AI-driven threat intelligent studying and judging system based on multi-modal data processing and knowledge graph

Abstract

The invention provides an AI-driven threat intelligent research and judgment system based on multi-modal data processing and a knowledge graph, and the system comprises a data sensing module which collects multi-modal original data at an operation site of a power system; the semantic identification module is used for performing feature extraction, intra-modal coding and cross-modal semantic alignment to obtain a high-dimensional vector representation set; the knowledge representation module is used for constructing a knowledge graph, a knowledge representation set and an index corresponding relation; the threat representation module fuses the high-dimensional vector representation set and the knowledge representation set to obtain a threat comprehensive representation vector; and the threat research and judgment module is used for constructing an AI research and judgment model, outputting a threat numerical value research and judgment result, and searching an interpretable threat semantic chain in the knowledge graph to obtain a final research and judgment result. According to the method, the integrated threat research and judgment capability of the system is greatly improved, the interpretability of knowledge driving and the adaptivity of deep learning can be considered, and a multi-dimensional reliable detection result can be obtained through one-time reasoning.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of electric power safety protection, and particularly relates to an AI-driven threat intelligent research and judgment system based on multi-modal data processing and a knowledge graph. BACKGROUND

[0002] With the rapid construction of smart grids and energy internet, the power system has gradually evolved from a traditional closed control network into an open network-physical integrated system. The system integrates dispatch automation, relay protection, state monitoring, communication control, and Internet of Things sensing layer devices, etc. The expansion of network scale and the openness of information flow make the power system a key target of network attacks. Attack behaviors are becoming increasingly diversified, concealed, and intelligent, and security threats are showing cross-modal, multi-stage, and sustainable characteristics.

[0003] In the research of dealing with complex threats from multiple sources, multi-modal data fusion technology has gradually attracted attention. Researchers attempt to input network traffic, logs, text, images, and sensor signals into the model together, and perform feature extraction and fusion analysis through deep learning. This method has achieved certain results in improving detection accuracy, but there are still two key problems: first, the semantic consistency between modalities is difficult to guarantee, and the fused features have information redundancy or conflict; second, the model lacks explainability and cannot combine domain knowledge for high-level reasoning and causal judgment.

[0004] On the other hand, knowledge graph technology has shown good explainability advantages in power operation and security analysis. The knowledge graph takes entities and their relationships as the core, and can depict the association between power devices, network nodes, vulnerabilities, attack types, and defense strategies, providing semantic support for threat identification. For example, by establishing a "device-vulnerability-attack-response strategy" chain, the model can assist in reasoning the propagation path and possible impact of threats. However, the current knowledge graph is mostly used for static event analysis or fault location, and has not been combined with dynamic multi-modal data, making it difficult to play a role in real-time threat detection.

[0005] In summary, the existing multi-modal analysis and knowledge graph reasoning technology still has obvious deficiencies in the field of power safety: 1) Lack of depth in fusion. Most existing systems use simple feature splicing, which lacks cross-modal semantic alignment and feature complementarity; 2) Lack of knowledge-driven. Knowledge graphs are mostly used for post-analysis rather than real-time reasoning, resulting in a lack of semantic enhancement support for AI models; 3) Mostly single-modal or weak multi-modal, lacking unified semantic modeling: detection models are built based on network traffic or logs alone, lacking close association with physical measurements and video surveillance. Even if multi-modal is used, it is mostly "simple feature splicing", lacking strict time alignment, semantic alignment, and unified spatial modeling; 4) Single detection result, unable to provide type, stage, risk, and impact range simultaneously. Many security detection systems only output "whether attacked" or a simple risk score; attack type, attack stage, and affected device range often require manual analysis and inference. SUMMARY

[0006] To overcome the deficiencies of the prior art, the purpose of the present application is to provide an AI-driven threat intelligent judgment system based on multi-modal data processing and knowledge graph, which not only greatly improves the integrated threat judgment capability of the system, but also takes into account the explainability of knowledge-driven and the adaptability of deep learning, and outputs reliable detection results in multiple dimensions at a time.

[0007] To achieve the above-mentioned purpose, the present application provides the following scheme: an AI-driven threat intelligent judgment system based on multi-modal data processing and knowledge graph, comprising: a data perception module for collecting multi-source data in the operating field of the power system, performing basic preprocessing on the multi-modal raw data, and obtaining multi-modal raw data; a semantic identification module for feature extraction, intra-modal encoding, and cross-modal semantic alignment based on the multi-modal raw data, obtaining a high-dimensional vector representation set in the same semantic space; a knowledge representation module for constructing a knowledge graph in combination with power safety domain knowledge, constructing a knowledge representation set based on the knowledge graph, and constructing an index correspondence relationship between the high-dimensional vector representation set and the knowledge representation set; a threat representation module for fusing the high-dimensional vector representation set and the knowledge representation set according to the index correspondence relationship, obtaining a threat comprehensive representation vector; a threat judgment module for constructing an AI judgment model using the threat comprehensive representation vector, outputting a threat numerical judgment result using the AI judgment model, searching for an interpretable threat semantic chain corresponding to the threat numerical judgment result in the knowledge graph, and obtaining a final judgment result in combination with the interpretable threat semantic chain and the threat numerical judgment result; The data perception module, the semantic identification module, the knowledge representation module, the threat representation module and the threat judgment module are connected with each other.

