Information security threat real-time blocking method based on edge calculation

Abstract

The invention discloses an information security threat real-time blocking method based on edge computing. The method comprises the following steps: collecting network flow data and security event data at an edge node; extracting a statistical feature vector, and encoding the statistical feature vector into a security feature vector; based on the stage judgment feature set, determining an attack stage category corresponding to the time step; based on an attack stage label and a staged feature subspace mapping scheme, mapping the security feature vector into a plurality of subspace feature sets; inputting the target subspace feature sequence into a sub auto-encoder and an output auto-encoder in an improved Kitsune model to obtain a stage total reconstruction error sequence; performing normalization and time smoothing processing on the stage total reconstruction error sequence; and determining the threat level of the current time step, and selecting and executing a corresponding blocking strategy. According to the method, an improved Kitsune model is adopted, and real-time and accurate blocking of security threats in an edge scene is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security and edge computing technology, and particularly relates to a method for blocking information security threats in real time based on edge computing. BACKGROUND

[0002] In the existing network security protection system, the anomaly detection method based on traffic features is widely used to identify potential attack behaviors. Some methods perform field analysis, session reorganization and feature statistics on network traffic, construct a fixed-dimensional input feature vector, and use an autoencoder model to reconstruct the features, and determine the anomaly according to the reconstruction error.

[0003] However, such methods usually use fixed feature subspace division and uniform autoencoder structure, and do not distinguish the differences in feature representation and key feature weight between different attack stages, resulting in inconsistent detection sensitivity in different stages such as scanning, penetration and lateral movement.

[0004] The existing methods are difficult to accurately identify the attack stage when dealing with time series feature changes, and lack the ability to accurately identify the attack stage. In addition, the traditional anomaly detection result is usually a single anomaly score, which cannot effectively associate the threat level and cannot form a linkage mechanism with the real-time blocking strategy, so it cannot take differentiated blocking measures for different levels of threats at the edge node.

[0005] For resource-constrained edge devices, the conventional model cannot adaptively select the subspace structure according to the attack stage, and all features are involved in the calculation, which may cause unnecessary computational overhead and affect the real-time performance.

[0006] Based on the above factors, the existing technology cannot simultaneously meet the lightweight demand, stage perception ability and real-time blocking ability in the edge environment.

[0007] Therefore, how to provide a method for blocking information security threats in real time based on edge computing is a problem that those skilled in the art need to solve. SUMMARY

[0008] An object of the present application is to provide an edge computing-based information security threat real-time blocking method. The present application uses an improved Kitsune multi-subspace autoencoder structure, introduces an attack phase determination mechanism, a phased feature subspace mapping scheme and a phase gating unit, and performs phased lightweight anomaly analysis on the statistical feature sequence of network traffic. By constructing a sub-autoencoder cluster corresponding to the attack phase, a subspace activation marker and a weight vector, the present application can realize adaptive feature processing and reconstruction error modeling for different attack phases on the edge node, and generate a threat score sequence based on normalization and time smoothing. Combined with the threat level and the attack phase, the present application can perform access control, connection interruption or traffic restriction on the edge side to realize real-time blocking. Compared with traditional fixed-structure anomaly detection models, the present application fully utilizes the multi-subspace advantage of the improved Kitsune model, has strong phase recognition ability, high model structure adaptability, low edge computing overhead and high real-time blocking efficiency.

[0009] An edge computing-based information security threat real-time blocking method according to an embodiment of the present application includes the following steps:

[0010] Collect network traffic data and security event data at the edge node, perform preprocessing on the collected data, and construct a security feature original input sequence;

[0011] Extract a statistical feature vector based on the security feature original input sequence, and encode the statistical feature vector into a security feature vector to obtain a security feature vector sequence;

[0012] Based on the security feature vector sequence, form a phase determination feature set, and determine the attack phase category of the corresponding time step according to the phase determination feature set to obtain an attack phase label;

[0013] Based on the attack phase label and the phased feature subspace mapping scheme, map the security feature vector to multiple subspace feature sets to obtain a target subspace feature sequence;

[0014] Input the target subspace feature sequence into the sub-autoencoder in the improved Kitsune model to form a reconstruction error vector, and input the output autoencoder to obtain a phase total reconstruction error sequence;

[0015] Through the phase gating unit set in the improved Kitsune model, perform normalization and time smoothing processing on the phase total reconstruction error sequence to obtain a threat score sequence;

[0016] Compare the threat score with the multi-level threshold to determine the threat level of the current time step, and select and execute the corresponding blocking strategy according to the attack phase label and the threat level.

[0017] Optionally, the preprocessing comprises a field parsing process, a session reorganization process and a time alignment process.

[0018] Optionally, the extracting the statistical feature vector based on the security feature raw input sequence and encoding the statistical feature vector into a security feature vector to obtain a security feature vector sequence specifically comprises:

[0019] Based on each time step feature vector in the security feature raw input sequence, a port access frequency vector is formed.

[0020] Based on the connection results of all network connections within a time step, the number of connection failures within the time step is counted to form an internal and external network access relationship vector.

[0021] According to the protocol type of each network connection within a time step, the protocol type is encoded one by one to form a protocol type vector.

[0022] The connection quantity scalar corresponding to the time step, the port access frequency vector, the connection failure proportion scalar, the internal and external network access relationship vector and the protocol type vector are sequentially spliced to form a statistical feature vector.

[0023] All components in the statistical feature vector are normalized, and the normalized statistical feature vector is mapped to a fixed dimension security feature vector to form a security feature vector sequence.

