A multi-source situation data fusion analysis method and system of an intelligent security platform

Abstract

The application provides a multi-source situation data fusion analysis method and system of an intelligent security platform, belongs to the cross technical field of network space security and data fusion, and comprises the following steps: S1, multi-source situation data acquisition; S2, multi-source situation data preprocessing; S3, multi-source situation data feature extraction; S4, multi-source situation data fusion; S5, security situation assessment; S6, abnormality detection and feedback; and S7, result output and response measure triggering. The application is developed around the multi-source situation data fusion analysis of the intelligent security platform, and realizes the whole-process management from data acquisition to response optimization through the seven steps.

Description

Technical Field

[0001] This invention relates to the field of cyberspace security and data fusion technology, specifically to a method and system for multi-source situational data fusion analysis of an intelligent security platform. Background Technology

[0002] In current cybersecurity scenarios, intelligent security platforms need to access multiple data sources, including network traffic, endpoint logs, security device alarms, and application system logs, to achieve comprehensive situational awareness. However, existing technologies have the following key problems:

[0003] Insufficient adaptability of multi-source data fusion: Different data sources are divided into numerical types (such as transmission rate, CPU utilization) and categorical types (such as alarm type, error code). Traditional fusion methods use fixed weights or a single algorithm (such as using only weighted average or Bayesian inference), which cannot dynamically adjust the fusion strategy according to the real-time characteristics of the data, resulting in a large deviation between the fusion results and the actual situation.

[0004] The correlation between features and decision-making is weak: the feature extraction stage does not design differentiated features for subsequent fusion algorithms (such as mixing numerical features and classification features), and the decision-making layer does not pay enough attention to high-risk features (such as "intrusion attempt" alarms) during reasoning, which easily underestimates key security risks;

[0005] Lack of closed-loop feedback throughout the process: The data collection frequency and preprocessing rules (such as outlier filling and invalid data filtering) are mostly statically configured and cannot be dynamically optimized based on subsequent situation assessment results and anomaly detection conclusions, resulting in continuous limitation of front-end data quality and forming a vicious cycle of "poor data quality → low fusion accuracy → inaccurate assessment".

[0006] Response measures are disconnected from the fusion results: Response strategies are often triggered based on a single indicator (such as only looking at the alarm level) without combining multi-dimensional fusion results (such as dynamic risk values ​​and feature attention weights) to formulate graded measures, which can easily lead to "over-response" or "response lag". Summary of the Invention

[0007] This invention provides a method and system for multi-source situational data fusion and analysis of intelligent security platforms. It focuses on the multi-source situational data fusion and analysis of intelligent security platforms, and achieves end-to-end management from data acquisition to response optimization through seven steps:

[0008] Accurate collection of multi-source data (S1): Distinguish between numerical data (network traffic, terminal performance) and categorized data (security alarms, application logs), formulate differentiated collection strategies and storage structures, and provide high-quality raw data for subsequent processing;

[0009] Data preprocessing optimization (S2): Cleaning (outlier filling, invalid data filtering) and standardization (min-max normalization, one-hot encoding) are performed on the two types of data respectively, and the preprocessing rules are dynamically adjusted based on feedback from the backend;

[0010] Differential Feature Extraction (S3): Extract 12 types of numerical features and 8 types of categorical features to adapt to subsequent fusion algorithms, ensuring that the features and algorithm requirements are accurately matched;

[0011] Multi-algorithm collaborative fusion (S4, core optimization): Algorithm A (dynamic weight optimization) processes numerical features to output dynamic fusion values, correcting the evidence weights of the DS evidence theory in the feature layer; then, Algorithm B (attention mechanism Bayesian inference) combines classification features with dynamic fusion values ​​to output enhanced posterior probabilities, forming a collaborative fusion mechanism of "numerical fusion - feature correction - decision enhancement".

[0012] Precise Situation Assessment (S5): Expands the assessment index system to include fusion results, calculates the situation scores of individual objects and the overall situation, and determines the situation level;

[0013] Anomaly Detection and Feedback (S6): Based on the evaluation results and fused features, locate anomalies in the data layer, feature layer, and decision layer, trace the root cause, and provide feedback on optimization requirements to the front end;

[0014] Tiered Response and Closed Loop (S7): Outputs structured assessments and anomaly reports, triggers routine monitoring, emergency blocking, disaster recovery switching and other response measures according to the situation level, and feeds back the response effect to each link for iterative optimization, ultimately achieving continuous improvement of the platform's situational awareness and security protection capabilities.

[0015] One aspect of this specification discloses a multi-source situational data fusion and analysis method for an intelligent security platform, including:

[0016] S1: Collect multi-source data, which includes numerical data and categorical data. The numerical data includes network traffic transmission rate, total number of data packets, and terminal CPU utilization. The categorical data includes alarm types, alarm levels, and error types of application systems.

[0017] S2: Clean and standardize the numerical data and categorical data to obtain numerical standardized data and categorical standardized data, respectively;

[0018] S3: Extract numerical features from the numerical standardized data, and extract categorical features from the categorical standardized data;

[0019] S4: Based on the numerical features, calculate the dynamic weights and dynamic fusion values ​​using a dynamic weight optimization algorithm. The dynamic weights are determined by the similarity between the numerical features and historical anomaly features. The dynamic fusion value is the weighted sum of the dynamic weights and the numerical features. Based on the categorical features, calculate the categorical feature fusion probability using DS evidence theory. Then, based on the dynamic fusion value and the categorical feature fusion probability, calculate the attention weights and the posterior probability of attention enhancement using an attention-enhanced Bayesian inference algorithm to obtain the enhanced situation feature matrix.

[0020] S5: Perform a security situation assessment based on the enhanced situation feature matrix to obtain the situation assessment result;

[0021] S6: Based on the situation assessment results and the enhanced situation feature matrix, perform anomaly detection and locate the anomaly type;

[0022] S7: Based on the situation assessment results and anomaly types, output a structured assessment report and trigger response measures, while feeding back the response effects to S1, S2, S4, and S5 to optimize the parameters of each step.

[0023] In this specification, step S4, the process of calculating dynamic weights by the dynamic weight optimization algorithm includes: calculating the real-time contribution of numerical features and historical abnormal features through cosine similarity, and adjusting the dynamic weights based on the real-time contribution and preset fixed weights. The dynamic weights are used to correct the evidence body weights in the DS evidence theory.

[0024] In this specification, step S4, the process of calculating attention weights in the Bayesian inference algorithm includes: fusion probability of classification features based on categorical features and dynamic fusion value output by dynamic weight optimization algorithm, amplifying the influence of high-risk features through enhancement factor, wherein the enhancement factor is the sum of 1 and dynamic fusion value, and attention weights are used to adjust the degree of influence of conditional probability in Bayesian inference.

[0025] In this specification, the interaction process between the dynamic weight optimization algorithm and the Bayesian inference algorithm in step S4 includes: the dynamic fusion value output by the dynamic weight optimization algorithm is used as the input parameter of the Bayesian inference algorithm to participate in the attention weight calculation; the dynamic weight output by the dynamic weight optimization algorithm is used to correct the fusion weight of the categorical features in the DS evidence theory, so that the fusion results of numerical features and categorical features are associated.

[0026] In this specification, in step S6, the preprocessing rule optimization requirements are fed back to S2, and the preprocessing rules include outlier filling strategies and invalid data filtering rules; the data acquisition strategy adjustment requirements are fed back to S1, and the acquisition strategy includes acquisition frequency and key monitoring data sources.

