Intelligent dynamic threat perception-based credential security enhancement method and system

Abstract

The invention provides a credential security enhancement method and system for intelligent dynamic threat perception. According to the method, four-dimensional original monitoring data covering a physical layer, a system layer, a data layer and an application layer is collected through a probe deployed at a core node of the credential environment, and a standardized time sequence matrix is formed after unified processing. A space-time diagram neural network is used for identifying known threats, sandbox simulation is carried out on unknown threats through a reinforcement learning driven confrontation deduction engine, and an extended threat portrait is generated. Based on this, a defense strategy is dynamically generated through multi-objective optimization in combination with a system resource state and a service priority, and the defense strategy is cooperatively executed by a multi-agent module. In the whole process, credible evidence storage is carried out through the block chain, a self-calibration closed loop based on efficiency evaluation is established, and continuous evolution of the protection capability is realized. The system effectively improves the real-time perception, intelligent response and credible traceability of the credential environment to known and unknown threats.

Description

Technical Field

[0001] This invention relates to the field of domestic IT security technology, and in particular to a method and system for enhancing domestic IT security through intelligent dynamic threat perception. Background Technology

[0002] Currently, domestic IT security protection faces multiple bottlenecks: traditional protection relies on fixed rules, lacks sufficient ability to identify unknown threats, and suffers from low threat detection accuracy and high false alarm rates in multi-component collaborative scenarios, leading to inefficient security operations; existing solutions lack scenario-based adaptation for the characteristics of power businesses, making it difficult to cover the dedicated protocol and business logic security requirements of critical scenarios such as distribution network terminals and dispatching systems; simultaneously, in environments where domestic and traditional terminals are deployed together, security management is fragmented, resulting in inaccurate threat localization and untimely response loops, failing to meet the high reliability and real-time security protection requirements of power systems. Therefore, it is urgent to build an intelligent dynamic threat perception system adapted to the domestic IT environment to improve the accuracy and response efficiency of security protection. Summary of the Invention

[0003] The purpose of this invention is to provide a method and system for enhancing information security through intelligent dynamic threat perception, aiming to solve the technical problems of existing technologies such as delayed perception, rigid response, one-sided assessment, lack of reliable traceability and self-evolution capabilities.

[0004] To address the aforementioned problems, according to one aspect of this application, an embodiment of the present invention provides a method for enhancing domestic IT security through intelligent dynamic threat perception, comprising:

[0005] Multi-source data acquisition steps: Through security probes deployed on core nodes of the domestic IT innovation environment, continuously collect underlying hardware operating status data, operating system kernel call logs, database access traces, network traffic metadata and application layer interaction behavior sequences to form a four-dimensional raw monitoring data stream covering the physical layer, system layer, data layer and application layer.

[0006] Heterogeneous data unification processing steps: The four-dimensional raw monitoring data stream is input into the heterogeneous data unification processing unit, the data of each dimension is slicing according to the preset time window length, the missing sampling points are filled by linear interpolation, the data of different dimensions are mapped to the zero to one interval by the normalization function, and the standardized time series observation matrix with consistent structure is output.

[0007] Known threat identification steps: Input the standardized time series observation matrix into the threat behavior identification model constructed based on spatiotemporal graph neural network. The model takes abnormal fluctuations in chip registers as the initial features of nodes, inter-process communication paths as edge connections, extracts cross-level attack propagation patterns through multi-layer graph convolution operations, focuses on high-risk behavior links through attention weight allocation mechanism, and outputs preliminary threat judgment results.

[0008] Unknown threat assessment steps: The preliminary threat assessment result is matched with the known attack fingerprints in the historical threat knowledge base using cosine similarity. If the matching degree is lower than a preset threshold, the unknown threat assessment process is triggered, and the reinforcement learning-driven adversarial inference engine is invoked to simulate the attacker's subsequent behavior in an isolated sandbox environment and generate an extended threat profile.

[0009] Dynamic policy generation steps: Based on the preliminary threat assessment results or extended threat profile, activate the dynamic policy generator, select the optimal combination from the preset defense action atomic library according to the current system resource load status, business continuity priority list and security policy constraints, determine the execution order and timing interval of each atomic action by solving a constrained multi-objective optimization problem, and output the defense policy instruction sequence.

[0010] Collaborative strategy execution steps: The defense strategy instruction sequence is distributed to the corresponding execution agent module, and each module synchronously adjusts its own operating parameters to achieve collaborative operation of threat blocking, resource isolation and privilege revoke;

[0011] Blockchain trusted evidence storage steps: During the execution of the defense strategy, the blockchain evidence storage unit is activated to encapsulate the threat judgment basis, strategy generation logic, execution timestamp, operation subject identifier and affected object hash value into a structured event record, and write it into the consortium blockchain ledger jointly maintained by multiple trust innovation nodes through a consensus algorithm;

[0012] Security assessment and self-calibration steps: Periodically read historical event records in the blockchain ledger, combine system stability indicators after the defense strategy is implemented, business interruption duration statistics and secondary attack occurrence rate to calculate comprehensive performance score, and trigger parameter self-calibration process based on the score results to adjust the sensitivity coefficient of the threat identification model, the resource allocation weight of the strategy generator and the data compression ratio of the evidence storage unit.

[0013] In some implementations, in the heterogeneous data unification processing step, the time window length is set to 500 milliseconds, the normalization function adopts the minimum-maximum scaling formula, and the linear interpolation method is used to calculate the weighted average based on the values ​​of adjacent valid sampling points.

[0014] In some implementations, the known threat identification step includes a spatiotemporal graph neural network comprising a three-layer graph convolutional module, with each layer followed by a nonlinear activation function and a residual connection structure. The attention weight allocation mechanism is jointly calculated based on the node centrality index and the edge traffic density index. The preliminary threat determination result includes an attack type label, a confidence score, and an affected asset identifier.

[0015] In some implementations, the unknown threat assessment step uses a deep Q-network architecture for the reinforcement learning-driven adversarial simulation engine. The state space is defined as the current set of controlled assets and the permission distribution matrix. The action space is defined as four types of atomic attack operations: port scanning, credential theft, service hijacking, and configuration tampering. The reward function is composed of the number of lateral movement steps, the level of permission elevation, and the duration of stealth maintenance. The extended threat profile includes the potential harm range and the spread speed.

[0016] In some implementations, the dynamic strategy generation step includes a defense action atomic library containing thirty-seven predefined action templates. The objective function of the multi-objective optimization problem is composed of a weighted sum of three indicators: threat suppression efficiency, resource consumption cost, and business impact. The constraints include the minimum available memory threshold of the system, critical process survival assurance requirements, and compliance audit integrity specifications.

