] Furthermore, the regression task decoding network is used for vulnerability threat scoring, and its loss function is... ; The classification task decoding network is used for attack type identification, and its loss function is: ; The binary classification task decoding network is used for abnormal traffic detection, and its loss function is: .

[0009] Furthermore, each task decoding network in the heterogeneous task decoding network maps the shared feature h to the corresponding task output. ,in This represents the preliminary security assessment result of the decoding network for the i-th task: The regression task decoding network employs a two-layer fully connected neural network: in, To share the output features of the feature encoding network, Let be the learnable parameters of the decoding network for the i-th regression task, and ReLU be the activation function; These are continuous numerical values, representing a quantitative score of safety risk. The classification task decoding network uses a three-layer fully connected neural network: The softmax function ensures that the output is a probability distribution for each category; This is a probability vector, representing the probability distribution of the input data belonging to each attack category; The binary classification task decoding network uses a two-layer fully connected neural network: in, This is the sigmoid function, and its output is the probability of belonging to the positive class. The value represents the probability that the input data may contain security anomalies.

[0010] Furthermore, the multi-task learning neural network model is trained using the aforementioned multi-source security dataset. The training process includes: The multi-source security dataset is divided into a training set and a validation set. The model is trained using the training set. The training employs an end-to-end joint learning strategy. A multi-task loss function is used. Defined as: Wherein, W is the set of learnable parameters of the model, including the parameters of the shared feature encoding network, the decoding networks of each task, and the fusion network; Let represent the loss function of the subtask corresponding to the decoding network of the i-th task; The regression loss function representing the comprehensive safety index; It is a real comprehensive safety indicator based on expert knowledge annotation or pre-calculated safety rules; and It is a learnable parameter representing the uncertainty of the i-th and f-th subtasks, which is automatically optimized during training via gradient descent; During training, a gradient surgery algorithm is used to resolve gradient conflicts between tasks, specifically including: In each training iteration, the multi-task loss function is calculated. The set of gradients relative to the model's shared parameters W ;in, for The derivative with respect to the shared parameter W; traversing all task pairs (i,j); when When this occurs, it indicates a gradient direction conflict, and will Projected to To eliminate conflicting components in the vertical direction, the projection is expressed as: Using the gradient after conflict resolution through the projection operation, the multi-task loss function is minimized through the Adam optimizer. Update the shared parameters W and uncertainty parameters of the model. .

[0011] Furthermore, the fusion network is an attention-based network, and the process of generating the comprehensive security index includes: First, the preliminary security assessment results are processed through a feature standardization module. Convert to feature vectors of uniform dimension ; ;in: The dimension is The weight matrix is ​​used to assign weights to the output of the decoding network for the i-th task, which are of dimension i. vector Linear mapping to a unified dimension ; The dimension is The bias vector and the weight matrix To complete the linear transformation; Then, the fusion weights are calculated based on the attention mechanism: Finally, considering all safety indicators Represented as: in, This represents vector concatenation. These are learnable parameters of the attention mechanism in the fusion network. The attention weights output for the i-th subtask.

[0012] Furthermore, the parameters of the model updated by the Adam optimizer multi-task loss function include: All learnable parameters of the shared feature encoding network, including the parameters of the multi-head self-attention sub-layers of each encoder layer in the Transformer architecture based on the self-attention mechanism. and the parameters of the feedforward neural network sublayers; All learnable parameters of each task decoding network in the heterogeneous task decoding network, including the weight matrix of the fully connected layers in each task decoding network. , and bias vector , For decoding networks used in classification tasks, a third layer weight matrix is ​​also included. and bias vector ; All learnable parameters of the fusion network, including the weight matrix of the feature normalization module. Bias vector and the parameters of the attention mechanism module ; Uncertainty parameters for all tasks and .

[0013] An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the processor, when executing the program, implements the steps of the method described in any of the preceding claims.

[0014] A computer-readable storage medium having a computer program stored thereon, characterized in that the program, when executed by a processor, implements the steps of the method as described in any of the preceding claims.