[0027] In this specification, a closed-loop feedback is formed in step S7: the change value of the situation assessment result after the implementation of the response measures is fed back to S5, which is used to optimize the index weights of the situation assessment; the change value of the enhanced situation feature matrix after the response is fed back to S4, which is used to iterate the parameters of the dynamic weight optimization algorithm and the Bayesian inference algorithm.

[0028] In this specification, when performing a security situation assessment in step S5, the assessment index system includes dynamic risk index, attention weight index, and posterior probability index. The dynamic risk index is the dynamic fusion value output by the dynamic weight optimization algorithm, the attention weight index is the classification feature with a weight of not less than 0.4 in the Bayesian inference algorithm, and the posterior probability index is the sum of the probabilities of the danger level and the extremely dangerous level output by the Bayesian inference algorithm.

[0029] In this specification, the process of locating the anomaly type in step S6 includes: when the dynamic fusion value exceeds the first threshold, it is determined to be a data layer anomaly; when the classification feature fusion probability exceeds the second threshold and the corresponding attention weight exceeds the third threshold, it is determined to be a feature layer anomaly; when the overall situation level is dangerous or extremely dangerous and the sum of the probabilities of the dangerous level and the extremely dangerous level exceeds the fourth threshold, it is determined to be a decision layer anomaly.

[0030] In this specification, the termination conditions of the closed-loop feedback include: after three consecutive iterations, the overall situational level in the situational assessment results remains at the safe level and the anomaly rate of anomaly detection is lower than a preset threshold, or the adjustment range of parameters in each step is less than a preset adjustment threshold.

[0031] Another aspect of this specification discloses a multi-source situational data fusion and analysis system for an intelligent security platform, applying the multi-source situational data fusion and analysis method for an intelligent security platform described in any one of the above descriptions. The multi-source situational data fusion and analysis system for the intelligent security platform includes:

[0032] The data acquisition module is used to collect multi-source data, which includes numerical data and categorical data. The numerical data includes the transmission rate of network traffic, the total number of data packets, and the CPU utilization of the terminal. The categorical data includes the alarm types and alarm levels of security devices and the error types of application systems.

[0033] The processing module is used to clean and standardize the numerical data and categorical data to obtain numerical standardized data and categorical standardized data, respectively.

[0034] The extraction module is used to extract numerical features from the numerical standardized data and extract categorical features from the categorical standardized data.

[0035] The feature module is used to calculate dynamic weights and dynamic fusion values ​​based on the numerical features using a dynamic weight optimization algorithm. The dynamic weights are determined by the similarity between the numerical features and historical anomaly features, and the dynamic fusion values ​​are the weighted sum of the dynamic weights and the numerical features. Based on the categorical features, the module calculates the categorical feature fusion probability using DS evidence theory, and then calculates the attention weights and attention-enhanced posterior probabilities using an attention-enhanced Bayesian inference algorithm based on the dynamic fusion values ​​and categorical feature fusion probabilities to obtain an enhanced situational feature matrix.

[0036] The assessment module is used to perform a security situation assessment based on the enhanced situation feature matrix and obtain the situation assessment result.

[0037] The detection module is used to perform anomaly detection and locate the anomaly type based on the situation assessment results and the enhanced situation feature matrix.

[0038] The feedback module is used to output a structured assessment report based on the situation assessment results and anomaly types and trigger response measures. At the same time, it feeds back the response effect to the acquisition module, processing module, feature module, and assessment module to optimize the parameters of each step.

[0039] The embodiments described in this specification can achieve at least the following beneficial effects:

[0040] Enhance the dynamic adaptability of multi-source data fusion: The dynamic weight optimization algorithm (Algorithm A) is used to adjust the real-time weights for numerical data, and the attention-enhanced Bayesian inference algorithm (Algorithm B) is used to focus on high-risk features in categorized data, which solves the problem of poor adaptability of traditional fixed strategies and makes the fusion results more in line with the real-time security situation.

[0041] Enhance the accuracy of situation assessment: Expand the assessment indicator system, incorporate dynamic risk values, feature attention weights, and posterior probabilities from the fusion phase into the assessment dimensions, and combine entropy weighting with dynamic weights to calculate the comprehensive indicator weights, avoiding assessment bias caused by single indicators or static weights, and more accurately distinguishing the "safe / moderate / dangerous / extremely dangerous" situation levels.

[0042] Achieve closed-loop optimization throughout the entire process: Through root cause analysis in the anomaly detection stage, feedback is provided to the front-end data acquisition (S1) regarding the need to adjust the acquisition frequency and to the preprocessing (S2) regarding the direction of rule optimization, forming a closed loop of "acquisition-preprocessing-fusion-evaluation-detection-feedback-optimization", continuously improving the quality of front-end data and the accuracy of back-end fusion evaluation;

[0043] Optimize the targeting and effectiveness of security responses: Develop tiered response strategies based on the results of the integrated assessment. Maintain routine monitoring in low-risk scenarios and accurately block abnormal objects and trigger emergency support in high-risk scenarios to avoid over-response or under-response. At the same time, iterate the algorithms and strategies based on the feedback of response effects to improve the platform's protection capabilities. Attached Figure Description

[0044] Figure 1 This is a schematic diagram of the multi-source situational data fusion and analysis method of the intelligent security platform of the present invention.

[0045] Figure 2 This is a schematic diagram of the feature extraction-fusion collaborative process involved in some embodiments of the present invention.

[0046] Figure 3 This is a schematic diagram of the situation assessment-anomaly detection process involved in some embodiments of the present invention.

[0047] Figure 4 This is a schematic diagram of the response measures - closed-loop optimization process involved in some embodiments of the present invention. Detailed Implementation

[0048] like Figure 1 As shown, this embodiment provides a multi-source situational data fusion and analysis method for an intelligent security platform, including:

[0049] S1: Multi-source situational data acquisition – the foundational data support for fusion analysis

[0050] This step serves as the starting point for the entire fusion analysis process, requiring comprehensive and high-quality raw data for subsequent steps (especially S4). The quality of the collected data directly affects the accuracy of the "real-time contribution" calculation of the dynamic weight optimization algorithm (Algorithm A) in S4, as well as the fusion effect of the feature layer DS evidence theory.

[0051] 1. Data source types and refined acquisition strategies

[0052] In response to S4's differentiated processing requirements for "numerical features" and "categorical features," this step needs to clearly distinguish the collection standards for the two types of data:

[0053] Numerical data (for processing by algorithm A):

[0054] Network traffic data: Collected through distributed network probes (deployed on key nodes such as core switches and border routers), and must include: basic indicators: source IP address, destination IP address, port number, protocol type (TCP / UDP / ICMP); key numerical indicators: transmission rate (Mbps), packet size (bytes), connection duration (seconds), and packets per second (pps).

[0055] Data collection frequency: A dynamic adjustment strategy is adopted, with 1 time per minute during normal periods, and increased to 30 times per second when the network load exceeds 70%, to ensure that Algorithm A can capture sudden changes in traffic.

[0056] Terminal performance data: Collected through a lightweight agent program, and must include: CPU utilization (%), memory usage (%), disk I / O rate (MB / s), and process startup frequency (times / hour).

[0057] Data collection frequency: 5 minutes / time, to avoid affecting terminal operation, while ensuring the timeliness of algorithm A's calculation of "terminal resource characteristics".