[0008] Optionally, the data perception module comprises: a data acquisition unit configured to acquire network communication data, system log and audit record data, time series operation measurement data and image and video data based on an electric power system operation site, to obtain multi-source data, and to design different acquisition interfaces and secure transport channels for different types of data in the multi-source data; a data unification unit configured to perform unified timestamp marking, unified identification system establishment and original data format packaging based on the multi-source data, to obtain a standardized data set; a quality control unit configured to eliminate missing and loss data, filter abnormal noise data, and check data integrity and continuity based on the standardized data set, to obtain multi-modal original data.

[0009] Optionally, the semantic identification module comprises: a sample recombination unit configured to perform data aggregation according to a time window based on the multi-modal original data, to define each time window as a multi-modal subset, and to fuse all the multi-modal subsets into a multi-modal sample set; wherein the multi-modal subset comprises a network subset, a log subset, a time series subset and a visual subset; a feature representation unit configured to perform feature extraction and coding on the network subset, the log subset, the time series subset and the visual subset respectively, to obtain a feature vector set; the feature vector set comprises network feature representation, log feature representation, time series feature representation and visual feature representation; a feature unification unit configured to map feature representations of different modalities to a same-dimensional semantic vector space by using a transformation network based on the feature vector set, to perform semantic alignment, to obtain an intermediate vector set, to aggregate all the intermediate vector sets of each sample, to obtain a unified semantic vector, and to arrange and combine the unified semantic vector, to obtain a high-dimensional vector representation set.

[0010] Optionally, the feature representation unit comprises: a first feature extraction unit configured to perform one-hot coding on discrete fields, normalization processing on numerical value fields based on the network subset, to connect field vectors of each message to form a single message vector, to concatenate the single message vector into a message sequence, to perform time series correlation and pattern feature extraction on the message sequence, and to compress the message sequence into a fixed-length network modal feature vector through a pooling operation or an attention mechanism, to obtain network feature representation; The second feature extraction unit is configured to perform word segmentation, stop word removal, and word sequence conversion on the text based on the log subset to obtain processed text, map each word in the processed text to a vector representation to obtain a word vector sequence, perform sequence modeling on the word vector sequence in each log to obtain an overall vector representation, and aggregate all the overall vector representations to obtain a log feature representation. The third feature extraction unit is configured to perform physical quantity normalization processing and abnormal value screening based on the time series subset to obtain a multi-dimensional time series, input the multi-dimensional time series into a time series modeling network, learn a typical mode of power change over time, and perform pooling on the output of the entire time window to obtain a time series feature representation. The fourth feature extraction unit is configured to extract multi-level spatial features of each frame of image using a visual self-attention network based on the visual subset, perform global average pooling on a high-level feature map of the multi-level spatial features to obtain a frame vector representation of each frame of image, and aggregate all the frame vector representations in a time sequence or according to content similarity to obtain a visual feature representation.

[0011] Optionally, the knowledge representation module comprises: The entity and relationship unit is configured to determine entity types and relationship types in combination with power safety field knowledge, perform entity extraction and relationship extraction, and construct triplets according to the extracted entities and relationships. The graph embedding unit is configured to construct a graph structure based on the entities, the relationships, and the triplets, perform vector initialization on the entities and the relationships to obtain a knowledge graph, perform multi-layer propagation and feature aggregation on the knowledge graph using a graph neural network to obtain a final embedding vector of each entity in a high-dimensional space, and fuse all the final embedding vectors to obtain a knowledge representation set. The knowledge association unit is configured to construct an index correspondence relationship between the high-dimensional vector representation set and the knowledge representation set.

[0012] Optionally, the entities comprise device class entities, network node class entities, software and service class entities, vulnerability and weak electricity class entities, attack behavior class entities, security event class entities, and defense strategy class entities, and the relationships comprise structure class relationships, vulnerability class relationships, attack path class relationships, defense strategy class relationships, and business impact class relationships.

[0013] Optionally, the threat representation module comprises: The knowledge enhancement unit is configured to obtain an associated knowledge vector in the set of high-dimensional vector representations according to the index correspondence and the set of knowledge representations, introduce attention weights to perform weighted summation on the associated knowledge vector to obtain a sample-level knowledge representation, and perform weighted fusion of the sample-level knowledge representation and the set of high-dimensional vector representations to obtain a knowledge-enhanced sample representation; The comprehensive representation unit is configured to perform feature splicing fusion of the knowledge-enhanced sample representation and the set of knowledge representations to obtain a threat comprehensive representation vector.