[0015] Compared with the prior art, the beneficial effects of the present invention are as follows: 1. This application achieves unified encoding and collaborative analysis of multi-source heterogeneous security data by constructing a multi-task learning neural network model; the shared feature encoding network can extract common high-level feature representations from different data sources, avoiding the dependence on feature engineering for a single data source or a single task; it helps the model to more effectively capture the inherent correlation between different security events and provides a more consistent information foundation for comprehensive evaluation.

[0016] 2. By introducing an adaptive loss function weight adjustment mechanism based on uncertainty, the model can dynamically balance the learning objectives of various heterogeneous tasks during training; combined with the gradient surgery algorithm, it can alleviate the optimization conflict of multiple tasks in the shared feature space, improve the stability and convergence efficiency of model training, and enable learning objectives of different natures such as regression tasks and classification tasks to be optimized collaboratively.

[0017] 3. The fusion network uses an attention mechanism to weight and fuse the outputs of heterogeneous tasks, which can dynamically allocate importance weights according to specific input samples, thereby generating more interpretable comprehensive security indicators. This method reduces the subjectivity of traditional fixed rule fusion methods, improves adaptability to complex and ever-changing security scenarios, and provides more reliable decision support for security managers. Attached Figure Description

[0018] The present invention will now be described in further detail with reference to the accompanying drawings.

[0019] Figure 1 : A schematic diagram of the process in this invention; Figure 2 : A schematic diagram of the data transmission flow in this invention. Detailed Implementation

[0020] To better understand the present invention, the content of the invention is further clearly illustrated below with reference to embodiments and accompanying drawings. However, the scope of protection of the present invention is not limited to the embodiments described below. Numerous specific details are set forth in the following description to provide a more thorough understanding of the invention. However, it will be apparent to those skilled in the art that the present invention can be practiced without one or more of these details.

[0021] Example 1: See Figure 1-2 This embodiment presents a comprehensive security index evaluation method based on multi-task learning, which includes: S1. Synchronously collect raw data from multiple heterogeneous security data sources, perform data cleaning, alignment, and feature extraction on the raw data, and construct a multi-source security dataset containing multi-dimensional feature vectors and their corresponding real labels; including: Raw data is collected synchronously from network traffic mirroring, host system logs, vulnerability scanner reports, and alarm data from the security information and event management system. The collected raw data undergoes data cleaning, noise reduction, and formatting to eliminate invalid values, abnormal noise, and format inconsistencies, providing high-quality, standardized data input for subsequent model training. A timestamp-based windowing method is employed to correlate and align data from different data sources within the same time window, forming a unified time-series data sample. By establishing a unified time benchmark, it ensures that security events from different sources can be correlated and analyzed on the same time dimension, thus laying the foundation for the model to capture temporal causal relationships in the attack chain. The size of the time-series window can be dynamically adjusted according to the needs of the actual security analysis scenario. Multi-dimensional feature vectors are extracted from each aligned time-series data sample. These features include numerical features, categorical features, and sequence features. Through these features, security events can be characterized from multiple dimensions, including statistical characteristics, state categories, and behavioral sequences, providing the model with rich and complementary information representations, thereby enhancing the model's ability to identify complex threat patterns. One-hot encoding is used for categorical features to transform discrete category identifiers into binary vectors, preventing the model from misinterpreting category relationships as numerical order. For numerical features, Z-score standardization is used for normalization, using the formula... The implementation transforms the feature values ​​into a distribution with a mean of 0 and a standard deviation of 1, where μ is the mean of the feature and σ is the standard deviation of the feature. Normalization can uniformly scale numerical features of different dimensions and magnitudes to a similar numerical range, effectively preventing certain features from dominating model training due to excessively large values, and promoting the stability and rapid convergence of the gradient descent process.

