Intelligent monitoring method for network security event

Abstract

The invention discloses an intelligent monitoring method for a network security event, and the method comprises the steps: collecting and preprocessing cross-domain heterogeneous multi-source data, extracting key features, and constructing a dynamic asset topology and a risk portrait; performing causal reasoning based on the time sequence security event data, constructing an attack event causal chain and positioning a root cause; simulating an attack propagation path in combination with topology and risk data, and outputting potential attack paths of probability sorting; according to the method, the traditional discrete and passive security alarm is upgraded into an active defense system with root cause positioning and propagation prediction capabilities, so that the intelligent level of monitoring, the risk discovery efficiency and the response accuracy are remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an intelligent monitoring method for network security incidents. Background Technology

[0002] The current network environment presents a complex landscape of cloud, edge, and endpoint convergence. Security data sources are heterogeneous, massive in volume, and highly dynamic, posing a significant challenge to traditional monitoring methods based on single-point, static analysis. Existing technologies typically rely on deploying agents or sensors locally on various assets to collect isolated security logs and traffic data, focusing on the correlation and tracing of security alerts. This approach struggles to construct a cross-domain global asset topology and a real-time risk view, lacking effective and proactive awareness of attackers' lateral movement and tiered penetration exploiting inter-domain asset dependencies. Furthermore, the lack of automated adaptation mechanisms to dynamic asset changes (such as container elastic scaling and service migration) makes static asset profiling and risk assessment models highly susceptible to failure, resulting in blind spots and lags in security monitoring, failing to meet the protection requirements of modern agile infrastructures.

[0003] Furthermore, at the security incident analysis level, existing solutions mostly rely on rule matching or statistical correlation within short time windows for alarm aggregation and event chain splicing. While this approach can handle some obvious attack patterns, it struggles to deeply reveal covert, long-term attack tactics with complex causal relationships. Its main limitations are: first, insufficient causal relationship inference capabilities, often equating chronological order with causality, failing to effectively distinguish between the true root cause event and accompanying phenomena, leading to high false alarm rates and inaccurate root cause identification; second, a lack of attack path prediction, failing to proactively deduce the attacker's most likely lateral movement path and potential targets early in the attack chain based on asset relationships and vulnerability status, leaving defense in a perpetually reactive state. Summary of the Invention

[0004] This application provides an intelligent monitoring method for cybersecurity incidents, which can integrate multi-source data, dynamically model asset relationships, accurately construct event causal chains, and achieve forward-looking prediction of attack paths.

[0005] This application provides an intelligent monitoring method for network security incidents, including: S1 extracts key features for subsequent security analysis by performing time-series alignment and preprocessing on heterogeneous multi-source data from cloud platforms, edge nodes, and local servers. S2 automatically discovers and draws a real-time topology map of cross-domain assets based on key features using active scanning and passive traffic analysis technologies; it also assesses the attack surface of each node in the map by combining asset status data, quantifying its probability of being compromised. S3, based on time-aligned security event data, analyzes the statistical dependencies between events to construct directed causal edges as a global causal graph, and connects the causal relationships to form a causal chain of attack events, thereby locating the root cause node of security events; S4 takes the root cause node as the starting point of propagation, combines the real-time topology map and the probability of node compromise, simulates the most likely movement path taken by the attacker, calculates the probability of the attack spreading to adjacent nodes, and outputs multiple potential attack paths sorted by probability.

[0006] Preferably, quantifying the probability of being compromised specifically includes: comprehensively utilizing active scanning technology and passive traffic analysis technology to automatically discover various cross-domain assets and record their basic attributes; analyzing the communication patterns and logical relationships between assets to establish service dependencies or data flow access relationships between assets; abstracting assets as nodes and the relationships between assets as edges to draw a real-time topology graph, and setting a period or dynamically updating the topology graph based on events; for each asset node in the topology graph, extracting multi-dimensional risk factors from its associated asset status data for comprehensive analysis, and using a weighted aggregation model to map them to the node's probability of being compromised, so as to quantify the relative risk level of the node.

[0007] Preferably, the process of locating the root cause node of a security event includes: employing a constraint-based causal discovery algorithm to infer the causal direction between security event variables through a systematic conditional independence test, and calculating conditional mutual information statistics based on the joint probability distribution and conditional probability distribution of the event sequence to quantify the conditional independence between variables, thereby constructing a preliminary causal graph; performing topology optimization on the preliminary causal graph using a causal function model, eliminating spurious correlation paths through graph theory criteria, and forming a causal chain of attack events with clear causal semantics; after obtaining a stable causal graph structure, transforming root cause location into the problem of identifying source nodes in the causal network, quantifying the global causal influence of each node in the entire attack chain by calculating the causal flow centrality index of the nodes, and locating key root cause nodes based on the influence score.

[0008] Preferably, the output of multiple potential attack paths sorted by probability specifically includes: the intelligent monitoring method for network security incidents according to claim 1, wherein step S4 includes: using the identified root cause node as the initial infection source of attack propagation, constructing a propagation dynamics model based on an independent cascade model; defining the probability of successful attack propagation between any adjacent nodes in the propagation dynamics model, wherein the probability is the product of the inherent probability of the target node being compromised and the propagation attenuation function based on the connection attributes between nodes; and using the path integral method in the probabilistic graphical model to calculate the overall realization probability of a specific attack path from the root cause node to the target node, wherein the probability is the product of the conditional probabilities of all continuous propagation links on the path, so as to obtain multiple potential attack paths sorted by probability.

