A method, system, device and medium for dynamic optimization of complex business process paths based on graph neural networks

Abstract

This invention discloses a method, system, device, and medium for dynamic optimization of complex business process paths based on graph neural networks, mainly relating to the field of artificial intelligence technology. The method includes: constructing a global business topology knowledge base; constructing a dynamic local subgraph based on the global business topology knowledge base when anomalies are detected or a new business flow is established; extracting spatiotemporal feature vectors containing trend information from each node in the dynamic local subgraph using a temporal neural network model; inputting each spatiotemporal feature vector into the graph neural network, and outputting an updated target spatiotemporal feature vector through node type embedding and risk sharpening aggregation; generating a preliminary probability distribution of the next-hop node, filtering it based on a predefined business rule mask, and outputting the optimal path orchestration instruction. Through dynamic local perception, risk sharpening aggregation, and business rule embedding, accurate real-time defense path orchestration under millisecond-level high-concurrency attacks is achieved.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence technology, and in particular to a method, apparatus, device, and medium for dynamic optimization of complex business process paths based on graph neural networks. Background Technology

[0002] Distributed Denial-of-Service (DDoS) defense systems play a crucial role in current network security architectures. Traditional defense mechanisms typically employ static, sequential processing flows, such as executing rate limiting, filtering, and blacklisting policies in sequence. When facing hybrid attacks (such as CC attacks combined with UDP floods), this fixed-order processing approach can lead to response latency and resource contention, thereby impacting the smooth operation of normal services. Existing solutions have limitations in dynamically adapting to changes in network conditions, especially in scenarios with drastic real-time load fluctuations, where their ability to adjust the execution order of service nodes is relatively limited.

[0003] In recent years, Graph Neural Networks (GNNs) have been attempted to be introduced into the field of cybersecurity to model network topology and traffic characteristics. However, mainstream GNN methods are mostly geared towards static or low-frequency update scenarios such as social networks or citation networks, and their designs are usually based on the assumption of node homogeneity. When directly applied to high-concurrency, high-dynamic DDoS defense environments, they face three challenges: First, the frequent reconstruction of the full graph adjacency matrix brings high computational overhead, making it difficult to match the timeliness requirements of millisecond-level path adjustment; second, standard aggregation mechanisms are prone to over-smoothing sparse abnormal traffic characteristics in massive connections, weakening the ability to distinguish hybrid attacks; third, general GNN architectures do not fully model the functional differences between cleaning, detection, and business nodes, and lack explicit support for business rule constraints.

[0004] Therefore, there is an urgent need for a dynamic path optimization method that takes into account real-time performance, feature sensitivity, and business logic compatibility in order to improve defense effectiveness in complex attack scenarios. Summary of the Invention

[0005] This invention provides a method, system, device, and medium for dynamic optimization of complex business process paths based on graph neural networks, in order to solve the problem that traditional DDoS defense mechanisms, due to their static serial processing flow, are unable to achieve real-time, accurate, and business-logic-compliant adaptive path optimization in highly dynamic mixed attack scenarios.

[0006] In a first aspect, embodiments of the present invention provide a method for dynamically optimizing complex business process paths based on graph neural networks, including:

[0007] Based on business requirements, a global business topology knowledge base is constructed, wherein the knowledge base stores the static attributes, types, and allowed business flow rules between all business nodes corresponding to the business requirements.

[0008] The status of each business node is monitored in real time. When a node abnormality or a new business flow is detected, a dynamic local subgraph is constructed based on the global business topology knowledge base.

[0009] Based on the temporal state data of each node in the dynamic local subgraph, a temporal neural network model is used to extract the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph.

[0010] Each of the aforementioned spatiotemporal feature vectors is input into a graph neural network, and through node type embedding and risk sharpening aggregation, the updated target spatiotemporal feature vector is output.

[0011] Based on the target spatiotemporal feature vector, a preliminary probability distribution of the next-hop node is generated, filtered based on a predefined business rule mask, and the optimal path orchestration instruction is output.

[0012] Optionally, the real-time monitoring of the status of each of the business nodes, and the construction of a dynamic local subgraph based on the global business topology knowledge base when a node anomaly or a new business flow is detected, includes:

[0013] Based on a preset time sliding window, the node status and newly created business flows are monitored in real time.

[0014] When a node anomaly is detected or a new business flow is created, a subgraph construction event is triggered.

[0015] Based on the abnormal node or the target, a new business flow is created, the root node is determined, and a dynamic local subgraph is constructed based on the root node and the global business topology knowledge base.

[0016] Optionally, the step of extracting the spatiotemporal feature vectors containing trend information for each node in the dynamic local subgraph based on the temporal state data of each node in the dynamic local subgraph using a temporal neural network model includes:

[0017] Obtain the temporal state data of each node in the dynamic local subgraph, and construct the time series tensor corresponding to each node in the dynamic local subgraph;

[0018] The time series tensors corresponding to each node are input into the temporal neural network model, and the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph are output.

[0019] Optionally, the spatiotemporal feature vectors are input into a graph neural network, and through node type embedding and risk sharpening aggregation, an updated target spatiotemporal feature vector is output, including:

[0020] Each of the aforementioned spatiotemporal feature vectors is input into a graph neural network. Through node type embedding, each of the aforementioned spatiotemporal feature vectors is concatenated with the corresponding type embedding vector to obtain an enhanced spatiotemporal feature vector.

[0021] A risk-aware sharpening aggregation function is used to update the enhanced spatiotemporal feature vector, resulting in the updated target spatiotemporal feature vector.

[0022] Optionally, the risk perception sharpening aggregation function employs a dual-channel aggregation mechanism, including:

[0023] The background channel is used to aggregate the regular load characteristics of neighboring nodes using the mean pooling aggregation method;

[0024] The alarm channel is used to aggregate the abnormal features of neighboring nodes by employing max pooling and combining risk entropy weight parameters.

[0025] Optionally, based on the target spatiotemporal feature vector, a preliminary probability distribution of the next-hop node is generated, filtered based on a predefined business rule mask, and an optimal path orchestration instruction is output, including:

[0026] Based on the target spatiotemporal feature vector, a preliminary probability distribution of the next-hop node is generated through a fully connected layer and an activation function.

[0027] Based on a predefined business rule mask, the preliminary probability distribution is filtered to obtain the target probability distribution;

[0028] Based on the normalized target probability distribution, the optimal path orchestration instructions are generated.

[0029] Optionally, the predefined business rule mask is in matrix form. The matrix is ​​predefined based on node type and business protocol compatibility and is used to prevent traffic from being directed to a next-hop node that is functionally incompatible or logically disallowed during the decoding phase.

[0030] Secondly, embodiments of the present invention provide a dynamic optimization system for complex business process paths based on graph neural networks. The system is used to execute the dynamic optimization method for complex business process paths based on graph neural networks described in any embodiment of the present invention, comprising:

[0031] The construction module is used to build a global business topology knowledge base based on business requirements. The knowledge base stores the static attributes, types, and allowed business flow rules between all business nodes corresponding to the business requirements.

[0032] The monitoring module is used to monitor the status of each business node in real time. When a node abnormality or a new business flow is detected, a dynamic local subgraph is constructed based on the global business topology knowledge base.

[0033] The feature extraction module is used to extract the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph based on the temporal state data of each node in the dynamic local subgraph through a temporal neural network model.

[0034] The update module is used to input each of the spatiotemporal feature vectors into the graph neural network, and output the updated target spatiotemporal feature vector through node type embedding and risk sharpening aggregation.