[0022] S2. Construct a multi-task learning neural network model, the model comprising: S21. A shared feature encoding network encodes the input multi-dimensional feature vector and outputs shared features; the shared feature encoding network is implemented using a Transformer architecture based on a self-attention mechanism. A learnable special classification label [CLS] is added to the beginning of the input feature vector sequence to form an enhanced input sequence. ,in The feature vector within the time window, For the vector corresponding to the special classification label, the introduction of a learnable [CLS] label can interact with elements at all other positions in the sequence through a self-attention mechanism, thereby automatically learning and aggregating the global context information of the entire sequence during model training, and finally outputting it as a condensed representation of the entire sequence, providing a unified feature base rich in context information for multiple subsequent parallel tasks; The enhanced input sequence X is fed into the Transformer architecture, which contains N encoder layers. Each encoder layer contains a multi-head self-attention sublayer and a feedforward neural network sublayer, and employs residual connections and layer normalization. The multi-layer stacked encoder structure gradually captures hierarchical feature representations from local feature patterns to global complex dependencies through layer-by-layer abstraction. The introduction of residual connections effectively alleviates the gradient vanishing problem in deep network training, ensuring effective backpropagation of gradient signals, while layer normalization improves training stability and convergence speed by re-centering and scaling activation values. The self-attention sublayer in each encoder layer captures the relationship between features at different positions in the sequence through the following process: the multi-head self-attention sublayer performs a linear transformation on the input sequence X to obtain the query matrix. Key matrix Sum matrix Then calculate the self-attention weights: in, It is the dimension of the key vector. The scaling factor is used; a scaled dot product attention mechanism is employed, which can calculate the correlation strength between any two positions in the sequence, thereby dynamically assigning different attention weights to them. This allows the model to adaptively focus on historical information most relevant to the current security event based on the context; the scaling factor This is used to soften the distribution of the Softmax function when the dot product result is large, preventing it from entering the saturation region where the gradient is minimal and ensuring the stability of gradient calculation. Furthermore, the multi-head mechanism allows the model to pay attention to information from different locations in parallel in different representation subspaces, which is equivalent to providing the model with a multi-angle "attention perspective", thereby enhancing the model's ability to capture a variety of complex dependencies, such as simultaneously paying attention to short-term sudden anomalies and long-term periodic patterns.

[0023] After processing by N layers of encoders, the vector corresponding to the [CLS] label output by the last layer of encoder is taken as the output feature of the shared feature coding network, denoted as h. Feature h encapsulates the global semantic information of the input sequence. S22. At least two heterogeneous task decoding networks, including a regression task decoding network that outputs continuous risk values ​​and a classification task decoding network or a binary classification task decoding network that outputs discrete classification probabilities, which map the shared features to preliminary security assessment results of different attributes; including: S221. Suppose that the heterogeneous task decoding network includes K tasks: Regression task: vulnerability threat scoring, loss function is Among them, choosing mean squared error as the loss function can effectively measure the degree of deviation between continuous predicted values ​​and true labels. By minimizing this loss, the model can learn accurate numerical regression capabilities and achieve quantitative assessment of safety risk levels. Classification task: Attack type identification, loss function is The cross-entropy loss function is used to effectively measure the difference between the predicted probability distribution and the true distribution. By optimizing this loss, the model can be driven to accurately distinguish different attack categories and enhance the ability to classify and distinguish complex threat scenarios. Binary classification task: Abnormal traffic detection, with the loss function being... The binary cross-entropy loss function is specifically designed for handling binary classification problems. By simultaneously considering the prediction accuracy of positive and negative examples, it ensures that the model maintains both high recall and low false positive rate in detecting abnormal traffic.