[0058] Categorized data (for processing by feature layer DS and algorithm B):

[0059] Security device alarm data: collected in real time via the Syslog protocol, and must include: alarm type (intrusion attempt / virus infection / port scan / abnormal login, etc., a total of 8 categories, corresponding to S3 classification features); alarm level (low / medium / high / urgent, mapped to classification labels); associated entity (IP address / terminal ID / application name that triggered the alarm).

[0060] Collection requirements: Each alarm must be accompanied by a complete context (such as attack payload fragments, login accounts, etc.) to provide a basis for S3 to extract "alarm association features".

[0061] Application system log data: collected periodically via API interface, and must include: error types (404 / 500 / insufficient permissions, etc., a total of 6 categories); user operation types (query / add / modify / delete, corresponding to S3 "user operation characteristics"); and interface call results (success / failure).

[0062] Data collection frequency: 2 minutes / time, to ensure that Algorithm B can obtain the latest data on "application error features" in a timely manner.

[0063] 2. Data storage and preprocessing preparation

[0064] The raw data is stored using a distributed data warehouse (such as Hadoop HDFS), partitioned according to a three-dimensional structure of "data source type + data type (numerical / categorical) + collection time," for example:

[0065] Path format: / data / network / numerical / 20XX0827 / (Network numerical data);

[0066] Path format: / data / security / alarm / categorical / 20XX0827 / (security alarm classification data).

[0067] This storage structure facilitates S2's rapid extraction of corresponding data types for preprocessing, while also ensuring efficient data access for the parallel computation of S4 algorithms A and B.

[0068] S2: Multi-source situational data preprocessing – providing standardized input for fusion algorithms

[0069] This step requires cleaning and standardizing the raw data collected in S1. The output "numerical standardized dataset" and "categorical standardized dataset" need to be adapted to Algorithm A in S4 and the feature layer DS evidence theory, respectively. At the same time, the feedback information from S6 is received to dynamically optimize the processing strategy.

[0070] 1. Refined Data Cleaning Process

[0071] Numerical data cleaning (serving algorithm A):

[0072] Outlier handling: Outliers (values ​​exceeding Q3 + 1.5 × IQR or below Q1 - 1.5 × IQR) are identified using the IQR (interquartile range) method. For example, in network transmission rates, if Q3 = 100 Mbps and IQR = 50 Mbps, values ​​exceeding 175 Mbps are marked as outliers and filled using the "moving average of the first 3 valid values" (to avoid data loss due to deletion).

[0073] Missing value handling: For key values ​​such as packet size and CPU utilization, the data is filled with the "historical average value of the same IP / terminal" (e.g., if the CPU utilization of terminal 1 at 9:00 is missing, it is filled with the average value of the previous 7 days at 9:00) to ensure data integrity when Algorithm A calculates the "real-time contribution".

[0074] Categorized data cleaning (serving the feature layer DS):

[0075] Standardized format: Alarm types are unified into 8 preset categories (e.g., "SQL injection" is classified into "intrusion attempt"), and error types are mapped to 6 standard codes to ensure the consistency of classification features extracted by S3.

[0076] Invalid data filtering: Invalid data is filtered based on the "false alarm rule base" fed back by S6 (such as alarms from the test IP segment 192.168.100.0 / 24). The rule base is updated every 24 hours and is driven by the anomaly analysis results of S6.

[0077] 2. Differentiation strategy for data standardization

[0078] Numerical standardization: Min-max standardization is used to map the data to the [0,1] interval.

[0079] ;

[0080] in Let j be the final feature value of the j-th numerical feature of the i-th evaluation object after min-max standardization. Let j be the original data value of the j-th numerical feature of the i-th evaluation object. and The minimum and maximum values ​​of the historical data collected by S1 over the past 30 days are used to ensure that the feature values ​​processed by algorithm A are of a uniform magnitude.

[0081] Categorical standardization: One-hot encoding is used to convert classification labels into binary vectors, for example:

[0082] The alarm level "high" is coded as [0,0,1,0] (corresponding to low / medium / high / urgent);

[0083] The operation type "Modify" is coded as [0,0,1,0] (corresponding to query / add / modify / delete).

[0084] The encoding results are directly used as input for S3 to extract classification features, ensuring the compatibility of the feature layer DS evidence theory.

[0085] 3. Dynamic optimization of preprocessing strategy (receiving S6 feedback)

[0086] Adjust the processing rules based on the "feedback information" output by S6:

[0087] If S6 frequently detects false alarms for "unknown processes", a "dynamic update mechanism for the process whitelist" will be added during the cleaning phase (e.g., the update will be changed from 7 days to 3 days).

[0088] If the dynamic fusion value of Algorithm A deviates significantly from the actual situation (as reflected in the S5 evaluation results), adjust the outlier filling strategy for numerical data (e.g., switch to exponential smoothing).

[0089] S3: Feature Extraction from Multi-Source Situational Data – Constructing the Input Feature Set for the Fusion Algorithm

[0090] This step requires extracting features from the standardized data in S2, clearly distinguishing between numerical features (for algorithm A) and categorical features (for feature layer DS and algorithm B). The feature definitions must strictly correspond to the algorithm parameters in S4 to ensure the accuracy of data flow.

[0091] 1. Numerical Feature Extraction (Adapted Algorithm A)

[0092] For the numerically standardized data of S2, 12 types of features are extracted (compared to Algorithm A). (One-to-one correspondence)

[0093] Network traffic characteristics (4 categories):

[0094] : The average transmission rate (normalized value) of IP address i over 1 hour;

[0095] : The total number of data packets per hour for IP address i (normalized value);

[0096] TCP protocol usage percentage of IP address i (normalized value);

[0097] : Connection frequency per hour for IP address i (normalized value).

[0098] Terminal characteristics (3 categories):

[0099] : Number of processes started per hour for terminal i (normalized value);

[0100] : Number of abnormal behaviors in terminal i in 1 hour (standardized value);

[0101] : Average CPU utilization of terminal i over 1 hour (normalized value).

[0102] Safety equipment characteristics (3 categories):

[0103] : Total number of alarms for safety device i in 1 hour (standardized value);

[0104] : Number of high-level alarms per hour for security device i (standardized value);

[0105] : Average interval between adjacent alarms of safety device i (normalized value).

[0106] Application system characteristics (2 categories):

[0107] : The average response time (normalized value) of application i over 1 hour.

[0108] : Total number of error codes in application i over 1 hour (normalized value).

[0109] Extraction method: A sliding window (window size of 1 hour, step size of 30 minutes) is used to calculate statistics to ensure that the features can reflect short-term trend changes and provide time dimension support for the calculation of the "real-time contribution" of Algorithm A.

[0110] 2. Classification Feature Extraction (Adapting Feature Layer DS and Algorithm B)

[0111] For the categorically standardized data of S2, extract 8 types of features (compared to Algorithm B). (One-to-one correspondence)

[0112] Network traffic characteristics (2 types):

[0113] Protocol type distribution of IP address i (probability distribution of UDP / TCP / ICMP);

[0114] Connection mode of IP address i (probability distribution of normal / frequent port switching / long connection).

[0115] Terminal characteristics (2 categories):

[0116] : The process type of terminal i (probability distribution of whitelisted processes / unknown processes / blacklisted processes);

[0117] : The login time period of terminal i (probability distribution of working hours / non-working hours / early morning).

[0118] Safety equipment characteristics (Class 2):

[0119] Alarm types of security device i (probability distribution of 8 categories such as intrusion attempt / virus infection);

[0120] Alarm level of security device i (probability distribution of low / medium / high / urgent).