[0024] Optionally, based on the security feature vector sequence, a phase judgment feature set is formed, and the attack phase category of the corresponding time step is determined according to the phase judgment feature set to obtain an attack phase label, which specifically comprises:

[0025] From the security feature vector in the security feature vector sequence, the security feature vectors are combined to form a time window feature set.

[0026] Each time step security feature vector in the time window feature set is processed in turn to form a phase judgment feature vector corresponding to the time step.

[0027] The phase judgment feature vectors obtained in each time step within the time window are combined in time step order to form a phase judgment feature set.

[0028] The phase judgment feature vectors in the phase judgment feature set are subjected to sequence analysis to obtain an attack phase label.

[0029] Optionally, based on the attack phase label and the phased feature subspace mapping scheme, the security feature vector is mapped to a plurality of subspace feature sets to obtain a target subspace feature sequence, which specifically comprises:

[0030] Establish corresponding feature subspace partitioning rules for each attack phase, and construct a phased feature subspace mapping scheme from all feature subspace partitioning rules.

[0031] Based on the attack stage label, select the feature subspace partitioning rule corresponding to the attack stage label from the staged feature subspace mapping scheme to form multiple subspace feature vector sets;

[0032] Multiple subspace feature vectors obtained within the same time step are arranged according to the order of the time steps. Subspace feature vectors of time steps belonging to the same subspace are combined in sequence to form multiple subspace feature sequences.

[0033] Multiple subspace feature sequences are combined sequentially according to the order of the subspaces to form the target subspace feature sequence.

[0034] Optionally, the step of inputting the target subspace feature sequence into the sub-autoencoder in the improved Kitsune model to form a reconstruction error vector, and then inputting it into the output autoencoder to obtain the total reconstruction error sequence for the stage, specifically includes:

[0035] In the improved Kitsune model, a sub-autoencoder cluster and an output autoencoder corresponding to each attack stage are established.

[0036] For each attack phase, a subspace activation label vector corresponding to each sub-autoencoder and a weight vector corresponding to each subspace reconstruction error are established.

[0037] Based on the attack phase label, select the sub-autoencoder cluster and output autoencoder from the improved Kitsune model, and obtain the subspace activation label sequence from the subspace activation label vector;

[0038] Establish a one-to-one correspondence between each subspace feature sequence in the target subspace feature sequence and each subautoencoder in the selected subautoencoder cluster;

[0039] The subspace reconstruction error is obtained based on the target subspace feature sequence, and the subspace reconstruction errors at each time step are combined in the order of time steps to form a subspace reconstruction error sequence.

[0040] Within each time step, the subspace reconstruction error of each subspace within the time step is weighted according to the weight components in the weight vector corresponding to the attack phase label, forming a reconstruction error vector.

[0041] Arrange the reconstruction error vectors of all time steps in chronological order to form a sequence of reconstruction error vectors;

[0042] The reconstruction error vectors in the reconstruction error vector sequence are sequentially input into the output autoencoder corresponding to the attack stage label according to the time step order, forming the total reconstruction error sequence of the stage.

[0043] Optionally, the step of obtaining the subspace reconstruction error based on the target subspace feature sequence and combining the subspace reconstruction errors of each time step in time step order to form a subspace reconstruction error sequence specifically includes:

[0044] For each subspace feature sequence in the target subspace feature sequence, obtain the subspace activation label sequence;

[0045] At each time step, when the subspace activation flag indicates that the subspace is in an active state, the subspace feature vector is input into the sub-autoencoder corresponding to the subspace feature sequence to obtain the reconstructed subspace feature vector and calculate the subspace reconstruction error.

[0046] In each time step, when the subspace activation flag corresponding to the time step indicates that the subspace is in an inactive state, the subspace reconstruction error of the time step is set to zero.

[0047] Under the condition of fixed subspace index, the subspace reconstruction errors obtained at each time step are arranged in the order of time steps to form a subspace reconstruction error sequence.

[0048] Optionally, the step of normalizing and time-smoothing the total reconstruction error sequence of the stages by setting the stage gating unit in the improved Kitsune model to obtain the threat score sequence specifically includes:

[0049] In the improved Kitsune model, a stage gating unit is set up. The stage gating unit determines the activation state of the sub-autoencoder cluster and the output autoencoder based on the attack stage label and generates a stage gating tag sequence.

[0050] At each time step, when the stage gating flag indicates that the output autoencoder corresponding to the current attack stage is in an active state, the total stage reconstruction error is input into the corresponding output autoencoder processing unit to obtain the stage reconstruction value.

[0051] When the stage gating flag indicates that the output autoencoder is inactive, the stage reconstruction value is recorded as zero, and the stage reconstruction values ​​of all time steps are combined in time step order to form a stage reconstruction value sequence.

[0052] Normalization is performed on each stage reconstruction value in the stage reconstruction value sequence to obtain a normalized value, and the normalized values ​​of all time steps are combined in time step order to form a normalized sequence.

[0053] The normalized values ​​at each time step in the normalized sequence are smoothed in time step order to obtain the smoothed value at the current time step. The smoothed values ​​obtained at all time steps are then combined in time step order to form a threat score sequence.

[0054] Optionally, the step of comparing the threat score with multi-level thresholds to determine the threat level at the current time step, and selecting and executing the corresponding blocking strategy based on the attack phase label and threat level, specifically includes:

[0055] The threat scores at each time step are obtained sequentially from the threat score sequence, and the threat scores are compared level by level according to the order of multi-level thresholds to obtain the corresponding threat level;

[0056] Based on the threat level and attack phase label of the time step, select blocking policy tags from the blocking policy tag set;

[0057] When the blocking policy flag indicates that access control rules need to be issued, the access restriction configuration corresponding to the target network traffic is generated and executed according to the access control rules.

