Network security protection method based on distributed threat identification and related equipment

Abstract

The invention discloses a network security protection method and device based on distributed threat identification, and relates to the field of network security. The method comprises the following steps: firstly, determining target acquisition granularity and frequency based on equipment type distribution, service load and link quality data; capturing the original flow in real time by an edge computing node, and extracting a distributed threat fingerprint containing a behavior sequence and a protocol variation feature; after block chain consensus verification, synchronizing to a collaborative detection network, and constructing an on-chain trusted threat knowledge base; simulating a target threat fingerprint propagation path in combination with real-time network topology and an on-chain trusted threat knowledge base, and generating a dynamic threat propagation map; and determining a multi-dimensional risk score based on the atlas, and further generating a self-adaptive protection strategy and issuing and executing the self-adaptive protection strategy. According to the method, technologies such as multi-dimensional data perception, edge calculation and block chain consensus are fused, and efficient, credible and real-time response distributed network security protection is realized.

Description

Technical Field

[0001] This application relates to the field of network security technology, and more specifically, to a network security protection method and related equipment based on distributed threat identification. Background Technology

[0002] With the rapid development of information technology and the increasing complexity of network architecture, cybersecurity threats are characterized by their wide distribution, rapid changes, and strong concealment, making traditional security protection systems based on static rules and centralized detection ineffective. Especially in emerging scenarios such as the Internet of Things, the Industrial Internet, and cloud-edge collaboration, massive numbers of terminal devices, dynamic business traffic, and complex topologies collectively constitute a high-risk and highly challenging cybersecurity protection environment.

[0003] In related technologies, network threat identification and protection typically rely on a central node for unified traffic aggregation and analysis. While this approach facilitates centralized management, it often faces challenges in practical deployments, such as high identification latency, high traffic pressure, and limited detection range, making it difficult to promptly detect and respond to rapidly spreading and dynamically evolving network attacks. Furthermore, traditional methods often rely on static feature matching, lacking the ability to deeply identify multi-dimensional behavioral patterns and protocol variation characteristics, leading to ineffective identification of unknown threats and variant attacks. Moreover, facing complex and ever-changing network environments and multiple attack paths, existing systems often lack dynamic propagation modeling and risk quantification capabilities, making it difficult for protection strategies to accurately match the actual impact of threats. In other words, related technologies generally suffer from poor real-time threat identification, weak collaborative defense capabilities, insufficient threat propagation analysis, and poor adaptability of protection strategies. Summary of the Invention

[0004] The summary section of this application introduces a series of simplified concepts, which will be further explained in detail in the detailed description section. The summary section of this application is not intended to limit the key features and essential technical features of the claimed technical solution, nor is it intended to determine the scope of protection of the claimed technical solution.

[0005] The network security protection method and related equipment based on distributed threat identification provided in this application can achieve an efficient, reliable, intelligent and real-time responsive distributed network security protection method by integrating multi-dimensional data perception, edge computing, blockchain consensus, threat propagation modeling and adaptive policy distribution.

[0006] Firstly, this application provides a network security protection method based on distributed threat identification, comprising: determining the target collection granularity and target collection frequency based on device type distribution data, service load data, and link quality data; capturing raw traffic data streams in real time at edge computing nodes based on the target collection granularity and target collection frequency; performing lightweight threat fingerprint extraction on the raw traffic data streams to generate a distributed threat fingerprint set containing behavioral sequence features and protocol variation features; synchronizing the distributed threat fingerprint set to a collaborative detection network after verification by blockchain consensus to construct an on-chain trusted threat knowledge base; simulating the propagation path of the target threat fingerprints based on real-time network topology information and the on-chain trusted threat knowledge base to generate a dynamic threat propagation graph; determining multi-dimensional risk scores based on the dynamic threat propagation graph; and generating and executing adaptive protection strategies based on the multi-dimensional risk scores.

[0007] In some implementations, determining the target collection granularity and target collection frequency based on device type distribution data, service load data, and link quality data includes: normalizing the device type distribution data according to a preset device type weight table to generate device type distribution weight coefficients, wherein the calculation formula for the device type distribution weight coefficients is: In the formula, The distribution weight coefficients for the device types are as follows: For the first The number of online devices of this type The first in the preset device type weight table Threat level weights for different types of devices; The service load volatility is determined based on the difference between the peak and trough values ​​of the service load data within a preset sliding time window. The formula for calculating the service load volatility is as follows: In the formula, The aforementioned business load volatility, The peak value of the service load. This represents the lowest point of the business load. The window duration is the preset sliding time window. This is the historical average load. When the packet loss rate in the link quality data is less than or equal to 2%, and the latency in the link quality data is less than or equal to 20ms, the collection frequency adjustment coefficient is determined to be a first value; when the packet loss rate is greater than 2% and less than or equal to 5%, and the latency is greater than 20ms and less than or equal to 50ms, the collection frequency adjustment coefficient is determined to be a second value, wherein the second value is less than the first value; when the packet loss rate in the link quality data is greater than 5%, and the latency in the link quality data is greater than 50ms, the collection frequency adjustment coefficient is determined to be a third value, wherein the third value is less than the second value; based on the device type distribution weight coefficient, the service load volatility, and the collection frequency adjustment coefficient, a weighted fusion is performed to obtain the target collection granularity and the target collection frequency, wherein the calculation formulas for the target collection granularity and the target collection frequency are: In the formula, The target acquisition granularity is defined as follows. To set the preset baseline acquisition granularity, The distribution weight coefficients for the device types are as follows: The target acquisition frequency, To preset the reference acquisition frequency, The sampling frequency adjustment coefficient is... The business load volatility is mentioned above.

[0008] In some implementations, the lightweight threat fingerprint extraction of the original traffic data stream to generate a distributed threat fingerprint set containing behavioral sequence features and protocol variation features includes: performing session reassembly processing based on the original traffic data stream to obtain a session sequence under consecutive timestamps; determining the establishment time interval jitter rate between adjacent sessions based on the session sequence, wherein the establishment time interval jitter rate is the ratio of the standard deviation of the time interval to the average time interval; detecting the window mutation period of the transmission window size based on the original traffic data stream, wherein the window mutation period is the time interval in which the window size exceeds three times the standard deviation of the historical average; and combining the establishment time interval jitter rate and the window mutation period into a behavioral sequence feature vector. Based on the original traffic data stream, the offset status of the protocol header field is parsed to determine the port mapping relationship between non-standard port numbers and standard protocol types; based on the original traffic data stream, the deviation of the header field length value from the preset standard value is determined as the field offset identifier; based on the original traffic data stream, the difference between the payload content entropy value and the baseline entropy value is calculated to obtain the entropy mutation coefficient; the port mapping relationship, the field offset identifier, and the entropy mutation coefficient are combined into a protocol mutation feature vector; the behavior sequence feature vector and the protocol mutation feature vector are fused with attention weighting to obtain a lightweight threat fingerprint; a generation timestamp and edge node location label are added to the lightweight threat fingerprint, and it is packaged to generate the distributed threat fingerprint set.

[0009] In some implementations, synchronizing the distributed threat fingerprint set to a collaborative detection network after blockchain consensus verification to construct an on-chain trusted threat knowledge base includes: encapsulating the distributed threat fingerprint set into a transaction data format to obtain a transaction format threat fingerprint set, and submitting the transaction format threat fingerprint set to the collaborative detection network; assigning dynamic voting weights to the verification nodes in the collaborative detection network based on historical verification accuracy; performing consensus verification on the transaction format threat fingerprint set through the verification nodes based on the dynamic voting weights to obtain a verified threat fingerprint set; and writing the verified threat fingerprint set into the blockchain ledger of the collaborative detection network to obtain the on-chain trusted threat knowledge base.

[0010] In some implementations, the step of simulating the propagation path of a target threat fingerprint and generating a dynamic threat propagation graph based on real-time network topology information and the on-chain trusted threat knowledge base includes: extracting the initial infected node and associated vulnerability identifier of the target threat fingerprint from the on-chain trusted threat knowledge base; determining the minimum propagation hop count from the initial infected node to each reachable node based on the node connection matrix and routing hop count limit of the real-time network topology; querying a preset vulnerability database based on the associated vulnerability identifier to determine a vulnerability severity score; weighting and fusing the minimum propagation hop count and the vulnerability severity score to generate a path propagation rate weight, wherein a larger minimum propagation hop count results in a lower path propagation rate weight, and a higher vulnerability severity score results in a higher path propagation rate weight; simulating the diffusion path of the target threat fingerprint along the network topology based on the path propagation rate weight to generate a multi-level propagation link with a time decay coefficient; and aggregating the spatiotemporal attributes of the multi-level propagation link to generate the dynamic threat propagation graph.

[0011] In some implementations, determining a multi-dimensional risk score based on the dynamic threat propagation map includes: extracting key risk assessment dimensions from the dynamic threat propagation map, wherein the key risk assessment dimensions include infected node density, core business node infection ratio, maximum propagation path depth, and propagation rate per unit time; independently quantifying each key risk assessment dimension according to preset dimension weight coefficients to obtain a dimension risk value, wherein the preset dimension weight coefficients are dynamically adjusted based on a preset device type weight table; performing weighted fusion processing on the dimension risk values ​​to generate an initial comprehensive risk value; and dynamically correcting the initial comprehensive risk value based on the activity frequency of the target threat fingerprint within a preset time window to obtain the multi-dimensional risk score.

[0012] In some implementations, generating an adaptive protection strategy based on the multi-dimensional risk score and issuing it for execution includes: classifying the multi-dimensional risk score to obtain the current threat level; mapping a preset protection strategy based on the current threat level to obtain an adaptive protection strategy set; mapping the adaptive protection strategy set to an executable protection instruction set, and issuing the protection instruction set to the target execution node.