[0017] In some implementations, the execution agent module in the collaborative policy execution step includes a network controller, a process manager, a key service middleware, an access control engine, and a log collector; the network controller adjusts the five-tuple filtering rule table according to instructions, the process manager sends a pause signal to the target process and migrates its memory pages to the isolation zone, the key service middleware triggers the immediate regeneration of elliptic curve digital signature algorithm key pairs, the access control engine updates the role-based access control policy tree, and the log collector increases the sampling frequency to two thousand records per second.

[0018] In some implementations, in the blockchain trusted evidence storage step, the consortium blockchain adopts a practical Byzantine fault-tolerant consensus algorithm, the block size upper limit is set to two megabytes, the event record adopts a compact binary encoding format, the hash algorithm adopts the national cryptographic standard SM3, and the ledger synchronization delay is controlled within fifty milliseconds.

[0019] In some implementations, the comprehensive performance score calculation formula in the security assessment and self-calibration steps is: performance score = threat interception success rate × 0.6 + resource utilization optimization range × 0.25 + user-unaware operation ratio × 0.15; the parameter self-calibration process is executed once every 24 hours, or triggered immediately when the secondary attack occurrence rate exceeds 5% in a single day.

[0020] This invention also provides an intelligent dynamic threat perception-based domestic security enhancement system, comprising:

[0021] The multi-source data acquisition subsystem is deployed on each core node of the domestic IT innovation environment. It is used to continuously collect underlying hardware operating status data, operating system kernel call logs, database access trajectories, network traffic metadata, and application layer interaction behavior sequences, forming a four-dimensional raw monitoring data stream covering the physical layer, system layer, data layer, and application layer.

[0022] The heterogeneous data unification processing subsystem is used to receive the four-dimensional raw monitoring data stream, perform sliding slicing of the data in each dimension according to the preset time window length, fill missing sampling points using linear interpolation, map data of different dimensions to the zero-to-one interval through a normalization function, and output a standardized time series observation matrix with consistent structure.

[0023] The threat behavior identification subsystem, built on a spatiotemporal graph neural network, is used to receive the standardized time-series observation matrix, take abnormal fluctuations in chip registers as the initial features of nodes, take inter-process communication paths as edge connections, extract cross-level attack propagation patterns through multi-layer graph convolution operations, focus on high-risk behavior links through an attention weight allocation mechanism, and output a preliminary threat judgment result including attack type labels, confidence scores and affected asset identifiers.

[0024] The unknown threat assessment subsystem is triggered when the matching degree between the preliminary threat assessment result and the historical threat knowledge base is lower than a preset threshold. It calls the reinforcement learning-driven adversarial inference engine to simulate the lateral movement paths and privilege escalation methods that attackers may take in the isolated sandbox environment, and generates an extended threat profile that includes the potential scope of harm and the speed of spread.

[0025] The dynamic policy generation subsystem is used to receive the preliminary threat assessment results or extended threat profiles, select the optimal combination from the pre-set defense action atomic library based on the current system resource load status, business continuity priority list and security policy constraints, determine the execution order and timing interval of each atomic action by solving a constrained multi-objective optimization problem, and output an executable defense policy instruction sequence.

[0026] The policy execution agent subsystem includes a network controller, process manager, key service middleware, access control engine, and log collector. It is used to receive and execute the defense policy instruction sequence, synchronously adjust its own operating parameters, and realize the coordinated operation of threat blocking, resource isolation, and permission revocation.

[0027] The blockchain trusted evidence storage subsystem is used to encapsulate the threat assessment criteria, strategy generation logic, execution timestamp, operation subject identifier and affected object hash value into a structured event record during the execution of defense strategies, and write it into the consortium blockchain ledger jointly maintained by multiple trust innovation nodes through a consensus algorithm;

[0028] The security assessment feedback subsystem is used to periodically read historical event records in the blockchain ledger, combine system stability indicators after the defense strategy is implemented, business interruption duration statistics and secondary attack occurrence rate to calculate the comprehensive performance score of the current security system, and trigger the parameter self-calibration process of the assessment indicator system based on the score results to adjust the sensitivity coefficient of the threat identification model, the resource allocation weight of the policy generator and the data compression ratio of the evidence storage unit.

[0029] In some implementations, the spatiotemporal graph neural network comprises three layers of graph convolutional modules, each followed by a nonlinear activation function and a residual connection structure; the reinforcement learning-driven adversarial inference engine employs a deep Q-network architecture; the consortium blockchain uses a practical Byzantine fault-tolerant consensus algorithm, and the hash algorithm uses the national cryptographic standard SM3; the comprehensive performance score calculation formula is as follows:

[0030] Performance score = Threat interception success rate × 0.6 + Resource utilization optimization level × 0.25 + Percentage of user-unnoticed operations × 0.15.

[0031] Compared with existing technologies, the intelligent dynamic threat perception-based information security enhancement method and system of the present invention have at least the following beneficial effects:

[0032] This invention overcomes the limitations of existing technologies that are limited to collecting data from a single network layer or application layer by constructing a four-dimensional data acquisition system covering the physical layer, system layer, data layer, and application layer. By combining a 500ms sliding time window and linear interpolation completion technology, it achieves unified processing of heterogeneous data across layers, laying a data foundation for the identification of cross-layer attack propagation patterns and effectively solving the shortcomings of the one-sided evaluation of existing technologies.

[0033] The architecture of spatiotemporal graph neural network and reinforcement learning is adopted. The spatiotemporal graph neural network uses chip register anomalies as node features and process communication paths as edge relationships to accurately extract cross-level attack propagation patterns. The reinforcement learning engine simulates unknown threats in a sandbox environment. Compared with the single graph neural network detection or generalized AI model application in the existing technology, it significantly improves the accuracy of identifying complex attacks and zero-day vulnerabilities and solves the problem of perception lag.

[0034] The dynamic policy generator is based on a multi-objective optimization algorithm and combines system resource load and business priority to adaptively combine defense actions. Compared with the fixed policies or simple dynamic adjustments of existing technologies, it avoids resource waste and business impact caused by policy rigidity and achieves a balance between threat suppression and business continuity.