[0058] When the blocking policy flag indicates that a connection interruption rule needs to be issued, a disconnection command corresponding to the target connection is generated and executed according to the connection interruption rule.

[0059] When the blocking policy flag indicates that a traffic limiting rule needs to be issued, the rate limiting parameter or flow limiting parameter corresponding to the target network traffic is generated according to the traffic limiting rule and then executed.

[0060] The beneficial effects of this invention are:

[0061] This invention introduces time-series variation analysis and attack phase determination mechanisms into feature processing, enabling the detection process to be structured based on the differences in network behavior at different stages. Compared to traditional detection methods that rely solely on static statistical features, this invention can identify potential attack phases based on the changing patterns of features over time. This allows subsequent feature subspace partitioning and model structure selection to better align with actual network behavior characteristics, improving the expressive power of phase-related anomalies.

[0062] This invention constructs a staged feature subspace mapping scheme and establishes corresponding sub-autoencoder clusters and output autoencoder structures for different attack stages within the improved Kitsune model. This enables the model to automatically select the subspaces to participate in the computation and the corresponding autoencoder structures based on the attack stage labels. By combining subspace activation markers and subspace weight vectors, this invention, while maintaining controllable computational paths, can highlight feature subspaces highly relevant to the current attack stage and reduce the influence of irrelevant features. This is beneficial for improving the targeting and efficiency of the detection process under the computational constraints of edge nodes.

[0063] This invention constructs a continuous threat scoring sequence through stage-based gating units, normalization processing, and time smoothing mechanisms. It then maps these threat scores to different levels using multi-level thresholds. Furthermore, it selects appropriate blocking strategies based on the combination of attack stage and threat level, enabling close linkage between detection results and real-time protection measures. This mechanism allows edge nodes to promptly implement access control, connection interruption, or traffic restriction when detection results change, thus forming a complete response chain from stage identification to real-time blocking, which helps improve the timeliness and accuracy of network attack blocking. Attached Figure Description

[0064] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0065] Figure 1 This is a flowchart of a real-time information security threat blocking method based on edge computing proposed in this invention;

[0066] Figure 2 This is a schematic diagram of the improved Kitsune model structure in the real-time blocking method for information security threats based on edge computing proposed in this invention;

[0067] Figure 3 This is a schematic diagram of the sub-autoencoder reconstruction process in a real-time information security threat blocking method based on edge computing proposed in this invention. Detailed Implementation

[0068] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0069] refer to Figures 1-3 A real-time information security threat blocking method based on edge computing includes the following steps:

[0070] Network traffic data and security event data are collected at edge nodes, and the collected data is preprocessed to construct the original input sequence of security features;

[0071] Statistical feature vectors are extracted from the original input sequence of security features, and the statistical feature vectors are encoded into security feature vectors to obtain a security feature vector sequence.

[0072] Based on the security feature vector sequence, a phase determination feature set is formed, and the attack phase category of the corresponding time step is determined according to the phase determination feature set to obtain the attack phase label;

[0073] Based on the attack phase label and phased feature subspace mapping scheme, the security feature vector is mapped into multiple subspace feature sets to obtain the target subspace feature sequence;

[0074] The target subspace feature sequence is input into the sub-autoencoder in the improved Kitsune model to form a reconstruction error vector, which is then input into the output autoencoder to obtain the total reconstruction error sequence for the stage.

[0075] By setting the stage gating unit in the improved Kitsune model, the total stage reconstruction error sequence is normalized and time-smoothed to obtain the threat score sequence.

[0076] The threat score is compared with multi-level thresholds to determine the threat level at the current time step, and the corresponding blocking strategy is selected and executed based on the attack stage label and threat level.

[0077] In this embodiment, the step of collecting network traffic data and security event data at edge nodes, performing preprocessing on the collected data, and constructing the original input sequence of security features specifically includes:

[0078] At the edge node, the raw network traffic data and raw security event data of the network to be detected are acquired. The acquired raw network traffic is recorded in chronological order of acquisition time to form a data sequence composed of network traffic records at multiple time steps. Each network traffic record in the data sequence corresponds to the time step at which it was acquired.

[0079] Perform field parsing processing on each data unit in the data sequence, and parse the source address field, destination address field, source port field, destination port field, protocol type field and timestamp field to generate a set of field parsing results;

[0080] Based on the set of field parsing results, the parsing results of fields with the same source address, destination address, source port, destination port and protocol type are classified. All data units belonging to the same network session are aggregated according to the collection time order to form the corresponding session sequence. Each session sequence consists of network traffic records of multiple time steps, thus forming a set of session sequences.

[0081] Time alignment is performed on the session sequence set. Based on the timestamp information of each data unit in the session sequence, the network traffic records of different session sequences in the same time interval are aligned to form a network traffic record sequence arranged according to a unified time step.

[0082] The network traffic records, after field parsing, session reassembly, and time alignment, are arranged sequentially according to time steps. The network traffic record corresponding to each time step is converted into a feature vector, and then combined sequentially using the time step as an index to form a continuous security feature raw input sequence. Each time step feature vector in the security feature raw input sequence corresponds to the result of the edge node processing the network traffic data and security event data at that time step, thus obtaining the security feature raw input sequence.

