Intelligent system adaptive defense method and device

Abstract

The invention discloses a self-adaptive defense method and device for an intelligent system, relates to the technical field of intelligent systems, and mainly aims to improve detection accuracy and protection pertinence and meet safety protection requirements of the intelligent system. According to the technical scheme, multi-source original data of an intelligent system is obtained; calculating a data entropy corresponding to the multi-source original data, and identifying a suspicious event data stream based on the data entropy; performing buffer sorting, missing point completion and data normalization on the suspicious event data flow to obtain a standardized vector of each suspicious event; inputting the standardized vector into an isolated forest model, a graph neural network model and a BERT semantic analysis model for parallel detection, and fusing output scores of the isolated forest model, the graph neural network model and the BERT semantic analysis model to obtain a data anomaly degree of each suspicious event; and determining an associated node of each suspicious event in the intelligent system, and constructing a defense execution strategy of the intelligent system based on the data anomaly of each suspicious event and the associated node.

Description

Technical Field

[0001] This application relates to the field of intelligent system technology, and in particular to an adaptive defense method and apparatus for intelligent systems. Background Technology

[0002] With the deep integration of artificial intelligence and Internet of Things technologies, intelligent systems have been widely penetrated into key areas such as industrial control, financial transactions, and energy dispatch. The stable operation of these systems is directly related to production safety and economic security, and their security protection needs are becoming increasingly urgent as applications deepen.

[0003] Currently, most existing defense methods for intelligent systems employ a full-data collection and analysis model, combined with fixed thresholds and unified response strategies. However, this approach has significant shortcomings: firstly, the massive amount of normal events generated during the operation of intelligent systems consumes substantial computing resources, causing genuinely suspicious events with anomalous characteristics to be overlooked, easily leading to misjudgments or missed detections; secondly, defense decisions lack dynamism, posing risks of insufficient or excessive protection. Ultimately, this results in the defensive capabilities of intelligent systems failing to meet actual security protection needs. Summary of the Invention

[0004] In view of the above problems, this application provides an adaptive defense method and device for intelligent systems, the main purpose of which is to improve the accuracy of detection and the targeted nature of protection, so as to meet the security protection needs of intelligent systems.

[0005] To solve the above-mentioned technical problems, this application proposes the following solution: In a first aspect, this application provides an adaptive defense method for an intelligent system, the method comprising: Acquire multi-source raw data from the intelligent system, including network traffic data and operation log data; Calculate the data entropy corresponding to the multi-source raw data, and identify suspicious event data streams based on the data entropy, wherein the suspicious event data stream is a sequence composed of multiple suspicious events; The suspicious event data stream is buffered, sorted, missing points are filled, and data is normalized to obtain a standardized vector for each suspicious event. The standardized vectors are input into the Isolation Forest model, the Graph Neural Network model, and the BERT semantic analysis model for parallel detection. The output scores of the Isolation Forest model, the Graph Neural Network model, and the BERT semantic analysis model are then fused to obtain the data anomaly degree of each suspicious event. The intelligent system identifies the associated nodes for each suspicious event and constructs a defense execution strategy for the intelligent system based on the data anomaly degree of each suspicious event and the associated nodes.

[0006] Secondly, this application provides an intelligent system adaptive defense device, the device comprising: The acquisition unit is used to acquire multi-source raw data from the intelligent system, including network traffic data and operation log data. The identification unit is used to calculate the data entropy corresponding to the multi-source raw data obtained by the acquisition unit, and to identify the suspicious event data stream based on the data entropy, wherein the suspicious event data stream is a sequence composed of multiple suspicious events; The first processing unit is used to perform buffer sorting, missing point completion, and data normalization on the suspicious event data stream obtained by the identification unit to obtain a standardized vector for each suspicious event. The fusion unit is used to input the standardized vector obtained by the first processing unit into the isolated forest model, the graph neural network model and the BERT semantic analysis model for parallel detection, and to fuse the output scores of the isolated forest model, the graph neural network model and the BERT semantic analysis model to obtain the data anomaly degree of each suspicious event; The construction unit is used to determine the associated nodes of each suspicious event in the intelligent system, and to construct the defense execution strategy of the intelligent system based on the data anomaly degree of each suspicious event and the associated nodes obtained by the fusion unit.

[0007] To achieve the above objectives, according to a third aspect of this application, a storage medium is provided, the storage medium including a stored program, wherein, when the program is executed, the device where the storage medium is located is controlled to perform the intelligent system adaptive defense method of the first aspect described above.

[0008] To achieve the above objectives, according to a fourth aspect of this application, a processor is provided for running a program, wherein the program executes the intelligent system adaptive defense method of the first aspect described above.

[0009] Using the above technical solution, this application provides an adaptive defense method and apparatus for an intelligent system. First, it acquires multi-source raw data from the intelligent system, including network traffic data and operation log data. Then, it calculates the data entropy corresponding to the multi-source raw data and identifies suspicious event data streams based on the data entropy. The suspicious event data stream is a sequence composed of multiple suspicious events. Next, it performs buffer sorting, missing point completion, and data normalization on the suspicious event data stream to obtain a standardized vector for each suspicious event. Then, it inputs the standardized vector into a parallel detection model using an isolated forest model, a graph neural network model, and a BERT semantic analysis model. The output scores of the isolated forest model, the graph neural network model, and the BERT semantic analysis model are fused to obtain the data anomaly degree of each suspicious event. Finally, it determines the associated nodes of each suspicious event in the intelligent system and constructs a defense execution strategy for the intelligent system based on the data anomaly degree and associated nodes of each suspicious event. The technical solution provided in this application calculates the data entropy corresponding to multi-source raw data and identifies suspicious event data streams. It eliminates the need for indiscriminate analysis of all network traffic data and operation log data, instead using data entropy to filter out sequences composed of suspicious events. This filters out massive amounts of redundant normal events, preventing them from consuming excessive computing resources and fundamentally avoiding the situation where suspicious events are overwhelmed, leading to misjudgments or omissions. This significantly improves data processing efficiency and accuracy. Standardized vectors are input into isolated forests, graph neural networks, and BERT semantic analysis models for parallel detection and score fusion. Simultaneously, it captures the distance features, spatial correlation features, and semantic features of the data. Through multi-dimensional score fusion, it accurately determines the data anomaly degree, further improving the accuracy of anomaly detection. By identifying the associated nodes of suspicious events and constructing defense execution strategies based on the data anomaly degree, it can match defense actions according to the actual attributes of the associated nodes, avoiding insufficient or excessive protection caused by a one-size-fits-all approach to different nodes. Ultimately, the defense capabilities of intelligent systems are no longer limited to basic security protection but are matched to the high security protection needs of key areas such as industrial control, financial transactions, and energy dispatch, effectively ensuring the stable operation of intelligent systems.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] Various other advantages and benefits will become apparent to those skilled in the art upon reading the following detailed description of preferred embodiments. The accompanying drawings are for illustrative purposes only and are not intended to limit the scope of this application. Furthermore, the same reference numerals denote the same parts throughout the drawings. In the drawings: Figure 1 A flowchart of an adaptive defense method for an intelligent system provided in an embodiment of this application is shown; Figure 2 This paper illustrates a flowchart of another intelligent system adaptive defense method provided in an embodiment of this application; Figure 3 This paper shows a block diagram of an intelligent system adaptive defense device provided in an embodiment of this application; Figure 4 A block diagram of another intelligent system adaptive defense device provided in an embodiment of this application is shown. Detailed Implementation

[0012] Exemplary embodiments of the present application will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the present application are shown in the drawings, it should be understood that the present application may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this application will be thorough and complete, and will fully convey the scope of the present application to those skilled in the art.