[0009] Preferably, the step of linking causal relationships to form a causal chain for attack events specifically includes: real-time monitoring and capturing dynamic change events of network assets; automatically classifying events into local changes and global changes based on the scope of the change's impact; wherein, dynamic change events include changes in the original event stream, including node additions, node deletions, and changes in connection relationships; when a topology change event is triggered, locating the local area directly affected by the changed node, and automatically defining the affected subgraph using a graph traversal algorithm; collecting only the security event sequences of relevant nodes within the isolated affected subgraph in the most recent time window, recalculating the causal relationships within the subgraph, and synchronously updating it to the global causal graph; performing logical consistency verification and loop detection on the updated global causal graph, and dynamically updating the causal chain for attack events through a predictive state caching and mapping mechanism.

[0010] Preferably, the specific steps for distinguishing between local and global changes include: extracting the core feature vector of each dynamic change event, wherein the feature vector at least includes the event type, the affected asset identifier, and the change context; based on the feature vector, classifying the event using a change impact range quantification model, determining the set of nodes affected by the event by traversing the graph topology with a finite step size, and calculating the proportion of affected nodes relative to all active nodes to quantify the impact range of the event; and automatically determining the event as a local change that triggers an incremental update process or a global change that triggers a limited-range full verification and model update based on the calculated impact range coefficient and a preset classification threshold.

[0011] Preferably, the dynamic updating of the attack event causal chain includes: collecting and preprocessing cross-domain long-term historical data, setting multi-scale time windows according to business cycles, adding context labels to the time-aligned security event data, and extracting nonlinear time-series features; identifying potential related security event pairs across time windows based on the extracted nonlinear time-series features; applying a nonlinear causal discovery algorithm to verify and orient the potential related event pairs, quantifying their nonlinear causal strength and delay time, and constructing a cross-domain causal graph with weights and delay labels; dynamically adjusting the causal edge strength using a decay function based on the delay time in the nonlinear causal graph; and, in conjunction with the attack event causal chain, correcting and re-verifying the affected long-term causal paths, and generating a real-time updated cross-domain attack event causal chain accordingly.

[0012] Preferably, the associated security event pairs specifically involve: based on the nonlinear characteristics of event sequences under multi-scale time windows, statistical analysis is used to evaluate the statistical dependencies between security event types over long time periods to initially identify a set of event pairs with lagging associations; a sliding window mechanism is used to perform dynamic stability analysis on the initially identified associations to screen out association patterns that remain stable over continuous time periods or show significant peaks during periods of abnormal network activity; a scoring model is used to rank and focus the importance of the screened candidate associated event pairs, wherein the scoring model assigns a comprehensive weight to the association strength of event pairs under different delays and different time windows, and the weight integrates association strength, time series persistence, and the level of abnormality in the corresponding time window; for the high-weight candidate event pairs after ranking and focusing, logical consistency is checked in conjunction with security context labels, and a list of potential long-term associated security event pairs with delay estimates and confidence level labels is output.

[0013] Preferably, the generation of real-time updated cross-domain attack event causal chains includes: extracting spatiotemporally correlated cross-domain security event clusters and constructing their initial entangled causal graph based on existing causal graphs; performing virtual intervention on each candidate root cause node in the graph, and quantifying the effect independence between each root cause node by simulating the change pattern of event occurrence probability under different interventions; clustering event nodes affected by the same intervention set into causal communities based on the measure of effect independence; retaining the causal edge with the highest statistical influence for each causal community to form multiple clear causal sub-chains representing independent attack activities; using the root cause nodes of independent causal sub-chains as simulated attack potential sources, propagating them to subsequent nodes according to the security event diffusion path, and calculating the combined attack potential that each node needs to withstand; calculating the vector difference between the combined attack potential and its inherent defense potential at each node, and determining the security stress value of the node; and drawing a network-wide security stress field map in real time, continuously monitoring and identifying areas with persistently high stress, and predicting them as network security vulnerabilities.

[0014] Preferably, the attack potential specifically includes: calculating the attack impact starting from the source, propagating along a predetermined path, and attenuating during propagation due to path resistance and topological distance, and finally, at the target node, the impacts from different attack chains will be vector-superimposed.

[0015] One or more technical solutions provided in this application have at least the following technical effects or advantages: By integrating multi-source data to construct dynamic asset topology and risk profiles, and innovatively combining causal reasoning and path prediction models, it achieves in-depth insight and forward-looking projection of cross-domain attack chains. Its core advantage lies in upgrading traditional discrete and passive security alerts into a proactive defense system with root cause localization, propagation prediction, and automatic response capabilities, significantly improving the intelligence level of network security monitoring, risk discovery efficiency, and response accuracy.

[0016] By introducing a topology change awareness and adaptive update mechanism into attack path prediction, this approach effectively addresses the model failure issue caused by asset elasticity changes in dynamic network environments. Through event-driven local incremental computation, it significantly reduces computational overhead while ensuring the accuracy of causal inference and path prediction, achieving a synergistic optimization of monitoring and analysis efficiency and model real-time performance. Ultimately, this solution enhances the continuous awareness and proactive defense capabilities of intelligent monitoring systems in dynamic infrastructures such as cloud-native and edge computing environments.