[0013] Secondly, this application also provides a network security protection device based on distributed threat identification, comprising: a parameter determination unit, used to determine the target collection granularity and target collection frequency based on device type distribution data, service load data, and link quality data; a data collection unit, used to capture raw traffic data streams in real time at edge computing nodes based on the target collection granularity and the target collection frequency; a threat fingerprint extraction unit, used to perform lightweight threat fingerprint extraction on the raw traffic data streams to generate a distributed threat fingerprint set containing behavioral sequence features and protocol variation features; an on-chain synchronization unit, used to synchronize the distributed threat fingerprint set to a collaborative detection network after verification by blockchain consensus, so as to construct an on-chain trusted threat knowledge base; a graph generation unit, used to simulate the propagation path of the target threat fingerprints based on real-time network topology information and the on-chain trusted threat knowledge base, and generate a dynamic threat propagation graph; a risk scoring unit, used to determine multi-dimensional risk scores based on the dynamic threat propagation graph; and a security protection unit, used to generate adaptive protection strategies based on the multi-dimensional risk scores and issue them for execution.

[0014] Thirdly, this application also provides an electronic device, including: a memory and a processor, wherein the processor is configured to implement the steps of the network security protection method based on distributed threat identification as described in the first aspect when executing a computer program stored in the memory.

[0015] Fourthly, this application also provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the steps of the network security protection method based on distributed threat identification described in the first aspect.

[0016] Fifthly, this application also provides a computer program product, including a computer program or computer executable instructions, which, when executed by a processor, implement the network security protection method based on distributed threat identification provided in the embodiments of this application.

[0017] In summary, this application dynamically determines the granularity and frequency of data collection based on multi-dimensional data such as device type, service load, and link quality, enabling on-demand acquisition of network traffic data. Compared to traditional fixed-frequency data collection methods, this mechanism is more flexible and accurate, effectively reducing unnecessary resource consumption and improving adaptability and real-time response in complex and dynamic network environments. By capturing raw traffic data in real time at edge computing nodes and performing lightweight threat fingerprint extraction, the solution achieves rapid perception and local processing of security threats, shortening the data analysis path, improving response speed, and facilitating effective interception at the initial stage of threat emergence, thereby improving the overall network security protection efficiency. Finally, blockchain technology is used to perform consensus verification of the extracted distributed threat fingerprints and synchronize them to the collaborative detection network, constructing a trusted on-chain threat knowledge base. This approach ensures the integrity, immutability, and multi-party sharing of threat intelligence, providing a solid foundation for secure collaboration among multiple nodes and enhancing the overall network's joint defense and control capabilities. Based on real-time network topology information and a trusted threat knowledge base, the solution can simulate the propagation path of target threat fingerprints and dynamically generate threat propagation maps. This allows security operations personnel to intuitively grasp threat spread trends and potential impact ranges, providing strong support for threat tracking and strategy formulation, and improving the visualization and scientific nature of network security decision-making. Relying on the multi-dimensional risk scoring generated by the dynamic threat propagation map, the system can automatically formulate and distribute adaptive protection strategies, achieving precise and differentiated security responses. This improves the targeting and intelligence of network security strategies, effectively reducing false alarm rates and the need for human intervention, and enhancing the system's autonomous protection capabilities. In summary, the network security protection method based on distributed threat identification provided in this application, by integrating multi-dimensional data perception, edge computing, blockchain consensus, threat propagation modeling, and adaptive strategy distribution, achieves an efficient, reliable, intelligent, and real-time responsive distributed network security protection method. Attached Figure Description

[0018] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit this specification. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart illustrating a network security protection method based on distributed threat identification, provided as an embodiment of this application; Figure 2 A schematic diagram illustrating the composition of a network security protection device based on distributed threat identification, provided for an embodiment of this application; Figure 3 This is a schematic diagram of the composition structure of an electronic device provided in an embodiment of this application. Detailed Implementation

[0019] The terms used in the specification, claims, and drawings of this application, such as "first," "second," "third," "fourth," etc. (if any), are used to distinguish similar objects and not to describe a specific order or sequence. Therefore, it is to be understood that these terms can be used interchangeably where appropriate, allowing the described embodiments to be used in different orders, unless specifically required by the illustrations or description. Furthermore, the terms "is" and "has," and any variations thereof, are intended to cover, non-exclusively, all possible constituent elements. For example, a process, method, system, product, or apparatus comprising several steps or units is not necessarily limited to the steps or units explicitly listed, but may also include other steps or units not explicitly listed, or steps or units inherent to the process, method, product, or apparatus.

[0020] In this application, a "module" or "unit" refers to a computer program or part of a computer program that has a specific function and works in conjunction with other related parts to achieve a predetermined goal. These modules or units can be implemented by software, hardware (e.g., processing circuitry or memory), or a combination of both. One or more processors or memories can implement one or more modules or units. Furthermore, each module or unit can also be part of a larger module or unit.

[0021] The technical solutions of this application will be described in detail below with reference to the accompanying drawings of the embodiments. It should be noted that the described embodiments are only a part of this application, and not all embodiments. In the following description, the "some embodiments" mentioned are only a subset of all possible embodiments, which may be the same or different subsets, and different embodiments can be combined with each other without conflict.

[0022] Figure 1 This is a flowchart illustrating a network security protection method based on distributed threat identification provided in an embodiment of this application. For example, see [link to example]. Figure 1 The network security protection method based on distributed threat identification provided in this application embodiment may include the following steps 101 to 107: Step 101: Based on device type distribution data, service load data, and link quality data, determine the target collection granularity and target collection frequency; In some examples, device type distribution data reflects the distribution of different types and quantities of devices in the current network environment. Device types in this data include, but are not limited to, servers, edge gateways, industrial control equipment, user terminals, and sensor nodes. The acquisition of device type distribution data can be based on network asset management systems, terminal identification systems, or active network scanning tools. For example, SNMP, NetFlow, NAC systems, or CMDB databases can be used to automatically collect current online device lists and classification tags. For instance, in an industrial control network, there might be 20 PLC controllers, 10 HMI devices, and 5 surveillance cameras. By interfacing with the device management system using device identifiers, device type distribution data can be generated. Service load data reflects the current service traffic intensity of each node or link in the network, typically expressed as bandwidth utilization, packet count, and concurrent session count. This data can be collected through traffic monitoring systems (such as NetFlow, sFlow, and SDN controllers) or edge probes. For example, in a cloud computing scenario, if a node detects an average inbound / outbound bandwidth of 800Mbps and a peak of 1Gbps per unit time, it indicates that the service load is at a high level. Link quality data is used to evaluate the transmission performance of network links. Key indicators include packet loss rate, latency, jitter, and bandwidth stability. This data can be obtained through ICMP probing, Ping testing, TCP three-way handshake time statistics, or dedicated network performance monitoring probes. For example, in an IoT deployment area, if the packet loss rate from the edge gateway to the core node is 3% and the average latency is 35ms, this data constitutes link quality data. Target collection granularity indicates the level of detail in the traffic data collection process. It can be measured by the completeness of the collected fields, the packet-level / session-level sampling ratio, and the data sampling period. Higher target collection granularity indicates more detailed and comprehensive data collection, suitable for critical nodes with high security requirements. For example, one could configure full packet capture for high-risk devices (high target collection granularity) while only collecting five-tuples and behavioral summaries from ordinary terminals (low target collection granularity). The target sampling frequency represents the frequency of sampling a specified traffic range per unit time. It directly affects the real-time performance of data analysis and system resource consumption. The target sampling frequency can be dynamically adjusted based on business volatility and link stability. For example, in a low-load, stable link environment, the target sampling frequency can be set to once every 5 seconds. In high-frequency changing scenarios, the target sampling frequency can be increased to once per second.

[0023] In practical implementation, the three types of data mentioned above can be weighted and fused based on a preset device weight table and the current network status to dynamically calculate the corresponding collection granularity and frequency. For example, when a region has a high density of servers, strong business bursts, and reasonable link latency, the collection granularity for that region is automatically set to a high level and the collection frequency to 1 second / time to enhance the threat perception capability of that region. Conversely, for regions with poor link quality where low-risk devices are located, the collection frequency and granularity are automatically reduced to optimize resource utilization and improve overall collection efficiency.

[0024] By implementing step 101, and combining multi-dimensional data such as the distribution of device types in the network, current service load, and link quality, the traffic collection strategy is dynamically optimized, thereby achieving on-demand collection, avoiding resource waste. Compared with the traditional fixed collection frequency method, it is more flexible and adaptive, and can improve the efficiency and real-time response capability of the method in complex environments.

