Network advanced threat detection and situation awareness system based on multi-modal large model

Abstract

The invention relates to the technical field of network security, and discloses a network advanced threat detection and situation awareness system based on a multi-modal large model, an acquisition unit performs multi-modal data acquisition, and a processing unit processes the data acquired by the acquisition unit and transmits the processed data to a processor. The model unit receives the processed data and generates a security situation representation, the scoring unit is used for calculating an abnormal score in the model unit, the center unit judges the calculated abnormal score, the traceability unit identifies a candidate attack chain based on the security situation representation, and the data processing unit processes the candidate attack chain. According to the system, various modal data such as texts, codes, network diagrams and byte features are collected, it is guaranteed that data acquisition is sufficient and comprehensive, the collected data are cleaned, standardized, sliced and uniformly represented, and the security of the attack chain is improved. And high-quality and structured input is provided for subsequent model analysis.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to an advanced network threat detection and situational awareness system based on a multimodal large model. Background Technology

[0002] With the rapid development of information technology, cyberspace has become the core carrier of national security and economic and social operations. However, cyber attack techniques have evolved accordingly, with new attack methods such as advanced persistent threats, zero-day exploits, and ransomware as a service emerging one after another, and their stealth, targeting, and destructiveness are increasing day by day. Traditional network security protection systems are comprehensive systems that safeguard the hardware, software, and data security of network systems through technical means and management measures. They encompass core components such as encryption technology, access control technology, and firewalls. Their protection targets include industrial control systems, employing strategies such as zoned and domain-based management, industrial firewall deployment, and data classification and grading to achieve security protection. Current security systems struggle to effectively integrate heterogeneous data from multiple sources, such as text, code, network traffic, and file characteristics, during data collection. This fragmentation leads to fragmented threat detection, hindering the rapid and diverse collection of threats. After data collection, traditional threat identification methods rely on rules or single-modal analysis, making it difficult to identify covert, persistent, and cross-stage attack behaviors. Once a potential threat is identified, existing systems often only perform threat detection or post-incident attribution, lacking integrated situational awareness capabilities that encompass detection, attribution, response, and prediction. Summary of the Invention

[0003] To overcome the aforementioned deficiencies of the prior art, the embodiments of the present invention provide a network advanced threat detection and situational awareness system based on a multimodal large model to solve the technical problems mentioned in the background art.

[0004] To achieve the above objectives, the present invention provides the following technical solution: a network advanced threat detection and situational awareness system based on a multimodal large model, comprising a data acquisition unit, a processing unit, a model unit, a scoring unit, a central unit, a source tracing unit, and a perception unit. The data acquisition unit acquires multimodal data; the processing unit processes the data acquired by the data acquisition unit; the model unit receives the processed data and generates a security situation representation; the scoring unit calculates anomaly scores within the model unit; the central unit determines the calculated anomaly scores; the source tracing unit identifies candidate attack chains based on the security situation representation; and the perception unit evaluates the attack chains as candidate attack chains and executes a security response. The acquisition unit is used for multimodal data acquisition. The acquisition unit acquires heterogeneous security data from network devices, hosts, terminals, cloud platforms and external threat intelligence sources. The heterogeneous security data acquired by the acquisition unit includes text modal data, code instruction sequence modal data, network metadata and graph modal data, bytes and feature modal data.

[0005] Furthermore, the processing unit receives the collected data and generates a unified intermediate representation for different modal data. The processing unit includes a cleaning module, a standard module, a slicing module, and a unification module. The cleaning module filters invalid characters and standardizes the format of text modal data, deobfuscates and normalizes code instruction sequence modal data, removes irrelevant code, filters network scanning noise from network metadata and graph modal data and encodes them uniformly, repairs file headers for byte and feature modal data according to the magic number, and removes holes and additional non-executable data from PE files.

[0006] Furthermore, the standard module maps the cleaned data to a unified, machine-readable standard pattern, including time standardization, entity standardization, behavior event type standardization, and field structure standardization. The slicing unit cuts the continuous, endless data stream after standardization into data units with semantic boundaries that are suitable for model processing.