[0017] By introducing multi-scale temporal analysis and a nonlinear causal discovery mechanism, this method effectively addresses the shortcomings of traditional methods in identifying causal chains for long-term, nonlinear attacks. It can accurately capture latent and delayed triggering relationships spanning weeks or even months between attack steps, significantly improving the early detection and warning capabilities for advanced persistent threats. Through causal intensity decay models and dynamic environment-based collaborative correction, the timeliness and accuracy of long-term predictions are ensured, thereby achieving in-depth insight and proactive defense against complex and persistent attacks.

[0018] By introducing causal entanglement resolution and a network security causal field model, this approach effectively solves the core challenges of complex causal chains and a lack of macro-level situational awareness in traditional causal analysis under multi-attack concurrency scenarios. It can automatically separate intertwined attack paths, accurately pinpoint the root causes of independent attacks, and significantly improve the accuracy of attributing complex threats. Simultaneously, by simulating the propagation and superposition of attack forces, it achieves, for the first time, the quantitative calculation and visualization of the overall security pressure distribution in cyberspace. This enables proactive prediction of vulnerable points that have not yet been directly attacked but are already in a high-risk state, thereby elevating security defense from discrete event response to a new level of continuous-field situational awareness and proactive hardening. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating an intelligent monitoring method for network security incidents according to an embodiment of the present invention. Detailed Implementation

[0020] To facilitate understanding of the present invention, a more complete description of this application will be given below with reference to the accompanying drawings, which illustrate preferred embodiments of the invention. However, the invention can be implemented in many different forms and is not limited to the embodiments described herein. Rather, these embodiments are provided to enable a more thorough and complete understanding of the disclosure of the present invention.

[0021] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains; the terminology used herein in the description of the invention is for the purpose of describing particular embodiments only and is not intended to limit the invention; the term "and / or" as used herein includes any and all combinations of one or more of the associated listed items.

[0022] Example 1: Figure 1 This is a flowchart illustrating an intelligent monitoring method for network security incidents according to an embodiment of the present invention.

[0023] like Figure 1 As shown, an intelligent monitoring method for network security incidents includes the following steps: S1 extracts key features for subsequent security analysis by performing time-series alignment and preprocessing on heterogeneous multi-source data from cloud platforms, edge nodes, and local servers.

[0024] The heterogeneous, multi-source data includes network traffic data, security event logs, asset status data, and business operation data. Key features of the preprocessed output include, but are not limited to, traffic peaks, event types, and asset dependencies.

[0025] S2 automatically discovers and draws a real-time topology map of cross-domain assets based on key features using active scanning and passive traffic analysis technologies; it also assesses the attack surface of each node in the map by combining asset status data, quantifying its probability of being compromised.

[0026] Specifically, by combining active scanning technology (sending probe packets to specified IP ranges) with passive traffic analysis technology (monitoring network traffic to identify active hosts), various assets across cloud, edge, and endpoint are automatically discovered, and their basic attributes (IP address, operating system, open ports) are recorded. Communication patterns between assets are analyzed; for example, persistent TCP connections are determined by parsing network flow logs, or API call chains are constructed by analyzing application logs. Based on this, logical relationships between assets are established (such as service dependencies, data flow access, etc.). Assets are abstracted as nodes, and relationships between assets are abstracted as edges, creating a directed or undirected real-time topology graph. This graph is dynamically updated at set intervals (e.g., every 30 minutes) or based on events (detection of new assets coming online).

[0027] After constructing the real-time topology map, the next step is to conduct a deep security assessment of each node. For each asset node in the map, multi-dimensional risk factors (including vulnerability exposure, configuration defects, and network exposure surface) are extracted from its associated asset status data for comprehensive analysis. A weighted aggregation model is used to quantify the probability of its vulnerability to attack. The formula is: in, , and These represent quantitative scores for vulnerability exposure, configuration defects, and network exposure, respectively. , , is the corresponding weight coefficient, and b is the bias term. This function maps the linearly weighted sum to a probability value between 0 and 1, reflecting the relative risk level of the node.

[0028] S3, based on time-aligned security event data, analyzes the statistical dependencies between events to construct directed causal edges as a global causal graph, and connects the causal relationships to form a causal chain of attack events, thereby locating the root cause node of security events.

[0029] Specifically, the analysis process begins with learning the causal structure of time-aligned security event sequences. A constraint-based causal discovery algorithm is employed, using systematic conditional independence tests to infer the causal direction between events. For the set of observed variables, the core mechanism lies in examining the conditional independence relationships between variables given different sets of conditions. The statistical inference process can be quantified by calculating conditional mutual information. in, and These represent two different security event variables, signifying the occurrence status or characteristic measurement of a specific type of security event (such as vulnerability exploitation, data breach, etc.). The condition set is the set of observed variables. Except and A subset outside of the set is used to control for confounding factors. This represents the joint probability distribution function, describing the likelihood of these event states occurring simultaneously. (Summation symbol) This indicates that all possible combinations of event states are traversed and calculated.