[0025] Step 102: Based on the target acquisition granularity and target acquisition frequency, capture the raw traffic data stream in real time at the edge computing node; In some examples, edge computing nodes refer to devices or system nodes deployed near the data source or network edge, possessing certain computing, storage, and data processing capabilities. The main function of edge computing nodes is to perform data preprocessing, feature extraction, and analysis locally, reducing the burden on the central server and improving response efficiency. Edge computing nodes can include, but are not limited to, edge gateways, smart switches, access controllers, field servers, and embedded processors. For example, in industrial internet scenarios, a factory's edge controller can act as an edge computing node to perform real-time analysis of communication traffic between devices in the workshop locally. Raw traffic data streams refer to unfiltered, un-anonymized, and unaggregated raw network transmission data, including IP packets at the network layer, TCP / UDP segments at the transport layer, and protocol payloads at the application layer. Raw traffic data streams contain information such as the addresses, ports, protocol types, packet sizes, timestamps, and content fields of the communicating parties, and are the core data source for network security detection and threat analysis. They can be captured using methods such as network bypass mirroring (e.g., using TAP or SPAN ports), access link packet capture, middleware log collection, or SDN controller flow table export. For example, in an enterprise intranet, a mirror port can be configured on the core switch to mirror and send all incoming and outgoing data streams to edge computing nodes for real-time capture and processing. Based on the target collection granularity and collection frequency strategy determined in step 101, the data capture logic of the edge nodes can be controlled to achieve refined and strategic traffic collection. The collection granularity determines the depth of the captured data, such as whether to collect only 5-tuples or retain the load content. The collection frequency determines the execution cycle of the collection task, such as collecting once per second or updating once per minute. By controlling these two parameters, the collection quality and resource utilization efficiency can be dynamically balanced to achieve precise monitoring. For example, when the target node is a high-risk server and the link quality is good, the edge node will continuously monitor the data stream at a frequency of 1 second and a complete packet capture granularity. For low-priority devices, only partial metadata may be collected every 10 seconds to reduce the load.

[0026] In actual deployment, edge computing nodes are equipped with a pre-set data acquisition agent module, which can automatically start, adjust, or pause traffic capture tasks according to the data acquisition strategy. This module supports functions such as protocol identification, data filtering, and sampling rate control. It can also cache the capture results locally or transmit them to the subsequent analysis module in real time, ensuring that critical raw data streams can still be obtained quickly and stably in environments with frequent changes in network status or sudden attacks, thereby improving the overall security incident perception and response capabilities.

[0027] By implementing step 102, traffic capture is performed on the edge computing node close to the data source, which can reduce data transmission overhead, improve the real-time performance of data collection, and effectively alleviate the pressure on the central node. Combined with a dynamic data collection strategy, low-latency and high-efficiency data acquisition can be achieved, providing timely and reliable basic data support for subsequent threat detection.

[0028] Step 103: Perform lightweight threat fingerprint extraction on the original traffic data stream to generate a distributed threat fingerprint set containing behavioral sequence features and protocol variation features; In some examples, lightweight threat fingerprinting refers to the efficient processing of raw traffic data at edge computing nodes to extract key features that reflect potential malicious behavior and encode them into representative fingerprint information, while minimizing computational and storage overhead. Compared to full feature extraction, lightweight threat fingerprinting emphasizes selectivity, compression, and real-time performance, enabling rapid pre-processing for threat identification even on resource-constrained edge devices. For example, several key indicators such as session interval jitter, protocol anomaly offset, and window mutation cycle for each connection can be extracted as fingerprint features, rather than retaining the entire data packet content. Behavioral sequence features refer to data patterns with temporal and behavioral logical relationships abstracted from network communication, which can be used to characterize the attacker's operation path or malicious behavior chain. Behavioral sequence feature extraction methods include, but are not limited to: the jitter rate of the time interval after session reassembly (such as irregular intervals between connections), the mutation cycle of transmission window size changes (such as DDoS features), data packet sending frequency, and interaction direction patterns. For example, in worm propagation behavior, the interval between connections to the target host will exhibit a relatively fixed or highly fluctuating periodic characteristic, which can be extracted as a behavioral sequence feature. Protocol variation features refer to abnormal, non-standard use, or content deviations of protocol fields in network communication. These features are used to identify attacks such as spoofed communication, protocol abuse, and hidden channels. For example, attackers can embed custom instructions within HTTPS encapsulation, causing field deviations and content entropy values ​​to deviate from standard features, allowing for the extraction of protocol variation features. A distributed threat fingerprint set refers to a multi-node shared threat dataset formed by encapsulating the aforementioned lightweight fingerprints (including behavioral sequence features and protocol variation features) into structured fingerprint units, annotating them with generation timestamps and edge node identifiers. The distributed threat fingerprint set can be distributed across multiple edge nodes and synchronized to a collaborative detection network through a subsequent consensus mechanism, enabling fingerprint reuse and joint identification in multi-source network environments. For example, each fingerprint in the set includes: behavioral feature vector, protocol feature vector, collection time, and source node ID, supporting cross-regional attack pattern matching and unified response.

[0029] In the specific implementation, the original data stream can first be reassembled into sessions, and then the sequence patterns and protocol structure differences of the target connection can be extracted in units of sliding time windows. Subsequently, an attention mechanism is used to weight and fuse the features of each dimension to generate a structured fingerprint. Finally, meta-information is added to each fingerprint and written to the local cache or uploaded to the consensus network. This process takes into account both accuracy and real-time performance, and can ensure that edge nodes can quickly identify new threats and form shareable fingerprint data resources.

[0030] By implementing step 103, key threat features (such as behavioral sequences and protocol variations) can be extracted in a lightweight manner, which can significantly reduce the computational burden and storage costs while ensuring identification accuracy. This enables efficient execution of security detection tasks even in resource-constrained environments and provides standardized data support for distributed processing and collaborative defense.

[0031] Step 104: After the distributed threat fingerprint set is verified by blockchain consensus, it is synchronized to the collaborative detection network to build an on-chain trusted threat knowledge base; In some examples, blockchain consensus verification refers to the joint confirmation of the authenticity, consistency, and credibility of the threat fingerprint sets reported by each edge node through a distributed verification mechanism, in order to prevent malicious nodes from uploading forged, redundant, or false alarm data. By introducing verification nodes (such as high-reputation security devices, backbone network exchange nodes, etc.) to form a verification network, consensus algorithms such as PBFT (Practical Byzantine Fault Tolerance) and DPoS (Delegated Proof-of-Stake) are adopted, and voting weights are dynamically assigned to each node according to its historical verification accuracy. For example, if a node's judgment is consistent with the entire network in 98 out of the past 100 consensuses, its voting weight will be higher than that of nodes with low accuracy. A collaborative detection network refers to a federated detection system composed of multiple physically isolated but logically interconnected edge nodes, central nodes, and security control nodes. Each node can achieve cross-domain collaborative defense and intelligent response by sharing fingerprint data, propagation path models, and detection strategies. In a collaborative detection network, nodes communicate through encrypted channels and utilize the blockchain ledger as a trust hub to ensure that all uploaded threat data is shared only after verification. For example, when an edge node of a provincial ISP identifies a new type of botnet control command, its fingerprint, after consensus verification, will quickly propagate to detection nodes in the same network segment or adjacent autonomous regions to intercept potential attacks in advance. An on-chain trusted threat knowledge base refers to a threat intelligence storage structure built on the blockchain ledger. Its content includes consensus-confirmed threat fingerprints, fingerprint metadata (such as source time, node location, and verification tags), and historical detection feedback. The on-chain trusted threat knowledge base possesses characteristics such as immutability, traceability, and verifiability, providing fundamental trusted data support for subsequent propagation path simulation, risk scoring, and strategy generation.

[0032] In the specific implementation process, edge nodes can encapsulate the distributed threat fingerprint set into a standard transaction format and submit it to the blockchain module of the collaborative detection network. Multiple verification nodes receive the transaction request and perform verification based on their own cached features and context detection results. After verification, the consensus algorithm decides whether to write it into the blockchain ledger. Threat fingerprints that have passed consensus verification form on-chain trusted data and are synchronized in real time by each collaborative node to enhance local detection capabilities and improve global response speed.

[0033] By implementing step 104, the consensus verification and trusted synchronization of threat fingerprints are achieved using blockchain, ensuring the integrity and immutability of threat intelligence, effectively preventing data from being tampered with or forged, improving the reliability of multi-node collaborative detection, and building a shared threat knowledge base with traceability and credibility.

[0034] Step 105: Based on real-time network topology information and on-chain trusted threat knowledge base, simulate the propagation path of the target threat fingerprint and generate a dynamic threat propagation map; In some examples, real-time network topology information refers to a dynamic dataset reflecting the state of the network structure, typically including node connectivity, link quality (such as bandwidth, latency, and packet loss rate), routing tables, and device type distribution. Real-time network topology information can be updated in real time through network controllers (such as SDN controllers), link status detection modules, SNMP protocol collection tools, etc. For example, an SDN controller periodically collects switch connection status and flow table entries to form a network topology map and node reachability matrix. A target threat fingerprint refers to a threat instance whose propagation path needs to be simulated, and can be derived from an on-chain trusted threat knowledge base. This target threat fingerprint can include fields such as behavioral sequence characteristics, protocol mutation characteristics, generation timestamps, infected node information, and associated vulnerability numbers. Propagation path simulation is based on the initial infected node of the target threat fingerprint, the current network topology, and its associated vulnerabilities. It extrapolates possible propagation paths in the topology graph. The simulation process considers factors such as propagation hop count, node connection weights, and vulnerability exploitation conditions, and introduces a time decay model to control path activity. For example, within a set propagation window (e.g., 6 hours), it simulates the shortest hop path from the initial node to any reachable node, and adjusts its propagation priority based on vulnerability severity (CVSS score). A dynamic threat propagation graph is a graph structure with spatiotemporal attributes, used to visualize threat propagation trends and scope. Nodes in the graph represent affected devices or services, edges represent potential propagation paths, and edge weights reflect propagation rate, time delay, or probability of successful exploitation. For example, a high-density node area in a propagation graph represents the core area of ​​a data center, and concentrated propagation paths indicate that the threat may trigger a large-scale spread in a short period.

[0035] In the implementation process, the initial infection location and vulnerability number of the target fingerprint can first be extracted from the on-chain trusted threat knowledge base. Then, a node connection graph is constructed by combining the current network topology information. Based on the connectivity of each node, routing hop limit, and vulnerability existence, the system simulates several propagation links and introduces path propagation rate weights and time decay factors to dynamically model the propagation trend. The final generated dynamic threat propagation map can be used to intuitively display the threat's reach, predict high-risk nodes, and provide decision support for subsequent risk scoring and protection strategy formulation.