[0035] The generation module is used to generate a preliminary probability distribution of the next-hop node based on the target spatiotemporal feature vector, filter it based on a predefined business rule mask, and output the optimal path orchestration instruction.

[0036] Thirdly, embodiments of the present invention provide an electronic device, the electronic device comprising:

[0037] At least one processor; and

[0038] A memory communicatively connected to the at least one processor; wherein,

[0039] The memory stores a computer program that can be executed by the at least one processor, which enables the at least one processor to execute the dynamic optimization method for complex business process paths based on graph neural networks according to any embodiment of the present invention.

[0040] Fourthly, embodiments of the present invention provide a computer-readable storage medium storing computer instructions, which are used to cause a processor to execute the method for dynamic optimization of complex business process paths based on graph neural networks as described in any embodiment of the present invention.

[0041] The technical solution of this invention significantly reduces computational overhead by constructing event-triggered dynamic local subgraphs, achieving millisecond-level response. It effectively enhances the ability to discriminate sparse and anomalous features in hybrid attacks by using a temporal neural network and a heterogeneous graph attention network integrating a risk-aware sharpening aggregation function, avoiding excessive feature smoothing. Finally, it ensures that path planning conforms to logical constraints through business rule masking filtering. The ultimate technical effect is a significant improvement in the real-time performance of defense, the accuracy of feature discrimination, and the compliance of business processes in complex attack scenarios, achieving adaptive, precise protection and service quality assurance.

[0042] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0043] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 The flowchart illustrates a method for dynamically optimizing complex business process paths based on graph neural networks, as provided in Embodiment 1 of the present invention.

[0045] Figure 2 This is a framework diagram of a complex business process path dynamic optimization system based on graph neural networks provided in Embodiment 3 of the present invention;

[0046] Figure 3 A schematic diagram of an electronic device that can be used to implement embodiments of the present invention is shown. Detailed Implementation

[0047] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0048] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0049] Application Overview:

[0050] In existing technologies, DDoS defense mechanisms typically employ static, serial processing flows (such as sequentially executing rate limiting, filtering, and blacklisting strategies). When facing hybrid attacks (such as CC attacks combined with UDP Flood), this fixed-order processing can easily lead to response delays and resource contention, impacting the smooth operation of normal services. Existing solutions have limitations in dynamically adapting to changes in network state, especially in scenarios with drastic real-time load fluctuations, where their ability to adjust the execution order of service nodes is insufficient. Furthermore, although Graph Neural Networks (GNNs) have been introduced into the field of network security, mainstream GNN methods are based on the assumption of node homogeneity and are geared towards static or low-frequency update scenarios (such as social networks). When directly applied to highly dynamic DDoS defense, they face three challenges: First, frequent reconstruction of the full graph adjacency matrix leads to high computational overhead, making it difficult to meet the timeliness requirements of millisecond-level path adjustment; second, standard aggregation mechanisms are prone to over-smoothing sparse abnormal traffic characteristics in massive connections, weakening their ability to distinguish hybrid attacks; and third, insufficient modeling of the functional differences between cleaning, detection, and service nodes, and a lack of explicit support for business rule constraints, may lead to path planning violating logical compatibility.

[0051] This invention, by monitoring network traffic and node status in real time, dynamically constructs event-triggered local subgraphs when anomalies are detected, associating only upstream and downstream nodes of currently active traffic, significantly reducing computational overhead and achieving millisecond-level response. It uses temporal neural networks (such as GRU / LSTM) to extract spatiotemporal feature vectors of nodes, capturing load trends. Then, a heterogeneous graph attention network integrates a risk-aware sharpening aggregation function with node type embedding. The former employs a dual-channel mechanism (smoothing normal load in the background channel and sharpening abnormal signals in the alarm channel) to avoid over-smoothing features, while the latter distinguishes node functional heterogeneity, enhancing sensitivity to hybrid attacks. Finally, it generates a next-hop probability distribution based on the inference output and applies predefined business rule masking filtering to ensure the path conforms to logical constraints. The ultimate technical effect is to improve defense effectiveness and service quality in complex attack scenarios, achieving adaptive load balancing and anomaly isolation through dynamic path optimization, balancing real-time performance, feature sensitivity, and business compliance.

[0052] Example 1: Figure 1 This is a flowchart of a method for dynamically optimizing complex business process paths based on graph neural networks, provided in Embodiment 1 of the present invention. This embodiment is applicable to situations where the data flow processing order between cleaning, detection, and business nodes is dynamically adjusted under DDoS attack scenarios to improve defense efficiency and service quality. This method can be executed using a graph neural network-based dynamic optimization system for complex business process paths. Figure 1 As shown, the method includes:

[0053] S110. Based on business requirements, construct a global business topology knowledge base, wherein the knowledge base stores the static attributes, types, and allowed business flow rules between all business nodes.

[0054] S120. Monitor the status of each business node in real time. When a node is detected to be abnormal or a new business flow is detected, construct a dynamic local subgraph based on the global business topology knowledge base.

[0055] S130. Based on the temporal state data of each node in the dynamic local subgraph, extract the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph through a temporal neural network model.

[0056] S140. Input each of the spatiotemporal feature vectors into a graph neural network, and output the updated target spatiotemporal feature vector through node type embedding and risk sharpening aggregation.

[0057] S150. Based on the target spatiotemporal feature vector, generate a preliminary probability distribution of the next-hop node, filter it based on a predefined business rule mask, and output the optimal path orchestration instruction.

[0058] In this embodiment, constructing an event-triggered dynamic local subgraph significantly reduces computational overhead, achieving millisecond-level response. Using a temporal neural network and a heterogeneous graph attention network integrating a risk-aware sharpening aggregation function effectively enhances the ability to discriminate sparse and anomalous features in hybrid attacks, preventing excessive feature smoothing. Finally, business rule masking filtering ensures that path planning conforms to logical constraints. The ultimate technical effect is a significant improvement in the real-time performance of defense, the accuracy of feature discrimination, and the compliance of business processes in complex attack scenarios, achieving adaptive, precise protection and service quality assurance.

[0059] Example 2: The technical solution in this example is a further refinement based on the above examples.

[0060] In S110, a global business topology knowledge base is constructed based on business requirements. The knowledge base stores the static attributes, types, and allowed business flow rules between all business nodes.

[0061] Specifically, all node devices participating in service path planning in the network are identified and registered by system administrators or automatic discovery tools (such as those combined with LLDP, SNMP, or SDN controllers). Each node is assigned a specific service function type. For example: Traffic monitoring node: responsible for traffic analysis, not traffic modification. TCP cleaning node: specifically handles TCP protocol attack traffic (such as CC attacks, SYN floods). UDP cleaning node: specifically handles UDP protocol attack traffic (such as UDP floods). CAPTCHA challenge node: used for human-machine verification. Blackhole routing node: directly discards traffic. Service server node: the server that ultimately provides the service. Ingress gateway node: the entry point for traffic.

[0062] Recording static attributes of each business node involves creating a profile for each node, recording its immutable or rarely changing attributes. These attributes constitute the static data about the node in the knowledge base. This mainly includes: unique identifier, business type, physical / logical location, inherent capabilities, and management information. The unique identifier can refer to a device ID or management IP address; the business type can refer to a type label; the physical / logical location can refer to its position in the network topology (data center, rack); inherent capabilities can refer to supported protocols (TCP / UDP / ICMP), maximum processing capacity threshold (theoretical peak), etc.; management information can refer to its business domain, responsible person, etc.