[0014] Optionally, the threat research and judgment module comprises: The model construction unit is configured to design a multi-task neural network structure comprising an input layer, a shared hidden layer, and a task-specific output layer, define outputs of each sub-task based on the multi-task neural network structure to obtain an initial research and judgment model; The model training unit is configured to design a loss function of each sub-task, perform weighted fusion of the loss functions of the tasks to obtain a total loss function, train the initial research and judgment model based on the total loss function using the threat comprehensive representation vector to obtain an AI research and judgment model, and output a sample-level threat numerical research and judgment result using the AI research and judgment model; The explainable unit is configured to search for paths reflecting security event causal logic in the knowledge graph using a graph search algorithm based on predefined start and end entities, set a maximum path length to obtain a plurality of candidate paths, perform path scoring based on path length, entity importance, and current sample feature similarity, select a plurality of paths with the highest scores to obtain an explainable threat semantic chain, and fuse the explainable threat semantic chain and the threat numerical research and judgment result to obtain a final research and judgment result.

[0015] Optionally, the model construction unit comprises: The input layer is configured to receive the threat comprehensive representation vector and transmit the threat comprehensive representation vector to the shared hidden layer; The shared hidden layer is configured to perform feature processing on the threat comprehensive representation vector using a plurality of layers of fully connected transformation and non-linear activation to obtain a shared hidden representation; The task-specific output layer is configured to define an attack type identification output head, an attack phase identification output head, a risk level evaluation output head, and a multi-label prediction output head.

[0016] Optionally, the attack type identification output head is configured to calculate prediction scores of different attack types based on the shared hidden representation, and perform normalization on the prediction scores to obtain an attack type probability distribution; The attack stage identification output head is configured to, based on the shared hidden representation, predefine an attack stage number, calculate probability estimates of different time sequence stages based on the attack stage number, and obtain attack stage probabilities; The risk level evaluation output head is configured to, based on the shared hidden representation, output a high risk level, a medium risk level, or a low risk level. The multi-label prediction output head is configured to, based on the shared hidden representation, output an impact score of a corresponding device or a corresponding area, and compress the impact score to between 0 and 1 by using a component-wise logical function to obtain an object impact score vector.

[0017] The present application provides an AI-driven threat intelligent research and judgment system based on multi-modal data processing and knowledge graph, and discloses the following technical effects: 1. End-to-end, multi-modal, cross-level integrated threat research and judgment capability: 1) Data is collected from the field collection network, logs, time sequence, and video, and is finally converted into a unified semantic vector after unified processing and quality control. 2) In the same system, both IT layer (network, host log) and OT layer (power equipment time sequence measurement, monitoring picture) are considered to realize panoramic research and judgment of cross-level security situation.

[0018] 2. Hybrid intelligent architecture driven by data and knowledge: 1) Multi-modal deep features ensure the learning ability of complex data patterns. 2) Knowledge graph and graph neural network embedding embed explicit knowledge in the power safety field, such as device structure, attack path, and defense strategy, into the model representation. 3) Through knowledge enhancement and comprehensive representation module, data features and knowledge prior are organically integrated to realize a research and judgment mechanism with learning ability and reasoning ability.

[0019] 3. Support multi-task joint research and judgment, high information utilization efficiency: 1) One shared representation drives multiple output tasks: attack type, attack stage, risk level, and multi-label impact score; shared feature representation avoids data waste and inconsistent results caused by modeling each task separately. 2) Multi-task loss weighting training enhances the model's understanding of the overall security situation and improves comprehensive detection and evaluation capabilities.

[0020] 4. Strong explainability and traceability: 1) Through path search and scoring in the knowledge graph, an explainable threat semantic chain is generated: one or more logical paths from attack entry, key device, vulnerability exploitation to business impact are given. 2) Combining semantic chain and numerical results meets the decision-making needs of the technical layer and the requirements of audit, supervision, or post-mortem.

[0021] 5. Strong scalability and practicality: 1) The data perception module can access more modalities as needed for business operations, such as alarm work orders and maintenance voice recordings, requiring only the extension of feature extraction processing in the semantic identification module. 2) The knowledge graph can be continuously updated (adding entities and relationships), and the AI ​​model can be fine-tuned periodically, forming a self-learning and self-evolving security assessment system.

[0022] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 This is a schematic diagram of the system architecture provided in an embodiment of the present invention; Figure 2 A schematic flowchart illustrating threat representation provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the final threat assessment process provided in an embodiment of the present invention. Detailed Implementation

[0025] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0027] like Figure 1 As shown, this invention provides an AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs, comprising: 1. Data Sensing Module like Figure 2 As shown, this is used to collect multi-source data at the power system operation site, and to perform basic preprocessing on the multimodal raw data to obtain multimodal raw data; the data sensing module includes: 1.1 Data Acquisition Unit The application is used for collecting network communication data, system log and audit record data, time series operation measurement data and image and video data based on power system operation site, obtaining multi-source data, and designing different collection interfaces and safe transportation channels for different types of data in the multi-source data.