[0121] Application system characteristics (2 categories):

[0122] Error types applied to i (probability distribution of 6 categories such as 404 / 500);

[0123] : The probability distribution of the user operation type of application i (query / modify, etc., 4 types).

[0124] Extraction method: For each evaluation object, the frequency percentage of each category appearing within the sliding window is statistically analyzed, serving as the initial evidence body for the feature layer DS evidence theory, ensuring... It satisfies the probability distribution property (the sum is 1).

[0125] 3. Feature set integration and verification

[0126] The extracted 12 numerical features and 8 categorical features are integrated into a structured feature set, in the following format:

[0127] Numerical feature table: [Evaluation object ID, Feature ID, Feature value, Extraction time];

[0128] Categorical Feature Table: [Evaluation Object ID, Feature ID, Category, Probability Value, Extraction Time].

[0129] Verification rules:

[0130] Numerical feature values ​​must be in the range [0,1] (otherwise, S2 standardization process backtracking will be triggered).

[0131] The sum of the probability values ​​of the categorical features must be 1 (otherwise the frequency percentages will be recalculated).

[0132] The verified feature set is transmitted to S4 as input to algorithm A and feature layer DS.

[0133] S4: Multi-source situational data fusion – algorithmic collaboration and dynamic fusion

[0134] This step receives the numerical feature set and categorical feature set from S3, and through the collaborative computation of Algorithm A (Dynamic Weight Optimization) and Algorithm B (Attention Mechanism Enhanced Bayesian Inference), outputs an "Enhanced Situation Feature Matrix," which includes:

[0135] Dynamic fusion value of Algorithm A ;

[0136] Corrected feature layer DS fusion result;

[0137] Attention-enhanced posterior probability of Algorithm B , For the DS fusion result set of the categorical features of the i-th evaluation object, The importance weight of the categorical features of the i-th evaluation object in Algorithm B to situational reasoning (i.e., the attention weight calculated by Algorithm B).

[0138] This matrix will be directly transmitted to S5, providing core input for situation assessment. It will be added as a "dynamic risk indicator" in S5. It will be used to correct the situation level determination of S5.

[0139] In the situational awareness of intelligent security platforms, multi-source data fusion is a core component, and its accuracy directly determines the effectiveness of subsequent situational assessment and anomaly detection. Step S4 integrates multi-source data through a three-level fusion process involving the data layer, feature layer, and decision layer. It introduces a dynamic weight optimization algorithm (Algorithm A) and an attention-enhanced Bayesian inference algorithm (Algorithm B). Through deep interaction and collaboration between the algorithms, the fusion accuracy is improved. The two optimization algorithms and the fusion layers form an organic whole.

[0140] I. Overall Logic and Connections of S4

[0141] S4, as the core link between S3 (feature extraction) and S5 (situation assessment), takes the feature set extracted by S3 (including numerical and categorical features) as input and outputs the fused situation feature matrix (transferred to S5). The S4 fusion process follows a progressive logic of "data layer enhancement → feature layer correction → decision layer enhancement," with the specific connections as follows:

[0142] 1. Connection with S3: The feature set extracted by S3 is divided into two categories: numerical features (such as the average transmission rate of network traffic, the total number of alarms of security devices, etc.) and classification features (such as the proportion of protocol types, alarm types, etc.), which serve as the original inputs of Algorithm A (Data Layer Enhancement) and Feature Layer DS Evidence Theory, respectively.

[0143] 2. Interaction and connection between algorithms:

[0144] Algorithm A (Dynamic Weight Optimization) outputs "Dynamic Weight" and "Dynamic Weight Fusion Value". The "Dynamic Weight" is used to correct the evidence body weights of the DS evidence theory in the feature layer, and the "Dynamic Weight Fusion Value" serves as the input parameter for Algorithm B (Attention Mechanism Enhanced Bayesian Inference).

[0145] The DS evidence theory output of the feature layer, "classification feature fusion probability", serves as the core input of algorithm B and participates in the calculation of attention weights together with the "dynamic weight fusion value" of algorithm A.

[0146] Algorithm B outputs "attention-enhanced posterior probability", which is integrated with the Bayesian results of the decision layer to form the final decision layer fusion result.

[0147] 3. Integration with S5: The situation feature matrix includes the dynamic fusion value of Algorithm A, the corrected feature layer fusion result, and the decision layer result of Algorithm B, providing more accurate input features for S5 situation assessment. In particular, the "dynamic fusion value" can serve as the core indicator for S5 to assess anomalies in network, terminal, and other objects.

[0148] II. Algorithm 1: Dynamic Weight Optimization Algorithm (Algorithm A) – Data Layer Augmentation

[0149] 1. Necessity of Algorithm Design

[0150] The data layer uses fixed weights (analytic hierarchy process based on expert experience), which cannot adapt to the dynamic changes in real-time data characteristics. For example, when the "transmission rate" of an IP address suddenly spikes, a fixed weight (such as 0.2) cannot reflect the high impact of this feature on the current situation, potentially leading to distorted fusion results. Algorithm A dynamically adjusts the weights by calculating the "real-time contribution" of features, making the fusion results more closely reflect the actual security situation.

[0151] 2. Model building process

[0152] (1) Definition of core parameters

[0153] : The j-th numerical feature of the i-th evaluation object (such as IP address 1, terminal device 2, etc.) (from the S3 feature set), after standardization [0,1], j=1,2,...,n (n is the total number of numerical features);

[0154] Data layer fixed weights (based on the analytic hierarchy process, determined by scores from 5 security experts), expert consensus. ;

[0155] : The historical abnormal sample mean of the j-th numerical feature (from the abnormal data of the past 90 days stored in S1-S3, such as "transmission rate abnormal sample" refers to the transmission rate data that caused security incidents in history), statistically calculated, [0,1];

[0156] The cosine similarity function is used to calculate the similarity between the current feature and historical abnormal features. The result is [0,1].

[0157] The "real-time contribution" of the j-th numerical feature of the i-th evaluation object in Algorithm A (reflecting the degree of influence of the feature on the current situation) is calculated as [0,1].

[0158] Algorithm A assigns a "dynamic weight" to the j-th numerical feature of the i-th evaluation object. After calculation... ;

[0159] The "dynamic weight fusion value" (fusion result after data layer enhancement) of the i-th evaluation object output by Algorithm A is calculated to be [0,1].

[0160] (2) Derivation and logical explanation of core formulas

[0161] Algorithm A's calculation process consists of three steps, gradually transforming the "feature contribution" into the "dynamic fusion value":

[0162] Step 1: Calculate real-time contribution

[0163] Real-time contribution measures current features Historical anomalies The higher the similarity, the more likely the feature is to point to a security risk and the greater its contribution.

[0164] ;

[0165] molecular The similarity between the current feature and similar historical anomaly features, such as the current value of the "transmission rate" feature. =0.9 and historical outlier mean The similarity of 0.8 is Sim(0.9,0.8)=0.98;

[0166] denominator The maximum similarity of all numerical features of the current evaluation object (avoiding the dominance of a single feature) plus the minimum value. (To prevent the denominator from being 0);

[0167] result The larger the value, the more significant the impact of the feature on the current situation.

[0168] Step 2: Calculate dynamic weights

[0169] Dynamic weights are adjusted based on "fixed weights" and "real-time contribution," giving higher weights to features with higher contributions while ensuring that the total weights are 1.