[0063] Define the rules for permitted business traffic flows between nodes, i.e., a permission matrix for traffic to flow between different types of nodes. Specifically, rules can be formulated based on business logic. Network architects and security experts can explicitly specify which type of node can flow to which other types of nodes, according to business needs and security policies. Essentially, it defines a directed graph where nodes represent types and edges represent permitted flow relationships. For example, the ingress gateway can flow to traffic monitoring nodes, TCP cleaning nodes, and UDP cleaning nodes. Traffic monitoring nodes can flow to TCP cleaning nodes, UDP cleaning nodes, CAPTCHA challenge nodes, and black hole routing nodes (depending on monitoring results). TCP cleaning nodes can flow to business server nodes (allowed after cleaning). UDP cleaning nodes cannot flow to TCP cleaning nodes (protocol incompatibility, prohibited by the rule). No node can directly flow to the ingress gateway (to prevent loops). Rules can be represented as a business rule mask matrix, a two-dimensional matrix where the row and column indices are node types. The values ​​in the matrix are generally Boolean values ​​(0 or 1), i.e., Mask[source node type, target node type] = 1, indicating that flow from a source node to a target node is allowed. Mask[source node type, target node type] = 0, indicating that such flow is prohibited. This matrix is ​​predefined and static; it encodes domain knowledge and is independent of the real-time state of the network.

[0064] Store the node attributes and business rules defined above in a reliable database, such as a relational database (e.g., MySQL), a graph database (e.g., Neo4j, as it can naturally represent nodes and relationships), or a configuration management database (CMDB). Before deployment, validate the rules to ensure there are no logical errors. For example, reachability verification can be performed using graph traversal algorithms to ensure at least one valid path exists from the entry node to the critical business server. Loop detection uses topology sorting or strongly connected component analysis (e.g., Tarjan's algorithm or Kosaraju's algorithm) to detect cyclic dependencies in the directed graph, ensuring that rule definitions do not generate infinite traffic loops. Conflict detection uses rule logic analysis or more advanced formal validation tools (e.g., TLA+, Alloy) to discover potential policy conflicts, ensuring there are no contradictions between rules.

[0065] Furthermore, when the network architecture changes (such as adding a new type of cleaning equipment), the knowledge base needs to be updated, which involves registering new nodes, defining their types, and updating the business flow rule matrix.

[0066] In this embodiment, a global business topology knowledge base is constructed. By storing the static attributes, types, and predefined business flow rules of all business nodes, it provides a basic framework for subsequent dynamic path optimization. This ensures that path planning always conforms to business logic constraints during real-time monitoring and subgraph construction, avoiding the redirection of traffic to nodes with mismatched functions or incompatible protocols. This significantly improves the decision-making accuracy, business compliance, and overall reliability of the defense system, laying a static data foundation for millisecond-level adaptive optimization.

[0067] Optionally, the status of each business node is monitored in real time. When a node anomaly or a new business flow is detected, a dynamic local subgraph is constructed based on the global business topology knowledge base, including:

[0068] Based on a preset time sliding window, the node status and newly created business flows are monitored in real time.

[0069] When a node anomaly is detected or a new business flow is created, a subgraph construction event is triggered.

[0070] Based on the abnormal node or the target, a new business flow is created, the root node is determined, and a dynamic local subgraph is constructed based on the root node and the global business topology knowledge base.

[0071] Node status refers to the real-time operational status of various business nodes in the network (such as gateways, firewalls, and scrubbing devices), including at least indicators such as CPU load, memory utilization, network throughput, and SYN packet ratio. Node anomaly refers to any node's indicators exceeding static thresholds or dynamic baselines; for example, CPU utilization > 80% is considered an "abnormal node." When a node anomaly is detected, subgraph construction is triggered. Additionally, even without anomalies, when new, important business flows (such as new large-volume API requests) enter the network, subgraph construction is triggered in advance for path planning. A dynamic local subgraph refers to a subgraph extracted from the global network topology that contains only nodes related to currently active traffic; its structure changes dynamically with the network state, rather than being a fixed global graph. The business rule mask matrix in the global business topology knowledge base can act as a "filter" during extraction, preventing traffic from being directed to functionally incompatible nodes (such as prohibiting UDP traffic from jumping to dedicated TCP nodes). Node types in the global business topology knowledge base (such as "scrubbing nodes" and "black hole nodes") can be used to quickly identify functional relevance, ensuring that the subgraph conforms to business chain logic. The target new business flow can refer to a new business flow that meets the preset filtering rules. The preset filtering rules can refer to the pre-set rules for filtering important and sensitive newly arrived business flows. The filtering rules can be divided into three layers.

[0072] The first layer is a business value filtering layer to identify business flows with high business value. Specifically, the attributes of newly created business flows can be matched against a static policy library. For example, the matching rules may include: matching if the source IP address of the traffic belongs to a preset VIP user or partner IP range; matching if the target URL or API interface requested by the traffic contains preset keywords, such as payment, seckill, video-conf, etc.; and matching if the protocol and destination port number used by the traffic correspond to a known critical service, for example, SIP port 5060 used for video conferencing. These matching rules can be customized according to actual business needs.

[0073] If a match is found, the business flow is marked as "high business value" and enters the second layer of dynamic traffic analysis. If no match is found, it is treated as a normal business flow, and subgraph construction is not triggered. Instead, it is directed to the default load balancing path to save computing resources.

[0074] The second layer of dynamic traffic analysis refers to real-time behavioral analysis of traffic marked as "high-value traffic" during the initial connection establishment phase (e.g., the first few hundred milliseconds) to determine whether it may have a significant impact on network resources. Specifically, this involves monitoring the dynamic metrics of the traffic flow in real-time at the initial moment (e.g., the first few hundred milliseconds) using a time-sliding window. This includes monitoring whether the rate of newly established connections instantaneously exceeds a first preset threshold, such as more than 1000 new connections per second (the first preset threshold). It also involves monitoring whether the bandwidth usage immediately upon traffic arrival exceeds a second preset threshold, such as instantaneously reaching 1Gbps (the second preset threshold). Finally, it involves determining whether the arrival pattern of the traffic packets significantly deviates from its normal (or baseline) behavior. This can be achieved using the Z-Score normalization method (standard deviation multiple method) to calculate baseline statistics, which involves continuously collecting the packet arrival interval time series of similar traffic flows over a period of time (e.g., the past hour) during a period of stable traffic flow. Calculate the mean (μ) and standard deviation (σ) of the sequence. For newly arriving traffic flows, calculate the variance (S²) of the packet arrival interval within the most recent short time window (e.g., the first 100 milliseconds). Calculate the deviation factor = (standard deviation S of the current window interval) / (baseline standard deviation σ). If the deviation factor exceeds a third preset threshold (e.g., 3 times, 5 times, or 10 times), it is determined that the arrival pattern of the traffic packets significantly deviates from its normal (or baseline) behavior. If so, the traffic flow is further marked as "high resource impact," indicating that it is likely to cause congestion if not guided. If not, it is determined that although it has high business value, its current scale is moderate and will not trigger a subgraph construction event for the time being, and it can be included in regular monitoring.

[0075] The third layer of comprehensive judgment and triggering will only identify a newly created business flow as a target new business flow and ultimately trigger the subgraph construction event when the new business flow simultaneously meets the two conditions of "high business value" and "high resource impact".