[0007] Furthermore, the unified module first establishes the link relationship between entities and behaviors within and between slices of different modalities within the slicing module, constructing a prototype of a dynamic and interconnected security knowledge graph, and finally encapsulating it into a unified multimodal security event tuple sequence that can be directly consumed by the multimodal large model core engine.

[0008] Furthermore, the model unit maps the unified multimodal security event tuple sequence to a unified vector space to form an initial vector. The initial vector is then subjected to security knowledge enhancement processing using a retrieval enhancement generation mechanism, incorporating cybersecurity domain knowledge to form a fusion feature vector. The knowledge-enhanced multimodal fusion feature vector representation is then subjected to contextual understanding and reasoning through a cross-attention mechanism to generate a unified, context-aware security posture representation.

[0009] Furthermore, the scoring unit is used to calculate the anomaly score of the fused feature vector within the model, and the formula for calculating the anomaly score is as follows: In the formula, PF is the calculated anomaly score, and x is the fused feature vector. The normal behavior pattern probability distribution model is a multivariate Gaussian distribution, where P is the fused feature vector in the normal distribution model. Based on the probability density, the scoring unit sends the calculated anomaly score PF to the central unit.

[0010] Furthermore, the central unit receives the calculated anomaly score P and compares it with its internal anomaly threshold Y. When the anomaly score PF ≥ the anomaly threshold Y, the central unit retrieves the fusion feature vector corresponding to the anomaly score PF, and the central unit controls the model unit to calculate the security situation representation of the fusion feature vector and send it to the tracing unit. When the anomaly score PF ≥ the anomaly threshold Y, the central unit does not process the fusion feature vector corresponding to the anomaly score PF.

[0011] Furthermore, the tracing unit receives attacker technical information associated with the security posture representation and risk assessments of affected assets. Based on the attacker technical information, it infers the attacker's tactical intent. Combined with the risk assessments of the affected assets, it identifies potential high-value attack targets and generates tracing hypotheses for searching specific behavioral patterns and connection paths in the event graph. Using the current abnormal activity node identified in the security posture representation as the search starting point, and based on the tracing hypotheses, it performs a reverse, cross-host graph search along one or more edges in the temporal attribute graph constructed by multimodal security events, including process derivation, network connection, file access, and identity authentication relationships. Paths that satisfy the preset attack mode logic and connect to suspicious entry points are identified as candidate attack chains.

[0012] Furthermore, the perception unit receives candidate attack chains, evaluates their confidence level, and associates them with asset, business, and threat intelligence information to enrich their context. The processed attack chains are mapped to an attack framework matrix for visualization, and cross-attack chain attribution and correlation analysis with vulnerability and asset information are performed. Based on the current tactics and techniques of the attack chains, the attacker's subsequent behavior is predicted, and response suggestions for containment, hunting, and hardening are generated or automatically executed.

[0013] The technical effects and advantages of this invention are as follows: 1. This invention collects multiple modal data such as text, code, network graphs, and byte features to ensure that the data acquisition is comprehensive enough. The collected data is cleaned, standardized, sliced, and uniformly represented to provide high-quality, structured input for subsequent model analysis, realize the integration between different data, and avoid data fragmentation. 2. This invention maps a unified event sequence to a vector space, incorporates domain knowledge through a retrieval enhancement generation mechanism, and then performs multimodal feature fusion and contextual reasoning through a cross-attention mechanism to finally generate a security posture representation. The security posture representation covers high-level semantic information such as attacker intent and affected assets, thereby enabling the identification of covert, continuous, and cross-stage attack behaviors. 3. This invention assesses the confidence level of candidate attack chains and enriches their context by associating them with asset, business, and threat intelligence information. The processed attack chains are mapped to an attack framework matrix for visualization. Cross-attack chain attribution and correlation analysis with vulnerability and asset information are performed. Based on the current tactics and techniques of the attack chains, the subsequent behavior of attackers is predicted, and response suggestions for containment, hunting, and hardening are generated or automatically executed, resulting in better situational awareness capabilities. Attached Figure Description

[0014] Figure 1 This is a schematic diagram of the overall system composition of the present invention. Detailed Implementation