[0035] The blockchain trusted evidence storage subsystem adopts the national cryptographic SM3 hash and practical Byzantine fault-tolerant consensus to ensure full-chain traceability of security incidents and meet compliance audit requirements. However, existing technologies generally lack trusted evidence storage mechanisms and cannot cope with the challenges of data tampering and liability determination. The security assessment feedback subsystem constructs a full-parameter self-calibration closed loop, which dynamically adjusts model and strategy parameters through quantitative performance scoring, so that the protection capability continues to evolve with the attack and defense confrontation. Compared with the local feedback adjustment of existing technologies, it achieves a systematic capability improvement.

[0036] The overall solution achieves an organic unity of real-time threat perception, intelligent defense strategies, reliable handling processes, and evolving system capabilities on a domestically developed basic software and hardware platform, comprehensively improving the overall protection level of the information technology innovation environment against quantum computing threats, advanced persistent penetration, and large-scale data leakage risks.

[0037] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, the preferred embodiments of the present invention are described in detail below with reference to the accompanying drawings. Attached Figure Description

[0038] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0039] Figure 1 A schematic diagram of the overall technical architecture of a method and system for enhancing domestic IT security through intelligent dynamic threat perception;

[0040] Figure 2 A schematic diagram of the core threat perception and assessment principle framework based on spatiotemporal graph neural networks and reinforcement learning adversarial inference;

[0041] Figure 3 A flowchart illustrating the logic process of unifying heterogeneous data from raw 4D monitoring data to a standardized time-series observation matrix.

[0042] Figure 4 A schematic diagram illustrating the collaborative decision-making and distribution interaction relationship of defense actions between the dynamic policy generator and the multi-agent execution module;

[0043] Figure 5 A closed-loop framework diagram of trusted traceability and parameter self-calibration, consisting of a blockchain evidence storage unit and a security assessment feedback module. Detailed Implementation

[0044] To further illustrate the technical means and effects adopted by the present invention to achieve the intended purpose, the specific embodiments, structures, features, and effects according to the present invention will be described in detail below with reference to the accompanying drawings and preferred embodiments. In the following description, different "an embodiment" or "an embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0045] In the description of this invention, it should be clearly stated that the terms "first," "second," etc., in the specification, claims, and accompanying drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence; the terms "vertical," "lateral," "longitudinal," "front," "rear," "left," "right," "up," "down," "horizontal," etc., indicate orientation or positional relationships based on the orientation or positional relationships shown in the accompanying drawings, and are merely for the convenience of describing this invention, and do not mean that the device or element referred to must have a specific orientation or position, and therefore should not be construed as a limitation of this invention.

[0046] In the description of this invention, it should be noted that, unless otherwise explicitly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium. Those skilled in the art can understand the specific meaning of the above terms in this invention based on the specific circumstances.

[0047] like Figures 1-5 As shown, this embodiment of the invention provides a method for enhancing domestic IT security through intelligent dynamic threat perception, including:

[0048] Multi-source data acquisition steps: Through security probes deployed on core nodes of the domestic IT innovation environment, continuously collect underlying hardware operating status data, operating system kernel call logs, database access traces, network traffic metadata and application layer interaction behavior sequences to form a four-dimensional raw monitoring data stream covering the physical layer, system layer, data layer and application layer.

[0049] Heterogeneous data unification processing steps: The four-dimensional raw monitoring data stream is input into the heterogeneous data unification processing unit, the data of each dimension is slicing according to the preset time window length, the missing sampling points are filled by linear interpolation, the data of different dimensions are mapped to the zero to one interval by the normalization function, and the standardized time series observation matrix with consistent structure is output.

[0050] Known threat identification steps: Input the standardized time series observation matrix into the threat behavior identification model constructed based on spatiotemporal graph neural network. The model takes abnormal fluctuations in chip registers as the initial features of nodes, inter-process communication paths as edge connections, extracts cross-level attack propagation patterns through multi-layer graph convolution operations, focuses on high-risk behavior links through attention weight allocation mechanism, and outputs preliminary threat judgment results.

[0051] Unknown threat assessment steps: The preliminary threat assessment result is matched with the known attack fingerprints in the historical threat knowledge base using cosine similarity. If the matching degree is lower than a preset threshold, the unknown threat assessment process is triggered, and the reinforcement learning-driven adversarial inference engine is invoked to simulate the attacker's subsequent behavior in an isolated sandbox environment and generate an extended threat profile.

[0052] Dynamic policy generation steps: Based on the preliminary threat assessment results or extended threat profile, activate the dynamic policy generator, select the optimal combination from the preset defense action atomic library according to the current system resource load status, business continuity priority list and security policy constraints, determine the execution order and timing interval of each atomic action by solving a constrained multi-objective optimization problem, and output the defense policy instruction sequence.

[0053] Collaborative strategy execution steps: The defense strategy instruction sequence is distributed to the corresponding execution agent module, and each module synchronously adjusts its own operating parameters to achieve collaborative operation of threat blocking, resource isolation and privilege revoke;

[0054] Blockchain trusted evidence storage steps: During the execution of the defense strategy, the blockchain evidence storage unit is activated to encapsulate the threat judgment basis, strategy generation logic, execution timestamp, operation subject identifier and affected object hash value into a structured event record, and write it into the consortium blockchain ledger jointly maintained by multiple trust innovation nodes through a consensus algorithm;

[0055] Security assessment and self-calibration steps: Periodically read historical event records in the blockchain ledger, combine system stability indicators after the defense strategy is implemented, business interruption duration statistics and secondary attack occurrence rate to calculate comprehensive performance score, and trigger parameter self-calibration process based on the score results to adjust the sensitivity coefficient of the threat identification model, the resource allocation weight of the strategy generator and the data compression ratio of the evidence storage unit.

[0056] In this embodiment, security probes are deployed on core nodes of the domestic IT innovation environment, continuously collecting underlying hardware operating status data, operating system kernel call logs, database access trajectories, network traffic metadata, and application layer interaction behavior sequences, forming a four-dimensional raw monitoring data stream covering the physical layer, system layer, data layer, and application layer. This data stream enters the heterogeneous data unification processing unit, slides into slices according to a preset time window, fills missing sampling points using linear interpolation, and then maps to the zero-to-one interval through a normalization function, outputting a standardized time-series observation matrix. The matrix is ​​input to a threat behavior recognition model based on a spatiotemporal graph neural network, using abnormal fluctuations in chip registers as initial node features and inter-process communication paths as edge connections. After multi-layer graph convolution operations and an attention weight allocation mechanism, a preliminary threat judgment result is output. If the matching degree between this result and the historical threat knowledge base is lower than a preset threshold, an unknown threat assessment process is triggered. A reinforcement learning-driven adversarial inference engine simulates the attacker's subsequent behavior in an isolated sandbox, generating an extended threat profile. Based on preliminary judgment results or extended profiles, the dynamic strategy generator, combined with system resource load, business priorities, and security constraints, selects the optimal combination from the defense action atomic library, solves a multi-objective optimization problem, outputs a sequence of defense strategy instructions, and distributes them to the execution agent module to achieve collaborative defense. During the defense process, the blockchain evidence storage unit encapsulates relevant information into structured event records and writes them into the consortium blockchain ledger. The security assessment feedback module periodically reads the ledger data, calculates the comprehensive performance score, and triggers a parameter self-calibration process to continuously optimize system performance. This process enables accurate perception, intelligent response, and reliable traceability of threats at all levels in the domestic IT innovation environment, significantly improving the real-time performance and adaptability of defense.