[0013] Currently, most existing defense methods for intelligent systems employ a full-data collection and analysis model, combined with fixed thresholds and unified response strategies. However, this approach has significant shortcomings: firstly, the massive amount of normal events generated during the operation of intelligent systems consumes substantial computing resources, causing genuinely suspicious events with anomalous characteristics to be overlooked, easily leading to misjudgments or missed detections; secondly, defense decisions lack dynamism, posing risks of insufficient or excessive protection. Ultimately, this results in the defensive capabilities of intelligent systems failing to meet actual security protection needs.

[0014] In-depth research into the aforementioned technical issues can be conducted by first filtering multi-source raw data based on data entropy to extract suspicious event data streams. Then, a multi-dimensional detection model can be used to analyze suspicious events in parallel and fuse scores to determine data anomaly levels. Finally, the associated nodes of suspicious events can be identified, and a defense strategy can be constructed based on the anomaly levels. This approach avoids excessive computational resource consumption and prevents false positives and false negatives caused by overwhelming the system. It also improves the accuracy of anomaly identification through multi-dimensional detection and avoids the risks of insufficient or excessive protection. Ultimately, the defense capabilities of intelligent systems are no longer limited to basic security protection but are matched to the high-security protection needs of critical areas such as industrial control, financial transactions, and energy dispatch, effectively ensuring the stable operation of intelligent systems.

[0015] Based on the above considerations, this application provides an adaptive defense method for intelligent systems. This method can improve detection accuracy and protection targeting, meeting the security protection needs of intelligent systems. This embodiment is applied to typical intelligent systems such as industrial control, financial transactions, and energy dispatching. Its specific execution steps are as follows: Figure 1As shown, it includes: 101. Obtain multi-source raw data from intelligent systems.

[0016] The multi-source raw data includes network traffic data and operation log data.

[0017] In this embodiment, transmission data from all network nodes within the intelligent system is collected to obtain network traffic data, including fields such as source IP address, destination IP address, transmission port, traffic size (unit: Byte), transmission protocol (TCP / UDP / ICMP, etc.), and session duration. For industrial control scenarios, Wireshark with an industrial Ethernet acquisition card is preferred, while for financial transaction scenarios, the Flink real-time stream processing framework is used to connect to the network switch's mirror port. The acquisition frequency is set to 10ms / time to ensure no data loss. Simultaneously, operation logs are collected from all terminals, servers, and controllers within the system, obtaining operation log data, including fields such as operating device ID, operator account, operation instructions (e.g., login, data writing, permission modification, etc.), operation time, operation result (success / failure), and log generation device model. This data is collected through the system's built-in log acquisition module (e.g., Linux's syslog or Windows' Event Log). For industrial scenarios, an additional connection to the PLC controller's log output interface (e.g., Modbus-TCP protocol) is required, while for financial scenarios, database operation logs (e.g., MySQL's binlog) must be collected synchronously.

[0018] After obtaining the raw data from multiple sources, the raw events in the raw data are deduplicated, timestamp unified, and format standardized. These raw events are used to represent the daily operational events of the intelligent system. Specifically, a deduplication key can be constructed based on the 5-tuple of network traffic (source IP, destination IP, port, protocol, session ID) + 'device ID + operation command + operation time' of the operation log. The deduplication key that has appeared is stored in a hash table to filter duplicate data (the duplication rate is controlled below 0.5%). Since the timestamps of the raw data from multiple sources may have time zone differences or clock deviations (such as the clock difference between the terminal and the server), the timestamps of all data are uniformly converted to the format "YYYY-MM-DD HH:MM:SS.fff" based on the NTP (Network Time Protocol) clock of the system's core server, and the time deviation is corrected to within ±1ms. Unstructured data (such as the binary logs of the controller) is converted into JSON structured format, and uniform field names are defined (such as "source IP" is uniformly named "src_ip", and "operation command" is uniformly named "op_cmd") to facilitate subsequent cross-source data fusion analysis.

[0019] 102. Calculate the data entropy corresponding to the original data from multiple sources, and identify suspicious event data streams based on the data entropy. The suspicious event data stream is a sequence composed of multiple suspicious events.

[0020] In this embodiment, the data entropy corresponding to the multi-source raw data is calculated based on the degree of surprise. This degree of surprise is used to quantify the degree to which a single raw event in the multi-source raw data deviates from the normal behavior pattern. The greater the degree of surprise, the greater the difference between the raw event and the normal event, the higher the value of the abnormal information contained, and the more likely it is to be a suspicious event. The calculation of this degree of surprise can be implemented using a 3-gram character model. The specific steps are as follows: First, collect several consecutive days of "no attack, no fault" normal operation data of the intelligent system (at least 1 million raw events). For each normal event's "key feature string" (composed of "device ID + operation command + core parameters", such as "PLC_S001_inspection_temperature 25℃"), perform 3-gram unit splitting (sliding window size of 3, step size of 1). Using the normal behavior feature library, for example, "PLC_S001_inspection_normal_temperature 25℃" is split into "PLC_S001-inspection-normal" and "inspection-normal-temperature 25℃". Two 3-gram units are used; the occurrence frequency of each 3-gram unit in the normal feature library is counted, and the occurrence probability Pmode(ei) (i.e., the number of times the unit occurs / the total number of units) is calculated to form a "3-gram unit - normal probability" mapping table; for each original event after preprocessing in step 101, the 3-gram units are also split, and the normal probability of each 3-gram unit is obtained based on the above "3-gram unit - normal probability" mapping table. Combined with the total number of 3-gram units in the original event, the surprise level of each original event is calculated.

[0021] To avoid the randomness of evaluating single raw events, a "fixed-quantity batch" model can be adopted to process raw events. This involves dividing them into batches based on "time sequence + fixed quantity," with each batch consisting of 100 consecutive raw events (this can be dynamically adjusted according to the system data volume; for industrial control scenarios, this could be set to 50 events / batch, and for financial transaction scenarios, 200 events / batch). Each batch is marked with a unique batch ID (e.g., "20251205_001" represents the first batch on December 5, 2025). Based on the surprise factor of all raw events within a batch, the overall entropy value Hbatch for each batch is calculated. The higher the overall entropy value, the higher the proportion of suspicious events within the batch. Simultaneously, for each batch, its dynamic entropy upper limit Hmax(t) is determined. This dynamic entropy upper limit is the core threshold distinguishing between "normal batches" and "batches containing suspicious events," and it can be dynamically adjusted based on the system's historical state and real-time load. Specifically, the overall entropy value of all normal batches over the past several days is statistically analyzed, and the mean μ and standard σ are calculated. Based on the mean μ and standard σ, a basic entropy upper limit Hbase is first determined, with the formula Hbase = μ + k × σ, where k is an adjustment coefficient that can be adjusted according to scenario sensitivity. On this basis, the dynamic entropy upper limit Hmax(t) of each batch is calculated by combining the current number of online assets, the maximum number of assets that the system can access, and the tidal coefficients set for different application scenarios. The first overall entropy value Hbatch of each batch is compared with the real-time dynamic entropy upper limit Hmax(t). If Hbatch > Hmax(t), it is determined to be an over-entropy batch, i.e., a batch containing high-value suspicious events; otherwise, it is a normal batch and is directly filtered out without further processing.