[0036] By implementing step 105, combining the current network topology and threat knowledge, simulating threat propagation paths and constructing a map, it is helpful to accurately predict threat spread trends and potentially affected nodes, realize visualized analysis and risk prediction of security incidents, and improve the intuitiveness and foresight of network security management.

[0037] Step 106: Determine multi-dimensional risk scores based on the dynamic threat propagation map; In some examples, multi-dimensional risk scoring refers to a comprehensive risk value formed by quantitatively assessing the impact of target threat propagation from multiple key risk assessment dimensions and fusing them together. This score is used to reflect the degree of threat currently faced by the network and the breadth and depth of the attack surface. Commonly used dimensions include, but are not limited to: infected node density, infection ratio of core business nodes, maximum propagation path depth, propagation rate per unit time, and historical activity frequency; for example, if three core nodes are hit in the propagation path and the propagation rate is an average of two new nodes per second, the risk score is relatively high. The above risk dimensions can be extracted based on the structural features and propagation behavior information contained in the dynamic threat propagation map generated in step 105, and weighted fusion can be performed to obtain the scoring result; for example, if a threat in the map shows a propagation depth of 5 hops, an infected node density of 20%, a fast propagation rate per unit time (e.g., 3 nodes / minute), and includes one core database node, the risk score obtained after combining the weights of each dimension is 0.83 (out of 1.0). If the threat is repeatedly captured by multiple edge nodes in the past hour, the score can be increased to 0.9.

[0038] In actual implementation, the system first analyzes the structural data and time series from the dynamic threat propagation map to automatically extract various risk dimension indicators. Then, based on the preset dimension weight table (which can be adaptively adjusted based on device level, business value, etc.), the values ​​of each dimension are weighted and fused to generate an initial risk score. Finally, the system will also introduce the historical activity count of the target fingerprint within a set sliding window, adjust the initial score proportionally, and output the final multi-dimensional risk score result to provide a basis for the next step of protection strategy formulation.

[0039] By implementing step 106, a comprehensive assessment is conducted on factors such as the scope of threat propagation, the degree of impact, and the possibility of damage to key nodes, generating a multi-dimensional risk score. This makes the risk assessment more comprehensive and accurate, thereby providing a quantitative basis for subsequent strategy formulation and improving the accuracy and effectiveness of security response.

[0040] Step 107: Based on multi-dimensional risk scoring, generate an adaptive protection strategy and issue it for execution; In some examples, adaptive protection strategies refer to a set of protection and response measures that are dynamically generated and adapted based on the current network environment, threat characteristics, and risk level. Adaptive protection strategies have the ability to make intelligent decisions, self-adjust, and respond in real time, and can achieve differentiated protection control according to different threat levels. The content of adaptive protection strategies may include: traffic isolation, IP blocking, port rate limiting, session blocking, honeypot redirection, alarm notification, and service disaster recovery switching. For example, when the risk score is high, port blocking and isolation mechanisms can be immediately activated, and a high-priority warning can be sent to the administrator.

[0041] For example, the current threat can first be classified into four levels: "low," "medium," "high," and "severe," based on the multi-dimensional risk score output in step 106 and a preset risk level classification standard. Then, an adaptive protection policy corresponding to the level is matched from the policy mapping library. For instance, if the score is below 0.3, a "monitoring level" policy is mapped, which only logs and tracks behavior; if the score is between 0.3 and 0.6, an "early warning level" policy is applied, such as rate limiting and enhanced behavior analysis; if the score is between 0.6 and 0.8, an "isolation level" policy is executed, including traffic blocking and port blocking; if the score is above 0.8, an "emergency level" policy is activated, such as blocking connections, issuing patches, and redirection. The matched protection policy set can be mapped to an executable protection command set, and based on the edge node location information recorded in the target threat fingerprint, the commands are precisely sent to the corresponding protection devices, such as edge firewalls, intrusion detection systems (IDS), micro-segmentation gateways, or SDN controllers.

[0042] By implementing step 107, differentiated protection strategies can be intelligently generated and distributed based on risk scores. This enables dynamic and adaptive adjustments to security strategies, improves the targeting and timeliness of defense strategies, reduces the need for human intervention, and ultimately builds an intelligent network security system with rapid response and autonomous defense capabilities.

[0043] In summary, this application's embodiments dynamically determine the granularity and frequency of data collection based on multi-dimensional data such as device type, service load, and link quality, achieving on-demand acquisition of network traffic data. Compared to traditional fixed-frequency data collection methods, this mechanism is more flexible and accurate, effectively reducing unnecessary resource consumption and improving adaptability and real-time response levels in complex and dynamic network environments. By capturing raw traffic data in real time at edge computing nodes and performing lightweight threat fingerprint extraction, the solution achieves rapid perception and local processing of security threats, shortening the data analysis path, improving response speed, and facilitating effective interception at the initial stage of threat emergence, thereby improving the overall network security protection efficiency. Blockchain technology is used to perform consensus verification of the extracted distributed threat fingerprints and synchronize them to the collaborative detection network, constructing trusted on-chain threat knowledge. The database ensures the integrity, immutability, and multi-party sharing capabilities of threat intelligence, providing a solid foundation for secure collaboration among multiple nodes and enhancing the overall network's joint defense and control capabilities. Based on real-time network topology information and a trusted threat knowledge base, the solution can simulate the propagation path of target threat fingerprints and dynamically generate threat propagation maps. This allows security operations personnel to intuitively grasp threat spread trends and potential impact ranges, providing strong support for threat tracking and strategy formulation, and improving the visualization and scientific nature of network security decision-making. Relying on the multi-dimensional risk scoring generated by the dynamic threat propagation map, the system can automatically formulate and issue adaptive protection strategies, achieving precise and differentiated security responses. This improves the targeting and intelligence of network security strategies, effectively reducing false alarm rates and the need for human intervention, and enhancing the system's autonomous protection capabilities. In summary, the network security protection method based on distributed threat identification provided in this application integrates multi-dimensional data perception, edge computing, blockchain consensus, threat propagation modeling, and adaptive strategy issuance to achieve an efficient, reliable, intelligent, and real-time responsive distributed network security protection method.

[0044] In some embodiments, step 101 may include: normalizing the device type distribution data according to a preset device type weight table to generate device type distribution weight coefficients, wherein the calculation formula for the device type distribution weight coefficients is: In the formula, The weighting coefficients for equipment type distribution. For the first The number of online devices of this type The first in the preset device type weight table Threat level weights for different types of devices; this formula eliminates the amplifying effect of varying device numbers on the final weight through normalization, achieving fair weighting; for example, when there is a subnet with densely deployed high-risk devices, its... The value will be relatively high, triggering a finer granularity of data collection; The business load volatility is determined based on the difference between the peak and trough values ​​of the business load data within a preset sliding time window. The formula for calculating the business load volatility is as follows: In the formula, For business load volatility, Peak business load This represents the lowest point of the business load. To preset the window duration of the sliding time window, This is the historical average load. When the packet loss rate in the link quality data is less than or equal to 2%, and the latency in the link quality data is less than or equal to 20ms, the first value is determined as the sampling frequency adjustment coefficient; when the packet loss rate is greater than 2% and less than or equal to 5%, and the latency is greater than 20ms and less than or equal to 50ms, the second value is determined as the sampling frequency adjustment coefficient, where the second value is less than the first value; when the packet loss rate in the link quality data is greater than 5%, and the latency in the link quality data is greater than 50ms, the third value is determined as the sampling frequency adjustment coefficient, where the third value is less than the second value; based on the device type distribution weight coefficient, service load volatility, and sampling frequency adjustment coefficient, a weighted fusion is performed to obtain the target sampling granularity and target sampling frequency, where the calculation formulas for the target sampling granularity and target sampling frequency are as follows: In the formula, To determine the target granularity, To set the preset baseline acquisition granularity, The weighting coefficients for equipment type distribution. For the target acquisition frequency, To preset the reference acquisition frequency, This is the sampling frequency adjustment coefficient. This refers to the volatility of business load.

[0045] In some examples, a preset device type weight table is a data structure used to categorize the potential threat levels of different types of devices in network security protection. This preset weight table can be customized based on factors such as device purpose, exposure surface, and operating permissions. For example, the weight of industrial control equipment can be set to 0.9, ordinary terminals to 0.5, and suspicious external devices to 1.0. The preset device type weight table can be configured by the system administrator during the deployment phase and can be dynamically adjusted. Device type distribution weight coefficients. The calculation is used to quantify the impact of device type distribution on the granularity of data collection. Service load data refers to the data traffic of various service communications within a unit of time in the network, which can be collected in real time through access switches, gateways, routers, or probe devices; a preset sliding time window (e.g., 5 minutes) can be used to dynamically analyze service fluctuation trends, recording peak values ​​within that time period. ) and trough ( Business load volatility is a key parameter for operational load volatility. This reflects the drastic changes in service load. High service load volatility indicates sudden increases and decreases in service volume, requiring encrypted sampling to detect potential attacks or abnormal behavior. Link quality refers to the stability and reliability of the data transmission channel, primarily measured by packet loss rate and latency. Packet loss rate can be obtained by statistically analyzing the difference between the number of sent and received data packets, while latency is obtained through ICMP Ping, timestamp protocols, or feedback from the SDN controller. The sampling frequency adjustment coefficient (…) Based on the link quality, dynamic adjustments can be made, with the following settings: packet loss rate ≤ 2%, latency ≤ 20ms. =1.3 (first value); 2% < packet loss rate ≤ 5%, 20ms < latency ≤ 50ms, =1.0 (second value); packet loss rate > 5%, latency > 50ms. =0.7 (third value). By introducing , , It can implement a highly adaptive acquisition strategy that dynamically adjusts according to the actual network conditions.