[0015] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings. In addition, the forms of the various structures described in the following embodiments are merely illustrative. The advanced network threat detection and situational awareness system based on multimodal large models involved in the present invention is not limited to the structures described in the following embodiments. All other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0016] This invention provides a network advanced threat detection and situational awareness system based on a multimodal large model, comprising a data acquisition unit, a processing unit, a model unit, a scoring unit, a central unit, a source tracing unit, and a perception unit. The data acquisition unit acquires multimodal data; the processing unit processes the data acquired by the acquisition unit; the model unit receives the processed data and generates a security situation representation; the scoring unit calculates anomaly scores within the model unit; the central unit determines the calculated anomaly scores; the source tracing unit identifies candidate attack chains based on the security situation representation; and the perception unit evaluates the attack chains as candidate attack chains and executes security responses.

[0017] In this embodiment, the present application forms a complete closed-loop system from data acquisition to threat detection, source tracing analysis, situational awareness and response. Each unit has a clear division of labor and sequentially completes tasks such as multimodal data acquisition, unified processing, intelligent modeling, anomaly scoring, decision judgment, attack chain reconstruction and security response, thereby intelligently realizing advanced network threat detection and situational awareness.

[0018] Reference Figure 1 The acquisition unit is used for multimodal data acquisition. The acquisition unit acquires heterogeneous security data from network devices, hosts, terminals, cloud platforms and external threat intelligence sources. The heterogeneous security data acquired by the acquisition unit includes text modal data, code instruction sequence modal data, network metadata and graph modal data, bytes and feature modal data.

[0019] In this embodiment of the application, when collecting data, the collection direction is multiple modal data such as text, code, network graph, and byte features, to ensure that the data acquisition is comprehensive enough, thereby providing a rich data foundation for the identification of complex and covert attack behaviors.

[0020] Reference Figure 1 The processing unit receives the collected data and generates a unified intermediate representation for different modal data. The processing unit includes a cleaning module, a standard module, a slicing module, and a unification module. The cleaning module filters invalid characters and standardizes the format of text modal data, deduplicates frequently generated repetitive state logs, retains key state change points, identifies and hashes or tags user personal information, deobfuscates and normalizes code instruction sequence modal data, removes irrelevant code, filters network scanning noise, TCP sequence numbers, timestamps, etc. from network metadata and graph modal data, reassembles fragmented network sessions caused by packet loss or collection point limitations, accurately extracts host headers, URIs, query domain names, and JA3 / JA3S fingerprint key fields from HTTP, DNS, and TLS protocol payloads, and encodes them uniformly. It repairs file headers for bytes and feature modal data according to the magic number and removes holes and additional non-executable data from PE files.

[0021] In this embodiment, the processing unit receives multimodal raw data and performs cleaning, standardization, slicing, and unified representation processing on it to provide high-quality, structured input for subsequent model analysis. The cleaning module is responsible for removing invalid data, repairing damaged structures, unifying encoding formats, improving data quality and consistency, and using different processing methods for different data to ensure that different data can be cleaned effectively.

[0022] Reference Figure 1 The standard module maps the cleaned data to a unified, machine-readable standard pattern, including time standardization, entity standardization, behavior event type standardization, and field structure standardization. The slicing unit cuts the continuous, endless data stream after standardization into data units with semantic boundaries that are suitable for model processing. Time standardization uses a unified, high-precision time base for all events, synchronizing and correcting log sources from different time zones or with discrepancies in system clocks. Entity standardization includes host identifiers, user identifiers, and process identifiers. Host identifiers map or associate hostnames, IP addresses, MAC addresses, cloud instance IDs, etc., with a unique asset ID within the system. User identifiers map usernames, email addresses, SIDs, IAM roles, etc., with a unique user ID. Process identifiers use the process name-PID-startup time triplet or command-line hash as a unique process instance ID. Behavioral event type standardization establishes an internally unified event classification method, mapping raw event names from different sources to standardized behavioral verbs and objects. Field structure standardization defines a common security event data pattern. The slicing module includes time-window-based slicing, session-transaction-based slicing, process lifecycle-based slicing, and causal context boundary-based slicing. Time-window-based slicing cuts logs and traffic into fixed windows of 5 minutes or 1 hour for initial batch analysis. Session-transaction-based slicing uses a complete TCP / UDP session as a slice unit and aggregates all relevant events generated during a user's login and logout into a slice. Process lifecycle-based slicing aggregates all behaviors of a process from creation to termination into a slice. Causal context boundary-based slicing uses rules or lightweight models to identify logical boundaries.