[0083] In this embodiment, the step of extracting statistical feature vectors based on the original input sequence of security features and encoding the statistical feature vectors into security feature vectors to obtain a security feature vector sequence specifically includes:

[0084] For each time step feature vector in the original input sequence of security features, the number of network connections successfully established within the time step is counted and recorded as a connection count scalar. Based on the destination ports of all network connections within the time step, the number of times each destination port is accessed is counted and the access counts of each port are arranged in order to form the port access count vector corresponding to the time step. Each component in the port access count vector represents the number of times the corresponding port is accessed within the time step.

[0085] Based on the connection results of all network connections within a time step, the number of connection failures within the time step is counted, and the number of connection failures is divided by the total number of connections to obtain the connection failure ratio of the time step. According to the network area to which the source address and destination address of each network connection belong, the network connections within the time step are divided into three categories: intranet access, extranet access, and intranet-extranet interactive access. The number of accesses in each category is counted separately, and the counts of intranet access, extranet access, and intranet-extranet interactive access are combined in order to form an intranet-extranet access relationship vector.

[0086] Based on the protocol type of each network connection within the time step, the protocol type is encoded one by one. One-hot encoding is used to generate corresponding encoded components for each protocol type. All encoded components are combined in a fixed order to form a protocol type vector. Each component in the protocol type vector is used to indicate whether the corresponding protocol type appears within the time step.

[0087] The statistical feature vector is formed by concatenating the connection count scalar, port access count vector, connection failure ratio scalar, internal and external network access relationship vector, and protocol type vector corresponding to the time step in a fixed order.

[0088] Normalization is performed on all components in the statistical feature vector to obtain the normalized statistical feature vector of the time step. The normalized statistical feature vector is then mapped to a fixed-dimensional security feature vector, and the security feature vectors corresponding to each time step are combined sequentially according to the time step order to form a security feature vector sequence.

[0089] In this embodiment, the step of forming a phase determination feature set based on the security feature vector sequence, and determining the attack phase category for the corresponding time step based on the phase determination feature set to obtain the attack phase label specifically includes:

[0090] Several consecutive safety feature vectors are selected from the safety feature vector sequence in chronological order of time steps. The selected consecutive safety feature vectors are combined to form a time window feature set, where each safety feature vector in the time window feature set corresponds to its time step position in the original safety feature vector sequence.

[0091] The security feature vectors of each time step in the time window feature set are processed sequentially. The changes in the number of connections, the number of port accesses, the proportion of connection failures, the relationship between internal and external network access, and the protocol type are calculated according to the time step order. The above changes are combined to form the stage judgment feature vector corresponding to the time step.

[0092] Specifically, the change in the number of connections is obtained by subtracting the scalar number of connections from the previous time step from the scalar number of connections in the current time step; the change in the number of port accesses is obtained by subtracting the corresponding component of the port access count vector from the previous time step component by component of the port access count vector in the current time step; the change in the connection failure ratio is obtained by subtracting the scalar number of connection failures from the previous time step from the scalar number of connection failures in the current time step; the change in the internal and external network access relationship is obtained by subtracting the corresponding component of the internal and external network access relationship vector from the previous time step component by component of the internal and external network access relationship vector from the previous time step; and the change in the protocol type is obtained by subtracting the corresponding component of the protocol type vector from the previous time step component by component of the protocol type vector in the current time step.

[0093] The stage determination feature vectors obtained at each time step within the time window are combined in the order of the time steps to form a stage determination feature set.

[0094] Sequence analysis is performed on the phase determination feature vectors in the phase determination feature set. The attack phase category to which the corresponding time step belongs is determined based on the feature changes within the time window, and the attack phase category is recorded as the attack phase label to obtain the attack phase label.

[0095] In this embodiment, the step of mapping the security feature vector into multiple subspace feature sets based on the attack stage label and the staged feature subspace mapping scheme to obtain the target subspace feature sequence specifically includes:

[0096] Establish corresponding feature subspace partitioning rules for each attack phase. The feature subspace partitioning rules are used to determine which feature components in the security feature vector belong to the same feature subspace, and all feature subspace partitioning rules are used to form a phased feature subspace mapping scheme.

[0097] Based on the attack stage label, select the feature subspace partitioning rule corresponding to the attack stage label from the staged feature subspace mapping scheme, and group the security feature vectors of each time step in the security feature vector sequence according to the feature subspace partitioning rule. The feature components in the same group are combined into subspace feature vectors to form multiple subspace feature vector sets.

[0098] Multiple subspace feature vectors obtained within the same time step are arranged in chronological order of the time steps. Subspace feature vectors belonging to the same subspace are combined sequentially to form multiple subspace feature sequences. Each subspace feature sequence is composed of subspace feature vectors of the corresponding subspace at each time step.

[0099] Multiple subspace feature sequences are combined sequentially according to the order of the subspaces to form a target subspace feature sequence. Each subspace feature sequence in the target subspace feature sequence is composed of the subspace feature vectors obtained by the corresponding subspace at each time step.

[0100] In this embodiment, the step of inputting the target subspace feature sequence into the sub-autoencoder in the improved Kitsune model to form a reconstruction error vector, and then inputting it into the output autoencoder to obtain the total reconstruction error sequence for the stage, specifically includes:

[0101] In the improved Kitsune model, a sub-autoencoder cluster and an output autoencoder are established for each attack phase. Each sub-autoencoder cluster consists of multiple sub-autoencoders, and each sub-autoencoder corresponds to a subspace feature sequence in the target subspace feature sequence. Each subspace feature vector in the subspace feature sequence corresponds to the subspace feature data of its time step.