[0046] For example, suppose a subnet contains 80 industrial control devices (w=0.9) and 120 ordinary terminals (w=0.5). The subnet's peak traffic over the past 5 minutes is 2000Mbps, the valley is 500Mbps, the average load is 1000Mbps, the current packet loss rate is 1.5%, and the latency is 18ms. The calculations show... ≈0.42, =(2000-500) / (5×60×1000)≈0.05, =1.3, then , Therefore, the system will focus on monitoring potential abnormal traffic in this subnet based on a higher collection frequency and finer granularity, thereby improving the coverage and timeliness of threat identification.

[0047] By implementing the above embodiments, quantitative modeling of three key factors—device type weight, service load volatility, and link quality—is introduced, which can intelligently adjust the collection granularity and frequency according to the real-time operating status. This dynamic adjustment mechanism can improve the targeting of threat monitoring and the efficiency of resource utilization while ensuring the normal communication load of the network. It is particularly suitable for scenarios with frequent service fluctuations or unstable link quality, such as smart factories, cloud platforms, and other critical infrastructure environments.

[0048] In some embodiments, step 103 may include: performing session reassembly processing based on the original traffic data stream to obtain a session sequence with consecutive timestamps; determining the setup time interval jitter rate between adjacent sessions based on the session sequence, wherein the setup time interval jitter rate is the ratio of the standard deviation of the time interval to the average time interval; detecting the window mutation period of the transmission window size based on the original traffic data stream, wherein the window mutation period is the time interval in which the window size exceeds three times the standard deviation of the historical average; combining the setup time interval jitter rate and the window mutation period into a behavioral sequence feature vector; and parsing the protocol header fields based on the original traffic data stream. The offset state determines the port mapping relationship between non-standard port numbers and standard protocol types; based on the original traffic data stream, the deviation of the header field length value from the preset standard value is determined as the field offset identifier; based on the original traffic data stream, the difference between the payload content entropy value and the baseline entropy value is calculated to obtain the entropy mutation coefficient; the port mapping relationship, field offset identifier, and entropy mutation coefficient are combined into a protocol mutation feature vector; attention-weighted fusion of the behavior sequence feature vector and the protocol mutation feature vector is performed to obtain a lightweight threat fingerprint; a generation timestamp and edge node location label are added to the lightweight threat fingerprint, and it is packaged to generate a distributed threat fingerprint set.

[0049] In some examples, session reassembly refers to grouping and reordering original data packets according to a five-tuple (source IP, destination IP, source port, destination port, protocol type) and time sequence to reconstruct a complete network session flow. For example, data packets during a TCP three-way handshake connection will be grouped into the same session. By reassembling these sessions, a session sequence with consecutive timestamps can be obtained, i.e., the start time, duration, and temporal relationship between each session and subsequent sessions. In the above session sequence, the time interval between the establishment of adjacent sessions can be calculated, and their average and standard deviation can be statistically analyzed. Further calculation of the time interval jitter rate is then performed. A high time interval jitter rate indicates abnormal traffic behavior or the presence of automated script-triggered behavior, such as the pulsed traffic in a DDoS attack. The window mutation period refers to the time interval during which the transmission window size in TCP traffic changes drastically. This can be achieved by calculating the average and standard deviation of historical window size sequences. If the current window value exceeds three times the standard deviation of the average, it is recorded as a mutation point. The interval between adjacent mutation points is the window mutation period. Frequent mutations may indicate malicious rate control behavior (such as data injection or protocol evasion). The behavior sequence feature vector combines the time interval jitter rate and window mutation period to form a vector representing the pattern of session behavior, which can be used to characterize communication behavior patterns. Protocol header field offset status refers to the length and position of header fields of protocols such as IP / TCP / UDP parsed from the original data packet to determine if there are any abnormal arrangements; for example, the standard TCP header should be 20 bytes. If the field offset does not conform to the standard, it indicates the existence of non-standard protocol mutations. Port mapping relationships are used to identify whether non-standard port numbers are used for known protocol communication (such as HTTP traffic appearing on port 8080 or other high-order ports). This type of mapping is obtained by detecting application layer protocol signatures and comparing them with the standard port table. Field offset identifiers are the deviations between the header field length value and the preset protocol standard value. The larger the value, the more severe the offset, which may indicate that the protocol has been tampered with or encapsulated. Entropy mutation coefficient is used to measure the difference between the entropy value of the payload data content and the standard communication entropy value. Abnormally high or low entropy values ​​usually indicate the existence of encrypted communication, tunneling protocols, or malicious payload hiding. Combining the above three types of indicators constitutes the protocol mutation feature vector, used to capture protocol-level anomalies. The generation of lightweight threat fingerprints involves attention-based fusion of behavioral sequence feature vectors and protocol variation feature vectors. This means that the importance of each type of feature is dynamically evaluated through neural networks or rule-based weighting mechanisms to form a lightweight threat fingerprint with compressed information. This lightweight threat fingerprint retains key discriminative features, has a high recognition rate and low transmission overhead, and is suitable for deployment on edge devices.Each generated lightweight fingerprint can be timestamped (e.g., ISO time format) and labeled with edge node location (e.g., device ID, IP, deployment area code, etc.) to form a structured fingerprint object. Multiple fingerprints can be combined and packaged together to form a distributed threat fingerprint set, which can be used for subsequent on-chain verification and collaborative detection.

[0050] For example, in a network environment containing IoT cameras and edge routers, data collected by edge computing nodes reveals that a certain IP segment continuously initiates TCP connections with a jitter rate of 0.65 between each connection, which is much higher than the normal value (<0.2). At the same time, periodic abrupt changes in the TCP window size are detected. This IP also uses the non-standard port 8888 to transmit the HTTP protocol, and the packet body entropy deviates from the normal range by 20%. After extracting the above behavioral sequences and protocol features, they are fused to form a lightweight fingerprint, which is marked as a suspected attack target and added to the threat fingerprint set for subsequent on-chain synchronization.

[0051] By implementing the above embodiments, threat features are constructed using two dimensions: behavioral sequence and protocol variation. The attention mechanism is then used for fusion, which can improve the accuracy and lightweight nature of threat identification. In particular, when facing complex attack methods such as encrypted traffic, non-standard ports, and spoofed protocols, key features can still be extracted. This effectively addresses the blind spots of traditional signature detection and static rule methods, and is suitable for rapid threat identification in scenarios with limited edge device resources.

[0052] In some embodiments, step 104 may include: encapsulating the distributed threat fingerprint set into a transaction data format to obtain a transaction format threat fingerprint set, and submitting the transaction format threat fingerprint set to the collaborative detection network; assigning dynamic voting weights to the verification nodes in the collaborative detection network based on historical verification accuracy; performing consensus verification on the transaction format threat fingerprint set through the verification nodes based on the dynamic voting weights to obtain a verified threat fingerprint set; and writing the verified threat fingerprint set into the blockchain ledger of the collaborative detection network to obtain an on-chain trusted threat knowledge base.

[0053] In some examples, transaction data format refers to encapsulating raw structured data (such as lightweight threat fingerprints) into a formatted data structure that can be recognized and processed by the blockchain network. This may include field labels, version numbers, commit node signatures, fingerprint hash digests, timestamps, etc., with common formats such as JSON or protobuf. A transaction format threat fingerprint set refers to a data set that unifies multiple lightweight threat fingerprints and encapsulates them according to the transaction format. A collaborative detection network refers to a consortium blockchain network composed of multiple security nodes (including enterprise, edge, cloud, and security vendor nodes). The submission process involves broadcasting transaction data to the entire network by calling a smart contract interface, with each verification node participating in consensus verification. Verification nodes are blockchain nodes with data auditing and block generation permissions. In this embodiment, to improve consensus quality, a dynamic voting weight mechanism is introduced: the weight of each verification node is not fixed but dynamically adjusted based on its historical verification accuracy (i.e., whether the data it confirms is subsequently proven valid). For example, nodes with an accuracy > 95% receive a weight coefficient of 1.2, while nodes with an accuracy below 90% have their weight reduced to 0.8. Once the transaction format threat fingerprint set is submitted, each verification node can verify its content according to its own weight, including but not limited to signature verification, field integrity verification, fingerprint hash consistency verification, and historical threat similarity comparison. Finally, based on consensus mechanisms such as DPoS (Delegated Proof of Stake) or PBFT (Practical Byzantine Fault Tolerance), the transaction is confirmed as legitimate after obtaining more than a set threshold (e.g., 67% valid votes), generating a verified threat fingerprint set. The process of writing this data into the blockchain ledger to form an on-chain trusted threat knowledge base involves packaging the verified data into the latest block of the blockchain, generating an immutable record. This record contains information such as the original fingerprint content, submission time, verification node signatures, and consensus results, constituting the on-chain trusted threat knowledge base. This knowledge base possesses characteristics such as distributed storage, auditability, traceability, and cross-domain trusted sharing, and can be used for subsequent detection, response, and tracing.

[0054] For example, taking an anomaly detected by an edge node as an example, the node encapsulates a set containing four fingerprints into a transaction format and submits it to the consortium blockchain. The five verification nodes in the network are assigned weights based on their respective historical verification accuracy rates (e.g., node A is 1.2, node B is 0.9), and verify the fingerprint set one by one. After confirmation by a majority weighted vote, the set successfully passes consensus and is recorded in the current blockchain block at height #234. Subsequently, other nodes can directly pull this threat knowledge from the chain as a matching basis or support for correlation analysis in the next round of detection.