[0022] For hyperentropy batches, the retention probability of a single original event can be calculated using the Metropolis probability formula to filter out suspicious events. This formula is based on the surprise level of a single original event, the average surprise level of the batch, and an adjustment parameter. This parameter can be a fixed value or adjusted according to actual conditions, such as using a PID algorithm to improve the accuracy of suspicious event filtering. Events are sorted in ascending order of retention probability. If there are 100 original events in the batch, the top 30%—the 30 events with the lowest retention probability and the highest relative surprise level—are retained and marked as suspicious events. All suspicious events filtered from hyperentropy batches are concatenated in chronological order to form a suspicious event data stream. Each suspicious event carries information such as the batch ID, original data fields, and surprise level.

[0023] 103. Perform buffer sorting, missing point completion, and data normalization on the suspicious event data stream to obtain a standardized vector for each suspicious event.

[0024] In this embodiment, since the suspicious event data stream may have temporal disorder and missing fields, it is necessary to perform buffer sorting and missing point completion first to ensure the accuracy of subsequent calculations. Buffer sorting involves constructing a buffer queue of length 500 (capable of holding 5 batches of suspicious events), sorting the events in ascending order of their "original operation timestamps." If timestamps are the same, the suspicious events are sorted by their sequence number within the original batch, thus ensuring the temporal continuity of the data stream. Missing point completion involves processing missing values ​​according to field type for the sorted data stream. Specifically, for numerical fields such as traffic volume and operation duration, "local linear interpolation" is used for completion, which involves fitting the values ​​of the three events before and after the missing field. For example, if the traffic value of the 10th event is missing, the average traffic values ​​of events 7-9 and 11-13 are used for completion. For categorical fields such as operation commands and device IDs, "mode completion" is used, which takes the value that appears most frequently in the current buffer queue for completion. If all values ​​are unique, historical operation commands with the same device ID are used for completion. In addition, if key identifier fields such as IP address and device ID are missing, they are directly marked as invalid events and filtered out from the data stream to avoid subsequent node association failures.

[0025] After buffer sorting and missing point completion, each suspicious event needs to be normalized to obtain its corresponding standardized vector, which is then adapted to the model input requirements in subsequent steps. The processed suspicious events can be converted into fixed-dimensional standardized vectors, such as a 64-dimensional vector structure, to represent both numerical and categorical features. Specifically, 20-dimensional numerical features and N-dimensional categorical features are extracted from each suspicious event. The 20-dimensional numerical features include network traffic-related features (source traffic, destination traffic, session duration, etc., 5 dimensions), operation behavior-related features (operation frequency, number of failures, permission level, etc., 8 dimensions), and device status-related features (CPU utilization, memory usage, etc., 7 dimensions), totaling 20 dimensions. The categorical features include IP addresses, device IDs, operation commands, and transmission protocols (the number is not fixed and needs to be uniformly encoded). Z-score normalization is used, transformed using the formula x′=σxx−μx, where μx is the mean of the feature in the normal feature library, and σx is the standard deviation, to eliminate differences in numerical magnitude. A "hash encoding + truncation" method is used, performing a 256-bit MD5 hash on each categorical feature, taking the first 44 bits as the encoding result. 44 bits can basically cover 99.9% of the categorical feature differentiation requirements. The 20-dimensional normalized numerical features and the 44-dimensional hash-encoded categorical features are concatenated sequentially to form a 64-dimensional standardized vector, with each suspicious event corresponding to a unique vector.

[0026] 104. Input the standardized vectors into the Isolation Forest model, Graph Neural Network model and BERT semantic analysis model for parallel detection, and fuse the output scores of the Isolation Forest model, Graph Neural Network model and BERT semantic analysis model to obtain the data anomaly degree of each suspicious event.

[0027] In this embodiment, the Isolation Forest model, Graph Neural Network model, and BERT semantic analysis model all adopt an "offline pre-training + online fine-tuning" mode, with initialization parameters adapted to the application scenario corresponding to the intelligent system in this embodiment. Specifically, for the Isolation Forest model, 256 isolated trees can be initialized, with each tree having a sampling scale of 256 standardized vectors. The splitting feature selection adopts a "random dimension selection + random segmentation threshold" strategy, and the pre-training data can use the standardized vectors of normal events from step 102. For the Graph Neural Network model, a 2-layer GCN (Graph Convolutional Network) structure can be used, with the input being a graph structure composed of "nodes and edges," where nodes are standardized vectors of suspicious events and edges represent the relationships between events. The pre-training data can use a public dataset containing attack samples. For the BERT semantic analysis model, a 4-layer lightweight BERT structure can be used, with a vocabulary size of 10,000 (the specific value can be customized, only needing to ensure coverage of common operation commands and log keywords of the intelligent system). The pre-training data can use the text content of the intelligent system's normal operation logs. The 64-dimensional normalized vector is converted into a model-compatible Tensor format, i.e., the input of the Isolation Forest is (None, 64), the input of the Graph Neural Network is the node features + adjacency matrix of (None, 64), and the input of BERT is the ID sequence of the operation log text after word segmentation corresponding to the vector.

[0028] A GPU cluster was used to achieve parallel inference on the aforementioned isolated forest model, graph neural network model, and BERT semantic analysis model, with the detection time for a single suspicious event controlled within 50ms. Specifically, for the isolated forest model, standardized vectors were input into 256 isolated trees, and the path length li of each vector in each tree was calculated. The average path length was calculated using the formula I(X)=2561∑i=1256li; then, the distance exponent SIF was calculated using the formula SIF=2−c(n)I(X), where c(n) is the average path length constant when the sample size n=256, c(256)=ln256+γ≈5.52+γ, γ=0.5772 is Euler's constant, and the distance exponent ranges from [0,1], with the closer to 1 indicating a more suspicious event; for the graph neural network model, first An event association graph is constructed. If two suspicious events meet any of the following conditions: same source IP, same device ID, or operation time interval < 5s, then an edge is constructed between the corresponding nodes. The node features (64-dimensional vector) and adjacency matrix are input into the GCN, and after two rounds of convolution (the first layer outputs 32-dimensional features, and the second layer outputs 16-dimensional features), the association index SGNN is output through a fully connected layer. The association index ranges from [0,1], and the closer it is to 1, the stronger the association between the suspicious event and other suspicious events. For the BERT semantic analysis model, the operation log text of the suspicious event (such as "2025-12-05") can be extracted. The code snippet "02:00PLC_S001 Force Change Administrator Password" is used to perform word segmentation (e.g., 2025-12-05, 02:00, PLC_S001, Force Change, Administrator Password), masking (randomly masking 15% of the word segments, such as Force Change in the form of [MASK]). The code is then input into BERT, and the model outputs the true word probability Ptrue at the masked position. The semantic index SBERT is calculated using the formula SBERT=−L1∑l=1Llog2Ptrue(l), where L is the number of masked word segments, and the semantic index ranges from [0,1]. The closer it is to 1, the more abnormal the semantics of the log text.