[0030] When this statistic is below the significance threshold determined by resampling or theoretical distribution, it can be judged. and Given Z, conditions are independent, thus gradually constructing a preliminary causal graph skeleton.

[0031] Based on the above test results, a causal function model is used to perform topology optimization on the preliminary causal graph. This process follows the causal Markov condition and the fidelity assumption, and eliminates spurious correlation paths through graph theory principles such as the d-separation criterion, forming a causal chain of attack events with clear causal semantics. Its mathematical representation is a directed acyclic graph G=(V,E), where the vertex set V corresponds to the security event type, and the edge set E represents the statistically verified causal relationship.

[0032] After obtaining a stable causal graph structure, root cause localization is transformed into the problem of identifying source nodes in the causal network. The influence of nodes in the entire attack chain is quantified by calculating the causal flow centrality index of each node. Here, v represents the target node whose centrality needs to be evaluated, i.e., the specific security event whose importance needs to be assessed. s and t represent the source node and sink node in the causal graph, respectively, and all three must be distinct. This represents the total number of directed paths from node s to node t, reflecting the strength of connectivity between nodes. Specifically, it refers to the number of paths that pass through the target node v, used to measure v's mediating role in the network. Ratio It represents the proportion of causal flow of node v between specific node pairs, while the summation operation is a comprehensive evaluation of all possible combinations of node pairs, ultimately obtaining the global causal influence score of node v.

[0033] S4 takes the root cause node as the starting point of propagation, combines the real-time topology map and the probability of node compromise, simulates the most likely movement path taken by the attacker, calculates the probability of the attack spreading to adjacent nodes, and outputs multiple potential attack paths sorted by probability.

[0034] Specifically, the initial conditions for the attack propagation simulation are set by using the identified root cause node as the initial infection source for the attack propagation. The propagation dynamics model is constructed based on an independent cascade model framework, where the infection state transition probability of each node depends on its adjacency relationship and inherent vulnerability. For any adjacent node pair (u,v), the probability that the attack successfully propagates from node u to node v is defined by the following conditional probability formula: in, This represents the inherent probability that the target node v can be compromised. Based on inter-node connection attributes A propagation attenuation function (such as connection type, trust relationship) that quantifies the connectivity characteristics of the network topology into the ease of propagation.

[0035] Path probability calculation employs the path integral method from the probabilistic graphical model. For a specific path from root node s to target node t... The overall probability of realization is the product of the conditional probabilities of all consecutive propagation stages along the path: This calculation method takes into account both path length and the vulnerability weight of each node, avoiding bias caused by a single factor.

[0036] The final probabilistic path generation employs an improved Monte Carlo simulation algorithm, sampling potential propagation paths through multiple random walk iterations. Each simulation follows the aforementioned propagation probabilities, recording all reachable paths originating from the root cause node and their frequencies. By performing frequency statistics on a large number of simulation results, a set of multiple most probable attack paths is generated, ordered in descending order of their realization probabilities. Each path is assigned a corresponding probability estimate, thus completing the situational projection from a single point of security incident to a global attack path.

[0037] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages: By integrating multi-source data to construct dynamic asset topology and risk profiles, and innovatively combining causal reasoning and path prediction models, it achieves in-depth insight and forward-looking projection of cross-domain attack chains. Its core advantage lies in upgrading traditional discrete and passive security alerts into a proactive defense system with root cause localization, propagation prediction, and automatic response capabilities, significantly improving the intelligence level of network security monitoring, risk discovery efficiency, and response accuracy.

[0038] Example 2: In Example 1, attack path prediction is based on static or periodically updated network topology and causal graphs. However, in dynamic environments such as cloud-native and edge computing, assets and their connections change frequently (e.g., container startup and shutdown, service elastic scaling), causing the constructed causal chains and predicted paths to face the risk of rapid failure. If every topology change triggers global causal rediscovery and full path recalculation, it will generate huge computational overhead and make it difficult to maintain the real-time performance of predictions and the continuity of attack tracing.

[0039] In some embodiments, the causal relationships are linked together to form a causal chain of attack events. Step S3 further includes: S31 monitors and captures dynamic change events of network assets in real time, and automatically classifies the events into local changes and global changes based on the scope of the change's impact.

[0040] Dynamic change events include changes to the original event stream, such as node additions, node deletions, and changes in connection relationships.

[0041] Specifically, for each captured event *e*, its core feature vector is extracted. This vector contains the event type, the affected asset identifier, the timestamp, and change context metadata. Based on the event feature extraction, a change impact range quantification model is used to classify the event. This model assesses the impact range of the event by calculating the relative proportion of affected nodes, where the set of affected nodes *D(e)* is determined by a finite-step (e.g., d_max steps) graph traversal in the global topology graph, starting from the changed node. Specifically, for event *e*, its impact range coefficient is calculated using the following formula: Where D(e) represents the set of all nodes directly affected by event e in the global topology graph, and the set of nodes directly or indirectly affected by event e; This represents the set of active nodes from the current network state. This coefficient characterizes the proportion of active nodes affected by the event out of all active nodes.

[0042] Based on the calculated influence range coefficient, the event classification decision-maker automatically classifies the event according to a preset threshold. When the influence range coefficient is less than the global classification threshold, the condition is met. (generally If set to 0.2), the event is considered a local change and will only trigger an incremental update process centered on the affected node. Conversely, when When an event is determined to be a global change, a limited-scope full verification and model update process will be initiated.