[0076] Specifically, a time-sliding window can be pre-set, with its duration set (e.g., 1 to 5 seconds), meaning data within the most recent 1-5 seconds is always maintained. The sliding step size, i.e., the data update frequency, is set (e.g., 100 milliseconds). This can be understood as collecting snapshot data of all monitored nodes every 100 milliseconds and removing the oldest data to maintain the freshness of the data within the window. A fixed-length queue or circular buffer is maintained for each node to store its metrics at each time step within the window. For example, node A: [(t-4s, CPU=45%), (t-3s, CPU=50%),..., (t-now, CPU=85%)]. Basic load metrics and business and security metrics are continuously collected for the nodes. Basic load metrics can include CPU utilization, memory utilization, network interface throughput (pps, bps), and connection count. Business and security metrics can include specific protocol packet ratios (e.g., SYN / FIN / RST), request rate (QPS), HTTP error code ratio, and the count of suspicious behaviors matched by the rule engine.

[0077] At each sliding step (e.g., 100 milliseconds), the node status metric is checked to see if it exceeds a threshold, and the latest value, mean, variance, or deviation from the baseline model of the status metric within the window is calculated. The threshold type can be a static threshold, such as "CPU utilization > 80%" or "SYN packet percentage > 60%". Alternatively, a dynamic baseline can be used, such as the current value exceeding 3 standard deviations (the three standard deviations rule) compared to the normal level of the same period in history (e.g., the same time last week). This embodiment does not limit the threshold type. If any metric of any node exceeds the threshold, a subgraph construction event will be triggered immediately. In addition, high-speed traffic acquisition technologies such as NetFlow, sFlow, or DPDK can be used to detect newly established traffic sessions with high throughput or specific patterns in real time. When a new business flow that meets preset filtering rules (e.g., a new video conferencing connection or a large number of API requests) is detected to enter the network, subgraph construction is triggered even if the current node load is normal, in order to plan the path in advance and avoid potential congestion.

[0078] If triggered by a node anomaly, the anomaly node is designated as the root node. If triggered by a new service flow, the entry point device (such as a border gateway or load balancer) into the network for that service flow is designated as the root node. The global service topology knowledge base not only contains physical connections but also defines reachability based on business logic. For example, a "web server" can connect to a "database server" and a "Redis cache," but it must never directly connect to a "black hole route." Starting from the root node, a breadth-first search is performed in the service topology with a limited number of steps (e.g., 2-3 hops). During the search, real-time link status (obtained via LLDP, BGP-LS, or SDN controller) is used for filtering: only links with a status of "UP" are included, and nodes with extremely high current load (even if topologically connected) are excluded. All searched nodes and their valid edges form a subgraph. This subgraph is "sparse," containing only nodes directly related to the current event, not all network devices. For example, it could be a minimal path graph consisting of service nodes such as "anomaly gateway, available scrubbing center, backup firewall, and target service server."

[0079] In this embodiment, the continuity of state awareness is ensured by a time sliding window; the event triggering mechanism ensures that computing resources are only invested when necessary; and the BFS based on business topology ensures that the subgraph contains topological relationships, conforms to business logic, and is extremely small in size, enabling millisecond-level response.

[0080] Optionally, the temporal state data of each node in the dynamic local subgraph is encoded, and a temporal neural network model is used to extract the spatiotemporal feature vectors containing trend information corresponding to each node in the dynamic local subgraph, including:

[0081] Obtain the temporal state data of each node in the dynamic local subgraph, and construct the time series tensor corresponding to each node in the dynamic local subgraph;

[0082] The time series tensors corresponding to each node are input into the temporal neural network model, and the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph are output.

[0083] The temporal state data refers to the sequence of node states over time, such as CPU load, memory usage, network throughput, and the proportion of specific attack packets (e.g., SYN packet percentage) over the past N time steps. Specifically, CPU load and memory usage metrics can be collected by agents deployed on nodes, and network throughput and SYN packet percentage metrics can be collected through network traffic telemetry. Finally, high-frequency, timestamped aggregation and alignment are performed through a data pipeline. The temporal neural network model is either a Gated Recurrent Unit (GRU) or a Long Short-Term Memory (LSTM) network. A temporal neural network model can refer to a neural network that processes time-series data, such as a GRU or LSTM, capable of capturing temporal dependencies. Trend information refers to the directional pattern of data changes over time, such as an increasing or decreasing trend in CPU load. The spatiotemporal feature vector can refer to a numerical vector that simultaneously encodes the spatial attributes (positional relationship in the graph) and temporal dynamics (historical changes) of a node for subsequent graph inference. The node spatiotemporal feature vector can refer to the numerical vector generated after processing the temporal state data through a temporal neural network model (such as a GRU or LSTM). This vector simultaneously encodes the spatial attributes (positional relationships within the subgraph structure) and temporal dynamics (historical trends) of a node, which are used for subsequent inference in the graph neural network.

[0084] Specifically, a time window length N can be preset (e.g., N=10, meaning data from the most recent 10 time steps is taken). For each node in the dynamic local subgraph, its past N consecutive time steps (e.g., t...) are... -9 , t -8 The time-series state data of node A (t0, ..., t0) is extracted. This time-series state data is then constructed into a standard time-series tensor, typically of shape (N, D), where N is the time step and D is the feature dimension of each time step (e.g., D=4, representing four metrics: CPU, memory, throughput, SYN ratio, etc.). For example, the CPU load data sequence of node A over the last 10 time steps is [45%, 50%, 55%, 60%, 70%, 75%, 80%, 85%, 88%, 90%]. This sequence itself implies a trend of "continuously and rapidly increasing load."

[0085] The formatted temporal tensor is input into a temporal neural network model (GRU or LSTM). Both GRU and LSTM are variants of recurrent neural networks, adept at capturing long-term dependencies in time series. This embodiment does not limit the specific temporal neural network model. The model input is an (N, D) temporal tensor for each node. GRU / LSTM processes the sequence through its internal gating mechanisms (such as the update and reset gates of GRU).

[0086] The update gate determines how much past information the current state needs to retain. It linearly combines the hidden state from the previous time step (the trend of state changes of a node from the beginning of the sequence to the previous time step in a temporal neural network model) with the current input (real-time state indicators of the node at this specific time step, such as CPU load, SYN packet ratio, etc.), and then passes it through a Sigmoid (σ) activation function. The output is a vector between 0 and 1, where each value acts like the opening of a "memory valve." The closer the value is to 1, the more historical information is retained. For example, when CPU load has been steadily increasing over the past few time steps, the update gate learns this pattern and maintains a large opening, firmly remembering this long-term trend of "continuous increase," helping the temporal neural network model capture long-term dependencies, such as the trend of continuously rising CPU load.

[0087] The reset gate determines how much irrelevant past information needs to be ignored, and its calculation is similar to that of the update gate. Each value in this vector acts like a "forget switch." The closer the value is to 0, the more past information needs to be forgotten because it is irrelevant to the current situation. This allows temporal neural network models to flexibly ignore irrelevant old information and focus on recent important mutations, thus responding sensitively to sudden situations, such as a sudden surge in attack traffic.

[0088] Temporal neural network models are arranged in time step order (from t) -9 Process the sequence up to time t0. At each time step, combining the current input and the hidden state from the previous time step, a new hidden state is calculated using a gating mechanism. First, calculate the candidate hidden states:

[0089] Candidate state = tanh(W·[Reset door * previous hidden state, current input] + b);

[0090] Here, W can refer to the weight matrix; b can refer to the bias vector; W and b can be determined through pre-training of a temporal neural network model. A candidate state can refer to an attempt to combine past information filtered by the reset gate with the current input to generate a candidate state. The tanh activation function normalizes its value to between -1 and 1.