[0023] In this embodiment, data from different sources and in different formats can be processed under the same framework, supporting cross-source correlation analysis. Based on various slicing methods such as time window, session, and process lifecycle, it adapts to the analysis needs of different scenarios. The slicing module cuts the continuous data stream into data units with semantic boundaries, reducing the computational complexity of the model, improving real-time processing capabilities, and thus facilitating model processing.

[0024] Reference Figure 1 The unified module first establishes the link relationship between entities and behaviors within and between slices of different modalities in the slicing module, constructs a prototype of a dynamic and interconnected security knowledge graph, and finally encapsulates it into a unified multimodal security event tuple sequence that can be directly consumed by the multimodal large model core engine. When establishing links between entities and behaviors, it is necessary to satisfy temporal association, causal association, and entity graph association. Temporal association aligns events of all modalities on a strict timeline. Causal association uses domain knowledge and statistical inference to establish causal relationship chains between events. Entity graph association uses assets, users, processes, files, network connections, etc. as nodes, and relationships such as running at, belonging to, connected to, created, downloaded, and modified as edges. As data flows in, the graph is dynamically added, deleted, and updated, combining all related, time-sorted "tuples" into a sequence. Within the same sequence, it is ensured that tuples from different data sources describing the same fact are precisely aligned in terms of timestamps and entity pointers, thereby generating a unified multimodal security event tuple sequence.

[0025] In this embodiment, the unified module establishes entity and behavior associations within and between different modal slices based on slices, initially constructs a dynamic security knowledge graph, and encapsulates it into a multimodal security event tuple sequence for direct use by model units. Furthermore, it connects fragmented events into meaningful attack storylines through three association methods: temporal, causal, and entity graph. The constructed knowledge graph prototype provides structured support for subsequent attack chain search and behavior reasoning. The unified multimodal event sequence preserves the logical and temporal relationships between events, enhancing the model's overall understanding of the attack scenario.

[0026] Reference Figure 1 The model unit maps the unified multimodal security event tuple sequence to a unified vector space to form an initial vector. The initial vector is then enhanced with security knowledge using a retrieval enhancement generation mechanism, incorporating knowledge from the cybersecurity domain. The knowledge-enhanced multimodal representation is then subjected to contextual understanding and reasoning through a cross-attention mechanism to generate a unified, context-aware security posture representation. Based on this security posture representation, threat detection, attack chain reconstruction, and security posture assessment are performed.

[0027] In this embodiment, the model unit maps a unified event sequence to a vector space, incorporates domain knowledge through a retrieval-enhanced generation mechanism, and then performs multimodal feature fusion and contextual reasoning through a cross-attention mechanism to finally generate a security posture representation. The cross-attention mechanism effectively captures the semantic relationships between different modalities, improving the ability to represent complex attack behaviors. The retrieval-enhanced generation introduces external security knowledge, enabling the model to have stronger professional domain understanding and reasoning capabilities. The generated security posture representation not only includes anomaly detection results but also covers high-level semantic information such as attacker intent and affected assets, facilitating subsequent source tracing and perception processing.

[0028] Reference Figure 1 The scoring unit is used to calculate the anomaly score of the fused feature vector within the model. The formula for calculating the anomaly score is as follows: In the formula, PF is the calculated anomaly score, and x is the fused feature vector. The normal behavior pattern probability distribution model is a multivariate Gaussian distribution, where P is the fused feature vector in the normal distribution model. Given the probability density, the scoring unit sends the calculated anomaly score PF to the central unit. The central unit receives the calculated anomaly score P and compares it with its internal anomaly threshold Y. When the anomaly score PF ≥ the anomaly threshold Y, the central unit retrieves the fusion feature vector corresponding to the anomaly score PF, and the central unit retrieves the security posture representation of the fusion feature vector from the model unit and sends it to the tracing unit. When the anomaly score PF ≥ the anomaly threshold Y, the central unit does not process the fusion feature vector corresponding to the anomaly score PF.