[0055] By implementing the above embodiments, the threat fingerprint data is verified and stored using the blockchain consensus mechanism, and a trusted on-chain threat knowledge base is established. This not only improves the immutability and traceability of threat data, but also supports security collaborative detection between nodes. It solves the shortcomings of the existing system where threat intelligence is scattered, inconsistent, and easily contaminated, and helps to establish a unified and highly reliable protection system in a distributed network with multiple organizations and regions.

[0056] In some embodiments, step 105 may include: extracting the initial infected node and associated vulnerability identifier of the target threat fingerprint from an on-chain trusted threat knowledge base; determining the minimum propagation hops from the initial infected node to each reachable node based on the node connection matrix and routing hop limit of the real-time network topology; querying a preset vulnerability database according to the associated vulnerability identifier to determine the vulnerability severity score; weighting and fusing the minimum propagation hops with the vulnerability severity score to generate a path propagation rate weight, wherein the larger the minimum propagation hops, the lower the path propagation rate weight, and the higher the vulnerability severity score, the higher the path propagation rate weight; simulating the diffusion path of the target threat fingerprint along the network topology based on the path propagation rate weight to generate a multi-level propagation link with a time decay coefficient; and aggregating the spatiotemporal attributes of the multi-level propagation links to generate a dynamic threat propagation map.

[0057] In some examples, the initial infected node refers to the edge or core network node where the target threat fingerprint was first detected. Its location and number can be directly extracted from the on-chain trusted threat knowledge base, such as the field `source_node_id`. The associated vulnerability identifier refers to the vulnerability number (such as CVE-ID) associated with the threat fingerprint, which can be mapped to the vulnerability database based on the feature code in the fingerprint; for example, if the fingerprint contains abnormal behavior of the SMB protocol, it can be associated with vulnerability CVE-2017-0144. The node connection matrix is ​​a two-dimensional array representing the network topology. Element A[i][j]=1 indicates that node i and node j are directly connected; otherwise, it is 0. This matrix can be generated in real time by the network topology monitoring module. Reachable nodes refer to the set of all nodes that can be accessed from the initial infected node under a specified hop count limit. The minimum propagation hop count represents the shortest path length from the initial infected node to each reachable node, which can be calculated using BFS or Dijkstra's algorithm. The preset vulnerability database includes fields such as CVE number, vulnerability type, attack conditions, and impact scope, and provides standard severity scores, such as CVSS (Common Vulnerability Scoring System). The vulnerability severity score is the CVSS score, typically ranging from 0 to 10, categorized into low, medium, high, and severe levels. For example, CVE-2021-44228 has a score of 9.8, classifying it as severe. The minimum propagation hops (H) and the vulnerability severity score (S) can be weighted and combined to construct a propagation rate weight. Example formula is as follows: ,in, A modulating factor (e.g., 0.6) indicates a higher weighting for severity scores; fewer hops indicate a more severe vulnerability, and a faster propagation rate along the corresponding path. This is based on propagation rate weighting. It can expand outward from the initial node in multiple levels to simulate the propagation path, adding a time decay coefficient K in each level of propagation. This indicates that the threat's ability to spread decreases over time. t represents the propagation stage; for example, if =0.8, =0.9, then the influence of the second-level node is 0.8 × 0.9 = 0.72. The dynamic threat propagation graph aggregates the spatiotemporal information of each propagation link, including start and end nodes, propagation delay, path weight, and scope of influence, constructing a dynamic graph structure containing topology, propagation levels, and time labels. This dynamic threat propagation graph can be stored in a graph database (such as Neo4j) or in tensor form, and supports visualization rendering for applications such as situational awareness and risk analysis.

[0058] For example, taking the threat fingerprint fp_20250805_001 as an example, its initial infected node is Node_23, and the associated vulnerability is CVE-2021-22986 (severity score 9.8). According to the current network connection matrix, Node_23 can reach 6 nodes, including Node_45 and Node_52, with minimum propagation hops of 2, 3, and 4 respectively. After calculating the propagation weight using the weighted fusion formula, a 4-level propagation link is generated based on the propagation rate and time decay. Each edge in the graph carries propagation delay and threat intensity information, ultimately forming a dynamic graph covering the entire network for subsequent defense deployment and risk scoring calculation.

[0059] By implementing the above embodiments, integrating network topology, propagation path, and vulnerability severity information, it is possible to simulate the propagation path of threat fingerprints and construct a dynamic threat map. This enables the prediction and modeling of potential attack spread trends, allowing the protection system to move beyond static response and acquire the capability of "predictive defense." It allows for the early deployment of protective measures before threats spread, making it particularly suitable for critical industry networks such as finance, government, and energy that require high availability.

[0060] In some embodiments, step 106 may include: extracting key risk assessment dimensions from a dynamic threat propagation map, wherein the key risk assessment dimensions may include the density of infected nodes, the infection rate of core business nodes, the maximum depth of the propagation path, and the propagation rate per unit time; independently quantifying each key risk assessment dimension according to preset dimension weight coefficients to obtain a dimension risk value, wherein the preset dimension weight coefficients are dynamically adjusted based on a preset device type weight table; performing weighted fusion processing on the dimension risk values ​​to generate an initial comprehensive risk value; and dynamically correcting the initial comprehensive risk value based on the activity frequency of the target threat fingerprint within a preset time window to obtain a multi-dimensional risk score.

[0061] In some examples, key risk assessment dimensions refer to the main indicator parameters used to measure the severity and potential harm of the current threat propagation, including but not limited to: Infected node density: This represents the ratio of the number of nodes marked as infected in the current propagation graph to the total number of nodes in the entire network.

[0062] Infection rate of core business nodes: refers to the ratio of the number of infected nodes in a specific business key node (such as server, database, middle platform module, etc.) to the total number of nodes of that type; core nodes can be predefined with tags, such as tag=core, provided by the network asset management system.

[0063] Maximum propagation path depth: This refers to the length of the longest effective path in the propagation graph starting from the initial infected node. It can be obtained through depth-first search (DFS) or graph search.

[0064] Propagation rate per unit time: measures the number of newly infected nodes in the propagation map per unit time.

[0065] Each of the above dimensions will be independently quantified using a set normalization function or piecewise function to obtain a standardized dimensional risk value. For example, when the propagation path depth is greater than a preset threshold (e.g., 5 hops), the corresponding risk value is set to the range of 0.8 to 1.0; when the infection rate of core business nodes is higher than 50%, the risk value can be set to 1.0. The quantification function can be set as a linear, exponential, or logistic regression model, selected based on the sensitivity of the threat performance in the actual deployment environment. The quantification results of each dimension can be weighted and fused according to weighting factors to obtain an initial comprehensive risk value. The weighting factors can be dynamically adjusted based on the device type weight table. If the proportion of high-risk terminal types (e.g., OT devices, IoT devices) in the current network is large, then higher weights are assigned to the propagation rate or node density dimension. The activity changes of threat fingerprints can be considered. The activity frequency of the target threat fingerprint within a preset time window (such as the number of times it appears per minute or the number of times it triggers alarms) can be used as a dynamic adjustment parameter to correct the initial comprehensive risk value. For example, in a distributed propagation, there are 80 infected nodes, a total of 400 nodes in the network, an infection rate of 40% for core business nodes, a maximum propagation depth of 6 hops, and a propagation rate of 20 nodes / minute. The dimensional risk values ​​are 0.2, 0.8, 0.9, and 1.0, respectively. After weighting with weighting coefficients [0.2, 0.3, 0.2, 0.3], the initial risk value is 0.78. If the target fingerprint actively triggers alarms 50 times within 5 minutes, and the activity frequency correction coefficient is 0.2, then the final multi-dimensional risk score is 0.78⋅(1+0.2⋅50100)=0.858. The resulting multi-dimensional risk score will be used for the automatic generation and distribution of the next protection strategy, ensuring that the threat response is targeted, adaptable, and dynamic.

[0066] By implementing the above embodiments, multi-dimensional indicators are introduced for risk scoring, enabling risk assessment to move from a single dimension to a three-dimensional and quantitative approach. This approach not only considers the propagation path but also integrates factors such as node roles and propagation speed, generating risk judgment results that are more in line with business scenarios. Through a dynamic correction mechanism, the scoring process can respond to changes in threat activity in real time, effectively supporting refined management of strategy scheduling and resource allocation.

[0067] In some embodiments, the aforementioned step 107 may include: classifying and categorizing according to multi-dimensional risk scores to obtain the current threat level; mapping a preset protection strategy based on the current threat level to obtain an adaptive protection strategy set; mapping the adaptive protection strategy set to an executable protection instruction set, and sending the protection instruction set to the target execution node.

[0068] In some examples, the current threat level is a level label obtained after classifying multi-dimensional risk scores. This can be divided using preset hierarchical intervals, such as: risk score < 0.3 for Low, 0.3 ≤ risk score < 0.6 for Medium, 0.6 ≤ risk score < 0.80 for High, and risk score ≥ 0.8 for Critical. This classification rule can be statically configured or dynamically adjusted based on machine learning models (such as cluster analysis) to ensure the classification adapts to changes in network conditions. Preset protection policy mapping refers to a pre-established level-policy mapping table based on different threat levels. Each level corresponds to one or more combinations of security policies. For example, for Low-risk levels, it can be mapped to observational policies, such as logging and behavior monitoring; for Medium-risk levels, lightweight protection measures can be added, such as enabling traffic limiting and protocol auditing; for High-risk or Critical levels, it is mapped to isolation, blocking, and alarm linkage policies. This policy mapping table can be configured by the security administrator or automatically optimized based on historical threat response data. An adaptive protection policy set is a collection of policies that are further tailored and adjusted based on the current network situation and resource status, derived from the mapping policies. Its generation methods include: removing policies incompatible with the target device, dynamically adding available redundant policies, and adjusting policy strength according to business importance; for example, in situations with high system load or limited execution node resources, policy combinations with less impact may be prioritized. An executable protection instruction set is a collection of specific formatted control instructions that convert the policy set into machine-resolvable commands. The conversion process can be based on an intermediate policy language (such as OpenFlow or NETCONF) or a control platform API standard. The target execution node refers to the network entity device that deploys the protection policies, typically including but not limited to firewalls, edge gateways, security agents, endpoint security agents, and SDN controllers. Its selection criteria include: threat location, device type, resource availability, and deployment policy priority. Target execution node information can be obtained from the network asset management platform and updated in real time based on the current topology and scheduling information.