[0057] In some implementations, in the heterogeneous data unification processing step, the time window length is set to 500 milliseconds, the normalization function adopts the minimum-maximum scaling formula, and the linear interpolation method is used to calculate the weighted average based on the values ​​of adjacent valid sampling points.

[0058] In this embodiment, after the four-dimensional raw monitoring data stream enters the heterogeneous data unification processing unit, a sliding slice is applied to the data of each dimension using a time window of 500 milliseconds to ensure the timeliness and continuity of data capture. For missing sampling points that occur during the acquisition process, a weighted average calculation is performed based on the values ​​of adjacent valid sampling points using linear interpolation to ensure data integrity. Simultaneously, the minimum-maximum scaling formula is used as the normalization function to uniformly map data of different dimensions to the zero-to-one interval, ultimately outputting a standardized time-series observation matrix with a consistent structure. This refined data processing method effectively solves the compatibility problem of heterogeneous data, provides high-quality, standardized input data for subsequent threat identification models, significantly improves the accuracy and efficiency of subsequent threat identification, and lays a solid foundation for the accurate extraction of cross-layer attack propagation patterns.

[0059] In some implementations, the known threat identification step includes a spatiotemporal graph neural network comprising a three-layer graph convolutional module, with each layer followed by a nonlinear activation function and a residual connection structure. The attention weight allocation mechanism is jointly calculated based on the node centrality index and the edge traffic density index. The preliminary threat determination result includes an attack type label, a confidence score, and an affected asset identifier.

[0060] In this embodiment, the standardized temporal observation matrix is ​​input into a threat behavior recognition model constructed based on a spatiotemporal graph neural network. This network contains three layers of graph convolutional modules, each followed by a nonlinear activation function and a residual connection structure, ensuring both the depth of feature extraction and effectively avoiding the gradient vanishing problem. The model uses abnormal fluctuations in chip registers as initial node features and inter-process communication paths as edge connections, extracting cross-level attack propagation patterns through multi-layer graph convolutional operations. An attention weight allocation mechanism combines node centrality and edge traffic density metrics for joint calculation, accurately focusing on high-risk behavior links, and finally outputting a preliminary threat assessment result including attack type labels, confidence scores, and affected asset identifiers. This multi-dimensional feature fusion and precise focusing recognition method significantly improves the accuracy of identifying known threats, enabling rapid identification of core attack links and buying valuable time for subsequent defense responses.

[0061] In some implementations, the unknown threat assessment step uses a deep Q-network architecture for the reinforcement learning-driven adversarial simulation engine. The state space is defined as the current set of controlled assets and the permission distribution matrix. The action space is defined as four types of atomic attack operations: port scanning, credential theft, service hijacking, and configuration tampering. The reward function is composed of the number of lateral movement steps, the level of permission elevation, and the duration of stealth maintenance. The extended threat profile includes the potential harm range and the spread speed.

[0062] In this embodiment, the initial threat assessment result is matched with the known attack fingerprints in the historical threat knowledge base using cosine similarity. When the matching degree is lower than a preset threshold, the unknown threat assessment process is initiated. The reinforcement learning-driven adversarial inference engine adopts a deep Q-network architecture, defining the current set of controlled assets and the permission distribution matrix as the state space, and port scanning, credential theft, service hijacking, and configuration tampering as the action space. The reward function is composed of the number of lateral movement steps, the level of privilege escalation, and the duration of stealth maintenance. In an isolated sandbox environment, the engine simulates the attacker's possible subsequent attack paths and methods, generating an extended threat profile that includes the potential harm range and spread speed. This mechanism breaks through the limitations of traditional detection methods that rely on known attack characteristics, can proactively infer the development trend of unknown threats, and deploy defense strategies in advance, effectively reducing the risks brought by zero-day vulnerabilities and new attacks.

[0063] In some implementations, the dynamic strategy generation step includes a defense action atomic library containing thirty-seven predefined action templates. The objective function of the multi-objective optimization problem is composed of a weighted sum of three indicators: threat suppression efficiency, resource consumption cost, and business impact. The constraints include the minimum available memory threshold of the system, critical process survival assurance requirements, and compliance audit integrity specifications.

[0064] In this embodiment, after receiving the preliminary threat assessment result or the expanded threat profile, the dynamic policy generator selects suitable defense actions from a defense action atomic library containing thirty-seven predefined action templates, based on the current system resource load status, business continuity priority list, and security policy constraints. The objective function of the multi-objective optimization problem is constituted by a weighted sum of three indicators: threat suppression efficiency, resource consumption cost, and business impact, while strictly adhering to constraints such as the minimum available memory threshold, critical process survival requirements, and compliance audit integrity specifications. By solving this optimization problem, the execution order and timing interval of each atomic action are determined, outputting a precise and efficient sequence of defense policy instructions. This dynamically optimized policy generation method achieves a balance between threat suppression, resource conservation, and business continuity, avoiding the rigidity of traditional fixed policies and significantly improving the flexibility and practicality of defense response.

[0065] In some implementations, the execution agent module in the collaborative policy execution step includes a network controller, a process manager, a key service middleware, an access control engine, and a log collector; the network controller adjusts the five-tuple filtering rule table according to instructions, the process manager sends a pause signal to the target process and migrates its memory pages to the isolation zone, the key service middleware triggers the immediate regeneration of elliptic curve digital signature algorithm key pairs, the access control engine updates the role-based access control policy tree, and the log collector increases the sampling frequency to two thousand records per second.