[0028] The network communication data includes communication data in dispatch data network, production control area, station control layer network, interval layer network, process layer network and business private line or virtual private network interacting with third party platform. The data source can be switch, router, firewall, intrusion detection device, industrial security gateway, network probe and the like.

[0029] The system log and audit record data includes operating system log, application system log, security device log, database audit log, operation and maintenance and dispatch operation audit record and the like. The data source can be dispatch automation master station system, substation integrated automation system, energy management system, power distribution management system, fire control monitoring system, security monitoring system and the like.

[0030] The time series operation measurement data includes time series measurement data from monitoring and data acquisition system, synchronous phasor measurement unit, protection and automation device, intelligent electric meter and various sensors. Typical measurement includes voltage, current, active power, reactive power, frequency, phase angle, switch quantity state and the like.

[0031] The image and video data includes substation monitoring camera screen, power distribution room or machine room monitoring, important operation terminal screenshot, alarm visualization interface screenshot and the like. The data source can be video monitoring system front-end camera, network video recorder, screen recording device and the like.

[0032] The above data form a data source list, which clearly shows the collection position, network position, security level, interface mode and sampling frequency of each type of data, providing basis for subsequent collection implementation.

[0033] The network communication data collection interface design: configure mirror port or bypass collection port at key network nodes (such as convergence switch, core router, firewall bypass port), and deploy network traffic collection probe. The original data frame or data packet is obtained through standard message capture mechanism (such as link layer message mirror, port mirror and the like), which is encapsulated into unified message record format. All network traffic collection processes should adopt read-only and bypass mode, which does not affect the real-time performance and reliability of production control network.

[0034] Log and audit data collection interface design: Configure uniform log collection clients on servers, terminals, networks, and security devices, and actively push local logs to the central log aggregation node in a secure transmission protocol. For old devices that do not support active pushing, log files can be periodically pulled by polling and incrementally parsed. All log transmission channels use encryption and two-way authentication mechanisms to prevent tampering or forgery of logs during transmission.

[0035] Time sequence measurement data collection interface design: For monitoring system measurement and protection device recording data, related data messages can be multiplexed or mirrored through existing monitoring communication channels of dispatching data network and production control area. For synchronous phasor measurement data, a data forwarding module can be added to the phasor measurement data concentrator to copy real-time measurement data and send it to the analysis system. For terminal devices such as smart meters and environmental sensors, they can be aggregated through concentrators or gateways and uploaded uniformly in standardized protocols.

[0036] Image and video data collection interface design: For real-time monitoring pictures, a low-code rate and low-frame rate auxiliary data stream can be set up in the video management platform and transmitted to the analysis system through a secure channel. For operation interface screenshots, terminal auxiliary software can be used to capture the screen and upload it when a specific event is triggered. The collection frequency of videos and images should be configured according to the analysis requirements and bandwidth limitations to avoid excessive pressure on the existing production network.

[0037] The above-mentioned different types of collection interfaces collectively form a "multi-channel, hierarchical isolation, safe and controllable" data collection network, providing a foundation for long-term stable acquisition of multi-modal data.

[0038] 1.2 Data unification unit Used for unified timestamp marking, unified identification system establishment, and original data format packaging based on the multi-source data, to obtain standardized data sets.

[0039] Unified timestamp marking: All collection devices should be time-synchronized through a unified time synchronization mechanism, such as using the time synchronization service of the dispatching data network or the high-precision time synchronization protocol. For each collected record, a unified format timestamp field is attached, which is used for time alignment and correlation analysis between different modal data.

[0040] Unified identification system establishment: Assign a unique identifier to each device, each logical node, and each type of business system, which is used to establish a correspondence between different data sources. In network traffic, log records, measurement data, and image data, the corresponding device identifier, system identifier, and business identifier fields are embedded or attached.

[0041] Raw data format packaging: network messages can be packaged into a unified message record structure, including timestamp, source address, destination address, port number, protocol type, message length, message content summary, etc. Log records can be parsed into a unified log entry structure, including timestamp, device identification, log level, event type, event content, etc. Time series measurement data can be packaged into a time series table structure, including timestamp, measurement point number, measurement type, electrical quantity value, etc. Image and video data can be referenced through file path or object storage index, with additional timestamp, camera number, scene description, etc.

[0042] Through the above processing, the original multi-source, heterogeneous data is semantically unified, which facilitates subsequent cleaning, screening and feature extraction.

[0043] 1.3 Quality control unit Based on the normalized data set, missing and damaged data is removed, abnormal noise data is filtered, and data integrity and continuity is checked to obtain multi-modal raw data.