[0024] S222, Each task decoding network in the heterogeneous task decoding network maps the shared feature h to the corresponding task output. ,in This represents the preliminary security assessment result of the decoding network for the i-th task: For the decoding network of the regression task, a two-layer fully connected neural network is used: in, To share the output features of the feature encoding network, Let be the learnable parameters of the decoding network for the i-th regression task, and ReLU be the activation function; The continuous numerical values ​​represent the quantitative score of safety risk. The two-layer fully connected network structure, while retaining the core information of the shared feature h, achieves sufficient non-linear transformation capability through a single hidden layer. This effectively captures complex patterns of input features and avoids the overfitting risk that may arise from excessively deep network structures. The introduction of the ReLU activation function alleviates the gradient vanishing problem and enhances the sparse activation of the network, improving model training efficiency. Finally, the linear output layer ensures that the model can generate continuous numerical predictions, meeting the accuracy requirements of the risk scoring task. For the decoding network of the classification task, a three-layer fully connected neural network is used: The softmax function ensures that the output is a probability distribution for each category; The probability vector represents the probability distribution of the input data belonging to each attack category. By increasing the network depth to three layers, the model is provided with stronger feature abstraction and hierarchical representation capabilities, which is crucial for classification tasks that require distinguishing fine-grained attack categories. The second hidden layer further performs nonlinear combination of features to enhance the model's ability to discriminate complex attack features. The output layer uses the softmax function to convert the original score into a normalized probability distribution, so that the sum of the predicted probabilities of each category is 1, which not only meets the axiom requirements of probability distribution but also provides numerical stability for subsequent cross-entropy loss calculation. For the binary classification task decoding network, a two-layer fully connected neural network is used: in, This is the sigmoid function, and its output is the probability of belonging to the positive class. The probability value represents the possibility that the input data is abnormal. Although both belong to classification tasks, binary classification tasks adopt a two-layer structure similar to regression tasks, reflecting the adaptability of network structure design to task complexity. The output layer uses the sigmoid function to directly map the network output to the [0,1] interval, which perfectly matches the binary classification task's requirement for a single probability value output. The output probability value can be intuitively interpreted as the possibility that the sample belongs to the positive class (such as anomalies), improving the interpretability of the model output.

[0025] S3. Train the multi-task learning neural network model using the multi-source security dataset. The training process includes: calculating a multi-task loss function, which is obtained by weighted summation of the loss functions of each task's decoding network and the loss function of the comprehensive security index output by the fusion network; resolving gradient conflicts between tasks using a gradient surgery algorithm; and dynamically adjusting the weights of the losses for each task. S31. Divide the multi-source security dataset into a training set and a validation set, and train the model using the training set; the training adopts an end-to-end joint learning strategy; multi-task loss function. Defined as: The loss function is designed based on the principle of homoscedastic uncertainty, by introducing a learnable uncertainty parameter. and The task-related noise estimation is modeled as observation noise; where As adaptive weights, these terms allow the model to dynamically adjust the contribution of its loss terms during training based on the inherent uncertainty of each task. The term acts as a regularizer to prevent uncertainty from increasing indefinitely, thereby ensuring training stability; it eliminates the tedious process of manually adjusting loss weights in traditional multi-task learning, and achieves automatic optimal balance of weights between tasks. Wherein, W is the set of learnable parameters of the model, including the parameters of the shared feature encoding network, the decoding networks of each task, and the fusion network; Let represent the loss function of the subtask corresponding to the decoding network of the i-th task; The regression loss function representing the comprehensive safety index; It is a real comprehensive safety indicator based on expert knowledge annotation or pre-calculated safety rules; and It is a learnable parameter representing the uncertainty of the i-th and f-th subtasks, which is automatically optimized during training via gradient descent; S311. During training, a gradient surgery algorithm is used to resolve gradient conflicts between tasks, specifically including: In each training iteration, the multi-task loss function is calculated. The set of gradients relative to the model's shared parameters W ;in, for The derivative with respect to the shared parameter W; traversing all task pairs (i,j); when When this occurs, it indicates a gradient direction conflict, and will Projected to To eliminate conflicting components in the vertical direction, the projection is expressed as: Gradient surgery effectively eliminates conflicting components in the gradient update direction by projecting conflicting gradient vectors onto the normal plane of another gradient vector. This enables shared parameters to be updated collaboratively in the common direction required by multiple tasks, thereby alleviating the negative transfer phenomenon commonly seen in multi-task learning and improving the convergence speed and generalization performance of the model. S312. Using the gradient after conflict resolution through the projection operation, minimize the multi-task loss function through the Adam optimizer. Update the shared parameters W and uncertainty parameters of the model. The Adam adaptive moment estimation algorithm is optimized by combining the estimation of first and second moments. It can design adaptive learning rates for different parameters, which is applicable to problem scenarios involving a large number of parameters and loss functions that may have different scales. The update process optimizes shared parameters and uncertain parameters at the same time, realizing collaborative learning that balances model inference ability and task weights.