[0091] Updated to final hidden state:

[0092] Current hidden state = Update gate * Previous hidden state + (1 - Update gate) * Candidate state;

[0093] In this context, the update gate acts as a "fusion of old and new information"; if the update gate is close to 1, the new state is almost entirely composed of the old state, i.e., h t ≈h t-1This indicates that a large amount of historical information will be retained. If the update gate is close to 0, the new state is almost entirely composed of candidate states, i.e., h t The ≈candidate state indicates that the temporal neural network model has more confidence in the newly observed situation.

[0094] When a sequential neural network model (GRU / LSTM) processes the entire sequence of length N, the hidden state h0 of the last time step (t0) is used as the spatiotemporal feature vector of that node. h0 is not generated out of thin air, but rather from the initial state h0. _{-9} Initially, the final result is obtained after 10 iterations (assuming N=10) of computation and gating. Each iteration is a selective "memory" and "forgetting" of historical information. Therefore, the final hidden state encodes the dynamic change pattern of the sequence. For example, if the indicator continues to rise, the vector will contain an "increasing" trend. If the indicator fluctuates sharply, the vector will contain high variance information, reflecting an "unstable" or "sudden" pattern.

[0095] In this embodiment, by encoding the temporal state data of each node in the dynamic local subgraph and extracting spatiotemporal feature vectors containing trend information using a temporal neural network model, the original temporal index data of each node is successfully transformed into a low-dimensional, dense, and information-rich feature vector. This vector is no longer an isolated instantaneous value, but a predictive expression containing historical behavior and future trends. This enables subsequent graph neural networks to perform more intelligent and forward-looking relational reasoning and path planning based on the node's "state trend" rather than just its "current state," thereby significantly improving the accuracy and robustness of decision-making in highly dynamic attack environments.

[0096] Optionally, the spatiotemporal feature vectors are input into a graph neural network, and updated spatiotemporal feature vectors are output through node type embedding and risk sharpening aggregation, including:

[0097] Each of the aforementioned spatiotemporal feature vectors is input into a graph neural network. Through node type embedding, each of the aforementioned spatiotemporal feature vectors is concatenated with the corresponding type embedding vector to obtain an enhanced spatiotemporal feature vector.

[0098] A risk-aware sharpening aggregation function is used to update the enhanced spatiotemporal feature vector, resulting in the updated target spatiotemporal feature vector.

[0099] Here, "graph neural network" can refer to a heterogeneous graph attention network, a deep learning model used to process graph-structured data. "Node type embedding" can refer to a vectorization method representing the business function type of a node. By assigning unique type embedding vectors to nodes with different business functions, the graph neural network can distinguish heterogeneous nodes. "Risk sharpening aggregation" can refer to a custom graph neural network aggregation function used to highlight abnormal features during message passing and prevent feature dilution. A dual-channel mechanism is adopted: one channel uses average aggregation to process regular load features, and the other channel uses max pooling to process abnormal features. The updated spatiotemporal feature vector can refer to the output vector after processing by the graph neural network. Through node type embedding and risk sharpening aggregation mechanisms, it integrates its own features, neighbor node information, and business rule constraints. This vector retains the original spatiotemporal trend, enhances the saliency of abnormal signals, and reflects the heterogeneity of node functions, and is used for final path decision-making.

[0100] Specifically, the spatiotemporal feature vector is input into a heterogeneous graph attention network (GNN). This vector encodes the temporal state data and trends of nodes. Through node type embedding integrated into the GNN, the GNN distinguishes between different node functions (e.g., cleaning nodes require high computational resources, while black hole nodes only discard traffic), avoiding the misclassification of heterogeneous nodes. The node type embedding operation can involve predefining a global node type dictionary, for example, {"traffic monitoring device": 0, "cleaning device": 1, "black hole routing device": 2, ...}, where each node type corresponds to a unique integer index for subsequent lookup in the embedding layer. A trainable embedding layer is created, which is essentially a matrix of size (total number of node types, dimension of the embedding vector), where each row represents an embedding vector for a node type. Initially, the embedding vector for each type consists of randomly generated trainable parameters. For example, if the embedding vector dimension is 3, the embedding vector corresponding to "traffic monitoring device" could be E... type [0] = [0.1, -0.2, 0.5]; the embedding vector corresponding to "cleaning equipment" can be E. type [1]=[-0.3, 0.6, 0.0].

[0101] For each node in the dynamic local subgraph, the corresponding type index is retrieved from the dictionary based on its business function. t Inputting the index into the embedding layer yields the type embedding vector e. t The spatiotemporal feature vector h of this node. n Its type embedding vector e t Concatenation is performed to form an enhanced spatiotemporal feature vector h. i h i=CONCAT(h n ,e t ), that is, h i It includes both the dynamic state of the node ("how it is now"), such as real-time load and attack characteristics trends, and the static identity of the node ("what it is"), such as the immutable business functions of the node.

[0102] The message passing based on risk-aware sharpening aggregation is the core of graph attention networks, updating node features through multi-layer message passing (graph convolution). Specifically, a risk-aware sharpening aggregation function is used in the aggregation process of each layer of the graph attention network. First, attention coefficients are calculated. For the target node i (the node that needs to make path decisions in the dynamic local subgraph) and each of its neighboring nodes j (all nodes in the dynamic local subgraph that have direct edges connected to the target node), an attention coefficient e is calculated. ij This coefficient represents the importance of node j to node i. Standard Graph Attention Networks (GAT) use a learnable weight vector a to compute: e ij = a^T * [W * h i ||W * h j ||risk j ], where W is the weight matrix, and || denotes vector concatenation. j Let node j be a risk feature vector, such as a vector of abnormal indicators like the SYN packet ratio and CPU load. By concatenating these vectors, the risk feature vector is directly incorporated into the attention coefficient calculation. The attention coefficient can be used as a weight to determine how much information should be drawn from neighbor node j when aggregating neighbor information to update the features of target node i. This ensures that the model pays more attention to neighbors with high load and high anomalies when calculating attention.

[0103] A dual-channel mechanism is employed, classifying the spatiotemporal characteristics of all neighboring nodes into two categories for processing. Channel A serves as the background channel, handling routine load. Aggregation is achieved using mean pooling on routine load characteristics of neighboring nodes (such as base CPU, memory usage, and network throughput). This maintains the smoothness of the overall load information and helps in understanding the underlying network pressure. Channel B is the alert channel, handling anomalous characteristics. Aggregation is achieved using max pooling on anomalous characteristics of neighboring nodes (such as the proportion of SYN packets). This highlights the most significant anomalous signals among neighbors, rather than averaging them out. A learnable parameter λ (risk entropy weight) is introduced. This parameter can be adjusted based on the entropy value of node features. If a neighboring node j has very "pure" features (low entropy value), indicating significant high risk, λ automatically increases the weight of node j in the aggregation. This parameter λ can be understood as a sharpening filter, amplifying the impact of high-risk neighbors.

[0104] The aggregation results of the two channels are combined with the calculated attention coefficients and then passed through a non-linear activation function (such as LeakyReLU) to obtain a new feature representation h of the target node i. in After multiple layers of such message passing, the final feature h of each node... if Each is a rich representation, integrating its own functional type and state trends as well as those of its neighbors. Risks present in its neighbors are sharply highlighted, rather than diluted.

[0105] After multi-layer heterogeneous graph attention inference, we obtain a set of updated node feature vectors {h}. if The final feature vector, along with its numerical values ​​and the differences between them, encodes the relationships between nodes. For example, if the features of two complementary nodes (such as a monitoring node and a cleaning node) are "close" in the vector space, it indicates that they currently form an efficient path. If a node's features contain strong anomalous signals from a high-risk neighbor, the model will tend to avoid or handle that risk in subsequent decisions.