[0044] Identification and processing of missing and damaged data records: for network messages, if the message header information is incomplete or the data content is severely missing, it is marked as damaged record and removed from subsequent analysis. For log records, if the timestamp is missing, the key field is empty or there is obvious format error, it is repaired or deleted. For time series measurement data, if continuous multiple frames of data are completely repeated or the value exceeds the physical reasonable range, it is marked as suspicious data for special processing by subsequent algorithms.

[0045] Preliminary filtering of abnormal noise data: for high-frequency repeated logs or periodic messages, obvious background noise can be removed from subsequent key analysis data through simple frequency statistics and threshold judgment. For a large number of identical messages or logs appearing in a very short time, if it is confirmed as a heartbeat message or a periodic inspection log, it can be classified separately to avoid interference with subsequent anomaly detection.

[0046] Data integrity and continuity check: check whether the time interval of time series data meets the expected sampling period, if there is a long time interval, it should be recorded as a data missing section. Check whether there is a sudden interruption in the logs and network traffic records of key devices, if a large range of data is missing, a data acquisition fault alarm should be triggered. After cleaning and quality control, a set of multi-modal raw data records with controllable quality and relatively unified structure is obtained, which will constitute the main content of the collection.

[0047] 2, semantic identification module For example Figure 2As shown, the system is used to perform feature extraction, intra-modal encoding, and cross-modal semantic alignment based on the original multimodal data to obtain a set of high-dimensional vector representations within the same semantic space; the semantic identification module includes: 2.1 Sample recombination unit This is used to aggregate data based on the original multimodal data according to time windows, define each time window as a multimodal subset, and then merge all the multimodal subsets into a multimodal sample set; wherein, the multimodal subset includes network subset, log subset, time series subset and visual subset.

[0048] 2.2 Feature Representation Unit This is used to extract and encode features from the network subset, the log subset, the temporal subset, and the visual subset respectively, to obtain a feature vector set; the feature vector set includes network feature representation, log feature representation, temporal feature representation, and visual feature representation. The feature representation unit includes: 2.2.1 First Feature Extraction Unit Based on the network subset, discrete fields are one-hot encoded, numerical fields are normalized, and the field vectors of each message are concatenated to form a single message vector. These single message vectors are then concatenated into a message sequence. Temporal correlation and pattern feature extraction are performed on the message sequence, and then, through pooling or attention mechanisms, the message sequence is compressed into a fixed-length network modality feature vector, resulting in a network feature representation. In other words, the network feature representation represents the comprehensive features of network communication behavior in this sample.

[0049] 2.2.2 Second Feature Extraction Unit Based on the aforementioned log subset, the text is segmented, stop word removed, and word sequence transformed to obtain processed text. Each word in the processed text is mapped to a vector representation to obtain a word vector sequence. Sequence modeling is performed on the word vector sequences in each log entry to obtain an overall vector representation. Finally, all the overall vector representations are aggregated to obtain the log feature representation. That is, the log feature representation is the semantic feature of the system logs and audit records in this sample.

[0050] 2.2.3 Third Feature Extraction Unit Based on the aforementioned time series subset, physical quantity normalization and outlier removal are performed to obtain a multidimensional time series. This multidimensional time series is then input into a time series modeling network to learn typical patterns of power variation over time. The output of the entire time window is pooled to obtain a time series feature representation. In other words, the time series feature representation represents the dynamic characteristics of power measurement changes over time in this sample.

[0051] 2.2.4 Fourth Feature Extraction Unit Based on the aforementioned visual subset, a visual self-attention network is used to extract multi-level spatial features for each frame of image. Global average pooling is then performed on the high-level feature maps of these multi-level spatial features to obtain a frame vector representation for each frame. Finally, all frame vector representations are aggregated according to temporal order or content similarity to obtain a visual feature representation. In other words, the visual feature representation represents the spatial features of the image or video scene in the sample.

[0052] 2.3 Feature Unification Unit Based on the set of feature vectors, a transformation network is used to map the feature representations of different modalities to a semantic vector space of the same dimension, perform semantic alignment, obtain an intermediate vector set, aggregate all the intermediate vector sets of each sample to obtain a unified semantic vector, and arrange and combine the unified semantic vectors to obtain a high-dimensional vector representation set.

[0053] 3. Knowledge Representation Module like Figure 2 As shown, this is used to construct a knowledge graph by combining knowledge from the field of power safety, build a knowledge representation set based on the knowledge graph, and then construct an index correspondence between the high-dimensional vector representation set and the knowledge representation set; the knowledge representation module includes: 3.1 Entity and Relationship Units This method combines knowledge from the field of power safety to identify entity and relation types, extract entities and relations, and then construct triples based on the extracted entities and relations.