[0170] ;

[0171] Logical explanation:

[0172] Fixed weight Ensure the fundamental impact of expert experience (e.g., "total number of alarms" has a fixed weight due to its high importance). =0.3);

[0173] Contribution Normalization process ( To ensure the rationality of dynamic adjustments, for example, if the contribution of a certain feature is twice that of other features, its dynamic weight will be increased accordingly.

[0174] Step 3: Calculate the dynamic weight fusion value

[0175] The fusion value is a weighted sum of dynamic weights and eigenvalues, comprehensively reflecting the overall trend of the evaluated object in terms of numerical characteristics.

[0176] ;

[0177] 3. Model Training Process

[0178] To ensure the accuracy of the "real-time contribution" calculation for Algorithm A, the model parameters need to be trained using historical data:

[0179] (1) Training data preparation

[0180] Input data: 12 categories of numerical features extracted by S3 (4 categories of network traffic: average transmission rate, total number of data packets, protocol type ratio, connection frequency; 3 categories of terminals: number of process starts, number of abnormal behaviors, CPU utilization; 3 categories of security devices: total number of alarms, number of high-level alarms, alarm interval; 2 categories of applications: average response time, total number of error codes).

[0181] Tag data: Five security experts labeled the “feature contribution” of 5,000 historical abnormal samples (1-5 points, standardized to [0,1]). For example, in the sample “abnormal transmission rate caused DDoS attack”, the “transmission rate” feature contribution was labeled as 0.9.

[0182] (2) Training objectives and optimization

[0183] Objective function: Minimizes the model output. Mean squared error (MSE) compared to expert-annotated values:

[0184] ;

[0185] N=5000 is the number of samples, and n=12 is the number of features; Let be the loss function of algorithm A, representing the degree of deviation between the model's prediction and the actual result; Calculate for algorithm A ( Let represent the contribution of the j-th numerical feature of the i-th evaluation object (representing the model's predicted value). Expert annotations in Algorithm A ( The contribution of the j-th numerical feature of the i-th evaluation object (representing the true value of the annotation);

[0186] Optimization process: Gradient descent method is used, with a learning rate of... =0.01, iterate 100 times, update in each round (Historical outlier mean), until <0.001 ensures that the calculation error of the model's "contribution" is within an acceptable range.

[0187] 4. Model Application Process

[0188] Taking the evaluation target i=1 (an IP address suspected of launching a DDoS attack) as an example, the application process is explained in detail:

[0189] (1) Input data (12 types of numerical features from the S3 feature set)

[0190]

[0191] (2) Calculation steps

[0192] Step 1: Calculate real-time contribution

[0193] Taking j=1 (average transmission rate) as an example:

[0194] ;

[0195] The maximum similarity of all features is Sim=0.99 for j=4 (connection frequency);

[0196] Therefore .

[0197] Similarly, calculate all 12 features. The results are as follows (partial):

[0198] , , , , (Network and security equipment features contribute significantly).

[0199] , (Low contribution of terminal features).

[0200] Step 2: Calculate dynamic weights

[0201] molecular: For example, j=1: 0.1×0.99=0.099;

[0202] Denominator: Sum of all numerators = 0.099 + 0.097 + 0.005 + 0.148 + 0.015 + 0.02 + 0.025 + 0.147 + 0.099 + 0.005 + 0.06 + 0.018 ≈ 0.738;

[0203] Therefore =0.099 / 0.738≈0.134 (an improvement compared to a fixed weight of 0.1). =0.148 / 0.738≈0.201 (a significant improvement compared to a fixed weight of 0.15).

[0204] Step 3: Calculate the dynamic weight fusion value

[0205] =0.134×0.9+0.131×0.85+...+0.024×0.25≈0.89 (Due to the increased weight of network and security device features, the fusion value is significantly higher, which is consistent with the characteristics of a DDoS attack).

[0206] (3) Output Results and Interaction

[0207] Data layer enhancement results: =0.89 was used as the numerical feature fusion result for this IP address, replacing the original fixed weight fusion value (the original result was 0.75).

[0208] Interaction with the feature layer: (like =0.134) is transmitted to the feature layer to correct the evidence body weight of the corresponding classification feature in the DS evidence theory (for example, the evidence body weight of the classification feature "proportion of protocol type" corresponding to "transmission rate" is corrected from 1 to 0.134).

[0209] III. Algorithm 2: Bayesian Inference Algorithm Enhanced with Attention Mechanism (Algorithm B) – Decision Layer Enhancement

[0210] 1. Necessity of Algorithm Design

[0211] The decision-making layer's Bayesian inference assigns equal weight to all categorical features, failing to highlight the impact of key features (such as the "intrusion attempt" alert type). For example, when a terminal simultaneously exhibits both "unknown process initiation" (high risk) and "login outside working hours" (medium risk), the algorithm treats both equally, potentially underestimating the risk. Algorithm B, through an attention mechanism, dynamically allocates weights based on feature importance, improving decision accuracy.

[0212] 2. Model building process

[0213] (1) Definition of core parameters

[0214] : The DS fusion result of the k-th classification feature of the i-th evaluation object (from the feature layer, i.e., the probability that the feature belongs to a certain category), [0,1]. (M is the total number of classification features);

[0215] : The dynamic weight fusion value of the i-th evaluation object output by Algorithm A (output of the preceding algorithm, used to enhance attention), [0,1];

[0216] The "attention weight" (reflecting the importance of this feature in decision-making) of the k-th classification feature of the i-th evaluation object in Algorithm B is calculated as follows: ;

[0217] Security posture level set: (Safety), (generally), (Danger), (Extremely dangerous), discrete value;

[0218] Prior probability of situation level S (based on statistical data from the past year). =1, such as =0.1;

[0219] : The conditional probability of classification feature k under situation S (the frequency of this feature appearing in situation S in historical data), [0,1], such as =0.8;

[0220] The "posterior probability of attention enhancement" (the final probability of a certain situation level) output by Algorithm B is calculated after... =1.

[0221] (2) Derivation and logical explanation of core formulas

[0222] Algorithm B's computation process consists of two steps, realizing the transformation from "attention weights" to "enhanced posterior probabilities":

[0223] Step 1: Calculate attention weights

[0224] Attention weights are derived from the feature layer DS fusion result. "and "dynamic fusion value of Algorithm A "Joint decision-making" The higher the value (the more likely the feature points to an anomaly), The higher the level (the more the data layer tends to be abnormal), the greater the attention weight of that feature.

[0225] ;

[0226] Logical explanation:

[0227] As an "enhancing factor", when When the value is high (e.g., 0.89), the factor is amplified. The effect (e.g., 1 + 0.89 = 1.89) makes high The weights of features were significantly increased;

[0228] when When the value is low (e.g., 0.3, which is normal), the enhancement factor is close to 1 (1+0.3=1.3), the weight distribution is more balanced, and it meets the needs of normal scenarios.

[0229] Step 2: Calculate the posterior probability of attention enhancement

[0230] Based on Bayes' theorem, attention weights are used. The impact of adjusting conditional probabilities: The higher the weight of a feature, the greater its conditional probability contributes to the posterior probability.

[0231] ;

[0232] Logical explanation:

[0233] The numerator is the product of prior probability and weighted conditional probability, where This represents the adjustment of the attention weights to the conditional probability (the higher the weight, the greater the impact on the conditional probability).

[0234] The denominator is the sum of the numerators of all situation levels, ensuring that the sum of the posterior probabilities is 1.