[0029] After obtaining the distance index (SIF), correlation index (SGNN), and semantic index (SBERT) mentioned above, the Analytic Hierarchy Process (AHP) can be used to determine the weights of the scores of the three models and merge them into the final data anomaly score. This weight allocation can be pre-set with a rule; for example, five security experts can be invited to score the importance of the three dimensions of "distance, correlation, and semantics." The weights can be calculated using AHP and further subdivided according to the application scenario. For instance, in industrial control scenarios where correlation attacks are more common, WIF=0.3, WGNN=0.4, and WBERT=0.3 can be set, while in financial transaction scenarios where semantic spoofing attacks are more prominent, WIF=0.2, WGNN=0.3, and WBERT=0.5 can be set. The data anomaly score, Stotal, is calculated using the formula Stotal=WIF×SIF+WGNN×SGNN+WBERT×SBERT. The data anomaly score ranges from [0,1] and can be rounded to three decimal places, such as 0.856 or 0.421.

[0030] 105. In the intelligent system, identify the associated nodes of each suspicious event, and construct the defense execution strategy of the intelligent system based on the data anomaly degree of each suspicious event and the associated nodes.

[0031] In this embodiment, the generation of suspicious events in the intelligent system always relies on a node, i.e., an associated node, which may be a direct node or an indirect node. To enable targeted protection operations on the corresponding nodes later, the associated nodes of each suspicious event can be determined first based on the metadata and business links of the suspicious event. Specifically, for locating directly associated nodes, the "device identification field" (such as device ID, IP address, controller number) of the suspicious event can be extracted, and the "directly associated nodes" can be matched using the system's "asset ledger" (which records the mapping relationship between device ID and node name, location, and function). For example, "IP=192.168.1.100" in the event can correspond to "core database server node SVR_001" in the asset ledger, and "device ID=PLC_S001" can correspond to "production line controller node PLC_001". For expanding indirectly associated nodes, indirect nodes related to the direct nodes can be identified through business process diagrams and network topology diagrams. For example, if the direct node is "Core Database Server SVR_001", then the indirect nodes include "Access Switch SW_002" (a node that data transmission must pass through) and "Backup Server SVR_002" (a data synchronization node). After determining the direct and indirect nodes, to ensure the accuracy of the associated nodes, the validity of the association can be verified through spatiotemporal consistency. That is, check whether the operation time of the suspicious event is within the node's running time and whether the operation permission of the suspicious event matches the node's access permission. Nodes that fail the verification are marked as "invalid associations" and removed.

[0032] In practical applications, intelligent systems contain multiple nodes, and the "importance" and "losses after being attacked" of different nodes vary greatly. If the same defense strategy is applied to every node, it may lead to resource waste or an imbalance in protection, i.e., there is a risk of insufficient or excessive protection. Therefore, it is advisable to first calculate the network asset value of each node to determine which nodes require key protection and which nodes can be protected more leniently. This network asset value is used to comprehensively characterize the core importance of nodes in the intelligent system, including the inherent value of the node itself, as well as its irreplaceable function in the intelligent system, the sensitivity of the data it carries, and the impact on system security and business operations after an attack or failure. Nodes with different network asset values ​​are classified into value levels, such as high, medium, and low value levels, and differentiated thresholds are set for nodes of different value levels, such as a danger threshold and a risk threshold, to match defense actions. These defense actions are issued to the firewall, intrusion prevention system (IPS), and device management module through the system API interface for execution.

[0033] The setting of differentiated thresholds can be based on the value level of the node and historical attack data. The thresholds for high-value nodes are more lenient to avoid misjudgments that could affect core business operations, while the thresholds for low-value nodes are more stringent to prevent them from becoming entry points for attacks. See Table 1 for details. Table 1 Node Level Dynamic hazard threshold Dynamic risk threshold High value 0.8 0.5 Medium Value 0.6 0.3 low value 0.4 0.2 The data anomaly score (Stotal) is compared with differentiated thresholds at different value levels, and corresponding defensive actions are determined based on the comparison results. Specifically, if the data anomaly score (Stotal) is greater than or equal to the dynamic danger threshold, a blocking action is executed. This blocking action can be to cut off the network connection between the source IP of the suspicious event and the associated node, freeze the operator's account, record event details, and trigger alarms (such as sending SMS and email alarms to the administrator). If the dynamic risk threshold is less than or equal to the dynamic danger threshold, a rate limiting action is executed. This rate limiting action can be to restrict the bandwidth of the suspicious event to 10% of the normal bandwidth, restrict the operator to only perform query-type operations, and monitor the subsequent behavior of the event in real time. If the score is less than the dynamic risk threshold, an observation action is executed. This observation action can be to log the event to the abnormal behavior database without interrupting business operations for subsequent model iteration and optimization.

[0034] In addition, after the above-mentioned defensive actions are executed, in order to further ensure the effectiveness of the protection, the operating status of related nodes can be collected in real time, such as CPU utilization and business success rate. If business interruption occurs due to mistaken blocking, such as the transaction success rate dropping to 0 after the core server is blocked, the threshold fine-tuning will be automatically triggered. For example, the danger threshold of high-value nodes will be temporarily increased by 0.1 and the node will be unlocked, thereby achieving closed-loop defense.

[0035] Based on the above Figure 1 As can be seen from the implementation method, the intelligent system adaptive defense method provided in this application calculates the data entropy corresponding to multi-source raw data and identifies suspicious event data streams. It does not require indiscriminate analysis of all network traffic data and operation log data, but instead filters out sequences composed of suspicious events through data entropy. This not only filters out massive amounts of redundant normal events, avoiding excessive consumption of computing resources, but also fundamentally avoids the situation where suspicious events are overwhelmed, leading to misjudgment or missed judgment. This significantly improves data processing efficiency and accuracy. Standardized vectors are input into the isolated forest, graph neural network and BERT semantic analysis model for parallel detection and fusion scoring. At the same time, it captures the distance features, spatial correlation features and semantic features of the data. Through multi-dimensional score fusion, it accurately determines the data anomaly degree, further improving the accuracy of anomaly detection. By determining the associated nodes of suspicious events and combining them with the data anomaly degree to construct defense execution strategies, it can match defense actions according to the actual attributes of associated nodes, avoiding the situation of insufficient or excessive protection caused by a one-size-fits-all defense for different nodes. Ultimately, the defense capability of the intelligent system is no longer limited to basic security protection, but matches the high security protection needs of key areas such as industrial control, financial transactions, and energy dispatch, effectively ensuring the stable operation of the intelligent system.

[0036] Furthermore, the preferred embodiments of this application are based on the above... Figure 1 Based on this, a detailed explanation of the adaptive defense process of intelligent systems is provided, including the specific steps as follows: Figure 2 As shown, it includes: 201. Obtain multi-source raw data from intelligent systems.

[0037] This step combines the description of step 101 in the above method, and the same content will not be repeated here.

[0038] 202. Mark the original events in the multi-source raw data with a unified timestamp, and perform cross-source time alignment and duplicate event filtering.