[0069] For example, if a threat fingerprint triggers multiple alarms within one minute and the result of a multi-dimensional risk score is 0.82, it is classified as a severe threat. Then, a set of protection strategies, including isolating nodes, blocking communication, and reporting linked alarms, is automatically mapped. After checking that the target node is an industrial control device with security agent capabilities, the strategy is converted into isolation control commands and security event reporting instructions, and sent to the device through the edge scheduling module. This ultimately realizes a joint prevention and control mechanism for the immediate blocking of threat propagation and alarm linkage.

[0070] Through the implementation of the above embodiments, the adaptive protection strategy generation and distribution mechanism enables network protection to shift from "manual preset" to "intelligent driving". By automatically mapping multi-dimensional risk levels to protection strategy sets, executable instructions are quickly generated and accurately distributed to target nodes, shortening the threat response cycle and improving the agility and controllability of overall protection. It is especially suitable for the automatic response needs of high-frequency security events in large-scale dynamic networks or multi-tenant cloud environments.

[0071] Furthermore, as an implementation of the aforementioned method embodiments, this application also provides a network security protection device based on distributed threat identification, used to implement the aforementioned method embodiments. This device embodiment corresponds to the aforementioned method embodiments. For ease of reading, this network security protection device embodiment based on distributed threat identification will not repeat the details of the aforementioned method embodiments one by one, but it should be understood that the device in this application embodiment can correspondingly implement all the contents of the aforementioned method embodiments. Figure 2 As shown, the network security protection device 20 based on distributed threat identification includes: a parameter determination unit 201, a data acquisition unit 202, a threat fingerprint extraction unit 203, an on-chain synchronization unit 204, a graph generation unit 205, a risk scoring unit 206, and a security protection unit 207. The parameter determination unit 201 is used to determine the target acquisition granularity and target acquisition frequency based on device type distribution data, service load data, and link quality data. The data acquisition unit 202 is used to capture raw traffic data streams in real time at edge computing nodes based on the target acquisition granularity and target acquisition frequency. The threat fingerprint extraction unit 203 is used to analyze the raw traffic data streams... The system performs lightweight threat fingerprint extraction based on data flow, generating a distributed threat fingerprint set containing behavioral sequence features and protocol variation features. An on-chain synchronization unit 204 synchronizes the distributed threat fingerprint set to the collaborative detection network after blockchain consensus verification, in order to construct an on-chain trusted threat knowledge base. A graph generation unit 205 simulates the propagation path of the target threat fingerprint based on real-time network topology information and the on-chain trusted threat knowledge base, generating a dynamic threat propagation graph. A risk scoring unit 206 determines multi-dimensional risk scores based on the dynamic threat propagation graph. A security protection unit 207 generates adaptive protection strategies based on the multi-dimensional risk scores and issues them for execution.

[0072] In some embodiments, the parameter acquisition determination unit 201 is further configured to normalize the equipment type distribution data according to a preset equipment type weight table to generate equipment type distribution weight coefficients, wherein the calculation formula for the equipment type distribution weight coefficients is: In the formula, The weighting coefficients for equipment type distribution. For the first The number of online devices of this type The first in the preset device type weight table Threat level weights for different types of devices; The business load volatility is determined based on the difference between the peak and trough values ​​of the business load data within a preset sliding time window. The formula for calculating the business load volatility is as follows: In the formula, For business load volatility, Peak business load This represents the lowest point of the business load. To preset the window duration of the sliding time window, This is the historical average load. When the packet loss rate in the link quality data is less than or equal to 2%, and the latency in the link quality data is less than or equal to 20ms, the first value is determined as the sampling frequency adjustment coefficient; when the packet loss rate is greater than 2% and less than or equal to 5%, and the latency is greater than 20ms and less than or equal to 50ms, the second value is determined as the sampling frequency adjustment coefficient, where the second value is less than the first value; when the packet loss rate in the link quality data is greater than 5%, and the latency in the link quality data is greater than 50ms, the third value is determined as the sampling frequency adjustment coefficient, where the third value is less than the second value; based on the device type distribution weight coefficient, service load volatility, and sampling frequency adjustment coefficient, a weighted fusion is performed to obtain the target sampling granularity and target sampling frequency, where the calculation formulas for the target sampling granularity and target sampling frequency are as follows: In the formula, To determine the target granularity, To set the preset baseline acquisition granularity, The weighting coefficients for equipment type distribution. For the target acquisition frequency, To preset the reference acquisition frequency, This is the sampling frequency adjustment coefficient. This refers to the volatility of business load.

[0073] In some embodiments, the threat fingerprint extraction unit 203 is further configured to perform session reassembly processing based on the original traffic data stream to obtain a session sequence under consecutive timestamps; determine the establishment time interval jitter rate between adjacent sessions based on the session sequence, wherein the establishment time interval jitter rate is the ratio of the standard deviation of the time interval to the average time interval; detect the window mutation period of the transmission window size based on the original traffic data stream, wherein the window mutation period is the time interval in which the window size exceeds three times the standard deviation of the historical average; combine the establishment time interval jitter rate and the window mutation period into a behavior sequence feature vector; and parse the protocol header fields based on the original traffic data stream. The offset state is used to determine the port mapping relationship between non-standard port numbers and standard protocol types; based on the original traffic data stream, the deviation of the header field length value from the preset standard value is determined as the field offset identifier; based on the original traffic data stream, the difference between the payload content entropy value and the baseline entropy value is calculated to obtain the entropy mutation coefficient; the port mapping relationship, field offset identifier, and entropy mutation coefficient are combined into a protocol mutation feature vector; attention-weighted fusion of the behavior sequence feature vector and the protocol mutation feature vector is performed to obtain a lightweight threat fingerprint; a generation timestamp and edge node location label are added to the lightweight threat fingerprint, and it is packaged to generate a distributed threat fingerprint set.

[0074] In some embodiments, the on-chain synchronization unit 204 is further configured to encapsulate the distributed threat fingerprint set into a transaction data format to obtain a transaction format threat fingerprint set, and submit the transaction format threat fingerprint set to the collaborative detection network; assign dynamic voting weights to the verification nodes in the collaborative detection network based on historical verification accuracy; perform consensus verification on the transaction format threat fingerprint set through the verification nodes based on the dynamic voting weights to obtain a verified threat fingerprint set; and write the verified threat fingerprint set into the blockchain ledger of the collaborative detection network to obtain an on-chain trusted threat knowledge base.

[0075] In some embodiments, the map generation unit 205 is further configured to extract the initial infected node and associated vulnerability identifier of the target threat fingerprint from the on-chain trusted threat knowledge base; determine the minimum propagation hops from the initial infected node to each reachable node based on the node connection matrix and routing hop count limit of the real-time network topology; query a preset vulnerability database according to the associated vulnerability identifier to determine the vulnerability severity score; weight and fuse the minimum propagation hops with the vulnerability severity score to generate a path propagation rate weight, wherein the larger the minimum propagation hops, the lower the path propagation rate weight, and the higher the vulnerability severity score, the higher the path propagation rate weight; simulate the diffusion path of the target threat fingerprint along the network topology based on the path propagation rate weight to generate a multi-level propagation link with a time decay coefficient; and aggregate the spatiotemporal attributes of the multi-level propagation link to generate a dynamic threat propagation map.

[0076] In some embodiments, the risk scoring unit 206 is further configured to extract key risk assessment dimensions from the dynamic threat propagation map, wherein the key risk assessment dimensions include the density of infected nodes, the infection ratio of core business nodes, the maximum depth of the propagation path, and the propagation rate per unit time; to independently quantify each key risk assessment dimension according to preset dimension weight coefficients to obtain a dimension risk value, wherein the preset dimension weight coefficients are dynamically adjusted based on a preset device type weight table; to perform weighted fusion processing on the dimension risk values ​​to generate an initial comprehensive risk value; and to dynamically correct the initial comprehensive risk value based on the activity frequency of the target threat fingerprint within a preset time window to obtain a multi-dimensional risk score.

[0077] In some embodiments, the security protection unit 207 is further configured to classify and grade according to multi-dimensional risk scores to obtain the current threat level; based on the current threat level, perform preset protection strategy mapping to obtain an adaptive protection strategy set; map the adaptive protection strategy set to an executable protection instruction set, and send the protection instruction set to the target execution node.

[0078] This application also provides a computer-readable storage medium storing computer-executable instructions or computer programs, which, when executed by a processor, will cause the processor to perform any step of the network security protection method based on distributed threat identification provided in this application.

[0079] In some embodiments, the computer-readable storage medium may be a random access memory (RAM), a read-only memory (ROM), flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); or it may be a variety of devices that include one or any combination of the above-mentioned memories.