[0235] 3. Model Training Process

[0236] To ensure the accuracy of the attention weights and posterior probability calculations in Algorithm B, it needs to be trained using historical data:

[0237] (1) Training data preparation

[0238] Input data: DS fusion results of 8 categories of classification features output by the feature layer. (Network traffic is categorized into two types: protocol type and connection mode; terminals are categorized into two types: process type and login time period; security devices are categorized into two types: alarm type and alarm level; applications are categorized into two types: error type and operation type); Algorithm A output ;

[0239] Tag data: True situational level of 3000 historical samples ( The security team will label the results of the handling (e.g., "DDoS attack" corresponding to...). ).

[0240] (2) Training objectives and optimization

[0241] Objective function: Minimize the cross-entropy loss between the posterior probability of the model output and the true label.

[0242] ;

[0243] =1 if the true situation of sample i is S, otherwise 0;

[0244] Optimization process: The Adam optimizer is used, and the learning rate is... =0.005, iterate 80 times, update in each round and until Convergence (five consecutive rounds of fluctuation < 0.002).

[0245] 4. Model Application Process

[0246] Taking the evaluation target i=1 (a certain IP address, suspected of being under DDoS attack) as an example, the application process is explained as follows:

[0247] (1) Input data

[0248] Feature layer DS fusion results (8 categories of classification features, some of which are shown below):

[0249] k=1 (Alarm type: Intrusion attempt): =0.9;

[0250] k=2 (Alarm Level: High): =0.85;

[0251] k=3 (Protocol type: UDP): =0.92;

[0252] The remaining values ​​are k=4-8: ≤0.1 (small impact).

[0253] Algorithm A output: =0.89.

[0254] Bayesian parameters:

[0255] Prior probability: =0.6, =0.25, =0.1, =0.05;

[0256] Conditional probability (partial): =0.8, =0.95; =0.75, =0.9.

[0257] (2) Calculation steps

[0258] Step 1: Calculate attention weights

[0259] Enhancer =1.89;

[0260] Molecules (k=1): ×1.89=0.9×1.89=1.701;

[0261] Molecular weight (k=2): 0.85 × 1.89 ≈ 1.607;

[0262] Denominator: Sum of all numerators = 1.701 + 1.607 + 0.92 × 1.89 + ... ≈ 3.5;

[0263] Therefore =1.701 / 3.5≈0.486, =1.607 / 3.5≈0.459 (the two together account for 94.5%, highlighting key characteristics).

[0264] Step 2: Calculate the posterior probability of attention enhancement

[0265] by (Danger) and (Extremely dangerous) as an example:

[0266] Molecules: ;

[0267] Molecules: ;

[0268] Denominator: Molecular + Molecular + Molecular + The numerator is approximately 0.001 + 0.01 + 0.0656 + 0.0442 ≈ 0.1208.

[0269] Therefore =0.0656 / 0.1208≈0.543, =0.0442 / 0.1208≈0.366 (the sum of the two is 0.909, which meets the characteristics of high risk).

[0270] (3) Output Results and Integration

[0271] Decision-making level enhances outcomes: =0.543, =0.366, compared with the Bayesian result ( =0.4, =0.2) Take the average to obtain the final decision result: =0.471, =0.283;

[0272] Integrated situation feature matrix: This incorporates the features of Algorithm A. =0.89, the DS result after feature layer correction, and the decision result of algorithm B are integrated to form a matrix containing "evaluation object, dynamic fusion value, classification feature fusion probability, and situation level probability", which is then transmitted to S5.

[0273] IV. Algorithmic Interaction and Core Contributions of S4

[0274] 1. Deep interaction between algorithms

[0275] Algorithm A → Feature Layer DS Evidence Theory:

[0276] Algorithm A As an evidence body weight correction factor, for example, if the dynamic weight of the "transmission rate" feature is 0.134, then the evidence body weight of its corresponding classification feature "protocol type" is corrected from 1 to 0.134, so that features with high contribution in the data layer still maintain high influence in classification fusion.

[0277] Algorithm A → Algorithm B:

[0278] Algorithm A Through enhancement factor 1+ Directly affects the attention weights of Algorithm B .when When the value is 0.89 (high risk), the enhancement factor amplifies the weight of key classification features (e.g., =0.486); when When the risk level is 0.3 (low risk), the weight distribution is more balanced (e.g., ...). =0.3), to achieve dynamic linkage between "data layer status quo → decision layer weight".

[0279] Feature layer DS → Algorithm B:

[0280] Feature layer It is the core input to the attention weights of Algorithm B. The higher the probability (e.g., 0.9 for an "intrusion attempt"), the better. The larger the value, the more reliable the feature in the classification feature fusion result will play a leading role in the decision-making process.

[0281] 2. Core Contributions

[0282] Improved fusion accuracy: Dynamic weights solve the static problem of fixed weights, and the attention mechanism solves the problem of insufficient attention to key features. According to the test, the optimized fusion results improved the matching degree with the real situation by 23% (based on 1000 test samples).

[0283] Enhanced robustness: The interaction between algorithms enables the fusion process to adapt to different situations (normal / abnormal). In the event of a sudden attack (such as DDoS), the weight of abnormal features is automatically increased to avoid missed detection.

[0284] Strengthening the connection with S5: The "Dynamic Fusion Value" provides S5 with a more accurate numerical assessment indicator, making the S5 situation level classification more in line with actual risks.

[0285] V. Summary

[0286] S4 achieves deep fusion of multi-source data by introducing a "dynamic weight optimization algorithm" and an "attention-enhanced Bayesian inference algorithm." The interaction between algorithms ensures the continuity of data flow, making the fusion results more reflective of the true security situation. This provides high-quality input for S5's situation assessment and lays the foundation for accurate early warning and response from the intelligent security platform.

[0287] S5: Security Situation Assessment – ​​Precise Assessment Based on Enhanced Fusion Results

[0288] This step, based on the enhanced situational awareness matrix output by S4, adjusts the evaluation index system and weight calculation method to achieve accurate situational awareness assessment of the network, terminals, security devices, and application systems. The assessment results are transmitted to S6 for anomaly detection. The situational awareness assessment-anomaly detection process is as follows: Figure 3 As shown.

[0289] 1. Evaluation index system (adapted to S4 output)

[0290] Indicators related to S4:

[0291] Dynamic risk indicators: output by Algorithm A (The threshold is set to 0.7; if it is exceeded, it will be marked as a data layer anomaly).

[0292] Attention weight metric: in Algorithm B Categorical features with a value of ≥0.4 (considered high-impact features and require close attention);

[0293] Posterior probability index: the output of Algorithm B (Danger) and The sum of (extremely dangerous) values ​​(threshold set at 0.6; values ​​exceeding this are marked as decision-making level anomalies).

[0294] Complete set of evaluation indicators (16 items in total):

[0295] Network security indicators (4 items): including dynamic risk indicators, frequency of abnormal connections, etc.;

[0296] Endpoint security metrics (4 items): including attention weight metrics (process type characteristics), etc.;

[0297] Equipment safety indicators (4 items): including posterior probability indicators, etc.;

[0298] Application security metrics (4 items): including attention weights with error type characteristics, etc.

[0299] 2. Dynamic calculation of indicator weights (combined with S4 results)

[0300] The comprehensive weight is calculated by fusing the entropy weight method with the dynamic weight of S4. :

[0301] ;

[0302] The weights calculated using the entropy weight method (reflecting the information value of the indicators);

[0303] The dynamic weights output by S4 algorithm A (reflecting the real-time importance of the indicators);

[0304] The weighting coefficients (0.6 and 0.4) were determined through verification using historical data to balance the value of static information with its dynamic importance.