[0039] In this step, the original timestamps of multi-source raw data have issues such as "time zone differences, clock drift, and inconsistent precision." Therefore, they can be processed according to the principle of "unified benchmark + precision alignment." Specifically, the NTP (Network Time Protocol) clock of the core server of the intelligent system is used as the sole benchmark. This server needs to be connected to the NTP server of the National Time Service Center, and the clock synchronization precision should be controlled within ±1ms. The time precision of different data sources varies and needs to be unified to the millisecond level. High-precision data (such as network traffic, native 10μs level) can be directly truncated to the millisecond level, while low-precision data (such as logs from old devices, native second level) is padded with "000" milliseconds after the second. For edge devices without NTP synchronization (such as old sensors), the event correlation method can be used for correction: if there is a fixed lag (such as 2s) between the "startup event" in the device log and the "connection success event" in the core server, then all event timestamps of that device are uniformly incremented by 2s.

[0040] For scenarios where "the same business behavior is scattered across multiple sources of raw data", it is necessary to associate the original events from multiple sources according to "business time sequence". Specifically, a dedicated alignment key is defined for the core business behavior. For example, for equipment inspection: equipment ID + inspection instruction + operation time (±5 tolerance), and for user transfer: user account + transfer amount + transaction time (±1s tolerance). The Python Pandas library is used to group the events by alignment key and mark the multiple-source events of the same business behavior as "associated event groups". For example, "inspection log of PLC_S001" is associated with "corresponding network traffic data" to ensure that subsequent analysis can integrate multiple-source features.

[0041] Duplicate data leads to inflated entropy and wasted computing resources. Deduplication can be achieved through "data type differentiation." Specifically, for network traffic deduplication, a 5-tuple deduplication key of "source IP + destination IP + source port + destination port + transport protocol + session start time (±1ms)" is used. Existing keys are stored in a Redis hash table; new events without a match are retained (duplicate rate controlled <0.5%). For operation log deduplication, "device ID + operator + operation command + operation time (±1s)" is used as the deduplication key, employing a 10-second sliding window to avoid log redundancy caused by repeatedly executing the same command within a short period.

[0042] 203. Use a 3-gram character model to count the probability of occurrence of 3-gram units in the original events, and calculate the surprise level of each original event based on the probability of occurrence and the number of 3-gram units.

[0043] In this step, data from multiple consecutive days of "no attacks, no faults" is collected. For industrial scenarios, this includes operations such as "equipment start / stop, routine inspection" (≥500,000 records); for financial scenarios, it includes behaviors such as "login, query, transfer" (≥1 million records). For each normal event, "invalid field removal -> key feature concatenation" is performed to form a standardized string. Network traffic: source IP type (core / edge) + destination IP type + transmission protocol + operation type; operation logs: device type + operation command + operation result; string cleaning: filtering special characters using regular expressions and merging consecutive spaces.

[0044] 3-grams are combinations of three consecutive feature words. They require splitting the cleaned string and calculating the normal probability. Feature words separated by spaces are used as basic units, splitting using a window size of 3 and a step size of 1. For example, "PLC_Inspection_Success_Normal Temperature" is split into "[PLC, Inspection, Success]" and "[Inspection, Success, Normal Temperature]". The frequency of 3-gram units is calculated, and the normal probability is calculated as unit frequency / total number of units. For example, if "[PLC, Inspection, Success]" appears 8000 times in 1 million units, the probability is 0.008. The "3-gram unit -> probability" mapping is mapped to a JSON file, loaded into memory as a dictionary, forming a normal feature library.

[0045] Surprise level is used to quantify the degree to which a single raw event deviates from normal behavioral patterns in multi-source raw data. A higher surprise level indicates a greater difference between the raw event and normal events, higher value of the anomalous information contained, and a greater likelihood of it being a suspicious event. For each raw event, strings are extracted according to feature library rules and split into 3-gram units. The surprise level of each raw event is then calculated using the following formula: Among them, the level of surprise The degree of surprise of the original event, Let be the probability of each 3-gram unit in the original event appearing in the normal feature library, and m be the number of units in the original event that are divided into 3-gram units.

[0046] 204. Divide the original events into multiple batches based on a specified number of events, and calculate the first overall entropy value for each batch based on the degree of surprise.

[0047] In this step, events are divided in ascending order of time. Industrial scenarios can be batched into 50 events per batch, and financial scenarios into 200 events per batch. Events that are not large enough to form a batch are merged with the previous batch (ensuring that there are ≥30 events per batch to avoid entropy distortion). A batch ID is set for each batch, with the ID format being "date_serial number_scenario" (e.g., 20251205_001_industrial control) for easy traceability.

[0048] The first overall entropy value of the batch is calculated using the "surprise accumulation" method. The higher the entropy value, the greater the uncertainty, meaning it contains more suspicious events. The specific calculation formula is as follows: Where H is the first overall entropy value of the batch, and N is the number of original events in the batch.

[0049] 205. Determine the upper limit of dynamic entropy for each batch, compare the first overall entropy value of each batch with the upper limit of dynamic entropy, and determine the over-entropy batches among multiple batches based on the comparison results.

[0050] In this step, the dynamic entropy upper limit is the core threshold for distinguishing between normal batches and over-entropy batches. A basic entropy upper limit, HBase, can be calculated first, reflecting the upper limit of entropy during normal system operation. Specifically, the entropy values ​​of normal batches over the past few days can be extracted, and the mean μ and standard deviation σ can be calculated: HBase = μ + k × σ (where k is an adjustment factor; k = 2 for industrial applications and k = 1.8 for financial applications). After determining the basic entropy upper limit HBase, for each batch, the online asset size is adjusted to adapt to changes in system load. The number of online assets can be obtained via SNMP protocol / Kubernetes API, showing the current number of online assets (Nonline(t)) and the maximum number of assets (Nmax). Based on the online asset number (Nonline(t), the maximum number of assets (Nmax), and the basic entropy upper limit HBase), the dynamic entropy upper limit Hmax(t) for each batch is calculated using the following formula: Where α is the tidal coefficient (α=50 for industry, α=100 for finance).

[0051] The first overall entropy value Hbatch is compared with its corresponding Hmax(t). If Hbatch > Hmax(t), it is an over-entropy batch; otherwise, it is a normal batch. Normal batches are directly filtered out. If there are 3 consecutive over-entropy batches, an alert can be issued, such as an SMS / email alert, which can include the batch ID, entropy value, and number of online assets.

[0052] 206. Calculate the retention probability of each original event in the hyperentropy batch using the Metropolis probability formula, and identify suspicious events in the hyperentropy batch based on the retention probability to obtain a suspicious event data stream.

[0053] The Metropolis probability formula is constructed based on the surprise level of a single original event, the average surprise level of the batch, and adjustment parameters.

[0054] In this step, the Metropolis probability formula is as follows: Where Eref is the average surprise level of the hyperentropy batch, Ei is the surprise level of a single original event, the greater the surprise level of the original event, the lower the retention probability, the lower the surprise level of the original event, and the retention probability of the original event with a surprise level lower than the average surprise level is 1, and β is an adjustment parameter (e.g., β=1.0 for industry, β=1.2 for finance).