[0106] In this embodiment, business logic is injected into the model through node type embedding, resolving heterogeneity conflicts and ensuring that the model understands "functional complementarity" rather than "feature similarity." Risk-aware sharpening aggregation alters the smoothing characteristics of standard GNNs, accurately highlighting abnormal signals in mixed traffic and resolving the over-smoothing problem. The model outputs node representations with a deep understanding of the current network state and risk distribution, laying a solid foundation for making correct optimal path decisions in subsequent steps.

[0107] Optionally, the risk perception sharpening aggregation function employs a dual-channel aggregation mechanism, including:

[0108] The background channel is used to aggregate the regular load characteristics of neighboring nodes using the mean pooling aggregation method;

[0109] The alarm channel is used to aggregate the abnormal features of neighboring nodes by employing max pooling and combining risk entropy weight parameters.

[0110] Among them, the risk entropy weight parameter h is a learnable scalar parameter dynamically associated with the information entropy (i.e., "feature entropy") of the anomalous features of node j. Its core idea originates from the Entropy Weight Method, which uses information entropy to measure the uncertainty or information content of indicators (i.e., node anomalous features) and assigns weights accordingly. For example, firstly, for each neighboring node j, its anomalous feature vector h is calculated. ja（For example, information entropy (Shannon entropy) includes SYN ratio, UDP flood ratio, etc. Mathematical form: e j =-Σ(p k *log(p k )), where p k It is h ja The probability distribution obtained after normalizing (e.g., using softmax) the k-th eigenvalue of a vector. Entropy value e j The value range is [0, log(K)] (where K is the feature dimension). Its physical meaning is the entropy value e. j The smaller the value, the more "pure" or "extreme" the anomalous characteristics of node j (e.g., a very high proportion of a certain type of attack traffic), the clearer the risk information it contains, and the lower the uncertainty. Therefore, it should be given a higher weight. The risk entropy weight λ... j It is e j The monotonically decreasing function ensures that low-entropy (high-risk) nodes receive high weights. A typical and simple mapping relationship is λ. j =(1-e j ) / Σ_{k∈N(i)} (1 - e k (Normalized form). Or, to introduce stronger nonlinear fitting capabilities, λ j It can also be a learnable function implemented by a small neural network (such as a single-layer MLP): λ j = MLP(1-e j ). Ultimately λ j ∈ (0, 1), and when the anomalous feature entropy e of node j j The lower the value, the better. j The larger.

[0111] Specifically, for a target node i, there are feature vectors for all its neighboring nodes j ∈ N(i). Each neighboring node's feature vector contains multiple dimensions (such as CPU load, memory utilization, SYN packet ratio, etc.). Feature channels are divided. Background features primarily select indicators representing normal, baseline load, such as CPU utilization, memory utilization, and network throughput. These features reflect the node's basic operational pressure. Alert features primarily select indicators representing potential risks or anomalies, such as the SYN packet ratio. This feature is a key signal for attack detection. For example, a neighboring node's feature vector [CPU=85%, MEM=60%, SYN_Ratio=70%], where [CPU, MEM] can be classified as background features, [SYN_Ratio=70%] as background features, [CPU, MEM] as background features, [SYN_Ratio=70%] as background features, [SYN_Ratio=70%] as background features, [MEM ...MEM] as background features, [SYN_Ratio=70%] as background features, [MEM] as background features, [MEM] as background features, [SYN_Ratio=70%] as background features, [MEM] as background features, [MEM] as background features, [MEM] as background features, [ R This can be classified as an alarm feature.

[0112] The two channels operate independently, employing different aggregation strategies to handle different types of features. The background channel (using mean pooling) aims to smoothly integrate the overall load of neighboring nodes to obtain the local average pressure level of the network. Specifically, it calculates the element-wise mean (MeanPooling) of the "background features" of all neighboring nodes, resulting in a stable background feature vector representing the average load of the region. For example, if the target node is the ingress gateway i, and the neighboring nodes are cleaning center j1 (70% normal load, 5% SYN packet ratio, low risk) and firewall j2 (50% normal load, 80% SYN packet ratio, high risk), then its background feature = Mean(70%, 50%) = 60%, yielding the regional average load level (60%), reflecting the basic pressure of the network, and this result is smooth.

[0113] The alert channel (using max pooling combined with risk entropy weights) aims to highlight the most significant anomalous signals among neighboring nodes, achieving "sharpening." Specifically, it first performs max pooling, calculating the element-wise maximum value for the "alert features" of all neighboring nodes. For example, Max(5%, 80%) = 80%, directly identifying the most significant anomalous signal (from j2). Second, it calculates the feature entropy, i.e., for each neighboring node j, its information entropy (Shannon entropy) is calculated based on its alert features (in practical applications, this is not limited to the SYN packet ratio but can also include the UDP Flood ratio, CC attack ratio, etc.). The lower the entropy value, the more "pure" or "abnormal" the node's feature distribution, i.e., the more significant the risk. For example, j2 has a SYN packet ratio as high as 80%, resulting in an extremely low entropy value. Finally, it applies the risk entropy weight parameter (λ), a parameter automatically learned during model training. It dynamically adjusts the importance of a node in the aggregation based on the entropy value of its neighboring node features. λ is negatively correlated with entropy; for neighboring nodes with low entropy values ​​(high risk), λ assigns them greater weight. For example, λ j Instead of being pre-calculated static weights, they are automatically optimized through backpropagation during end-to-end supervised learning, serving as part of the trainable parameters of the STR-GNN model. The training process for the risk entropy weight parameter (λ) specifically includes:

[0114] Forward propagation: In each layer (or each message pass), the model calculates the feature entropy e based on the features of the current node. j Thus, the weight λ is obtained. j .

[0115] Loss calculation: The model calculates the loss (e.g., cross-entropy loss) based on the final node representation (e.g., for classification).

[0116] Backpropagation and parameter update: The loss gradient passes through the entire network (including the calculation of λ). j The function or parameters are backpropagated. The gradient guides the backpropagation of λ. j The learning direction is adjusted automatically to more effectively amplify the signals of high-risk neighbor nodes that contribute the most to the final anomaly detection task.

[0117] The training objective is to enable the model to adaptively learn that when aggregating neighbor information, nodes with low feature entropy (i.e., significant attack features) should be given higher attention (larger λ). j This allows for the "sharpening" perception of weak but critical anomalous signals.

[0118] The aggregation results of the two channels are merged to update the features of the target node. The background channel output... , where is the output of the background channel, and is the weighted average of the regular load characteristics of all neighboring nodes of target node i; α ij The standardized attention coefficient (obtained via softmax), h jb The regular load feature vector of neighbor node j. It includes metrics such as CPU load, memory utilization, and basic network throughput. Calculate the weighted anomaly features for each neighbor node: Weighted Features j =λ j * h ja ; where λ j Based on the above, the feature entropy e j The mechanism generates this. The sharpening characteristics of the alarm channel output. , where h aw The output of the alarm channel is N(i), which represents the set of neighboring nodes of node i, and λ. j h represents the risk entropy weight. ja The abnormal feature vector of neighbor node j. It includes security indicators such as the proportion of SYN packets, UDP flood proportion, and CC attack proportion. Among them, max pooling itself has the "winner-takes-all" characteristic, which can directly extract the most significant signals.