[0305] 3. Situation assessment value and level determination

[0306] Single object evaluation value:

[0307] ;

[0308] in The standardized value of the j-th indicator for the i-th evaluation object (from the S4 matrix).

[0309] Overall situation assessment value:

[0310] ;

[0311] in The average evaluation value of a certain type of object. Type weights (network 0.3, terminal 0.25, device 0.25, application 0.2).

[0312] Level determination:

[0313] →Safe; (0.3,0.6]→Moderate; (0.6,0.8]→Dangerous; (0.8,1]→Extremely dangerous.

[0314] The evaluation results include "single object score, average score of type, overall score, and situation level", which are transmitted to S6 for anomaly detection.

[0315] S6: Anomaly Detection and Feedback – Root Cause Tracing Based on Accurate Assessment

[0316] This step utilizes the situation assessment results from S5 and the enhanced feature matrix from S4 to achieve precise anomaly localization and cause analysis, and generates feedback information to optimize the front-end steps (S2 and S1).

[0317] 1. Multi-level strategy for anomaly detection

[0318] Data layer anomaly detection:

[0319] If S4 >0.7 (dynamic risk threshold), combined with the numerical characteristics of S3, to locate abnormal numerical characteristics (such as transmission rate). A value greater than 0.85 was marked as a "data layer anomaly".

[0320] Feature layer anomaly detection:

[0321] If the probability of a certain category in the feature layer DS fusion result is >0.8 (e.g., the probability of "intrusion attempt" is 0.9), and the corresponding attention weight... A value >0.5 is marked as "feature layer anomaly".

[0322] Anomaly detection at the decision-making level:

[0323] If the S5 assessment level is "dangerous" or "extremely dangerous", and A value >0.8 is marked as "decision-level anomaly".

[0324] 2. Source tracing methods for anomaly cause analysis

[0325] By combining the fusion results of S4, the root cause of the anomaly can be traced:

[0326] If the data layer is abnormal, retrieve the original network traffic data of S1 (such as the packet content of the abnormal IP) to determine whether it is a DDoS attack (characteristics: high transmission rate + UDP protocol ratio > 90%).

[0327] If the anomaly is at the feature layer, associate it with the classification features of S3 (e.g., "blacklist process startup" probability 0.95), and combine it with the original terminal log data to locate the virus infection (features: unfamiliar process + high CPU usage).

[0328] If the decision-making level is abnormal, the abnormality type (malicious attack / device failure / configuration error / user misoperation) is determined by combining the dynamic fusion value of S4 and the posterior probability.

[0329] 3. Generation and transmission of feedback information

[0330] Feedback to S2: Preprocessing rules that need optimization (e.g., "Adjust the outlier judgment threshold for high UDP traffic").

[0331] Feedback to S1: The data source for data collection needs to be enhanced (e.g., "For the network segment where the abnormal IP is located, increase the traffic collection frequency to 10 seconds / time").

[0332] Feedback information is transmitted in a structured format to ensure that front-end steps can automatically adjust strategies.

[0333] S7: Output Results and Response Triggering – Dynamic Response Based on Full-Process Data

[0334] This step receives the situation assessment results from S5 and the anomaly report from S6, outputs a structured assessment result, triggers precise response measures based on the situation level, and simultaneously feeds back the response effect to the front-end steps. The response measures - closed-loop optimization process is as follows: Figure 4 As shown.

[0335] 1. Structured content of the output results

[0336] Core assessment results:

[0337] Overall situation level (safe / moderate / dangerous / extremely dangerous) and corresponding value;

[0338] Average scores and rankings of each type of object (network / terminal / device / application) (from highest to lowest risk);

[0339] High-risk object list (single object) >0.7) and associated S4 eigenvalues ​​(such as =0.89、 =0.486).

[0340] Anomaly Details Report:

[0341] Anomaly types (data layer / feature layer / decision layer) and trigger thresholds;

[0342] Anomaly-related characteristics (e.g., "Intrusion attempt alarm, probability 0.9");

[0343] Abnormal timestamps and duration (calculated based on S1 collection timestamps).

[0344] 2. Tiered triggering of response measures (based on S5 level)

[0345] Security level ( ≤0.3):

[0346] Routine monitoring: Maintain S1 data collection frequency and generate a security report every 24 hours;

[0347] Feature Update: The feature extraction rules for S3 are updated weekly.

[0348] General level (0.3 < ≤0.6):

[0349] Enhanced monitoring: The frequency of network traffic and security alarm collection in S1 is doubled;

[0350] Warning notification: Send an email to the security administrator, with attachment A list of objects exceeding 0.5.

[0351] Hazard level (0.6 < ≤0.8):

[0352] Emergency Response: Automatic Blocking IP addresses with a value >0.8 (via firewall API);

[0353] Technical intervention: Notify engineers to investigate within 15 minutes. Features >0.6 (such as high-risk alarms).

[0354] Extremely dangerous level ( >0.8):

[0355] Disaster recovery switchover: Activate the core business disaster recovery system (based on S4 application system risk assessment).

[0356] Expert Support: Contact the emergency response team to provide a complete data chain from S4 to S6 (including...) , wait).

[0357] 3. Closed-loop feedback of response effect

[0358] Feedback to S1: Add the blocked IP addresses to the data collection blacklist to reduce invalid data;

[0359] Feedback to S5: After response The magnitude of the decrease (e.g., a decrease of 0.3 after blocking) is used to optimize the weighting of evaluation indicators;

[0360] Feedback to S4: Response measures and Effects (such as after blocking) (From 0.89 to 0.2), used for algorithm parameter iteration.

[0361] Summary of the entire collaborative logic process

[0362] 1. Data flow closed loop: The forward flow of S1→S2→S3→S4→S5→S6→S7 and the reverse feedback of S6→S2 and S7→S1 / S5 / S4 form a closed loop to ensure the continuity of data between each step.

[0363] 2. Core of Algorithm Collaboration: Algorithms A and B in S4 serve as the central processing unit, respectively processing the numerical and classification features of S3. The output enhanced matrix runs through S5 to S7, becoming the core basis for situation assessment, anomaly detection, and response.

[0364] 3. Dynamic Adaptability: Each step dynamically adjusts its strategy through a feedback mechanism (such as the preprocessing rules of S2 and the acquisition frequency of S1), enabling the entire fusion analysis process to adapt to different security situations and improve the practical effectiveness of the intelligent security platform.

[0365] In some embodiments, an algorithmic collaboration mechanism is established: a dynamic weight-attention bidirectional interaction model.

[0366] To strengthen the fusion and correlation between Algorithm A (dynamic weight optimization) and Algorithm B (attention mechanism Bayesian inference), a two-way interaction is introduced. This allows the dynamic weights of Algorithm A to adjust the attention weights of Algorithm B through feature influence factors, while the posterior probability of Algorithm B optimizes the real-time contribution calculation of Algorithm A through decision feedback factors, forming a closed-loop collaboration. The feature extraction-fusion collaboration process combining two-way interaction is as follows: Figure 2 As shown.

[0367] I. Construction of a bidirectional interaction model between Algorithm A and Algorithm B

[0368] 1. Core Parameter Definition

[0369] Feature Influence Factor: The influence coefficient of algorithm A on algorithm B, reflecting the correlation between numerical feature j and classification feature k, [0,1];

[0370] Decision feedback factor: The feedback coefficient of algorithm B to algorithm A, which is adjusted based on the posterior probability to determine the real-time contribution, [0,1];

[0371] Dynamic weights of Algorithm A after optimization by decision feedback factors (revised parameters) =1;

[0372] Attention weights in Algorithm B (revised parameters) after correction by feature influence factors. =1.