[0102] For each attack phase, a subspace activation label vector corresponding to each sub-autoencoder and a weight vector corresponding to each subspace reconstruction error are established.

[0103] Based on the attack phase label, select the sub-autoencoder cluster and output autoencoder corresponding to the attack phase label from the improved Kitsune model, and obtain the sub-space activation label sequence corresponding to the attack phase label from the sub-space activation label vector. Establish a one-to-one correspondence between each sub-space feature sequence in the target sub-space feature sequence and each sub-autoencoder in the selected sub-autoencoder cluster.

[0104] The subspace reconstruction error is obtained based on the target subspace feature sequence, and the subspace reconstruction errors at each time step are combined in the order of time steps to form a subspace reconstruction error sequence.

[0105] Within each time step, the subspace reconstruction error of each subspace within the time step is weighted according to the weight components in the weight vector corresponding to the attack phase label. The weighted subspace reconstruction errors are combined in a fixed order to form the reconstruction error vector of the time step. The reconstruction error vectors of all time steps are arranged in the order of the time steps to form a reconstruction error vector sequence.

[0106] The reconstruction error vectors in the reconstruction error vector sequence are sequentially input into the output autoencoder corresponding to the attack stage label according to the time step order. Each reconstruction error vector is processed to obtain the total reconstruction error of the corresponding time step. The total reconstruction errors of each time step are combined in the order of the time steps to form the total reconstruction error sequence of the stage.

[0107] This invention constructs a cluster of sub-autoencoders and an output autoencoder corresponding to each stage, and combines subspace activation marker vectors and a weighted reconstruction mechanism. This enables the model to activate matching subspace feature processing structures as needed for different attack stages, reducing interference from irrelevant features and improving the sensitivity of reconstruction error discrimination. By generating a continuous sequence of total reconstruction errors at the time step level, the system can accurately reflect the fine-grained changes in attack behavior at different stages, thereby improving the timeliness and stability of threat identification and enhancing real-time blocking capabilities in edge environments.

[0108] In this embodiment, obtaining the subspace reconstruction error based on the target subspace feature sequence and combining the subspace reconstruction errors at each time step in time step order to form a subspace reconstruction error sequence specifically includes:

[0109] For each subspace feature sequence in the target subspace feature sequence, a subspace activation marker sequence corresponding to the subspace feature sequence is obtained. The subspace activation marker sequence is composed of subspace activation markers at each time step. The subspace activation marker at each time step is used to indicate whether the subspace is in an active state within the time step.

[0110] In each time step, when the subspace activation flag corresponding to the time step indicates that the subspace is in an active state, the subspace feature vector is input into the sub-autoencoder corresponding to the subspace feature sequence to obtain the reconstructed subspace feature vector, and the subspace reconstruction error is calculated. The subspace reconstruction error is determined by the difference norm between the subspace feature vector and the reconstructed subspace feature vector.

[0111] In each time step, when the subspace activation flag corresponding to the time step indicates that the subspace is in an inactive state, the subspace reconstruction error is set to zero.

[0112] Under the condition of fixed subspace index, the subspace reconstruction errors obtained at each time step are arranged in the order of time steps to form the subspace reconstruction error sequence.

[0113] This invention controls the activation state of the sub-autoencoder based on subspace activation markers, enabling the model to perform reconstruction operations only on the subspace relevant to the current attack phase at each time step, reducing noise interference from irrelevant features. Furthermore, the subspace reconstruction error calculated using the difference norm accurately reflects the degree of feature deviation and forms a continuous subspace reconstruction error sequence over time. This allows the system to capture the dynamic changes in threat behavior, improving the sensitivity and stability of phase identification and enhancing real-time detection performance.

[0114] In this embodiment, the step of performing normalization and time smoothing on the total reconstruction error sequence of the stages by setting the stage gating unit in the improved Kitsune model to obtain the threat score sequence specifically includes:

[0115] In the improved Kitsune model, a stage gating unit is set up. The stage gating unit determines the activation state of the sub-autoencoder cluster and the output autoencoder corresponding to the attack stage label based on the attack stage label, and generates a stage gating mark sequence according to the order of each time step. The stage gating mark of each time step is used to indicate the output autoencoder structure that should be used in the time step.

[0116] At each time step, when the stage gating flag indicates that the output autoencoder corresponding to the current attack stage is in an active state, the total stage reconstruction error is input into the corresponding output autoencoder processing unit to obtain the stage reconstruction value.

[0117] When the stage gating flag indicates that the output autoencoder is inactive, the stage reconstruction value is recorded as zero, and the stage reconstruction values ​​of all time steps are combined in time step order to form a stage reconstruction value sequence.

[0118] Normalization is performed on each stage reconstruction value in the stage reconstruction value sequence. The corresponding normalized value is calculated based on the difference between the stage reconstruction value and the maximum and minimum values ​​in the stage reconstruction value sequence. The normalized values ​​of all time steps are combined in time step order to form a normalized sequence.

[0119] The normalized values ​​of each time step in the normalized sequence are smoothed in time step order. The normalized value of the current time step is combined with the smoothed value of the previous time step in a fixed ratio to obtain the smoothed value of the current time step. The smoothed values ​​obtained from all time steps are combined in time step order to form a threat score sequence.

[0120] This invention controls the activation state of the output autoencoder through a stage gating unit, enabling the model to select a matching reconstruction structure based on the attack stage label, thus reducing error fluctuations caused by stage inconsistencies. Based on the normalization and time smoothing of stage reconstruction values, it effectively suppresses drastic numerical changes caused by instantaneous anomalies, resulting in a stable and continuous evolution trend in threat scores. This helps to accurately reflect the actual development state of attack behavior, thereby improving the reliability and real-time performance of threat identification and enhancing the decision-making accuracy of blocking strategies.