[0055] 207. Perform buffer sorting, missing point completion, and data normalization on the suspicious event data stream to obtain a standardized vector for each suspicious event.

[0056] This step combines the description of step 103 in the above method, and the same content will not be repeated here.

[0057] The specific execution process of performing buffer sorting, missing point completion, and data normalization on the suspicious event data stream to obtain the standardized vector of each suspicious event is as follows: perform buffer sorting and missing point completion on the suspicious event data stream to obtain the processed suspicious event data stream; perform data normalization on the processed suspicious event data stream to obtain the standardized vector of each suspicious event.

[0058] It should be noted that while the Metropolis probability formula is used to calculate the retention probability in steps 205-206, this formula is based on the surprise level of a single original event, the average surprise level of the batch, and adjustment parameters. The magnitude of these adjustment parameters directly affects the screening accuracy of suspicious events. Therefore, to ensure the accuracy of suspicious events, after buffering, sorting, filling in missing points, and normalizing the suspicious event data stream to obtain a standardized vector for each suspicious event, the following steps are also included: dimensionality increase of the standardized vector for each suspicious event to obtain a density operator for each event; dividing the data into multiple batches using a specified number of density operators and calculating the second overall entropy value for each batch based on the density operators; calculating the entropy error based on the second overall entropy value of each batch and the dynamic entropy upper limit; and using a PID algorithm to dynamically adjust the adjustment parameters in the retention probability based on the entropy error, which in turn updates the Metropolis probability formula with the adjusted parameters.

[0059] In this step, the standardized vector X of each suspicious event is increased in dimensionality. By constructing a density operator, the low-dimensional vector is transformed into a density matrix in a high-dimensional space, thereby capturing the statistical characteristics and distribution information of the suspicious events more comprehensively. Specifically, the standardized vector X of each suspicious event is first outer productted with its own transpose to obtain: Then, normalization is performed to obtain the density operator: in, The square norm of a dimensional normalized vector X. For the trace of the density operator, By constructing a density operator through dimensionality increase, the low-dimensional 64-dimensional normalized vector X is transformed into a 64×64-dimensional density operator ρ. This density operator ρ can more comprehensively characterize the statistical features and inter-dimensional correlation information of event data, providing a high-dimensional and high-quality data foundation for subsequent accurate calculation of entropy value updates.

[0060] For each suspicious event's density operator, the data is also divided into batches according to a specified number, that is, a specified number of density operators are combined into one batch. The second overall entropy value is calculated for each batch, and the specific formula is as follows: in, Let the entropy be the b-th density operator. The second global entropy value is obtained by summing the entropies of all density operators, where ρ is the j-th largest eigenvalue. .

[0061] The entropy error is calculated by subtracting the dynamic entropy upper limit Hmax(t) from the entropy value of the current batch. The specific formula is as follows: The regulating parameter β in the Metropolis valve is adjusted using a PID algorithm, with the specific formula as follows: in, This is the proportionality coefficient. The proportional loop directly adjusts the control quantity based on the current entropy error, quickly responding to error changes. The integral loop adjusts the control quantity based on the integral value of the entropy error, eliminating static errors and ensuring that the intelligent system output is stable near the set value, thus improving the stability of the intelligent system. In a new processing cycle, the new adjustment parameter β is rewritten into the intelligent system.

[0062] 208. The standardized vectors are input into the Isolation Forest model, Graph Neural Network model and BERT semantic analysis model for parallel detection, and the output scores of the Isolation Forest model, Graph Neural Network model and BERT semantic analysis model are fused to obtain the data anomaly degree of each suspicious event.

[0063] This step combines the description of step 104 in the above method, and the same content will not be repeated here.

[0064] The process of inputting standardized vectors into the Isolation Forest model, Graph Neural Network model, and BERT semantic analysis model for parallel detection, and fusing the output scores of the Isolation Forest model, Graph Neural Network model, and BERT semantic analysis model to obtain the data anomaly degree of each suspicious event is as follows: Input standardized vectors into the Isolation Forest model to obtain the distance index of each suspicious event; input standardized vectors into the Graph Neural Network model to obtain the correlation index of each suspicious event; input standardized vectors into the BERT semantic analysis model to obtain the semantic index of each suspicious event; and fuse the distance index, correlation index, and semantic index of each suspicious event according to the preset weight allocation rules to obtain the data anomaly degree of each suspicious event.

[0065] In this step, the standardized vector X is subjected to multi-dimensional and comprehensive anomaly detection from three dimensions: distance features, spatial correlation features and semantic features of suspicious events. The output results of the three models are then fused by stacking linear weights to obtain the final data anomaly score, Statotal, thereby achieving accurate identification of suspicious events in the intelligent system.

[0066] 209. In the intelligent system, identify the associated nodes of each suspicious event, and construct the defense execution strategy of the intelligent system based on the data anomaly degree of each suspicious event and the associated nodes.

[0067] This step combines the description of step 105 in the above method, and the same content will not be repeated here.

[0068] The specific execution process of the defense strategy of the intelligent system based on the data anomaly degree and associated nodes of each suspicious event is as follows: determine the value level corresponding to each associated node; for each suspicious event, when the data anomaly degree exceeds the dynamic danger threshold, execute the blocking action; when the data anomaly degree is between the dynamic risk threshold and the dynamic danger threshold, execute the flow restriction action.

[0069] Each value level corresponds to a dynamic hazard threshold and a dynamic risk threshold, with the dynamic risk threshold being lower than the dynamic hazard threshold.

[0070] In this step, before determining the value level of associated nodes, a corresponding value level, such as high, medium, and low value levels, can be pre-set for each node in the intelligent system. Differential thresholds, namely dynamic danger thresholds and dynamic risk thresholds, can be set for different value levels, with the dynamic risk threshold being lower than the dynamic danger threshold. This value level can be determined based on the network asset value of the node. This network asset value comprehensively characterizes the core importance of the node in the intelligent system, including the node's inherent value, its irreplaceable function within the intelligent system, the sensitivity of the data it carries, and the impact on system security and business operations after an attack or failure. This network asset value can be determined from multiple dimensions, such as asset attributes, topological position, and data importance. Specifically, the execution process for determining the value level of each associated node is as follows: For each node in the intelligent system, the network asset value is determined based on the fixed asset value assessment value, topological weight assessment value, and data importance assessment value; each node is classified according to its network asset value to obtain its corresponding value level; and for each value level, corresponding dynamic danger thresholds and dynamic risk thresholds are set.

[0071] In this step, the network asset value is calculated and classified based on three dimensions: node asset attributes, topological position, and data importance. Specifically, the fixed asset value assessment value, topological weight assessment value, and data importance assessment value are determined respectively. Details are as follows: Fixed asset valuation value V1: In industrial scenarios, it is scored as a percentage of the equipment purchase cost after depreciation, such as core server V1=10, ordinary sensor V1=2. In financial scenarios, it is scored based on virtual resource occupancy rate, such as core transaction node V1=10, office terminal V1=3. Topology weight valuation value V2: Based on the betweenness centrality of nodes, which is calculated as the number of times a node is on all shortest paths / the total number of shortest paths, normalized and multiplied by 10, such as core routing node V2=10, edge terminal V2=2. Data importance valuation value V3: Based on the CIA triple (confidentiality, integrity, availability), each item has a maximum score of 10 points, including confidentiality, integrity, and availability, such as customer funds database V3=10, ordinary log storage node V3=3.