[0029] In this embodiment, the scoring unit is based on a multivariate Gaussian distribution model to calculate the probability of anomalies in the fused feature vector relative to the normal behavior pattern and outputs an anomaly score in logarithmic form to quantify the degree of threat. Therefore, when the anomaly score PF ≥ the anomaly threshold Y, a relevant security posture representation is used for in-depth analysis. Through threshold control, over-processing of low-risk events is avoided, saving computational and response resources. High-overhead source tracing analysis is only triggered when necessary, balancing detection depth and processing efficiency.

[0030] Reference Figure 1 The tracing unit receives attacker technical information associated with the security posture representation and risk assessment of affected assets. Based on the attacker technical information, it infers the attacker's tactical intent. Combined with the risk assessment of the affected assets, it identifies potential high-value attack targets and generates tracing hypotheses for searching specific behavioral patterns and connection paths in the event graph. Using the current abnormal activity node identified in the security posture representation as the search starting point, and based on the tracing hypotheses, it performs a reverse, cross-host graph search along one or more edges in the temporal attribute graph constructed by multimodal security events, such as process derivation, network connection, file access, and identity authentication relationships. Paths that satisfy the preset attack mode logic and are connected to suspicious entry points are identified as candidate attack chains.

[0031] In this embodiment, the tracing unit generates tracing hypotheses based on the security situation representation and combines attacker technology and asset risk information. It then performs a reverse search in the time-series attribute graph to find paths that satisfy the attack pattern, identifies candidate attack chains, and connects isolated abnormal events into complete attack chains through graph search to reveal the full picture of the attack. By combining the attacker's tactical intent and asset value, the targeting and accuracy of attack chain identification are improved.

[0032] Reference Figure 1The perception unit receives candidate attack chains, evaluates their confidence level, and associates them with asset, business, and threat intelligence information to enrich their context. It then maps the processed attack chains to an attack framework matrix for visualization, performs cross-attack chain attribution and correlation analysis with vulnerability and asset information, predicts the attacker's subsequent behavior based on the current tactics and techniques of the attack chains, and generates or automatically executes response suggestions for containment, hunting, and hardening.

[0033] In this embodiment, the perception unit performs confidence assessment, context enrichment, visualization mapping, attribution analysis, and behavior prediction on candidate attack chains, and generates or automatically executes security response suggestions. It maps the attack chains to standard frameworks such as ATT&CK to improve the understandability and operability of security analysis. Based on the current attack chain, it predicts the attacker's subsequent behavior to achieve proactive defense and hunting. Furthermore, it combines assets, vulnerabilities, and business context to generate precise containment and hardening response measures to improve emergency response efficiency.

[0034] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. The units and algorithm steps of the various examples described in the embodiments can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0035] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0036] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0037] In conclusion, the above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A network advanced threat detection and situational awareness system based on a multimodal large model, characterized in that: The system includes a data acquisition unit, a processing unit, a model unit, a scoring unit, a central unit, a source tracing unit, and a perception unit. The data acquisition unit acquires multimodal data, the processing unit processes the data acquired by the acquisition unit, the model unit receives the processed data and generates a security posture representation, the scoring unit calculates anomaly scores within the model unit, the central unit determines the calculated anomaly scores, the source tracing unit identifies candidate attack chains based on the security posture representation, and the perception unit evaluates the attack chains and executes security responses. The acquisition unit is used for multimodal data acquisition. The acquisition unit acquires heterogeneous security data from network devices, hosts, terminals, cloud platforms and external threat intelligence sources. The heterogeneous security data acquired by the acquisition unit includes text modal data, code instruction sequence modal data, network metadata and graph modal data, bytes and feature modal data.