[0066] In this embodiment, after the defense policy instruction sequence is distributed to the execution agent module, which consists of a network controller, process manager, key service middleware, access control engine, and log collector, each module responds synchronously. The network controller adjusts the five-tuple filtering rule table according to the instructions to block threat propagation paths; the process manager sends a pause signal to the target process and migrates its memory pages to an isolation zone to prevent threat spread; the key service middleware triggers the immediate regeneration of elliptic curve digital signature algorithm key pairs to ensure data transmission and storage security; the access control engine updates the role-based access control policy tree to tighten permission control; and the log collector increases the sampling frequency to two thousand records per second to ensure complete traceability of threat behavior. This multi-module collaborative execution architecture achieves comprehensive defense including threat blocking, resource isolation, and permission revokement, significantly improving the execution efficiency and coverage of defense actions and ensuring the effective implementation of defense strategies.

[0067] In some implementations, in the blockchain trusted evidence storage step, the consortium blockchain adopts a practical Byzantine fault-tolerant consensus algorithm, the block size upper limit is set to two megabytes, the event record adopts a compact binary encoding format, the hash algorithm adopts the national cryptographic standard SM3, and the ledger synchronization delay is controlled within fifty milliseconds.

[0068] In this embodiment, during the execution of the defense strategy, the blockchain evidence storage unit is simultaneously activated, encapsulating key information such as threat assessment criteria, strategy generation logic, execution timestamps, operator identifiers, and affected object hash values ​​into a structured event record in a compact binary encoding format. The consortium blockchain employs a practical Byzantine fault-tolerant consensus algorithm to ensure data consistency and reliability. The block size is capped at two megabytes, and the hash algorithm uses the national cryptographic standard SM3 to ensure data encryption security. These event records are written to the consortium blockchain ledger, jointly maintained by multiple domestically developed nodes, through a consensus algorithm, with ledger synchronization latency controlled within fifty milliseconds. This mechanism achieves tamper-proof traceability across the entire security event chain, meeting the needs of compliance auditing and accountability, providing a solid and reliable basis for post-event analysis and accountability, and enhancing the credibility of the security handling process.

[0069] In some implementations, the comprehensive performance score calculation formula in the security assessment and self-calibration steps is: performance score = threat interception success rate × 0.6 + resource utilization optimization range × 0.25 + user-unaware operation ratio × 0.15; the parameter self-calibration process is executed once every 24 hours, or triggered immediately when the secondary attack occurrence rate exceeds 5% in a single day.

[0070] In this embodiment, the security assessment feedback module periodically reads historical event records from the blockchain ledger and combines them with system stability indicators, business interruption duration statistics, and secondary attack incidence rates after the defense strategy is implemented. A comprehensive performance score is calculated using the formula: Performance Score = Threat Interception Success Rate × 0.6 + Resource Utilization Optimization Amount × 0.25 + Percentage of User-Unnoticed Operations × 0.15. The parameter self-calibration process is automatically executed every 24 hours, and is triggered immediately if the secondary attack incidence rate exceeds 5% within a single day. During calibration, the system dynamically adjusts the sensitivity coefficient of the threat identification model, the resource allocation weight of the strategy generator, and the data compression ratio of the evidence storage unit. This closed-loop optimization mechanism enables the system to continuously adapt to changes in the attack and defense landscape, constantly improving threat identification accuracy, strategy rationality, and resource utilization efficiency, thus achieving continuous evolution of protection capabilities.

[0071] This invention also provides an intelligent dynamic threat perception-based domestic security enhancement system, comprising:

[0072] The multi-source data acquisition subsystem is deployed on each core node of the domestic IT innovation environment. It is used to continuously collect underlying hardware operating status data, operating system kernel call logs, database access trajectories, network traffic metadata, and application layer interaction behavior sequences, forming a four-dimensional raw monitoring data stream covering the physical layer, system layer, data layer, and application layer.

[0073] The heterogeneous data unification processing subsystem is used to receive the four-dimensional raw monitoring data stream, perform sliding slicing of the data in each dimension according to the preset time window length, fill missing sampling points using linear interpolation, map data of different dimensions to the zero-to-one interval through a normalization function, and output a standardized time series observation matrix with consistent structure.

[0074] The threat behavior identification subsystem, built on a spatiotemporal graph neural network, is used to receive the standardized time-series observation matrix, take abnormal fluctuations in chip registers as the initial features of nodes, take inter-process communication paths as edge connections, extract cross-level attack propagation patterns through multi-layer graph convolution operations, focus on high-risk behavior links through an attention weight allocation mechanism, and output a preliminary threat judgment result including attack type labels, confidence scores and affected asset identifiers.

[0075] The unknown threat assessment subsystem is triggered when the matching degree between the preliminary threat assessment result and the historical threat knowledge base is lower than a preset threshold. It calls the reinforcement learning-driven adversarial inference engine to simulate the lateral movement paths and privilege escalation methods that attackers may take in the isolated sandbox environment, and generates an extended threat profile that includes the potential scope of harm and the speed of spread.

[0076] The dynamic policy generation subsystem is used to receive the preliminary threat assessment results or extended threat profiles, select the optimal combination from the pre-set defense action atomic library based on the current system resource load status, business continuity priority list and security policy constraints, determine the execution order and timing interval of each atomic action by solving a constrained multi-objective optimization problem, and output an executable defense policy instruction sequence.

[0077] The policy execution agent subsystem includes a network controller, process manager, key service middleware, access control engine, and log collector. It is used to receive and execute the defense policy instruction sequence, synchronously adjust its own operating parameters, and realize the coordinated operation of threat blocking, resource isolation, and permission revocation.

[0078] The blockchain trusted evidence storage subsystem is used to encapsulate the threat assessment criteria, strategy generation logic, execution timestamp, operation subject identifier and affected object hash value into a structured event record during the execution of defense strategies, and write it into the consortium blockchain ledger jointly maintained by multiple trust innovation nodes through a consensus algorithm;

[0079] The security assessment feedback subsystem is used to periodically read historical event records in the blockchain ledger, combine system stability indicators after the defense strategy is implemented, business interruption duration statistics and secondary attack occurrence rate to calculate the comprehensive performance score of the current security system, and trigger the parameter self-calibration process of the assessment indicator system based on the score results to adjust the sensitivity coefficient of the threat identification model, the resource allocation weight of the policy generator and the data compression ratio of the evidence storage unit.