[0026] S32. The multi-task learning neural network model further includes a fusion network, which weights and fuses the preliminary security assessment results output by the heterogeneous task decoding network based on an attention mechanism to generate a comprehensive security index; including: Let the output of the K-task decoding network be ,in This represents the output of the decoding network for the i-th task; specifically, The continuous risk value output by the regression task. The discrete classification probability vector output for a classification task. The probability value output for a binary classification task; The fusion network is an attention-based network, and the process of generating the comprehensive security index includes: The fusion network first uses a feature normalization module to convert the heterogeneous results output by the decoding networks of each task into a single feature normalization module. Convert to feature vectors of uniform dimension ; ;in: The dimension is The weight matrix is ​​used to assign weights to the output of the decoding network for the i-th task, which are of dimension i. vector Linear mapping to a unified dimension This is a preprocessing step in information fusion, the purpose of which is to perform dimensional transformation and solve the problem that different task outputs cannot be directly mathematically calculated due to heterogeneity in format and dimension. The dimension is The bias vector and the weight matrix To complete the linear transformation; The purpose of this feature standardization process is to solve the problem of inability to directly fuse features due to the heterogeneity of task outputs (scalar, vector, and other different dimensions). By using a learnable linear transformation, the outputs of each task are projected onto a unified feature space, laying a mathematical foundation for subsequent attention-weighted fusion. This design can ensure the comparability between features while maintaining the integrity of information from each task.

[0027] Then, the fusion weights are calculated based on the attention mechanism: The calculation of attention weights incorporates shared features h as contextual information, enabling the fusion process to dynamically perceive the overall feature background of the current input. A tanh activation function is used to ensure the numerical stability of the attention score, and subsequent softmax normalization ensures that the weight coefficients are optimized. It meets the probability distribution requirement, that is, the sum of all weights is 1. This characteristic ensures the interpretability of the final comprehensive index. Finally, considering all safety indicators Represented as: The final composite metric is generated through a weighted summation, where the attention weight is... It adaptively reflects the importance of each task output to the current specific input sample; this dynamic weighting mechanism enables the model to automatically adjust the key evaluation dimensions it depends on for different security scenarios, thereby generating a more accurate and more stable comprehensive security index. in, This represents vector concatenation. These are learnable parameters of the attention mechanism in the fusion network. The attention weights output for the i-th subtask.

[0028] S313. The process of minimizing the multi-task loss function using the Adam optimizer to update the model parameters includes the following parameter update range: All learnable parameters of the shared feature encoding network, including the parameters of the multi-head self-attention sub-layers of each encoder layer in the Transformer architecture based on the self-attention mechanism. and the parameters of the feedforward neural network sublayers; All learnable parameters of each of the K heterogeneous task decoding networks, including the weight matrix of the fully connected layers in each task decoding network. , and bias vector , For decoding networks used in classification tasks, a third layer weight matrix is ​​also included. and bias vector ; All learnable parameters of the fusion network, including the weight matrix of the feature normalization module. Bias vector and the parameters of the attention mechanism module ; Uncertainty parameters for all tasks and ; S4. Input the real-time security data of the system to be evaluated into the trained multi-task learning neural network model. First, the shared feature encoding network extracts features from the input real-time security data to obtain a shared feature representation h containing temporal correlation and contextual information. Then, the shared feature h is input in parallel into each heterogeneous task decoding network to generate preliminary evaluation results y1, y2,..., y1 corresponding to different security dimensions such as vulnerability threat, attack type, and abnormal traffic. kFinally, the outputs yᵢ of each task decoding network and the shared feature h are input into the fusion network. The weights of each preliminary evaluation result are dynamically calculated based on the attention mechanism, and the final comprehensive security index is generated through weighted fusion.

[0029] Technical effects of this embodiment: 1. By constructing a multi-task learning neural network model, unified encoding and collaborative analysis of multi-source heterogeneous security data are achieved; the shared feature encoding network can extract common high-level feature representations from different data sources, avoiding the dependence on feature engineering for a single data source or a single task; it helps the model to more effectively capture the inherent correlation between different security events and provide a more consistent information foundation for comprehensive evaluation.

[0030] 2. By introducing an adaptive loss function weight adjustment mechanism based on uncertainty, the model can dynamically balance the learning objectives of various heterogeneous tasks during training; combined with the gradient surgery algorithm, it can alleviate the optimization conflict of multiple tasks in the shared feature space, improve the stability and convergence efficiency of model training, and enable learning objectives of different natures such as regression tasks and classification tasks to be optimized collaboratively.