[0054] 1) The entity includes: Equipment-related entities: such as "substation", "switchgear", "protection device", "measurement and control device", "server", "workstation", etc.

[0055] Network node entities: such as "switch", "router", "firewall", "security gateway", etc.

[0056] Software and service entities: such as "operating system", "database service", "monitoring application", "scheduling application", etc.

[0057] Vulnerability and vulnerability entities: such as "specific vulnerability ID", "weak password", "unpatched risk", etc.

[0058] Entities associated with attack behaviors include: "scanning", "brute-force login", "spoofed data injection", "malicious remote control", and "denial of service".

[0059] Security incident entities: such as "unauthorized access incident", "illegal operation incident", "system abnormal shutdown incident", etc.

[0060] Defense strategy entities include: "Isolate device", "Switch local control", "Block session", "Upgrade patch", "Strengthen authentication", etc.

[0061] 2) The relationship includes: Structural relationships, such as "located in", "belonging to", and "connected to", indicate physical or logical topological relationships between devices or between devices and regions.

[0062] Vulnerability-related relationships: such as "vulnerable" or "affected by vulnerability", indicating the relationship between a device or software and a specific vulnerability.

[0063] Attack path relationships: such as "initiating an attack", "being attacked", "exploiting vulnerabilities", "causing an event", describing the attacker's behavioral path.

[0064] Defense strategy relationships, such as "mitigates", "applicable to", and "recommended strategy", indicate the applicability of a certain strategy to a certain type of threat or vulnerability.

[0065] Business impact relationships: such as "affects business", "causes alarm", "triggers protection", indicating the impact relationship between security events and power business operations.

[0066] 3.2 Spectrum Embedding Unit The system is used to construct a graph structure based on the entity, the relation, and the triple, and to initialize the entity and the relation with vectors to obtain a knowledge graph. The knowledge graph is then propagated through multiple layers and features are aggregated using a graph neural network to obtain the final embedding vector of each entity in a high-dimensional space. All the final embedding vectors are then fused to obtain a knowledge representation set.

[0067] 3.3 Knowledge-related Units This is used to construct the index correspondence between the high-dimensional vector representation set and the knowledge representation set.

[0068] 4. Threat Presentation Module like Figure 2 As shown, the method is used to fuse the high-dimensional vector representation set and the knowledge representation set according to the index correspondence to obtain a comprehensive threat representation vector; the threat representation module includes: 4.1 Knowledge Enhancement Unit This is used to obtain associated knowledge vectors in the high-dimensional vector representation set based on the index correspondence and the knowledge representation set, introduce attention weights to perform weighted summation on the associated knowledge vectors to obtain sample-level knowledge representations, and then perform weighted fusion of the sample-level knowledge representations with the high-dimensional vector representation set to obtain knowledge-enhanced sample representations.

[0069] 4.2 Integrated Representation Unit This is used to perform feature concatenation and fusion of the knowledge-enhanced sample representation and the knowledge representation set to obtain a comprehensive threat representation vector.

[0070] 5. Threat Assessment Module like Figure 3 As shown, the system is used to construct an AI assessment model using the threat comprehensive representation vector, output a threat numerical assessment result using the AI ​​assessment model, search for an interpretable threat semantic chain corresponding to the threat numerical assessment result in the knowledge graph, and then combine the interpretable threat semantic chain and the threat numerical assessment result to obtain the final assessment result; the threat assessment module includes: 5.1 Model Building Unit This is used to design a multi-task neural network structure that includes an input layer, a shared hidden layer, and a task-specific output layer. Based on the multi-task neural network structure, the output of each sub-task is defined to obtain an initial judgment model.

[0071] The model building unit includes: An input layer is used to receive the threat synthesis representation vector and transmit the threat synthesis representation vector to the shared hidden layer.

[0072] A shared hidden layer is used to perform feature processing on the threat synthesis representation vector using multi-layer fully connected transformation and nonlinear activation to obtain a shared hidden representation.

[0073] A task-specific output layer is used to define attack type identification output headers, attack phase identification output headers, risk level assessment output headers, and multi-label prediction output headers.

[0074] The attack type identification output head is used to calculate the prediction score for different attack types based on the shared hidden representation, and normalize the prediction score to obtain the attack type probability distribution.

[0075] The attack phase identification output header is used to predefine the number of attack phases based on the shared hidden representation, and to calculate the probability estimate of different time phases based on the number of attack phases, thereby obtaining the attack phase probability.

[0076] The risk level assessment output header is used to output a high-risk level, a medium-risk level, or a low-risk level based on the shared hidden representation.

[0077] The multi-label prediction output head is used to output the impact score of the corresponding device or region based on the shared hidden representation, and to compress the impact score to between 0 and 1 using a component-wise logical function to obtain the object impact score vector.