[0080] In some embodiments, computer-executable instructions may take the form of programs, software, software modules, scripts, or code, written in any form of programming language (including compiled or interpreted languages, or declarative or procedural languages), and may be deployed in any form, including as stand-alone programs or as modules, components, subroutines, or other units suitable for use in a computing environment.

[0081] In some embodiments, computer-executable instructions may, but do not necessarily, correspond to files in a file system, and may be stored as part of a file that holds other programs or data, for example, in one or more scripts in a HyperText Markup Language (HTML) document, in a single file dedicated to the program in question, or in multiple co-located files (e.g., files that store one or more modules, subroutines, or code sections).

[0082] In some embodiments, computer-executable instructions may be deployed to execute on an electronic device, or on multiple electronic devices located at one location, or on multiple electronic devices distributed across multiple locations and interconnected via a communication network.

[0083] like Figure 3 As shown, this application also provides an electronic device 30, including a memory 310, a processor 320, and a computer program 311 stored in the memory 310 and executable on the processor. When the processor 320 executes the computer program 311, it implements any of the steps of the network security protection method based on distributed threat identification described above.

[0084] This application also provides a computer program product comprising a computer program or computer-executable instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer program or computer-executable instructions from the computer-readable storage medium and executes the computer program or computer-executable instructions, causing the electronic device to perform any step of the network security protection method based on distributed threat identification described above.

[0085] The above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A network security protection method based on distributed threat identification, characterized in that, include: Based on device type distribution data, service load data, and link quality data, determine the target collection granularity and target collection frequency; Based on the target acquisition granularity and the target acquisition frequency, raw traffic data streams are captured in real time at edge computing nodes; Lightweight threat fingerprint extraction is performed on the original traffic data stream to generate a distributed threat fingerprint set containing behavioral sequence features and protocol variation features; The distributed threat fingerprint set is verified by blockchain consensus and then synchronized to the collaborative detection network to build an on-chain trusted threat knowledge base; Based on real-time network topology information and the on-chain trusted threat knowledge base, the propagation path of the target threat fingerprint is simulated to generate a dynamic threat propagation map. Based on the dynamic threat propagation map, a multi-dimensional risk score is determined; Based on the multi-dimensional risk score, an adaptive protection strategy is generated and deployed for execution.

2. The method according to claim 1, characterized in that, The determination of the target collection granularity and target collection frequency based on device type distribution data, service load data, and link quality data includes: Based on a preset equipment type weight table, the equipment type distribution data is normalized to generate equipment type distribution weight coefficients. The calculation formula for these weight coefficients is as follows: In the formula, The distribution weight coefficients for the device types are as follows: For the first The number of online devices of this type The first in the preset device type weight table Threat level weights for different types of devices; The service load volatility is determined based on the difference between the peak and trough values ​​of the service load data within a preset sliding time window. The formula for calculating the service load volatility is as follows: In the formula, The aforementioned business load volatility, The peak value of the service load. This represents the lowest point of the business load. The window duration is the preset sliding time window. This is the historical average load. When the packet loss rate in the link quality data is less than or equal to 2% and the latency in the link quality data is less than or equal to 20ms, the sampling frequency adjustment coefficient is determined to be the first value. When the packet loss rate is greater than 2% and less than or equal to 5%, and the delay is greater than 20ms and less than or equal to 50ms, the sampling frequency adjustment coefficient is determined to be a second value, wherein the second value is less than the first value; When the packet loss rate in the link quality data is greater than 5% and the latency in the link quality data is greater than 50ms, the sampling frequency adjustment coefficient is determined to be a third value, wherein the third value is less than the second value. Based on the device type distribution weight coefficient, the service load volatility, and the acquisition frequency adjustment coefficient, a weighted fusion is performed to obtain the target acquisition granularity and the target acquisition frequency. The calculation formulas for the target acquisition granularity and the target acquisition frequency are as follows: In the formula, The target acquisition granularity is defined as follows. To set the preset baseline acquisition granularity, The distribution weight coefficients for the device types are as follows: The target acquisition frequency, To preset the reference acquisition frequency, The sampling frequency adjustment coefficient is... The business load volatility is mentioned above.

3. The method according to claim 1, characterized in that, The step of performing lightweight threat fingerprint extraction on the original traffic data stream to generate a distributed threat fingerprint set containing behavioral sequence features and protocol variation features includes: Based on the original traffic data stream, session reassembly processing is performed to obtain a session sequence under consecutive timestamps; Based on the session sequence, the establishment time interval jitter rate between adjacent sessions is determined, wherein the establishment time interval jitter rate is the ratio of the standard deviation of the time interval to the average value of the time interval; Based on the original traffic data stream, the window mutation period of the transmission window size is detected, wherein the window mutation period is the time interval in which the window size exceeds three standard deviations of the historical average. The establishment time interval jitter rate and the window mutation period are combined to form a behavioral sequence feature vector; Based on the original traffic data stream, the offset status of the protocol header field is parsed to determine the port mapping relationship between non-standard port numbers and standard protocol types; Based on the original traffic data stream, the deviation between the header field length value and the preset standard value is determined as the field offset identifier; Based on the original traffic data stream, the difference between the load content entropy value and the baseline entropy value is calculated to obtain the entropy value mutation coefficient. The port mapping relationship, the field offset identifier, and the entropy mutation coefficient are combined into a protocol variation feature vector; Attention-weighted fusion of the behavior sequence feature vector and the protocol variation feature vector yields a lightweight threat fingerprint. Add a generation timestamp and edge node location tag to the lightweight threat fingerprint, and package it to generate the distributed threat fingerprint set.

4. The method according to claim 3, characterized in that, The step of synchronizing the distributed threat fingerprint set to the collaborative detection network after blockchain consensus verification to construct an on-chain trusted threat knowledge base includes: The distributed threat fingerprint set is encapsulated into a transaction data format to obtain a transaction format threat fingerprint set, and the transaction format threat fingerprint set is submitted to the collaborative detection network. Dynamic voting weights are assigned to the verification nodes in the collaborative detection network based on their historical verification accuracy. Based on the dynamic voting weight, the transaction format threat fingerprint set is verified through the verification node to obtain the verified threat fingerprint set. The verified threat fingerprint set is written into the blockchain ledger of the collaborative detection network to obtain the on-chain trusted threat knowledge base.

5. The method according to claim 1, characterized in that, The step of simulating the propagation path of the target threat fingerprint based on real-time network topology information and the on-chain trusted threat knowledge base to generate a dynamic threat propagation map includes: Extract the initial infected node and associated vulnerability identifier of the target threat fingerprint from the on-chain trusted threat knowledge base; Based on the node connection matrix and routing hop limit of the real-time network topology, determine the minimum propagation hops from the initial infected node to each reachable node; Based on the associated vulnerability identifier, a preset vulnerability database is queried to determine the vulnerability severity score; The minimum propagation hop count and the vulnerability severity score are weighted and fused to generate a path propagation rate weight. The larger the minimum propagation hop count, the lower the path propagation rate weight. The higher the vulnerability severity score, the higher the path propagation rate weight. Based on the path propagation rate weights, the diffusion path of the target threat fingerprint along the network topology is simulated to generate a multi-level propagation link with a time decay coefficient. The spatiotemporal attributes of the multi-level propagation links are aggregated to generate the dynamic threat propagation map.

6. The method according to claim 1, characterized in that, The determination of multi-dimensional risk scores based on the dynamic threat propagation map includes: Key risk assessment dimensions are extracted from the dynamic threat propagation map, including the density of infected nodes, the infection rate of core business nodes, the maximum depth of the propagation path, and the propagation rate per unit time. Each of the key risk assessment dimensions is independently quantified according to the preset dimension weight coefficients to obtain the dimension risk value, wherein the preset dimension weight coefficients are dynamically adjusted based on the preset equipment type weight table; The risk values ​​of the aforementioned dimensions are weighted and fused to generate an initial comprehensive risk value; Based on the activity frequency of the target threat fingerprint within a preset time window, the initial comprehensive risk value is dynamically corrected to obtain the multi-dimensional risk score.

7. The method according to claim 1, characterized in that, The process of generating an adaptive protection strategy based on the multi-dimensional risk score and then issuing and executing it includes: The current threat level is obtained by classifying and categorizing the risks based on the multi-dimensional risk score. Based on the current threat level, a preset protection strategy mapping is performed to obtain an adaptive protection strategy set; The adaptive protection strategy set is mapped to an executable protection instruction set, and the protection instruction set is sent to the target execution node.

8. A network security protection device based on distributed threat identification, characterized in that, include: The parameter determination unit is used to determine the target collection granularity and target collection frequency based on device type distribution data, service load data, and link quality data. The data acquisition unit is used to capture raw traffic data streams in real time at the edge computing node based on the target acquisition granularity and the target acquisition frequency; The threat fingerprint extraction unit is used to perform lightweight threat fingerprint extraction on the original traffic data stream, generating a distributed threat fingerprint set containing behavioral sequence features and protocol variation features; The on-chain synchronization unit is used to synchronize the distributed threat fingerprint set to the collaborative detection network after being verified by blockchain consensus, so as to build an on-chain trusted threat knowledge base; The map generation unit is used to simulate the propagation path of the target threat fingerprint based on real-time network topology information and the on-chain trusted threat knowledge base, and generate a dynamic threat propagation map. The risk scoring unit is used to determine a multi-dimensional risk score based on the dynamic threat propagation map. The security protection unit is used to generate an adaptive protection strategy based on the multi-dimensional risk score and then issue it for execution.

9. An electronic device, comprising: The memory and processor are characterized in that the processor, when executing a computer program stored in the memory, implements the steps of the network security protection method based on distributed threat identification as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the steps of the network security protection method based on distributed threat identification as described in any one of claims 1 to 7.

Images