[0031] 3. The fusion network uses an attention mechanism to weight and fuse the outputs of heterogeneous tasks, which can dynamically allocate importance weights according to specific input samples, thereby generating more interpretable comprehensive security indicators. This method reduces the subjectivity of traditional fixed rule fusion methods, improves adaptability to complex and ever-changing security scenarios, and provides more reliable decision support for security managers.

[0032] Example 2: An electronic device includes a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the steps of the method described in Example 1.

[0033] Example 3: A computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the method as described in Example 1.

[0034] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Any other modifications or equivalent substitutions made by those skilled in the art to the technical solutions of the present invention, as long as they do not depart from the spirit and scope of the technical solutions of the present invention, should be covered within the scope of the claims of the present invention.

Claims

1. A comprehensive security index evaluation method based on multi-task learning, characterized in that, include: Raw data is collected synchronously from multiple heterogeneous security data sources. The raw data is then cleaned, aligned, and feature extracted to construct a multi-source security dataset containing multi-dimensional feature vectors and their corresponding real labels. A multi-task learning neural network model is constructed, the model comprising: a shared feature encoding network that encodes the input multi-dimensional feature vector and outputs shared features; At least two heterogeneous task decoding networks, including a regression task decoding network that outputs continuous risk values ​​and a classification task decoding network or a binary classification task decoding network that outputs discrete classification probabilities, are used to map the shared features to preliminary security assessment results of different attributes; a fusion network is used to perform weighted fusion of the preliminary security assessment results based on an attention mechanism to generate a comprehensive security index; The multi-task learning neural network model is trained using the multi-source security dataset. The training process includes: calculating a multi-task loss function, which is obtained by weighted summation of the loss functions of each task's decoding network and the loss function of the comprehensive security index output by the fusion network; using a gradient surgery algorithm to resolve gradient conflicts between tasks; and dynamically adjusting the weights of the losses for each task. The real-time security data of the system to be evaluated is input into the trained multi-task learning neural network model, and the comprehensive security index is output through the fusion network.

2. The comprehensive security index evaluation method based on multi-task learning as described in claim 1, characterized in that, A method for constructing a multi-source security dataset containing multi-dimensional feature vectors and their corresponding ground truth labels by synchronously collecting raw data from multiple heterogeneous security data sources, performing data cleaning, alignment, and feature extraction on the raw data, includes: Raw data is collected synchronously from network traffic mirroring, host system logs, vulnerability scanner reports, and alarm data from the security information and event management system. The collected raw data is cleaned, denoised, and formatted; a timestamp-based windowing method is used to associate and align data from different data sources within the same time window to form a unified time-series data sample. Extract multi-dimensional feature vectors from each aligned time-series data sample; the features include numerical features, categorical features, and sequence features. One-hot encoding is used for categorical features, and normalization is used for numerical features.

3. The comprehensive security index evaluation method based on multi-task learning as described in claim 2, characterized in that, Shared feature encoding networks encode multi-dimensional feature vectors from input and output shared features. Methods for this include: The shared feature encoding network is implemented using a Transformer architecture based on a self-attention mechanism; A learnable special classification label [CLS] is added to the beginning of the input feature vector sequence to form an enhanced input sequence. ,in The feature vector within the time window, The vector corresponding to the special classification label; The enhanced input sequence X is input into the Transformer architecture, which contains N encoder layers, each of which contains a multi-head self-attention sublayer and a feedforward neural network sublayer, and employs residual connections and layer normalization. The self-attention sublayer in each encoder layer captures the relationship between features at different positions in the sequence through the following process: the multi-head self-attention sublayer performs a linear transformation on the input sequence X to obtain the query matrix. Key matrix Sum matrix Then calculate the self-attention weights: in, It is the dimension of the key vector. This is the scaling factor; After processing by N layers of encoders, the vector corresponding to the [CLS] label output by the last encoder layer is taken as the output feature of the shared feature coding network, denoted as h.