2. The network advanced threat detection and situational awareness system based on a multimodal large model according to claim 1, characterized in that: The processing unit receives the collected data and generates a unified intermediate representation for different modal data. The processing unit includes a cleaning module, a standard module, a slicing module, and a unification module. The cleaning module filters invalid characters and standardizes the format of text modal data, deobfuscates and normalizes code instruction sequence modal data, removes irrelevant code, filters network scanning noise from network metadata and graph modal data and unifies the encoding, repairs the file header of byte and feature modal data according to the magic number, and removes holes and additional non-executable data from PE files.

3. The advanced network threat detection and situational awareness system based on a multimodal large model according to claim 2, characterized in that: The standard module maps the cleaned data to a unified, machine-readable standard pattern, including time standardization, entity standardization, behavior event type standardization, and field structure standardization. The slicing unit cuts the continuous, endless data stream after standardization into data units with semantic boundaries that are suitable for model processing.

4. The advanced network threat detection and situational awareness system based on a multimodal large model according to claim 2, characterized in that: The unified module first establishes the link relationship between entities and behaviors within and between slices of different modalities in the slicing module, constructing a prototype of a dynamic and interconnected security knowledge graph, and finally encapsulates it into a unified multimodal security event tuple sequence that can be directly consumed by the multimodal large model core engine.

5. The advanced network threat detection and situational awareness system based on a multimodal large model according to claim 1, characterized in that: The model unit maps the unified multimodal security event tuple sequence to a unified vector space to form an initial vector. The initial vector is then enhanced with security knowledge through a retrieval enhancement generation mechanism, incorporating cybersecurity domain knowledge to form a fusion feature vector. The knowledge-enhanced multimodal fusion feature vector representation is then subjected to contextual understanding and reasoning through a cross-attention mechanism to generate a unified, context-aware security posture representation.

6. The advanced network threat detection and situational awareness system based on a multimodal large model according to claim 1, characterized in that: The scoring unit is used to calculate the anomaly score of the fused feature vector within the model. The formula for calculating the anomaly score is as follows: In the formula, PF is the calculated anomaly score, and x is the fused feature vector. The normal behavior pattern probability distribution model is a multivariate Gaussian distribution, where P is the fused feature vector in the normal distribution model. Based on the probability density, the scoring unit sends the calculated anomaly score PF to the central unit.

7. The advanced network threat detection and situational awareness system based on a multimodal large model according to claim 1, characterized in that: The central unit receives the calculated anomaly score P and compares it with its internal anomaly threshold Y. When the anomaly score PF ≥ the anomaly threshold Y, the central unit retrieves the fusion feature vector corresponding to the anomaly score PF, and the central unit controls the model unit to calculate the security situation representation of the fusion feature vector and send it to the tracing unit. When the anomaly score PF ≥ the anomaly threshold Y, the central unit does not process the fusion feature vector corresponding to the anomaly score PF.

8. The advanced network threat detection and situational awareness system based on a multimodal large model according to claim 1, characterized in that: The tracing unit receives attacker technical information associated with the security posture representation and risk assessments of affected assets. Based on the attacker technical information, it infers the attacker's tactical intent. Combined with the risk assessments of the affected assets, it identifies potential high-value attack targets and generates tracing hypotheses for searching specific behavioral patterns and connection paths in the event graph. Using the current abnormal activity node identified in the security posture representation as the search starting point, and based on the tracing hypotheses, it performs a reverse, cross-host graph search along one or more edges in the temporal attribute graph constructed from multimodal security events, including process derivation, network connection, file access, and authentication relationships. Paths that satisfy the preset attack mode logic and connect to suspicious entry points are identified as candidate attack chains.

9. The advanced network threat detection and situational awareness system based on a multimodal large model according to claim 8, characterized in that: The perception unit receives candidate attack chains, evaluates their confidence level, and associates them with asset, business, and threat intelligence information to enrich their context. It then maps the processed attack chains to an attack framework matrix for visualization, performs cross-attack chain attribution and correlation analysis with vulnerability and asset information, predicts the attacker's subsequent behavior based on the current tactics and techniques of the attack chains, and generates or automatically executes response suggestions for containment, hunting, and hardening.

Images