[0043] S32, when a topology change event is triggered, locate the local area directly affected by the changed node and use a graph traversal algorithm to automatically define the affected subgraph.

[0044] The affected subgraph includes the changed nodes and their directly related nodes and edges in terms of causal and topological relationships.

[0045] S33 collects only the security event sequence of relevant nodes within the isolated affected subgraph in the most recent time window, recalculates the causal relationships within the subgraph, and synchronously updates it to the global causal graph.

[0046] S34 performs logical consistency verification and loop detection on the updated global causal graph, and dynamically updates the causal chain of attack events through a predictive state cache and mapping mechanism.

[0047] The logical consistency check and loop detection perform temporal consistency checks on all causal edges in the global causal graph. For each directed causal edge e: A→B, the timestamps of its corresponding events are checked to see if they satisfy the causal timing constraint, i.e., the occurrence time of the causal event A must not be later than the occurrence time of the result event B. Any edge that violates this timing constraint will trigger a contradiction flag. The specific verification is achieved by validating inequalities. Whether it is established or not, in which and Δ represents the timestamps of events A and B, respectively, and Δ is the maximum allowed logical clock offset or propagation delay threshold. Loop detection is then performed on the global causal graph. Loop structures are identified and located by calculating the loop coefficients of the graph, which are implemented through the adjacency matrix M of the analytical graph, where the matrix elements... This indicates the existence of a causal edge from node i to node j. Loop detection can be formally performed by computation. To determine, among which This is the set of causal nodes. If a loop is detected, the loop elimination process is initiated.

[0048] The dynamic update of the attack event causal chain involves taking a snapshot of the ongoing attack path prediction state at the beginning of a topology change event. This cached state records the set of nodes the attack is believed to have spread to at the current moment, the probability distribution of each path, and the relevant intermediate computation context. After the global causal graph is updated and verified, a path relocation process is initiated. This process maps the cached state to the new global causal graph. For nodes in the cached path that have disappeared due to the topology change, equivalent replacement nodes with similar topology and configuration are searched within their respective service or functional groups. The mapping relationship is based on the similarity calculation of node attributes, and the candidate node with the highest similarity is selected as the replacement, thereby grafting the original attack path onto the new network structure. Finally, based on the updated global causal graph and the relocated attack state, a finite number of attack propagation simulations are re-executed within the affected local subgraph.

[0049] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages: By introducing a topology change awareness and adaptive update mechanism into attack path prediction, this approach effectively addresses the model failure issue caused by asset elasticity changes in dynamic network environments. Through event-driven local incremental computation, it significantly reduces computational overhead while ensuring the accuracy of causal inference and path prediction, achieving a synergistic optimization of monitoring and analysis efficiency and model real-time performance. Ultimately, this solution enhances the continuous awareness and proactive defense capabilities of intelligent monitoring systems in dynamic infrastructures such as cloud-native and edge computing environments.

[0050] Example 3: In Example 2, event-driven local incremental computation achieved adaptation to dynamic network topology changes, effectively maintaining the real-time performance of causal models and path predictions. However, this method primarily focuses on causal inference and path updates within short time windows. It still lacks effective modeling and identification methods for complex dependencies such as long-term latency, nonlinear interactions, and delayed triggering that may exist between attack steps. Faced with advanced threats such as APT attacks, which often exhibit slow penetration and indirect impact over weeks or even months, relying solely on the dynamic mechanism of Example 2 may still lead to delayed warnings or missed detections due to the inability to capture these long-term, nonlinear causal patterns. To fundamentally improve the ability to deeply understand and proactively assess complex and persistent attack chains, it is necessary to break through linear and short-term assumptions and establish an analytical model capable of quantifying long-term causal strength and latency. This leads to the optimization and improvement of this example.

[0051] In some embodiments, step S34, dynamically updating the causal chain of attack events, further includes: S341 collects and preprocesses cross-domain long-term historical data, sets multi-scale time windows according to business cycles, adds context labels to the time-aligned security event data, and extracts non-linear time-series features.

[0052] Specifically, this involves extensive data collection across cloud, edge, and endpoint environments. Historical records covering periods of several weeks to months are retrieved from log repositories, traffic mirroring points, and configuration management databases across various domains. After data acquisition, preprocessing and time-series alignment are performed. A synchronization mechanism based on network time protocols maps all event logs to a unified global logical timeline. For discretization or minor omissions caused by transmission and storage, interpolation methods are used to estimate and ensure the continuity of the time series, thus constructing a strictly aligned and coherent cross-domain event timeline. Based on the aligned timeline, and according to the natural cycle of business operations and the empirical scale of security analysis, multi-level time windows are defined, including short-cycle windows to capture immediate interactions at the daily or hourly level, medium-cycle windows for analyzing lateral movement phases on a weekly basis, and long-cycle windows for observing strategic attack preparation activities spanning several months.

[0053] Add contextual semantic labels (including event type, involved asset identifier, security risk category, source reliability, and potential logical relationships with other events) to each security event instance in the timeline. Extract nonlinear temporal features from the processed, labeled multi-scale event sequences. Calculate sequence complexity metrics at various time scales using a sliding window technique. For example, calculate the permutation entropy of event occurrences within a specific window to measure pattern randomness, or calculate mutual information between sequences of different event types to detect potential nonlinear correlations.