4. The comprehensive security index evaluation method based on multi-task learning as described in claim 3, characterized in that: The regression task decoding network is used for vulnerability threat scoring, and its loss function is... ; The classification task decoding network is used for attack type identification, and its loss function is: ; The binary classification task decoding network is used for abnormal traffic detection, and its loss function is: .

5. The comprehensive security index evaluation method based on multi-task learning as described in claim 4, characterized in that: Each task decoding network in the heterogeneous task decoding network maps the shared feature h to the corresponding task output. ,in This represents the preliminary security assessment result of the decoding network for the i-th task: The regression task decoding network employs a two-layer fully connected neural network: in, To share the output features of the feature encoding network, Let be the learnable parameters of the decoding network for the i-th regression task, and ReLU be the activation function; These are continuous numerical values, representing a quantitative score of safety risk. The classification task decoding network uses a three-layer fully connected neural network: The softmax function ensures that the output is a probability distribution for each category; This is a probability vector, representing the probability distribution of the input data belonging to each attack category; The binary classification task decoding network uses a two-layer fully connected neural network: in, This is the sigmoid function, and its output is the probability of belonging to the positive class. The value represents the probability that the input data may contain security anomalies.

6. The comprehensive security index evaluation method based on multi-task learning as described in claim 5, characterized in that, The multi-task learning neural network model is trained using the aforementioned multi-source security dataset. The training process includes: The multi-source security dataset is divided into a training set and a validation set. The model is trained using the training set. The training employs an end-to-end joint learning strategy. A multi-task loss function is used. Defined as: Wherein, W is the set of learnable parameters of the model, including the parameters of the shared feature encoding network, the decoding networks of each task, and the fusion network; Let represent the loss function of the subtask corresponding to the decoding network of the i-th task; The regression loss function representing the comprehensive safety index; It is a real comprehensive safety indicator based on expert knowledge annotation or pre-calculated safety rules; and It is a learnable parameter representing the uncertainty of the i-th and f-th subtasks, which is automatically optimized during training via gradient descent; During training, a gradient surgery algorithm is used to resolve gradient conflicts between tasks, specifically including: In each training iteration, the multi-task loss function is calculated. The set of gradients relative to the model's shared parameters W ;in, for The derivative with respect to the shared parameter W; traversing all task pairs (i,j); when When this occurs, it indicates a gradient direction conflict, and will Projected to To eliminate conflicting components in the vertical direction, the projection is expressed as: Using the gradient after conflict resolution through the projection operation, the multi-task loss function is minimized through the Adam optimizer. Update the shared parameters W and uncertainty parameters of the model. .

7. The comprehensive security index evaluation method based on multi-task learning as described in claim 6, characterized in that, The fusion network is an attention-based network, and the process of generating the comprehensive security index includes: First, the preliminary security assessment results are processed through a feature standardization module. Convert to feature vectors of uniform dimension ; ;in: The dimension is The weight matrix is ​​used to assign weights to the output of the decoding network for the i-th task, which are of dimension i. vector Linear mapping to a unified dimension ; The dimension is The bias vector and the weight matrix To complete the linear transformation; Then, the fusion weights are calculated based on the attention mechanism: Finally, considering all safety indicators Represented as: in, This represents vector concatenation. These are learnable parameters of the attention mechanism in the fusion network. The attention weights output for the i-th subtask.

8. The comprehensive security index evaluation method based on multi-task learning as described in claim 7, characterized in that, The parameters of the model updated by the Adam optimizer multi-task loss function include: All learnable parameters of the shared feature encoding network, including the parameters of the multi-head self-attention sub-layers of each encoder layer in the Transformer architecture based on the self-attention mechanism. and the parameters of the feedforward neural network sublayers; All learnable parameters of each task decoding network in the heterogeneous task decoding network, including the weight matrix of the fully connected layers in each task decoding network. , and bias vector , For decoding networks used in classification tasks, a third layer weight matrix is ​​also included. and bias vector ; All learnable parameters of the fusion network, including the weight matrix of the feature normalization module. Bias vector and the parameters of the attention mechanism module ; Uncertainty parameters for all tasks and .

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the method as described in any one of claims 1-8.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the steps of the method as described in any one of claims 1-8.

Images