[0121] In this embodiment, the step of comparing the threat score with multi-level thresholds to determine the threat level at the current time step, and selecting and executing the corresponding blocking strategy based on the attack phase label and threat level, specifically includes:

[0122] The threat scores at each time step are obtained sequentially from the threat scoring sequence, and the threat scores are compared level by level according to the order of multi-level thresholds. The threat scores that are not less than the corresponding thresholds are determined as the corresponding threat levels. The threat levels include observation level threat level, alarm level threat level, restricted level threat level and blocking level threat level.

[0123] Based on the threat level and attack phase label of the time step, a blocking policy label corresponding to the combination of the two is selected from the blocking policy label set. The blocking policy label is used to indicate the type of blocking policy to be executed within the time step.

[0124] When the blocking policy flag indicates that access control rules need to be issued, an access restriction configuration corresponding to the target network traffic is generated according to the access control rules, and the access restriction configuration is issued to the access control module of the edge node;

[0125] When the blocking policy flag indicates that a connection interruption rule needs to be issued, a disconnection command corresponding to the target connection is generated according to the connection interruption rule, and the disconnection command is issued to the connection control module of the edge node;

[0126] When the blocking policy flag indicates that traffic limiting rules need to be issued, the rate limiting parameters or flow limiting parameters corresponding to the target network traffic are generated according to the traffic limiting rules, and the rate limiting parameters or flow limiting parameters are issued to the traffic management module of the edge node.

[0127] Edge nodes perform real-time blocking control on target network traffic or target connections that meet the blocking conditions, based on access control rules, connection interruption rules, or traffic restriction rules.

[0128] Example 1:

[0129] To verify the feasibility of this invention in practice, it was applied to an enterprise edge node deployment scenario. This enterprise sets up an edge security gateway between its office network and production network to handle cross-regional access requests. Due to frequent port scanning, weak password attempts, internal lateral access, and the risk of abnormal data transmission within the network, traditional anomaly detection methods based on static features cannot accurately distinguish between different attack stages. Furthermore, during peak business hours, the computational load on the model can easily lead to increased latency, and blocking strategies cannot differentiate based on different threat levels, making it difficult to meet the dual requirements of real-time performance and accuracy.

[0130] In this scenario, the present invention is deployed on an edge security gateway to preprocess collected network traffic data and security event data, generating a continuous sequence of raw security feature inputs. The system first constructs a time window for network access behavior. By analyzing changes in the number of connections, port access distribution, connection failure rate, internal / external network relationships, and protocol type, it identifies the attack phase of the access behavior, such as scanning, credential attempt, lateral movement, or abnormal data transmission. Subsequently, the present invention automatically selects the corresponding feature subspace partitioning scheme based on the identified attack phase, mapping the security feature vector into multiple subspace feature sets. Each subspace is reconstructed using the corresponding sub-autoencoder in the improved Kitsune model; inactive subspaces are not included in the calculation, thus avoiding unnecessary computational burden.

[0131] During actual enterprise network operation, edge nodes continuously analyze data from different time periods. The experiment selected business access records within a continuous operating cycle, including normal office access, database queries, file transfer traffic, and simulated attack behaviors. The traffic characteristics of the attack behaviors included port scanning, abnormal password attempts, lateral access to internal interfaces, and large-volume encrypted transmission. This invention uses a threat scoring sequence generated by a phased gating unit, combined with multi-level thresholds, to hierarchically identify these behaviors. During the scanning phase, this invention detected significant changes in the number of port accesses, and the threat score exceeded the observation-level threshold at multiple consecutive time steps, entering the alarm level. During the credential attempt phase, due to an abnormally high connection failure rate, the threat score quickly entered the restriction level. During the lateral movement phase, the changes in the internal and external network access relationships increased, and the corresponding subspace reconstruction error increased significantly. During the data transmission phase, combined with anomalies in the protocol type vector, this invention triggered blocking-level policies at multiple time steps, and the edge node automatically interrupted the connection and restricted further transmission.

[0132] To verify the improvements made by this invention in terms of stage identification accuracy, anomaly detection accuracy, and real-time blocking efficiency, data from multiple time periods were selected for comparative analysis. The results show that, under the same edge device conditions, this invention, through staged feature subspaces and subspace activation mechanisms, reduces the average computation time of the model by approximately 34%, achieves an attack stage identification accuracy of over 96%, and reduces the severe threat blocking delay from approximately 2.3 seconds using traditional methods to less than 0.9 seconds, significantly improving real-time protection capabilities. Analysis of reconstruction errors and threat scores reveals that this invention can detect abnormal patterns in the early stages of an attack, triggering restriction-level or blocking-level strategies multiple time steps in advance, achieving higher-priority proactive protection. Throughout the entire implementation period, no business interruptions occurred due to misjudgments, indicating that the hierarchical strategy of this invention effectively balances security and business continuity.