[0078] 5.2 Model Training Unit The loss functions for each sub-task are designed, and the loss functions of each task are weighted and fused to obtain the total loss function. Based on the total loss function, the initial judgment model is trained using the threat comprehensive representation vector to obtain the AI ​​judgment model. The AI ​​judgment model is then used to output sample-level threat numerical judgment results.

[0079] 5.3 Interpretable Unit This algorithm searches the knowledge graph for paths that reflect the causal logic of security events based on predefined starting and ending entities and using a graph search algorithm. It sets the maximum path length, obtains multiple candidate paths, scores the paths based on path length, entity importance, and similarity to current sample features, selects the paths with the highest scores to obtain an interpretable threat semantic chain, and then merges the interpretable threat semantic chain with the threat numerical assessment results to obtain the final assessment result.

[0080] For example, the starting entity can be "critical equipment entity under attack" or "attacker / source node entity"; the ending entity can be "important business entity affected" or "final defense strategy entity".

[0081] Search for paths that reflect the causal logic of security incidents, for example: Key equipment entities Vulnerable entities Exploited by specific attack entities Entities that cause security incidents Impact on business entities; Or: Attacker Entity Entity that launched the attack Attack target entity Entities that trigger alarms Enable the defense strategy entity.

[0082] Therefore, by providing an AI-driven threat intelligence assessment system based on multimodal data processing and knowledge graphs, this invention not only greatly improves the system's integrated threat assessment capability, but also takes into account the interpretability of knowledge-driven approaches and the adaptability of deep learning, and infers reliable multi-dimensional detection results in one go.

[0083] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. The same or similar parts between the various embodiments can be referred to each other.

[0084] This document uses specific examples to illustrate the principles and implementation methods of the present invention. The descriptions of the above embodiments are only for the purpose of helping to understand the method and core ideas of the present invention. Furthermore, those skilled in the art will recognize that, based on the ideas of the present invention, there will be changes in the specific implementation methods and application scope. Therefore, the content of this specification should not be construed as a limitation of the present invention.

Claims

1. An AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs, characterized in that: include: The data sensing module is used to collect multi-source data at the power system operation site and perform basic preprocessing on the multimodal raw data to obtain multimodal raw data. The semantic labeling module is used to perform feature extraction, intra-modal encoding, and cross-modal semantic alignment based on the multimodal raw data to obtain a set of high-dimensional vector representations in the same semantic space; The knowledge representation module is used to combine knowledge in the field of power safety to construct a knowledge graph, construct a knowledge representation set based on the knowledge graph, and then construct an index correspondence between the high-dimensional vector representation set and the knowledge representation set; The threat representation module is used to fuse the high-dimensional vector representation set with the knowledge representation set according to the index correspondence to obtain a comprehensive threat representation vector; The threat assessment module is used to construct an AI assessment model using the threat comprehensive representation vector, output a threat numerical assessment result using the AI ​​assessment model, search for an interpretable threat semantic chain corresponding to the threat numerical assessment result in the knowledge graph, and then combine the interpretable threat semantic chain and the threat numerical assessment result to obtain the final assessment result. The data perception module, the semantic identification module, the knowledge representation module, the threat representation module, and the threat assessment module are interconnected.

2. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 1, characterized in that, The data sensing module includes: The data acquisition unit is used to collect network communication data, system log and audit record data, time-series operation measurement data and image and video data based on the power system operation site to obtain multi-source data. Different acquisition interfaces and secure transportation channels are designed for different types of data in the multi-source data. The data unification unit is used to perform unified timestamp marking, unified identification system establishment and raw data format encapsulation based on the multi-source data to obtain a standardized dataset; The quality control unit is used to remove missing and lost data, filter abnormal noise data, and check the integrity and continuity of the data based on the normalized dataset to obtain multimodal raw data.

3. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 2, characterized in that, The semantic identification module includes: The sample recombination unit is used to aggregate data according to time windows based on the original multimodal data, define each time window as a multimodal subset, and then merge all the multimodal subsets into a multimodal sample set; wherein, the multimodal subset includes network subset, log subset, time series subset and visual subset; The feature representation unit is used to extract and encode features from the network subset, the log subset, the temporal subset, and the visual subset respectively, to obtain a feature vector set; the feature vector set includes network feature representation, log feature representation, temporal feature representation, and visual feature representation; The feature unification unit is used to map the feature representations of different modalities to the semantic vector space of the same dimension based on the feature vector set using a transformation network, perform semantic alignment to obtain an intermediate vector set, then aggregate all the intermediate vector sets of each sample to obtain a unified semantic vector, and arrange and combine the unified semantic vector to obtain a high-dimensional vector representation set.

4. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 3, characterized in that, The feature representation unit includes: The first feature extraction unit is used to perform one-hot encoding on discrete fields and normalize numerical fields based on the network subset, and to connect the field vectors of each message to form a single message vector, concatenate the single message vectors into a message sequence, extract temporal correlation and pattern features from the message sequence, and then compress the message sequence into a fixed-length network modality feature vector through pooling operations or attention mechanisms to obtain the network feature representation; The second feature extraction unit is used to perform word segmentation, stop word removal and word sequence transformation on the text based on the log subset to obtain processed text, map each word in the processed text to a vector representation to obtain a word vector sequence, perform sequence modeling on the word vector sequence in each log to obtain an overall vector representation, and then aggregate all the overall vector representations to obtain a log feature representation; The third feature extraction unit is used to perform physical quantity normalization and outlier removal based on the time series subset to obtain a multi-dimensional time series. The multi-dimensional time series is then input into the time series modeling network to learn the typical pattern of power change over time. The output of the entire time window is pooled to obtain a time series feature representation. The fourth feature extraction unit is used to extract multi-level spatial features of each frame image based on the visual subset using a visual self-attention network, and to perform global average pooling on the high-level feature maps of the multi-level spatial features to obtain the frame vector representation of each frame image. Then, all the frame vector representations are aggregated according to time order or content similarity to obtain the visual feature representation.

5. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 4, characterized in that, The knowledge representation module includes: The entity and relation unit is used to combine knowledge in the field of power safety to clarify the entity type and relation type, and to extract the entity and relation. Then, based on the extracted entities and relations, triples are constructed. The graph embedding unit is used to construct a graph structure based on the entity, the relation, and the triple, and to initialize the entity and the relation with vectors to obtain a knowledge graph. The knowledge graph is then propagated in multiple layers and features are aggregated using a graph neural network to obtain the final embedding vector of each entity in a high-dimensional space. All the final embedding vectors are then fused to obtain a knowledge representation set. The knowledge association unit is used to construct the index correspondence between the high-dimensional vector representation set and the knowledge representation set.

6. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 5, characterized in that, The entities include device entities, network node entities, software and service entities, vulnerability and weak current entities, attack behavior entities, security event entities, and defense strategy entities. The relationships include structural relationships, vulnerability relationships, attack path relationships, defense strategy relationships, and business impact relationships.

7. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 6, characterized in that, The threat representation module includes: The knowledge enhancement unit is used to obtain the associated knowledge vectors in the high-dimensional vector representation set according to the index correspondence and the knowledge representation set, introduce attention weights to perform weighted summation on the associated knowledge vectors to obtain sample-level knowledge representations, and then perform weighted fusion of the sample-level knowledge representations with the high-dimensional vector representation set to obtain knowledge-enhanced sample representations. The comprehensive representation unit is used to perform feature concatenation and fusion of the knowledge-enhanced sample representation and the knowledge representation set to obtain a threat comprehensive representation vector.

8. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 7, characterized in that, The threat assessment module includes: The model building unit is used to design a multi-task neural network structure including an input layer, a shared hidden layer, and a task-specific output layer. Based on the multi-task neural network structure, the output of each sub-task is defined to obtain an initial judgment model. The model training unit is used to design the loss function for each sub-task and to weight and fuse the loss functions of each task to obtain the total loss function. Based on the total loss function, the initial judgment model is trained using the threat comprehensive representation vector to obtain the AI ​​judgment model. The AI ​​judgment model is used to output the sample-level threat numerical judgment result. The interpretable unit is used to search for paths reflecting the causal logic of security events in the knowledge graph based on predefined starting and ending entities using a graph search algorithm. It sets the maximum path length, obtains multiple candidate paths, scores the paths based on path length, entity importance, and similarity of current sample features, selects the paths with the highest scores to obtain an interpretable threat semantic chain, and then merges the interpretable threat semantic chain with the threat numerical judgment result to obtain the final judgment result.

9. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 8, characterized in that, The model building unit includes: An input layer is used to receive the threat synthesis representation vector and transmit the threat synthesis representation vector to the shared hidden layer; A shared hidden layer is used to perform feature processing on the threat synthesis representation vector using multi-layer fully connected transformation and nonlinear activation to obtain a shared hidden representation; A task-specific output layer is used to define attack type identification output headers, attack phase identification output headers, risk level assessment output headers, and multi-label prediction output headers.

10. The AI-driven intelligent threat assessment system based on multimodal data processing and knowledge graphs according to claim 9, characterized in that: The attack type identification output head is used to calculate the prediction score of different attack types based on the shared hidden representation, and normalize the prediction score to obtain the attack type probability distribution; The attack phase identification output header is used to predefine the number of attack phases based on the shared hidden representation, and to calculate the probability estimate of different time phases based on the number of attack phases, thereby obtaining the attack phase probability. The risk level assessment output header is used to output a high-risk level, a medium-risk level, or a low-risk level based on the shared hidden representation. The multi-label prediction output head is used to output the impact score of the corresponding device or region based on the shared hidden representation, and to compress the impact score to between 0 and 1 using a component-wise logical function to obtain the object impact score vector.

Images