[0054] S342 identifies potentially correlated security event pairs across time windows based on extracted nonlinear temporal features.

[0055] Specifically, based on the nonlinear characteristics of event sequences under multi-scale time windows, the statistical dependence of any two types of security events over long time series is quantitatively evaluated. By calculating the time-shifted mutual information between event type sequences, the information contribution of the historical occurrence pattern of one event type to the current occurrence state of another event type under different time delay conditions is systematically assessed. This process traverses a preset delay range covering several days to several months, thereby capturing statistical correlation patterns with significant time lags and forming a preliminary broad correlation set.

[0056] A sliding window mechanism is introduced to perform dynamic stability analysis on the aforementioned broad associations. A fixed-length analysis window slides across the entire timeline, recalculating the association strength between event pairs within each local window. This method aims to identify the temporal dynamics of associations, filtering out association patterns that remain stable across multiple consecutive time windows or exhibit significant strength peaks during periods of network anomalous activity. A lightweight attention scoring model is employed to rank and focus candidate associations based on their importance. This model assigns a comprehensive weight to the association strength of each event pair under different delays and time windows, with the weight calculation incorporating the absolute value of the association strength, its temporal persistence, and the overall anomalous level of the corresponding time window.

[0057] The system performs a security context-based logical consistency check on the statistically selected high-scoring candidate event pairs. Context labels are used to verify whether there is a logically reasonable connection path between the events in the candidate event pairs. The final output is a list of potentially long-term correlated security event pairs labeled with estimated latency and correlation confidence.

[0058] S343 applies a nonlinear causal discovery algorithm to verify and orient potentially related event pairs, quantifies their nonlinear causal strength and delay time, and constructs a cross-domain causal graph with weighted and delayed labels.

[0059] S344 dynamically adjusts the strength of causal edges based on the delay time in the nonlinear causal graph using a decay function; combined with the causal chain of attack events, it corrects and re-verifies the affected long-cycle causal paths, and generates a real-time updated causal chain of cross-domain attack events accordingly.

[0060] The cross-domain attack event causal chain is generated by extracting and producing a specific cross-domain attack event causal chain based on the updated nonlinear causal graph after strength attenuation and topology adaptation correction. Starting from the initial event node of the current security alert or high risk, a depth-first or breadth-first traversal is performed in the nonlinear causal graph after attenuation adjustment and relocation to search for all reachable causal paths where the cumulative causal strength of each edge on the path exceeds a threshold. Each such path constitutes a potential cross-domain attack event causal chain.

[0061] It should be noted that the causal chain of cross-domain attack events needs to be checked for logical consistency and timeliness. Each causal chain should be checked for temporal inconsistencies; for example, the result event should not be significantly earlier than the cause event.

[0062] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages: By introducing multi-scale temporal analysis and a nonlinear causal discovery mechanism, this method effectively addresses the shortcomings of traditional methods in identifying causal chains for long-term, nonlinear attacks. It can accurately capture latent and delayed triggering relationships spanning weeks or even months between attack steps, significantly improving the early detection and warning capabilities for advanced persistent threats. Through causal intensity decay models and dynamic environment-based collaborative correction, the timeliness and accuracy of long-term predictions are ensured, thereby achieving in-depth insight and proactive defense against complex and persistent attacks.

[0063] Example 4: In Example 3, long-term dependency modeling effectively identified attack causal chains across time windows, significantly improving the ability to detect latent attacks such as APTs. However, when multiple intertwined or concurrent attack activities occur simultaneously in the network environment, the events generated by different attack chains are mixed in time and space, forming causal entanglement. This makes it difficult for models based on a single causal chain to distinguish the independent attack roots and evolution paths, resulting in ambiguous root cause determination and a loss of focus in response strategies. Furthermore, Example 3 focuses on the construction of discrete causal chains, lacking a continuous and macroscopic assessment of the overall network security situation. It cannot quantify the distribution and transmission of security pressure across the entire network, making it difficult to predict potential high-risk and vulnerable areas. To address the aforementioned shortcomings in causal entanglement analysis and overall situational awareness...

[0064] In some embodiments, step S344, generating a real-time updated causal chain of cross-domain attack events, further includes: 4A. Extract spatiotemporally correlated cross-domain security event clusters and construct their initial entangled causal graph based on the existing causal graph; perform virtual intervention on each candidate root cause node in the graph, and quantify the effect independence between each root cause node by simulating the change pattern of event occurrence probability under different interventions.

[0065] Specifically, based on preset rules of temporal proximity and network topology reachability, event clusters that are temporally closely continuous and logically related to assets are selected from the continuous security event stream. For each identified event cluster, its corresponding substructure is extracted from the weighted cross-domain causal graph constructed in Example 3. This substructure not only includes all event nodes within the cluster but also encompasses all intermediate causal nodes and directed edges connecting these nodes within a reasonable path length, thereby forming an initial entangled causal graph representing all possible causal relationships within the cluster.