[0133] Table 1. Statistics on the Multi-Stage Threat Detection and Blocking Effects at Edge Nodes

[0134] Time step sequence Connection quantity change Port access change Connection failure rate change Intranet and extranet relationship change Subspace reconstruction error (after weighting) Threat score Threat level Blocking policy Blocking delay (seconds) t1 +3 +12 +0.01 0 0.021 0.18 Observation level No action — t2 +15 +86 +0.03 +2 0.094 0.43 Alarm level Access restriction 1.2 t3 +28 +152 +0.11 +5 0.231 0.67 Restriction level Rate limiting control 1.0 t4 +4 +11 +0.00 0 0.019 0.22 Observation level No action — t5 +7 +15 +0.52 +1 0.302 0.81 Restriction level Flow limiting control 0.9 t6 +2 +9 +0.00 0 0.017 0.16 Observation level No action — t7 +3 +130 +0.02 +7 0.341 0.88 Blocking level Connection interruption 0.8 t8 +1 +4 +0.00 0 0.011 0.12 Observation level No action —

[0135] As can be seen from the table above, this invention exhibits significantly different performance compared to traditional single anomaly detection models in multi-stage threat detection and real-time blocking at edge nodes. Firstly, regarding the sensitivity of threat identification, through staged feature subspace mapping and a subspace reconstruction error weighting mechanism, this invention can respond promptly when early anomalies appear in network access behavior. For example, at time t2, the port access change rate increases rapidly, and the subspace weighted reconstruction error rises synchronously to 0.094, the threat score reaches 0.43, and it enters the alarm level, enabling the system to take access restriction measures in advance. Traditional methods often require more significant anomaly accumulation to trigger a response. This feature effectively avoids the risk of initial scanning behavior being ignored.

[0136] Secondly, this invention demonstrates stability in distinguishing different attack phases. At times t3 and t5, the connection failure rate and port access changes show a phased increase, resulting in reconstruction errors of 0.231 and 0.302 respectively. The corresponding threat scores stably enter the restricted level, thereby activating rate limiting or throttling strategies. This result indicates that when attack phase characteristics change significantly, the phased sub-autoencoder structure can accurately capture key anomalies at different stages, enabling the model to maintain high sensitivity to phase-specific behaviors. In contrast, traditional autoencoders with fixed structures often fail to perform targeted identification based on phase characteristic differences, leading to both high false positive and false negative rates.

[0137] Furthermore, in severe threat blocking scenarios, this invention demonstrates a faster response capability. When a significant surge in port access and abnormal changes in the relationship between internal and external networks occur at time t7, the subspace weighted reconstruction error rapidly rises to 0.341, the threat score reaches 0.88, and the system enters the blocking stage. This invention triggers a connection interruption strategy with a blocking latency of only 0.8 seconds. Compared to traditional methods that often require more than 2 seconds to complete the blocking action, this invention effectively shortens the threat processing link at edge nodes, achieving higher real-time performance.

[0138] Finally, observations from multiple time steps show that when the network state returns to normal (e.g., t4, t6, t8), this invention can quickly bring the reconstruction error and threat score back to a low level, preventing continuous misjudgments and avoiding triggering excessive protection measures. This demonstrates that the phase gating and time smoothing mechanism of this invention can maintain output stability while preserving detection sensitivity, and provide highly reliable threat score results in dynamic traffic environments.

[0139] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An edge computing-based information security threat real-time blocking method, characterized in that, The method comprises the following steps: Collecting network traffic data and security event data at the edge node, performing preprocessing on the collected data, and constructing a security feature raw input sequence; Based on the security feature raw input sequence, a statistical feature vector is extracted, and the statistical feature vector is encoded into a security feature vector to obtain a security feature vector sequence; Based on the security feature vector sequence, a phase judgment feature set is formed, and the attack phase category of the corresponding time step is determined according to the phase judgment feature set to obtain an attack phase label; Based on the attack phase label and the phased feature subspace mapping scheme, the security feature vector is mapped into multiple subspace feature sets to obtain a target subspace feature sequence; The target subspace feature sequence is input into the sub-autoencoder in the improved Kitsune model to form a reconstruction error vector, which is input into the output autoencoder to obtain a phase total reconstruction error sequence; Through the phase gating unit set in the improved Kitsune model, the phase total reconstruction error sequence is normalized and time-smoothed to obtain a threat score sequence; The threat score is compared with the multi-level threshold to determine the threat level of the current time step, and the corresponding blocking strategy is selected and executed according to the attack phase label and the threat level. 2.The method of claim 1, wherein, The preprocessing includes field parsing processing, session recombination processing and time alignment processing. 3.The method of claim 1, wherein, The security feature raw input sequence is extracted based on the security feature raw input sequence, and the statistical feature vector is encoded into a security feature vector to obtain a security feature vector sequence, which specifically includes: Based on each time step feature vector in the security feature raw input sequence, a port access frequency vector is formed; Based on the connection results of all network connections within the time step, the number of connection failures within the time step is counted to form an internal and external network access relationship vector; According to the protocol type of each network connection within the time step, the protocol type is encoded one by one to form a protocol type vector; The connection quantity scalar corresponding to the time step, the port access frequency vector, the connection failure proportion scalar, the internal and external network access relationship vector and the protocol type vector are sequentially spliced to form a statistical feature vector; All components in the statistical feature vector are normalized, and the normalized statistical feature vector is mapped into a fixed-dimensional security feature vector to form a security feature vector sequence. 4.The method of claim 1, wherein, Based on the security feature vector sequence, a phase judgment feature set is formed, and the attack phase category of the corresponding time step is determined according to the phase judgment feature set to obtain an attack phase label, which specifically includes: From the security feature vector sequence, the security feature vectors are combined to form a time window feature set; Each time step security feature vector in the time window feature set is processed in turn to form a phase judgment feature vector corresponding to the time step; The phase judgment feature vectors obtained in each time step within the time window are combined in time step order to form a phase judgment feature set; The phase judgment feature vectors in the phase judgment feature set are subjected to sequence analysis to obtain an attack phase label.