[0080] In this embodiment, the multi-source data acquisition subsystem is deployed on each core node of the domestic IT innovation environment, comprehensively collecting four-dimensional raw monitoring data streams from the physical layer, system layer, data layer, and application layer. The heterogeneous data unification processing subsystem performs sliding slicing, missing value imputation, and normalization on this data stream, outputting a standardized time-series observation matrix. The threat behavior identification subsystem, based on a spatiotemporal graph neural network, extracts cross-layer attack propagation patterns and outputs preliminary threat assessment results including attack type labels, confidence scores, and affected asset identifiers. The unknown threat assessment subsystem activates when the preliminary assessment results are insufficiently matched, generating an extended threat profile through a reinforcement learning-driven adversarial inference engine. The dynamic strategy generation subsystem outputs an optimized defense strategy instruction sequence based on threat information and system status. The strategy execution agent subsystem executes defense instructions collaboratively through multiple functional modules, the blockchain trusted evidence storage subsystem ensures full traceability of security events, and the security assessment feedback subsystem achieves comprehensive performance evaluation and parameter self-calibration. These subsystems work together to construct a comprehensive, intelligent, and evolvable domestic IT innovation security protection system, comprehensively enhancing the domestic IT innovation environment's ability to respond to various security threats.

[0081] In some implementations, the spatiotemporal graph neural network comprises three layers of graph convolutional modules, each followed by a nonlinear activation function and a residual connection structure; the reinforcement learning-driven adversarial inference engine employs a deep Q-network architecture; the consortium blockchain uses a practical Byzantine fault-tolerant consensus algorithm, and the hash algorithm uses the national cryptographic standard SM3; the comprehensive performance score calculation formula is as follows:

[0082] Performance score = Threat interception success rate × 0.6 + Resource utilization optimization level × 0.25 + Percentage of user-unnoticed operations × 0.15.

[0083] In this embodiment, the spatiotemporal graph neural network employs a three-layer graph convolutional module, with each layer followed by a nonlinear activation function and a residual connection structure to ensure the depth and effectiveness of feature extraction. The reinforcement learning-driven adversarial inference engine adopts a deep Q-network architecture to accurately simulate the evolution of unknown threats. The consortium blockchain uses a practical Byzantine fault-tolerant consensus algorithm, coupled with the national cryptographic SM3 hash standard, to ensure secure and efficient synchronization of evidence storage. The comprehensive performance score is calculated using the formula: threat interception success rate × 0.6 + resource utilization optimization magnitude × 0.25 + user-unnoticed operation ratio × 0.15. The optimized design of these core components further improves the accuracy of system threat identification, the scientific nature of unknown threat assessment, the security of evidence storage, and the rationality of performance evaluation. This enables the system to continuously and stably output high-quality security protection capabilities in the complex and ever-changing domestic IT security environment, achieving full-process optimization of threat perception, response, tracing, and evolution.

[0084] Specific embodiments of the present invention are provided below:

[0085] The embodiment provides a method and system for enhancing the security of domestic IT innovation based on intelligent dynamic threat perception, which is applied to the domestic IT innovation environment of government cloud. This environment is built on the Loongson 3A5000 chip, the Kylin V10 operating system and the Renmin University Kingbase database, and includes 200 server nodes to carry core businesses such as government approval and data sharing.

[0086] The multi-source data acquisition subsystem collects hardware status data such as chip register voltage fluctuations and temperature data through hardware probes deployed on each server node; collects kernel call logs such as operating system process creation, file reading and writing, and network connection through kernel-mode plugins; collects trajectory data such as SQL execution statements and access permission changes through database audit plugins; collects TCP / UDP session metadata through traffic mirroring; and collects interactive behavior sequences such as user login and data submission through application tracking points, forming a four-dimensional raw monitoring data stream.

[0087] The heterogeneous data unification processing subsystem performs sliding slices on the four-dimensional data with a time window of 500ms. It uses linear interpolation to fill in the missing sampling points caused by the acquisition delay. It maps data of different dimensions, such as hardware temperature (0-100℃) and network traffic (0-10Gbps), to the [0,1] interval through the minimum-maximum scaling formula, and outputs a 32×32 dimension standardized time series observation matrix.

[0088] The spatiotemporal graph neural network of the threat behavior identification subsystem contains three layers of graph convolution modules. The first layer of graph convolution extracts process-level attack features, the second layer extracts cross-process propagation features, and the third layer extracts hardware-system-application cross-level features. Each layer is followed by a ReLU activation function and residual connections to avoid gradient vanishing. The attention weight allocation mechanism combines node centrality (core business processes have higher weights than ordinary processes) and edge traffic density (abnormal communication links have higher weights than normal links). It outputs attack type labels (such as SQL injection, privilege escalation), confidence scores (0-100 points), and preliminary threat judgment results of the affected server IPs.

[0089] When the cosine similarity between the initial threat assessment result and the historical threat knowledge base is less than 0.7, the unknown threat assessment subsystem is triggered. Its deep Q network architecture's state space contains the asset list and permission matrix of the current 200 servers, and its action space contains four types of atomic attack operations: port scanning, credential theft, service hijacking, and configuration tampering. It simulates the attacker's lateral movement path within 10 minutes in an isolated sandbox, generating an expanded threat profile with a range of harm (e.g., affecting 5 core servers) and a spread rate (e.g., infecting 2 servers per minute).

[0090] The dynamic policy generation subsystem selects combinations from an atomic library containing 37 action templates. The objective function is threat suppression efficiency (weight 0.6), resource consumption cost (weight 0.25), and business impact (weight 0.15). The constraints are set as follows: the system's available memory is not less than 4GB, the core approval process must run continuously, and audit logs must be retained completely for 90 days. The optimal solution is found through particle swarm optimization algorithm, and the output is a sequence of instructions: "Network controller blocks attacking IPs, process manager isolates malicious processes, and key service middleware rotates database keys".

[0091] In the policy execution agent subsystem, the network controller adjusts the five-tuple filtering rule table to block access to ports 80 / 443 by the attacking IP, the process manager sends a SIGSTOP signal to the malicious process and migrates its memory pages to an independent isolation zone, the key service middleware generates a new elliptic curve digital signature key pair and updates the database connection configuration within 5 seconds, the access control engine reduces the permissions of the affected account to read-only, and the log collector increases the sampling frequency from 500 records per second to 2000 records per second.

[0092] The blockchain trusted evidence storage subsystem adopts a consortium chain composed of 6 trusted innovation nodes. It uses a practical Byzantine fault-tolerant consensus algorithm to encapsulate the threat judgment criteria (such as abnormal SQL statement hash), strategy generation logic (such as objective function parameters), execution timestamp, operation subject (system administrator account) and affected object (database name hash) into binary encoded event records, writes them into blocks with a maximum size of 2MB, and controls the ledger synchronization delay to 45ms to ensure that the data is tamper-proof.