[0119] Entropy weight λ j Before pooling, the signal is preprocessed to amplify the abnormal feature values ​​of nodes with low feature entropy (high risk). This gives the real risk sources an advantage in the pooling competition, even if their original feature values ​​are not the largest, they may still win due to being amplified by λ_j.

[0120] The aggregation results of the two channels are merged and concatenated or weighted to form the final aggregated neighbor information Ha, where Ha = COMBINE(h b , h awThe aggregated neighbor information Ha is combined with the features of the target node i itself, and the updated feature representation of node i is obtained through a learnable weight matrix and a nonlinear activation function (such as ReLU).

[0121] ;

[0122] in, The updated spatiotemporal feature vector of the target node i. Let σ be the feature vector of the target node i itself, σ be the nonlinear activation function σ (such as ReLU), W be the learnable weight matrix, and b be the bias.

[0123] In this embodiment, stable load characteristics and sudden anomaly characteristics of nodes are processed separately through signal separation to avoid mutual interference. Mean pooling is used to maintain awareness of the overall network state. Max pooling is used to capture extreme values, and the contribution of high-risk neighbors is dynamically amplified through learnable risk entropy weight parameters, so that weak attack characteristics are preserved and enhanced during message passing, rather than being "averaged out". This ensures that the model can sensitively identify abnormal traffic in high-concurrency mixed attacks, thereby providing an accurate and reliable basis for subsequent path decisions.

[0124] In step S140, based on the target spatiotemporal feature vector, a preliminary probability distribution for the next node is generated, filtered based on a predefined business rule mask, and an optimal path orchestration instruction is output, including:

[0125] Based on the target spatiotemporal feature vector, a preliminary probability distribution of the next-hop node is generated through a fully connected layer and an activation function.

[0126] Based on a predefined business rule mask, the preliminary probability distribution is filtered to obtain the target probability distribution;

[0127] Based on the normalized target probability distribution, the optimal path orchestration instructions are generated.

[0128] The business rule mask is a matrix, predefined based on compatibility rules between node types and business protocols. This matrix is ​​used to filter out invalid paths that direct traffic to incompatible nodes during decoding. The next-hop node can refer to the next business node traffic should be directed from the current node. The preliminary probability distribution can refer to the probability value of each possible next-hop node, representing the recommendation bias. The predefined business rule mask can refer to a matrix or rule set defining compatibility between node types; for example, a TCP cleaning node cannot handle UDP traffic, used to filter invalid paths. Business logic constraints can refer to rule restrictions on the business chain, ensuring path functionality is feasible. The optimal path orchestration instruction can refer to the final decision path command, such as directing traffic from gateway A to cleaner B.

[0129] Specifically, the feature vector of the target node is input into a fully connected layer, followed by a softmax activation function. The fully connected layer maps the high-dimensional feature vector to a vector with a dimension equal to the number of candidate next-hop nodes. The softmax function transforms this vector into a probability distribution. The value of each element in the distribution represents the raw probability predicted by the model of directing traffic to the corresponding neighbor node. This yields a preliminary probability distribution vector P. initial For example, for the current gateway, its neighbors include scrubbing center A, firewall B, and backup path C. The model might output: P initial =[P A =0.7,P B =0.2,P C =0.1]. This indicates that the model, based on real-time load and attack characteristics, strongly favors sending traffic to scrubbing center A.

[0130] Load the Business Logic Mask Matrix, a predefined, static two-dimensional matrix typically manually configured by the network architect according to business specifications. Its rows and columns index different node types. Each element in the matrix has a value of 0 or 1. Mask[i,j] = 1: This indicates that a jump from a node of type i to a node of type j is allowed by the business logic. For example, a jump from "Traffic Monitoring Device" (type i) to "TCP Cleaning Device" (type j) is allowed. Mask[i,j] = 0: This indicates that such jumps are prohibited. For example, a direct jump from "Traffic Monitoring Device" (type i) to "Business Server" (type j) may be prohibited (it must first undergo cleaning); or, directing UDP traffic (characteristics of the current session) to a "TCP-only cleaning node" (type j) is also prohibited.

[0131] Determine the type of the current decision node (i.e., the target node) and the protocol type of the current traffic. Extract a row mask vector M corresponding to the current decision node type from the business rule mask matrix. This vector indicates which types of next-hop nodes are legally reachable from this type of node. Then, use the initial probability distribution vector P... initial Multiply element-wise with the mask vector M. masked = P initial In node M, the probability of all paths prohibited by business rules (corresponding to positions 0 in M) will be forcibly set to zero. The probability of legal paths remains unchanged. For example, assume the current node is a "traffic monitoring device" and the traffic is UDP. P initial =[TCP cleaning node: 0.7, UDP cleaning node: 0.2, Black hole: 0.1]. The business rule mask stipulates that UDP traffic cannot be directed to TCP cleaning nodes. Therefore, the mask vector M = [TCP cleaning node: 0, UDP cleaning node: 1, Black hole: 1]. After filtering: P masked = [0, 0.2, 0.1], the originally most recommended TCP cleaning node was effectively blocked.

[0132] The probability distribution P_masked after masking is renormalized (because the sum of probabilities may no longer be 1) to ensure it remains a valid probability distribution. Then, the path with the highest probability is selected as the final optimal choice. For example, after renormalization, P... final =[UDP scrubbing node: 0.67, Blackhole: 0.33]. Therefore, the optimal next hop is the UDP scrubbing node. The system doesn't just output a node name; instead, it generates a specific path orchestration instruction that can be executed by the network controller (such as an SDN controller). The instruction typically includes flow entry rules, such as: "Modify the next-hop address of UDP packets from source IP X, destination IP Y, and forward them to node Z (the IP address of the UDP scrubbing node)." This instruction is sent to the corresponding network devices in real time, dynamically changing the traffic path and achieving adaptive defense scheduling.

[0133] In this embodiment, the ability of a Generative Neural Network (GNN) to perceive complex network states is utilized in the form of a preliminary probability distribution. Through business rule masking, it ensures that all output paths are 100% consistent with business logic, fundamentally avoiding the error of directing traffic to nodes with mismatched functions. Closed-loop control is achieved, and the final output is an immediately executable network command, completing a fully automated closed loop from "perception-analysis-decision-execution." This enables intelligent, accurate, and compliant dynamic defense against complex hybrid attacks within milliseconds. A global business topology knowledge base is constructed by storing the static attributes, types, and predefined business flow rules of all business nodes, providing a basic framework for subsequent dynamic path optimization. This ensures that path planning always conforms to business logic constraints during real-time monitoring and subgraph construction, avoiding directing traffic to nodes with mismatched functions or incompatible protocols. This significantly improves the decision-making accuracy, business compliance, and overall reliability of the defense system, laying a static data foundation for millisecond-level adaptive optimization.

[0134] Example 3: Figure 2 This is a framework diagram of a dynamic optimization system for complex business process paths based on graph neural networks, provided in Embodiment 3 of the present invention. Figure 2 As shown, the system includes:

[0135] The construction module 210 is used to build a global business topology knowledge base based on business requirements. The knowledge base stores the static attributes, types, and allowed business flow rules between all business nodes corresponding to the business requirements.

[0136] The monitoring module 220 is used to monitor the status of each business node in real time. When a node abnormality or a new business flow is detected, a dynamic local subgraph is constructed based on the global business topology knowledge base.

[0137] The feature extraction module 230 is used to extract the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph based on the temporal state data of each node in the dynamic local subgraph through a temporal neural network model.

[0138] The update module 240 is used to input each of the spatiotemporal feature vectors into the graph neural network, and output the updated target spatiotemporal feature vector through node type embedding and risk sharpening aggregation.