[0066] After obtaining the initial entangled causal graph, all potential candidate root cause nodes are enumerated. These nodes typically include events without preceding events, and alerts pre-marked as high-suspicious starting points based on their security severity or asset value. Subsequently, a virtual intervention analysis is performed on each candidate root cause node. The virtual intervention does not actually change the network state, but rather simulates a counterfactual scenario in the computational model where the event did not occur, while keeping the causal mechanisms between all other events unchanged.

[0067] For each virtual intervention, counterfactual reasoning is performed using an established causal graph model to quantitatively calculate the change in the probability of all other events within the event cluster under that intervention. This calculation quantifies the causal effect strength on a series of subsequent events after removing a potential cause, thereby generating a unique effect fingerprint for each candidate cause—a vector describing its magnitude of influence on numerous events within the cluster.

[0068] Finally, by comparing the effect vectors generated by different candidate root cause nodes, the statistical independence measure between them is calculated. If the sets of events significantly affected by two candidate causes have low overlap, or their effect patterns differ significantly in the vector space, then the effect independence between them is considered high, suggesting that they may drive two different causal chains.

[0069] 4B, based on the measure of effect independence, clusters event nodes affected by the same set of interventions into causal communities; for each causal community, retains the causal edge with the highest statistical influence, forming multiple clear causal sub-chains representing independent attack activities.

[0070] 4C uses the root node of the independent causal subchain as the simulated attack potential source, propagates it to subsequent nodes according to the security event propagation path, and calculates the combined attack potential that each node needs to withstand.

[0071] The attack potential is calculated by taking the attack impact from its source (potential source) and propagating along a predetermined path. During propagation, the impact attenuates due to path resistance and topological distance, ultimately resulting in a vector superposition of the effects from different attack chains at the target node. Its mathematical expression needs further refinement based on the specific application scenario.

[0072] 4D calculates the vector difference between the combined attack potential and the inherent defense potential of each node, and assigns the node's security stress value; based on this, it draws a real-time security stress field map of the entire network, continuously monitors and identifies areas with persistently high stress, and predicts them as network security vulnerabilities.

[0073] The technical solutions described in the embodiments of this application have at least the following technical effects or advantages: By introducing causal entanglement resolution and a network security causal field model, this approach effectively solves the core challenges of complex causal chains and a lack of macro-level situational awareness in traditional causal analysis under multi-attack concurrency scenarios. It can automatically separate intertwined attack paths, accurately pinpoint the root causes of independent attacks, and significantly improve the accuracy of attributing complex threats. Simultaneously, by simulating the propagation and superposition of attack forces, it achieves, for the first time, the quantitative calculation and visualization of the overall security pressure distribution in cyberspace. This enables proactive prediction of vulnerable points that have not yet been directly attacked but are already in a high-risk state, thereby elevating security defense from discrete event response to a new level of continuous-field situational awareness and proactive hardening.

[0074] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. For those skilled in the art, the present invention can have various modifications and variations. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. An intelligent monitoring method for network security incidents, characterized in that, include: S1 extracts key features for subsequent security analysis by performing time-series alignment and preprocessing on heterogeneous multi-source data from cloud platforms, edge nodes, and local servers. S2, based on key features, utilizes active scanning and passive traffic analysis technologies to automatically discover and draw real-time topology maps of cross-domain assets. By combining asset status data, the attack surface of each node in the graph is assessed, and its probability of being compromised is quantified. S3, based on time-aligned security event data, analyzes the statistical dependencies between events to construct directed causal edges as a global causal graph, and connects the causal relationships to form a causal chain of attack events, thereby locating the root cause node of security events; S4 takes the root cause node as the starting point of propagation, combines the real-time topology map and the probability of node compromise, simulates the most likely movement path taken by the attacker, calculates the probability of the attack spreading to adjacent nodes, and outputs multiple potential attack paths sorted by probability.

2. The intelligent monitoring method for network security incidents as described in claim 1, characterized in that, The quantification of the probability of being compromised specifically includes: comprehensively utilizing active scanning technology and passive traffic analysis technology to automatically discover various cross-domain assets and record their basic attributes; analyzing the communication patterns and logical relationships between assets to establish service dependencies or data flow access relationships between assets; abstracting assets as nodes and the relationships between assets as edges to draw a real-time topology graph, and setting a period or dynamically updating the topology graph based on events; for each asset node in the topology graph, extracting multi-dimensional risk factors from its associated asset status data for comprehensive analysis, and using a weighted aggregation model to map them to the node's probability of being compromised, so as to quantify the relative risk level of the node.

3. The intelligent monitoring method for network security incidents as described in claim 1, characterized in that, The process of locating the root cause of a security incident includes: employing a constraint-based causal discovery algorithm to infer the causal direction between security incident variables through a systematic conditional independence test, and calculating conditional mutual information statistics based on the joint probability distribution and conditional probability distribution of the event sequence to quantify the conditional independence between variables, thereby constructing a preliminary causal graph; using a causal function model to perform topology optimization on the preliminary causal graph, eliminating spurious correlation paths through graph theory criteria to form a causal chain of attack events with clear causal semantics; after obtaining a stable causal graph structure, transforming root cause location into the problem of identifying source nodes in the causal network, quantifying the global causal influence of each node in the entire attack chain by calculating the causal flow centrality index of the nodes, and locating key root cause nodes based on the influence score.