[0093] The security assessment feedback subsystem reads the blockchain ledger every 24 hours. If the threat interception success rate is 95%, resource utilization is optimized by 15%, and the percentage of user-unnoticed operations is 98%, then the performance score = 95%×0.6 + 15%×0.25 + 98%×0.15 = 0.57 + 0.0375 + 0.147 = 0.7545. If the secondary attack rate reaches 6% on the same day, a self-calibration process is immediately triggered, increasing the sensitivity coefficient of the threat identification model by 20%, reducing the resource consumption weight of the policy generator by 10%, and adjusting the data compression ratio of the evidence storage unit from 8:1 to 4:1.

[0094] Tests showed that the threat perception latency of this embodiment was 300ms, the accuracy rate of unknown threat identification reached 92%, the business interruption time after the defense strategy was executed was less than 1 second, the response time of blockchain evidence query was less than 100ms, and the secondary attack rate was reduced to 1.2%. Compared with existing technologies, this embodiment significantly improves the security protection capabilities of the domestic IT innovation environment.

[0095] Alternative solutions description

[0096] Data acquisition alternatives: Hardware status data can be collected by the monitoring interface built into the domestic chip (such as Loongson's LS2K1000 monitoring module) instead of independent probes, and application layer data can be collected by API gateway logs instead of application tracking points, both of which can achieve full coverage of four-dimensional data;

[0097] Model architecture replacement: The spatiotemporal graph neural network can be replaced with a graph attention network (GAT) or a gated graph neural network (GGNN), and the reinforcement learning engine can be replaced with a proximal policy optimization (PPO) algorithm, which can still achieve cross-layer attack identification and unknown threat inference;

[0098] Algorithm replacement: The multi-objective optimization algorithm for dynamic strategy generation can be replaced by a genetic algorithm or a simulated annealing algorithm. The defense action atomic library can be expanded to 50 types according to the scenario without affecting the adaptive generation effect of the strategy.

[0099] Consensus algorithm replacement: The practical Byzantine fault-tolerant consensus for blockchain evidence storage can be replaced by Simplified Byzantine Fault Tolerance (SBFT) or Delegated Byzantine Fault Tolerance (dBFT), and the hash algorithm can be replaced by the national cryptographic standard SM4, which can still meet the requirements of trusted evidence storage and non-repudiation.

[0100] Self-calibration trigger condition replacement: The parameter self-calibration process can be triggered when the weekly performance score is lower than a preset threshold (such as 0.7). The weight coefficient of the comprehensive performance score formula can be adjusted (such as a threat interception success rate weight of 0.7), which can achieve continuous evolution of protection capabilities.

[0101] Key technologies (ranked by importance)

[0102] A four-dimensional data acquisition and 500ms window unified processing technology covering the physical layer, system layer, data layer and application layer solves the problem of cross-layer data heterogeneity.

[0103] A spatiotemporal graph neural network threat identification model with chip register anomalies as nodes and process communication paths as edges is used to extract cross-layer attack propagation patterns.

[0104] Sandbox adversarial simulation technology based on deep Q-networks solves the problem of assessing unknown threats;

[0105] A multi-objective optimization dynamic strategy generation technology that combines business priorities and resource load avoids strategy rigidity;

[0106] The trusted evidence storage technology of the consortium blockchain, powered by national cryptographic algorithms, ensures that security incidents are traceable throughout the entire chain.

[0107] Based on a full-parameter self-calibration closed-loop technology with quantitative performance scoring, the protection capability is continuously evolved.

[0108] A multi-agent collaborative execution architecture ensures the synchronous implementation of defense strategies;

[0109] The software and hardware adaptation and optimization technologies for domestically developed technologies (such as the adaptation of domestic chip interfaces and the development of kernel-mode plugins for the Kylin system) ensure the compatibility of the solution.

[0110] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the devices, apparatuses, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0111] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in the present invention, and these modifications or substitutions should all be covered within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A method for enhancing security of a smart dynamic threat perception, characterized in that, The method comprises the following steps: Multi-source data collection step: through the deployment of a security probe in the core node of the Xinchuang environment, continuously collect the running state data of the underlying hardware, the operating system kernel call log, the database access track, the network traffic metadata and the application layer interaction behavior sequence, and form a four-dimensional original monitoring data stream covering the physical layer, system layer, data layer and application layer; Heterogeneous data unification processing step: input the four-dimensional original monitoring data stream into the heterogeneous data unification processing unit, slice each dimension of data according to the preset time window length, fill in the missing sampling points by using the linear interpolation method, map the data of different dimensions to the interval of zero to one through the normalization function, and output a standardized time series observation matrix with consistent structure; Known threat identification step: input the standardized time series observation matrix into a threat behavior identification model based on a spatio-temporal graph neural network, the model takes the abnormal fluctuation of the chip register as the initial feature of the node, takes the inter-process communication path as the edge connection relationship, extracts the cross-level attack propagation mode through multi-layer graph convolution operation, focuses on the high-risk behavior link through the attention weight distribution mechanism, and outputs the preliminary threat determination result; Unknown threat research and judgment step: the preliminary threat determination result is matched with the known attack fingerprints in the historical threat knowledge base through cosine similarity, if the matching degree is lower than the preset threshold, the unknown threat research and judgment process is triggered, the reinforcement learning driven counter deduction engine is called, the subsequent behavior of the attacker is simulated in the isolated sandbox environment, and an extended threat portrait is generated; Dynamic strategy generation step: based on the preliminary threat determination result or the extended threat portrait, the dynamic strategy generator is activated, the optimal combination is selected from the preset defense action atom library according to the current system resource load state, the business continuity priority list and the security policy constraint condition, the execution order and time interval of each atomic action are determined by solving the multi-objective optimization problem with constraints, and the defense strategy instruction sequence is output; Cooperative strategy execution step: the defense strategy instruction sequence is distributed to the corresponding execution agent module, each module synchronously adjusts its running parameters, and the cooperative operation of threat blocking, resource isolation and permission recovery is realized; Blockchain trusted evidence step: during the execution of the defense strategy, the blockchain evidence unit is started, the threat determination basis, the strategy generation logic, the execution timestamp, the operation subject identifier and the affected object hash value are packaged into a structured event record, and the structured event record is written into the alliance chain ledger maintained by multiple Xinchuang nodes through the consensus algorithm; Security evaluation and self-calibration step: periodically read the historical event records in the blockchain ledger, combine the system stability index after the execution of the defense strategy, the business interruption time length statistical value and the secondary attack occurrence rate, calculate the comprehensive performance score, and trigger the parameter self-calibration process according to the score result, adjust the sensitivity coefficient of the threat identification model, the resource allocation weight of the strategy generator and the data compression ratio of the evidence unit.