5. The method of claim 1, wherein the method further comprises: Based on the attack phase label and the phased feature subspace mapping scheme, the security feature vector is mapped into multiple subspace feature sets to obtain a target subspace feature sequence, which specifically includes: establishing a corresponding feature subspace division rule for each attack stage, and constructing a phased feature subspace mapping scheme by using all feature subspace division rules; selecting a feature subspace division rule corresponding to the attack stage label from the phased feature subspace mapping scheme to form a plurality of subspace feature vector sets according to the attack stage label; arranging the plurality of subspace feature vectors obtained at the same time step in the order of time steps, and sequentially combining the time step subspace feature vectors belonging to the same subspace to form a plurality of subspace feature sequences; sequentially combining the plurality of subspace feature sequences in the order of subspace arrangement to form a target subspace feature sequence.

6. The method of claim 1, wherein the method further comprises: The inputting of the target subspace feature sequence into the sub-autoencoder in the improved Kitsune model to form a reconstruction error vector, and the inputting of the output autoencoder to obtain a stage total reconstruction error sequence specifically includes: In the improved Kitsune model, a sub-autoencoder cluster corresponding to each attack stage and an output autoencoder are established for each attack stage; a subspace activation marker vector corresponding to each sub-autoencoder and a weight vector corresponding to each subspace reconstruction error are established for each attack stage; selecting a sub-autoencoder cluster and an output autoencoder from the improved Kitsune model according to the attack stage label, and obtaining a subspace activation marker sequence from the subspace activation marker vector; sequentially establishing a one-to-one correspondence between each subspace feature sequence in the target subspace feature sequence and each sub-autoencoder in the selected sub-autoencoder cluster; obtaining a subspace reconstruction error based on the target subspace feature sequence, and combining the subspace reconstruction errors at each time step in the order of time steps to form a subspace reconstruction error sequence; at each time step, the subspace reconstruction errors of each subspace at the time step are weighted and processed according to each weight component in the weight vector corresponding to the attack stage label to form a reconstruction error vector; arranging all reconstruction error vectors at all time steps in the order of time steps to form a reconstruction error vector sequence; sequentially inputting each reconstruction error vector in the reconstruction error vector sequence into the output autoencoder corresponding to the attack stage label in the order of time steps to form a stage total reconstruction error sequence.

7. The edge computing-based information security threat real-time blocking method according to claim 6, characterized in that, The obtaining of the subspace reconstruction error based on the target subspace feature sequence, and the combining of the subspace reconstruction errors at each time step in the order of time steps to form a subspace reconstruction error sequence specifically includes: for each subspace feature sequence in the target subspace feature sequence, obtaining a subspace activation marker sequence; in each time step, when the subspace activation marker indicates that the subspace is in an active state, inputting the subspace feature vector into the sub-autoencoder corresponding to the subspace feature sequence to obtain a reconstructed subspace feature vector and calculating the subspace reconstruction error; in each time step, when the subspace activation marker corresponding to the time step indicates that the subspace is in an inactive state, the value of the subspace reconstruction error at the time step is set to zero; The subspace reconstruction error sequence is formed by arranging the subspace reconstruction error obtained by the subspace at each time step in the order of time steps. 8.The method of claim 1, wherein the method further comprises: receiving a request for a web page from the client device; and determining whether the request is associated with the security threat. The threat score sequence is obtained by performing normalization and time smoothing on the stage total reconstruction error sequence through the stage gating unit in the improved Kitsune model, and the threat score sequence specifically includes: The stage gating unit is arranged in the improved Kitsune model, and the stage gating unit determines the activation state of the output autoencoder and the sub-autoencoder cluster according to the attack stage label, and generates a stage gating mark sequence; At each time step, when the stage gating mark indicates that the output autoencoder corresponding to the current attack stage is in the active state, the stage total reconstruction error is input into the corresponding output autoencoder processing unit to obtain a stage reconstruction value; When the stage gating mark indicates that the output autoencoder is in the inactive state, the stage reconstruction value is recorded as zero, and the stage reconstruction values of all time steps are combined in the order of time steps to form a stage reconstruction value sequence; Normalization is performed on each stage reconstruction value in the stage reconstruction value sequence to obtain a normalized value, and the normalized values of all time steps are combined in the order of time steps to form a normalized sequence; The normalized values of each time step in the normalized sequence are time-smoothed in the order of time steps to obtain a smoothed value of the current time step, and the smoothed values obtained at all time steps are combined in the order of time steps to form a threat score sequence. 9.The method of claim 1, wherein the method further comprises: receiving a request for a web page from the client device; and transmitting the web page to the client device. The threat score is compared with the multi-level threshold to determine the threat level of the current time step, and the corresponding blocking strategy is selected according to the attack stage label and the threat level and executed, and the specific comparison includes: The threat scores of each time step are obtained from the threat score sequence in turn, and the threat scores are compared in stages according to the order of the multi-level threshold to obtain the corresponding threat level; According to the threat level of the time step and the attack stage label, the blocking strategy mark is selected from the blocking strategy mark set; When the blocking strategy mark indicates that the access control rule needs to be issued, the access restriction configuration corresponding to the target network traffic is generated according to the access control rule and executed; When the blocking strategy mark indicates that the connection interruption rule needs to be issued, the disconnection instruction corresponding to the target connection is generated according to the connection interruption rule and executed; When the blocking strategy mark indicates that the traffic limiting rule needs to be issued, the speed limiting parameter or flow limiting parameter corresponding to the target network traffic is generated according to the traffic limiting rule and executed.

Images