[0072] Weights w1=0.3, w2=0.4, and w3=0.3 were determined using analytic hierarchy process (AHP). The network asset value V = w1V1 + w2V2 + w3V3 was calculated. Nodes were categorized into three levels: V≥8 (high-value nodes), 4≤V<8 (medium-value nodes), and V<4 (low-value nodes). A value level label (e.g., "High Value - Core PLC") was added to each node and stored in the intelligent system's node asset information database.

[0073] The thresholds are set based on the value level of nodes and historical attack data. The thresholds for high-value nodes are more lenient to avoid misjudgment that could affect core business, while the thresholds for low-value nodes are more stringent to avoid them becoming entry points for attacks, as shown in Table 1 in step 105.

[0074] After identifying the associated nodes, their value level can be determined based on the pre-added value level tags, thereby determining their corresponding dynamic danger threshold and dynamic risk threshold. This allows for comparison with data anomalies, enabling the determination of defensive actions for different associated nodes and forming the defense execution strategy of the intelligent system.

[0075] Furthermore, as a response to the above Figure 1-2 The implementation of the method embodiment shown in this application provides an adaptive defense device for intelligent systems. This device is used to improve detection accuracy and protection targeting, meeting the security protection needs of intelligent systems. The embodiment of this device corresponds to the foregoing method embodiments. For ease of reading, this embodiment will not repeat the details of the foregoing method embodiments one by one, but it should be clear that the device in this embodiment can correspondingly implement all the contents of the foregoing method embodiments. Specifically, as shown... Figure 3 As shown, the device includes: Acquisition unit 31 is used to acquire multi-source raw data of the intelligent system, the multi-source raw data including network traffic data and operation log data; The identification unit 32 is used to calculate the data entropy corresponding to the multi-source raw data obtained by the acquisition unit 31, and to identify the suspicious event data stream based on the data entropy, wherein the suspicious event data stream is a sequence composed of multiple suspicious events; The first processing unit 33 is used to perform buffer sorting, missing point completion and data normalization on the suspicious event data stream obtained by the identification unit 32 to obtain a standardized vector for each suspicious event. The fusion unit 34 is used to input the standardized vector obtained by the first processing unit 33 into the isolated forest model, the graph neural network model and the BERT semantic analysis model for parallel detection, and to fuse the output scores of the isolated forest model, the graph neural network model and the BERT semantic analysis model to obtain the data anomaly degree of each suspicious event; The construction unit 35 is used to determine the associated nodes of each suspicious event in the intelligent system, and to construct the defense execution strategy of the intelligent system based on the data anomaly degree of each suspicious event and the associated nodes obtained by the fusion unit 34.

[0076] Furthermore, such as Figure 4 As shown, the identification unit 32 includes: The first processing module 321 is used to mark the original events in the multi-source raw data with a unified timestamp, and to perform cross-source time alignment and duplicate event filtering. The first calculation module 322 is used to use a 3-gram character model to count the probability of occurrence of 3-gram units in the original events obtained by the first processing module 321, and to calculate the surprise level of each original event based on the probability of occurrence and the number of units of the 3-gram units. The second calculation module 323 is used to divide the original events into multiple batches with a specified number of them, and calculate the first overall entropy value of each batch based on the surprise level obtained by the first calculation module 322. The comparison module 324 is used to determine the upper limit of dynamic entropy for each batch. It compares the first overall entropy value of each batch obtained by the second calculation module 323 with the upper limit of dynamic entropy, and determines the over-entropy batch among multiple batches based on the comparison results. The identification module 325 is used to calculate the retention probability of each original event in the hyperentropy batch obtained by the comparison module 324 using the Metropolis probability formula, and to identify the suspicious events in the hyperentropy batch based on the retention probability, thereby obtaining the suspicious event data stream. The Metropolis probability formula is constructed based on the surprise level of a single original event, the batch average surprise level, and adjustment parameters.

[0077] Furthermore, such as Figure 4 As shown, the first processing unit 33 includes: The second processing module 331 is used to perform the buffer sorting and missing point completion on the suspicious event data stream to obtain the processed suspicious event data stream. The third processing module 332 is used to normalize the processed suspicious event data stream obtained by the second processing module 331 to obtain the standardized vector of each suspicious event.

[0078] Furthermore, such as Figure 4 As shown, the device further includes: The second processing unit 36 ​​is used to perform dimensionality-upgrading processing on the normalized vector of each suspicious event after the first processing unit 33 to obtain the density operator of each suspicious event. The first calculation unit 37 is used to divide multiple batches with a specified number of density operators obtained by the second processing unit 36, and to calculate the second overall entropy value of each batch based on the density operators. The second calculation unit 38 is used to calculate the entropy error based on the second overall entropy value of each batch obtained by the first calculation unit 37 and the dynamic entropy upper limit, respectively. The update unit 39 is used to dynamically adjust the adjustment parameter in the retention probability based on the entropy error obtained by the second calculation unit 38 using a PID algorithm, and to update the Metropolis probability formula with the adjusted adjustment parameter.

[0079] Furthermore, such as Figure 4 As shown, the fusion unit 34 includes: The first determining module 341 is used to input the standardized vector into the isolated forest model to obtain the distance index of each suspicious event; The second determining module 342 is used to input the standardized vector into the graph neural network model to obtain the correlation index of each suspicious event; The third determining module 343 is used to input the standardized vector into the BERT semantic analysis model to obtain the semantic index of each suspicious event; The fusion module 344 is used to perform fusion calculation on the distance index obtained by the first determination module 341, the correlation index obtained by the second determination module 3042, and the semantic index obtained by the third determination module 343 for each suspicious event according to a preset weight allocation rule, so as to obtain the data anomaly degree of each suspicious event.

[0080] Furthermore, such as Figure 4 As shown, the building unit 35 includes: The fourth determining module 351 is used to determine the value level corresponding to each of the associated nodes, and each value level corresponds to a dynamic danger threshold and a dynamic risk threshold, wherein the dynamic risk threshold is lower than the dynamic danger threshold. The fourth processing module 352 is used to perform a blocking action for each of the suspicious events when the data anomaly exceeds the dynamic danger threshold obtained by the fourth determining module 351, and to perform a flow restriction action when the data anomaly is between the dynamic risk threshold and the dynamic danger threshold obtained by the fourth determining module.

[0081] Furthermore, such as Figure 4 As shown, the fourth determining module 352 is specifically used for, For each node in the intelligent system, the network asset value is determined based on the fixed asset value assessment, topology weight assessment, and data importance assessment. Each node is classified into different levels based on the value of the network assets, thus obtaining the value level corresponding to each node. For each value level, a corresponding dynamic danger threshold and a dynamic risk threshold are set.

[0082] Furthermore, embodiments of this application also provide a storage medium for storing a computer program, wherein the computer program, when running, controls the device where the storage medium is located to execute the above-described... Figure 1-2 The adaptive defense method for intelligent systems described in [the document].

[0083] Furthermore, embodiments of this application also provide a processor for running a program, wherein the program executes the above-described... Figure 1-2 The adaptive defense method for intelligent systems described in [the document].