[0139] The generation module 250 is used to generate a preliminary probability distribution of the next-hop node based on the target spatiotemporal feature vector, filter it based on a predefined business rule mask, and output the optimal path orchestration instruction.

[0140] The system for dynamic optimization of complex business process paths based on graph neural networks provided in this invention can execute the method for dynamic optimization of complex business process paths based on graph neural networks provided in any embodiment of this invention, and has the corresponding functional modules and beneficial effects of the method.

[0141] Example 4: Figure 3 A schematic diagram of an electronic device 10, which can be used to implement embodiments of the present invention, is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0142] like Figure 3 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., which is communicatively connected to the at least one processor 11. The memory stores a computer program that can be executed by the at least one processor 11, and the computer program is executed by the at least one processor 11 to enable the at least one processor 11 to perform the method provided by the present invention.

[0143] The processor 11 can perform various appropriate actions and processes based on a computer program stored in the read-only memory (ROM) 12 or a computer program loaded from the storage unit 18 into the random access memory (RAM) 13. The RAM 13 can also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0144] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0145] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 executes the various methods and processes described above, such as dynamic optimization methods for complex business process paths based on graph neural networks.

[0146] In some embodiments, the graph neural network-based dynamic optimization method for complex business process paths can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the graph neural network-based dynamic optimization method for complex business process paths described above can be performed. Alternatively, in other embodiments, processor 11 can be configured to execute the graph neural network-based dynamic optimization method for complex business process paths by any other suitable means (e.g., by means of firmware).

[0147] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard parts (ASSPs), systems-on-chip (SoCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0148] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0149] In the context of this invention, a computer-readable storage medium stores computer instructions that, when executed by a processor, implement the graph neural network-based dynamic optimization method for complex business process paths provided by this invention. The computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. The computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, the computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0150] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device for displaying information to the user (e.g., a cathode ray tube (CRT) or a liquid crystal display (LCD monitor)); and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0151] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0152] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is established by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system. It addresses the shortcomings of traditional physical hosts and Virtual Private Server (VPS) services, such as high management difficulty and weak business scalability.

[0153] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0154] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for dynamic optimization of complex business process paths based on graph neural networks, characterized in that, include: Based on business requirements, a global business topology knowledge base is constructed, wherein the global business topology knowledge base stores the static attributes, types, and allowed business flow rules between all business nodes corresponding to the business requirements. The status of each business node is monitored in real time. When a node abnormality or a new business flow is detected, a dynamic local subgraph is constructed based on the global business topology knowledge base. Based on the temporal state data of each node in the dynamic local subgraph, a temporal neural network model is used to extract the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph. The spatiotemporal feature vectors of each node are input into a graph neural network, and the updated target spatiotemporal feature vectors are output through node type embedding and risk sharpening aggregation. Based on the updated target spatiotemporal feature vector, a preliminary probability distribution of the next-hop node is generated, filtered based on a predefined business rule mask, and the optimal path orchestration instruction is output. The predefined business rule mask is in matrix form, with rows and columns indexing different node types. Each element in the matrix has a value of 0 or 1. The matrix is ​​predefined based on node type and business protocol compatibility and is used to prevent traffic from being directed to a next-hop node that is functionally incompatible or logically disallowed during the decoding phase.

2. The method of claim 1, wherein, The real-time monitoring of the status of each business node, when a node anomaly or a new business flow is detected, constructs a dynamic local subgraph based on the global business topology knowledge base, including: Based on a preset time sliding window, the node status and newly created business flows are monitored in real time. When a node anomaly is detected or a new business flow is created, a subgraph construction event is triggered. A new business flow is created based on the abnormal node or the target, the root node is determined, and a dynamic local subgraph is constructed based on the root node and the global business topology knowledge base.

3. The method according to claim 1, characterized in that, Based on the temporal state data of each node in the dynamic local subgraph, a temporal neural network model is used to extract the spatiotemporal feature vectors containing trend information corresponding to each node in the dynamic local subgraph, including: Obtain the temporal state data of each node in the dynamic local subgraph, and construct the time series tensor corresponding to each node in the dynamic local subgraph; The time series tensors corresponding to each node are input into the temporal neural network model, and the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph are output.

4. The method according to claim 1, characterized in that, The spatiotemporal feature vectors of each node are input into a graph neural network. Through node type embedding and risk sharpening aggregation, the updated target spatiotemporal feature vector is output, including: The spatiotemporal feature vectors of each node are input into the graph neural network. By embedding the node type, the spatiotemporal feature vectors of each node are concatenated with the corresponding type embedding vector to obtain the enhanced spatiotemporal feature vector. A risk-aware sharpening aggregation function is used to update the enhanced spatiotemporal feature vector, resulting in the updated target spatiotemporal feature vector. The risk perception sharpening aggregation function refers to a custom graph neural network aggregation function used to highlight abnormal features during message transmission and avoid feature dilution. The risk perception sharpening aggregation function adopts a dual-channel aggregation mechanism.

5. The method according to claim 4, characterized in that, The risk perception sharpening aggregation function employs a dual-channel aggregation mechanism, including: The background channel is used to aggregate the regular load characteristics of neighboring nodes using the mean pooling aggregation method; The alarm channel is used to aggregate the abnormal features of neighboring nodes by employing max pooling and combining risk entropy weight parameters.

6. The method according to claim 1, characterized in that, Based on the target spatiotemporal feature vector, a preliminary probability distribution of the next-hop node is generated, filtered based on a predefined business rule mask, and an optimal path orchestration instruction is output, including: Based on the target spatiotemporal feature vector, a preliminary probability distribution of the next-hop node is generated through a fully connected layer and an activation function. Based on a predefined business rule mask, the preliminary probability distribution is filtered to obtain the target probability distribution; Based on the normalized target probability distribution, the optimal path orchestration instructions are generated.

7. A dynamic optimization system for complex business process paths based on graph neural networks, characterized in that, The system is used to execute the dynamic optimization method for complex business process paths based on graph neural networks as described in any one of claims 1-6, comprising: The construction module is used to build a global business topology knowledge base based on business requirements. The global business topology knowledge base stores the static attributes, types, and allowed business flow rules between all business nodes corresponding to the business requirements. The monitoring module is used to monitor the status of each business node in real time. When a node abnormality or a new business flow is detected, a dynamic local subgraph is constructed based on the global business topology knowledge base. The feature extraction module is used to extract the spatiotemporal feature vectors containing trend information of each node in the dynamic local subgraph based on the temporal state data of each node in the dynamic local subgraph through a temporal neural network model. The update module is used to input the spatiotemporal feature vectors of each node into the graph neural network, and output the updated target spatiotemporal feature vector through node type embedding and risk sharpening aggregation. The generation module is used to generate a preliminary probability distribution of the next-hop node based on the updated target spatiotemporal feature vector, filter it based on a predefined business rule mask, and output the optimal path orchestration instruction. The predefined business rule mask is in matrix form, with its rows and columns indexing different node types. Each element in the matrix has a value of 0 or 1. The matrix is ​​predefined based on the compatibility of node types and business protocols and is used to prevent traffic from being directed to next-hop nodes that are functionally incompatible or logically disallowed during the decoding phase.

8. An electronic device, characterized in that, include: At least one processor; as well as A memory communicatively connected to the at least one processor; wherein, The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to execute the method for dynamic optimization of complex business process paths based on graph neural networks as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that cause a processor to execute the method for dynamic optimization of complex business process paths based on graph neural networks as described in any one of claims 1-6.

Images