2. The Xeon security enhanced method of intelligent dynamic threat perception according to claim 1, wherein, In the heterogeneous data unification processing step, the time window length is set to 500 milliseconds, the normalization function adopts the minimum and maximum scaling formula, and the linear interpolation method is calculated by weighted average according to the numerical values of the adjacent effective sampling points.

3. The method of claim 1, wherein the method further comprises: In the known threat identification step, the space-time graph neural network includes three layers of graph convolution modules, each followed by a nonlinear activation function and a residual connection structure, and an attention weight distribution mechanism is jointly calculated based on node centrality indicators and edge flow density indicators, and the preliminary threat determination result includes an attack type label, a confidence score and an affected asset identification.

4. The method of claim 1, wherein the method further comprises: In the unknown threat judgment step, the reinforcement learning driven adversarial reasoning engine adopts a deep Q network architecture, the state space is defined as the current controlled asset set and the permission distribution matrix, the action space is defined as four types of atomic attack operations including port scanning, credential stealing, service hijacking and configuration tampering, the reward function is composed of the number of horizontal movement steps, the level of permission promotion and the length of time maintaining concealment, and the extended threat portrait includes the potential damage range and the diffusion speed.

5. The method of claim 1, wherein the method further comprises: In the dynamic strategy generation step, the defense action atom library includes thirty-seven pre-defined action templates, the objective function of the multi-objective optimization problem is composed of the weighted sum of three indicators including threat suppression efficiency, resource consumption cost and business impact level, and the constraint conditions include the minimum available memory threshold of the system, the survival guarantee requirement of the key process and the integrity specification of the compliance audit.

6. The method of claim 1, wherein the method further comprises: In the cooperative strategy execution step, the execution agent module includes a network controller, a process manager, a key service middleware, an access control engine and a log collector; the network controller adjusts the five-tuple filtering rule table according to the instructions, the process manager sends a pause signal to the target process and migrates its memory page to the isolation area, the key service middleware triggers the instant regeneration of the elliptic curve digital signature algorithm key pair, the access control engine updates the role-based access control policy tree, and the log collector increases the sampling frequency to two thousand records per second.

7. The method of claim 1, wherein the method further comprises: In the blockchain trusted evidence step, the consortium chain adopts a practical Byzantine fault tolerance consensus algorithm, the upper limit of the block size is set to two megabytes, the event record adopts a compact binary encoding format, the hash algorithm selects the national standard SM3, and the ledger synchronization delay is controlled within fifty milliseconds.

8. The method of claim 1, wherein the method further comprises: In the security evaluation and self-calibration step, the comprehensive performance score calculation formula is: performance score = threat interception success rate × 0.6 + resource utilization optimization amplitude × 0.25 + user non-perception operation proportion × 0.15; the parameter self-calibration process is executed once every twenty-four hours, or immediately triggered when the attack occurrence rate exceeds five percent within a single day.

9. A smart dynamic threat-aware XeonSafe security enhancement system, characterized in that, It comprises: A multi-source data acquisition subsystem deployed on each core node in the Xinyuan environment for continuously collecting bottom-layer hardware running state data, operating system kernel call logs, database access trajectories, network traffic metadata and application layer interaction behavior sequences, forming four-dimensional raw monitoring data streams covering the physical layer, system layer, data layer and application layer; A heterogeneous data unification processing subsystem for receiving the four-dimensional raw monitoring data streams, slicing each dimension data according to a preset time window length, filling missing sampling points using linear interpolation, and mapping data of different dimensions to the interval of zero to one through a normalization function, outputting a standardized time series observation matrix with consistent structure; The threat behavior recognition subsystem is constructed based on a spatio-temporal graph neural network, configured to receive the standardized time-series observation matrix, take abnormal fluctuations in chip registers as initial features of nodes, take inter-process communication paths as connection relationships between edges, extract cross-level attack propagation patterns through multi-layer graph convolution operations, focus on high-risk behavior links through an attention weight distribution mechanism, and output preliminary threat determination results including attack type labels, confidence scores, and affected asset identifications; The unknown threat judgment subsystem is configured to be triggered when the matching degree between the preliminary threat determination results and a historical threat knowledge base is lower than a preset threshold, to call a reinforcement learning driven adversarial reasoning engine, to simulate subsequent possible lateral movement paths and privilege escalation means of an attacker in an isolated sandbox environment, and to generate an extended threat profile including potential damage range and diffusion speed; The dynamic strategy generation subsystem is configured to receive the preliminary threat determination results or the extended threat profile, to select an optimal combination from a preset defense action atom library according to current system resource load state, business continuity priority list, and security policy constraint conditions, to determine the execution order and time interval of each atomic action by solving a constrained multi-objective optimization problem, and to output an executable defense strategy instruction sequence; The strategy execution agent subsystem includes a network controller, a process manager, a key service middleware, an access control engine, and a log collector, configured to receive and execute the defense strategy instruction sequence, to synchronously adjust its own running parameters, and to realize the cooperative operation of threat blocking, resource isolation, and privilege recovery; The blockchain trusted evidence subsystem is configured to encapsulate threat determination basis, strategy generation logic, execution timestamp, operation subject identification, and affected object hash value as a structured event record during the execution of the defense strategy, and to write the structured event record into a consortium chain ledger maintained by multiple trust creation nodes through a consensus algorithm; The security evaluation feedback subsystem is configured to periodically read historical event records in the blockchain ledger, to calculate a comprehensive performance score of the current security system in combination with system stability indicators, business interruption duration statistics, and secondary attack occurrence rate after the execution of the defense strategy, and to trigger a parameter self-calibration process of the evaluation index system according to the score result, to adjust the sensitivity coefficient of the threat recognition model, the resource allocation weight of the strategy generator, and the data compression ratio of the evidence unit.

10. The intelligent dynamic threat-aware XGS enhanced security system of claim 9, wherein, The spatio-temporal graph neural network includes three layers of graph convolution modules, each followed by a nonlinear activation function and a residual connection structure; the reinforcement learning driven adversarial reasoning engine adopts a deep Q network architecture; the consortium chain adopts a practical Byzantine fault tolerance consensus algorithm, and the hash algorithm selects the national standard SM3; and the comprehensive performance score calculation formula is: Performance score = threat interception success rate × 0.6 + resource utilization optimization amplitude × 0.25 + user non-perception operation proportion × 0.15.

Images