[0084] In the above embodiments, the descriptions of each embodiment have different focuses. For parts not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0085] It is understood that the relevant features in the above methods and apparatus can be referenced interchangeably. Furthermore, the terms "first," "second," etc., in the above embodiments are used to distinguish between embodiments and do not represent the superiority or inferiority of any particular embodiment.

[0086] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0087] The algorithms and displays provided herein are not inherently related to any particular computer, virtual system, or other device. Various general-purpose systems can also be used in conjunction with the teachings herein. The required structure for constructing such systems is apparent from the above description. Furthermore, this application is not directed to any particular programming language. It should be understood that the content of this application described herein can be implemented using various programming languages, and the above description of specific languages ​​is for the purpose of disclosing the best mode of implementation of this application.

[0088] In addition, the memory may include non-permanent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM, and the memory includes at least one memory chip.

[0089] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0090] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0091] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0092] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0093] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0094] Memory may include non-persistent memory in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0095] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0096] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0097] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0098] The above are merely embodiments of this application and are not intended to limit the scope of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of the claims of this application.

Claims

1. An adaptive defense method for an intelligent system, characterized in that, The method includes: Acquire multi-source raw data from the intelligent system, including network traffic data and operation log data; Calculate the data entropy corresponding to the multi-source raw data, and identify suspicious event data streams based on the data entropy, wherein the suspicious event data stream is a sequence composed of multiple suspicious events; The suspicious event data stream is buffered, sorted, missing points are filled, and data is normalized to obtain a standardized vector for each suspicious event. The standardized vectors are input into the Isolation Forest model, the Graph Neural Network model, and the BERT semantic analysis model for parallel detection. The output scores of the Isolation Forest model, the Graph Neural Network model, and the BERT semantic analysis model are then fused to obtain the data anomaly degree of each suspicious event. The intelligent system identifies the associated nodes for each suspicious event and constructs a defense execution strategy for the intelligent system based on the data anomaly degree of each suspicious event and the associated nodes.

2. The method according to claim 1, characterized in that, Calculating the data entropy corresponding to the multi-source raw data, and identifying suspicious event data streams based on the data entropy, includes: The original events in the multi-source raw data are marked with a unified timestamp, and cross-source time alignment and duplicate event filtering are performed. The probability of occurrence of 3-gram units in the original events is statistically analyzed using a 3-gram character model, and the surprise level of each original event is calculated based on the occurrence probability and the number of units in the 3-gram units. Divide the original events into multiple batches based on a specified number of batches, and calculate the first overall entropy value for each batch based on the degree of surprise. Determine the upper limit of dynamic entropy for each batch, compare the first overall entropy value of each batch with the upper limit of dynamic entropy, and determine the over-entropy batches among multiple batches based on the comparison results; The retention probability of each original event in the hyperentropy batch is calculated using the Metropolis probability formula, and the suspicious events are identified in the hyperentropy batch based on the retention probability, thereby obtaining the suspicious event data stream. The Metropolis probability formula is constructed based on the surprise level of a single original event, the batch average surprise level, and adjustment parameters.

3. The method according to claim 1, characterized in that, The suspicious event data stream is buffered, sorted, padded with missing data, and normalized to obtain a standardized vector for each suspicious event, including: The suspicious event data stream is subjected to the buffer sorting and missing point completion to obtain the processed suspicious event data stream. The processed suspicious event data stream is normalized to obtain the standardized vector for each suspicious event.

4. The method according to claim 3, characterized in that, After performing buffer sorting, missing point completion, and data normalization on the suspicious event data stream to obtain a standardized vector for each suspicious event, the method further includes: The normalized vector of each suspicious event is subjected to dimensionality increase processing to obtain the density operator of each suspicious event; Divide the data into multiple batches using a specified number of density operators, and calculate a second overall entropy value for each batch based on the density operators; The entropy error is calculated based on the second overall entropy value and the upper limit of dynamic entropy for each batch. Using the PID algorithm, the adjustment parameter in the retention probability is dynamically adjusted based on the entropy error, which is used to update the Metropolis probability formula with the adjusted adjustment parameter.

5. The method according to claim 1, characterized in that, The standardized vectors are input into an isolated forest model, a graph neural network model, and a BERT semantic analysis model for parallel detection. The output scores of the isolated forest model, the graph neural network model, and the BERT semantic analysis model are then fused to obtain the data anomaly degree for each suspicious event, including: The standardized vector is input into the isolated forest model to obtain the distance index of each suspicious event; The standardized vector is input into the graph neural network model to obtain the correlation index of each suspicious event; The standardized vector is input into the BERT semantic analysis model to obtain the semantic index of each suspicious event; According to the preset weight allocation rules, the distance index, the correlation index and the semantic index of each suspicious event are fused and calculated to obtain the data anomaly degree of each suspicious event.

6. The method according to any one of claims 1-5, characterized in that, Based on the data anomaly degree of each suspicious event and the associated nodes, a defense execution strategy for the intelligent system is constructed, including: Determine the value level corresponding to each of the associated nodes. Each value level corresponds to a dynamic danger threshold and a dynamic risk threshold. The dynamic risk threshold is lower than the dynamic danger threshold. For each suspicious event, a blocking action is performed when the data anomaly exceeds the dynamic danger threshold, and a flow restriction action is performed when the data anomaly is between the dynamic risk threshold and the dynamic danger threshold.

7. The method according to claim 6, characterized in that, Determining the value level corresponding to each of the associated nodes includes: For each node in the intelligent system, the network asset value is determined based on the fixed asset value assessment, topology weight assessment, and data importance assessment. Each node is classified into different levels based on the value of the network assets, thus obtaining the value level corresponding to each node. For each value level, a corresponding dynamic danger threshold and a dynamic risk threshold are set.

8. An intelligent system adaptive defense device, characterized in that, The device includes: The acquisition unit is used to acquire multi-source raw data from the intelligent system, including network traffic data and operation log data. The identification unit is used to calculate the data entropy corresponding to the multi-source raw data obtained by the acquisition unit, and to identify the suspicious event data stream based on the data entropy, wherein the suspicious event data stream is a sequence composed of multiple suspicious events; The first processing unit is used to perform buffer sorting, missing point completion, and data normalization on the suspicious event data stream obtained by the identification unit to obtain a standardized vector for each suspicious event. The fusion unit is used to input the standardized vector obtained by the first processing unit into the isolated forest model, the graph neural network model and the BERT semantic analysis model for parallel detection, and to fuse the output scores of the isolated forest model, the graph neural network model and the BERT semantic analysis model to obtain the data anomaly degree of each suspicious event; The construction unit is used to determine the associated nodes of each suspicious event in the intelligent system, and to construct the defense execution strategy of the intelligent system based on the data anomaly degree of each suspicious event and the associated nodes obtained by the fusion unit.

9. A storage medium, characterized in that, The storage medium includes a stored program, wherein, when the program is executed, it controls the device where the storage medium is located to perform the intelligent system adaptive defense method as described in any one of claims 1 to 7.

10. A processor, characterized in that, The processor is used to run a program, wherein the program executes the intelligent system adaptive defense method as described in any one of claims 1 to 7.

Images