4. The intelligent monitoring method for network security incidents as described in claim 1, characterized in that, The output of multiple potential attack paths sorted by probability specifically includes: the intelligent monitoring method for network security incidents according to claim 1, characterized in that step S4 includes: using the identified root cause node as the initial infection source of attack propagation, constructing a propagation dynamics model based on an independent cascade model; defining the probability of successful attack propagation between any adjacent nodes in the propagation dynamics model, which is the product of the inherent probability of the target node being compromised and the propagation attenuation function based on the connection attributes between nodes; using the path integral method in the probabilistic graphical model to calculate the overall realization probability of a specific attack path from the root cause node to the target node, which is the product of the conditional probabilities of all continuous propagation links on the path, so as to obtain multiple potential attack paths sorted by probability.

5. The intelligent monitoring method for network security incidents as described in claim 1, characterized in that, The process of linking causal relationships to form a causal chain for attack events specifically includes: real-time monitoring and capturing dynamic change events of network assets; automatically classifying events into local and global changes based on the scope of their impact; dynamic change events include changes to the original event stream, including node additions, node deletions, and changes in connection relationships; when a topology change event is triggered, locating the local area directly affected by the changed node and automatically defining the affected subgraph using a graph traversal algorithm; collecting only the security event sequences of relevant nodes within the isolated affected subgraph in the most recent time window, recalculating the causal relationships within the subgraph, and synchronously updating it to the global causal graph; performing logical consistency verification and loop detection on the updated global causal graph, and dynamically updating the causal chain for attack events through a predictive state caching and mapping mechanism.

6. The intelligent monitoring method for network security incidents as described in claim 5, characterized in that, The specific steps for distinguishing between local and global changes include: extracting the core feature vector of each dynamic change event, whereby the feature vector contains at least the event type, the affected asset identifier, and the change context; classifying the event based on the feature vector using a change impact range quantification model, determining the set of nodes affected by the event by traversing the graph topology with a finite step size, and calculating the proportion of affected nodes relative to all active nodes to quantify the event's impact range; and automatically determining the event as a local change that triggers an incremental update process or a global change that triggers a limited-range full verification and model update based on the calculated impact range coefficient and a preset classification threshold.

7. The intelligent monitoring method for network security incidents as described in claim 5, characterized in that, The dynamically updated causal chain of attack events includes: collecting and preprocessing cross-domain long-term historical data; setting multi-scale time windows according to business cycles; adding context labels to the time-aligned security event data; and extracting nonlinear time-series features; identifying potentially related security event pairs across time windows based on the extracted nonlinear time-series features; applying a nonlinear causal discovery algorithm to verify and orient the potentially related event pairs, quantifying their nonlinear causal strength and delay time, and constructing a cross-domain causal graph with weights and delay labels; dynamically adjusting the causal edge strength using a decay function based on the delay time in the nonlinear causal graph; and, in conjunction with the causal chain of attack events, correcting and re-verifying the affected long-term causal paths, thereby generating a real-time updated causal chain of cross-domain attack events.

8. The intelligent monitoring method for network security incidents as described in claim 7, characterized in that, The associated security event pairs are specifically defined as follows: based on the nonlinear characteristics of event sequences under multi-scale time windows, statistical analysis is used to evaluate the statistical dependencies between security event types over long time series, so as to initially identify a set of event pairs with lag correlations. A sliding window mechanism is used to perform dynamic stability analysis on the initially identified associations, screening out association patterns that remain stable over continuous time periods or show significant peaks during periods of abnormal network activity. A scoring model is then used to rank and focus the importance of the screened candidate association event pairs. The scoring model assigns a comprehensive weight to the association strength of event pairs under different delays and time windows, and the weight integrates association strength, temporal persistence, and the level of abnormality in the corresponding time window. For the high-weight candidate event pairs after ranking and focusing, logical consistency is checked in conjunction with security context labels, and a list of potential long-term associated security event pairs with delay estimates and confidence level labels is output.

9. The intelligent monitoring method for network security incidents as described in claim 7, characterized in that, The process of generating real-time updated causal chains for cross-domain attack events includes: extracting spatiotemporally correlated clusters of cross-domain security events and constructing an initial entangled causal graph based on existing causal graphs; performing virtual intervention on each candidate root cause node in the graph, quantifying the independence of effects among each root cause node by simulating the change patterns of event occurrence probabilities under different interventions; clustering event nodes affected by the same set of interventions into causal communities based on the measure of effect independence; retaining the causal edge with the highest statistical influence for each causal community to form multiple clear causal sub-chains representing independent attack activities; using the root cause nodes of independent causal sub-chains as simulated attack potential sources, propagating them to subsequent nodes according to the security event diffusion path, and calculating the combined attack potential that each node needs to withstand; calculating the vector difference between the combined attack potential and the inherent defense potential of each node, and determining the security stress value of the node; and drawing a real-time network security stress field map based on this, continuously monitoring and identifying areas with persistently high stress levels, and predicting them as network security vulnerabilities.

10. The intelligent monitoring method for network security incidents as described in claim 7, characterized in that, The attack potential specifically includes: calculating the attack impact starting from the source, propagating along a predetermined path, and attenuating during propagation due to path resistance and topological distance, and finally, at the target node, the impacts from different attack chains will be vector-superimposed.

Images