[0373] 2. Derivation of the two-way interactive formula

[0374] (1) Algorithm A → Algorithm B: Feature Influence Factor Adjustment of Attention Weight

[0375] Characteristic Influence Factors The correlation between numerical feature j and categorical feature k is measured by calculating their mutual information (e.g., a high correlation between transmission rate and the proportion of UDP protocol).

[0376] ;

[0377] Where MI(a,b) is the mutual information function, calculated as follows:

[0378] ;

[0379] based on Adjust the attention weights of Algorithm B:

[0380] ;

[0381] Logical explanation: Feature pairs with high correlation (such as network traffic numerical features and protocol type classification features) will receive higher attention weights, strengthening the correlation between the data layer and the feature layer.

[0382] (2) Algorithm B → Algorithm A: Optimization of dynamic weights by decision feedback factors

[0383] Decision feedback factors The posterior probability calculation based on Algorithm B reflects the decision-making level's trust in the data layer:

[0384] ;

[0385] That is, the sum of the posterior probabilities of the dangerous and extremely dangerous levels. The higher the value, the higher the risk that the decision-makers believe the current situation is.

[0386] based on Optimize the real-time contribution of algorithm A :

[0387] ;

[0388] This leads to optimization of dynamic weights:

[0389] ;

[0390] Logical explanation: When the decision-making level determines that the risk is high ( When the value is large, the real-time contribution of numerical features is amplified, making the data layer weights more sensitive to potential threats.

[0391] II. Complete Algorithm Collaboration Process

[0392] 1. Model building process

[0393] Step 1: Initialize the feature correlation matrix

[0394] The mutual information between all numerical features j and categorical features k is calculated using historical data to construct a basic correlation matrix. , as the initial value of the characteristic influence factor.

[0395] Step 2: Setting the feedback coefficient threshold

[0396] Based on historical decision-making data, set Valid interval: when When <0.3, the decision-making level provides weak feedback to the data layer; when When the value is ≥0.3, the feedback strength increases linearly with the increase of the value.

[0397] Step 3: Design of a bidirectional iterative mechanism

[0398] The outputs of Algorithm A and Algorithm B are iteratively optimized through the following process:

[0399] 1. Initial dynamic weights →Calculation →Correction ;

[0400] 2. Based on calculate →Get →Optimization ;

[0401] 3. Repeat steps 1-2 until the weight change rate between two iterations is <0.01 (convergence condition).

[0402] 2. Model Training Process

[0403] Training data: 6000 historical samples were selected (including 3000 normal data and 3000 abnormal data). Each sample contains:

[0404] 12 types of numerical features ;

[0405] 8 categories of classification features ;

[0406] Manually labeled true situation level ( ).

[0407] Training objective: Minimize the joint loss function :

[0408] ;

[0409] The MSE of the dynamic fusion value after algorithm A optimization versus the true risk value; Let be the cross-entropy between the posterior probability corrected by Algorithm B and the true label.

[0410] Optimization process: The Adam optimizer is used, and the learning rate is... 0.005, iterating 100 times, updating in each round. Matrix and The calculation parameters, until <0.005.

[0411] 3. Model Application Process (Complete Example)

[0412] Taking the evaluation target i=1 (suspected DDoS attack IP) as an example, the interaction process is shown:

[0413] Step 1: Basic calculations (using the results of the original algorithm)

[0414] Algorithm A: =[0.99,0.97,...,0.3] (partial values). =[0.134,0.131,...,0.024];

[0415] Algorithm B: =[0.486,0.459,...,0.005], =0.543, =0.366.

[0416] Step 2: Calculate the characteristic influence factors

[0417] The mutual information MI between numerical feature j=1 (transmission rate) and classification feature k=3 (UDP protocol share) is 0.82 (maximum value).

[0418] Therefore =0.82 / 0.82=1.0, other feature pairs The value is between 0.2 and 0.9.

[0419] Step 3: Adjust the attention weights of Algorithm B

[0420] Taking k=3 as an example: numerator = 0.05 × (1.0 + 1) = 0.1;

[0421] Denominator = 0.486 × 1.2 + 0.459 × 1.1 + ... + 0.1 ≈ 1.8;

[0422] Therefore =0.1 / 1.8≈0.056 (an improvement compared to the original 0.05, due to high correlation).

[0423] Step 4: Calculate decision feedback factors

[0424] =0.543+0.366=0.909 (High-risk feedback).

[0425] Step 5: Optimize the dynamic weights of Algorithm A

[0426] After optimization =0.99×(1+0.909)≈1.89;

[0427] New dynamic weights =0.1×1.89 / 1.243≈0.152 (an improvement compared to the original 0.134).

[0428] Step 6: Iterative convergence

[0429] After two iterations, the weight change rate = 0.008 < 0.01, and the final result is output:

[0430] Algorithm A: =0.92 (an improvement over the original 0.89, more sensitive to risk);

[0431] Algorithm B: =0.41 (an increase from the original 0.366, indicating that decision-makers are more inclined to high-risk).

[0432] III. Core Contributions of Algorithm Collaboration

[0433] 1. Breaking algorithm independence: through and This enables cross-layer association between numerical features and classification features, making the fusion results more consistent.

[0434] 2. Enhance risk sensitivity: In high-risk scenarios, the decision feedback factor amplifies the weight of numerical features, and the attention weight is tilted towards highly correlated features, which improves the platform's speed of identifying attacks such as DDoS and virus infections (for example, an attack that takes 5 minutes to confirm in the original algorithm can be identified in 2 minutes after optimization).

[0435] 3. Enhance the explanatory power of decision-making: Characteristic influencing factors It can directly output strongly correlated feature pairs such as transmission rate and UDP protocol, providing security personnel with clear evidence of why a risk is identified, thus solving the black box problem of traditional fusion algorithms.

[0436] IV. Full-Process Algorithm Association Explanation

[0437] 1. S3→S4: Extracted from S3 and These are used as inputs to Algorithm A and Algorithm B, respectively, and the feature definitions correspond strictly one-to-one with the algorithm parameters (e.g., j=1 always represents the transmission rate).

[0438] 2. Algorithm A → Feature Layer DS: As an evidence weight correction factor, for example, the dynamic weight of transmission rate of 0.152 is mapped to the evidence weight of protocol type feature.

[0439] 3. Feature Layer DS → Algorithm B: Corrected and They jointly participate in the calculation of posterior probability to ensure the accurate impact of the classification feature fusion results on decision-making.

[0440] 4. S4→S5: Algorithm A And Algorithm B As an S5 evaluation indicator, it directly affects Calculation (e.g.) The weighting percentage has been increased to 0.3%.

[0441] 5. S6→S4: The anomaly type detected by S6 (such as data layer anomaly) is fed back to... The calculation parameters are adjusted to control the feedback strength (e.g., when there is an anomaly in the data layer). (weight increase).

[0442] Through the above optimizations, a complete closed loop is formed between the algorithms: numerical features → dynamic weights → attention correction → decision feedback → weight optimization. This upgrades multi-source data fusion from hierarchical processing to collaborative reasoning, significantly improving the situational awareness accuracy and response speed of the intelligent security platform.

Claims

1. A method for multi-source situational data fusion and analysis of an intelligent security platform, characterized in that, include: S1: Collect multi-source data, which includes numerical data and categorical data. The numerical data includes network traffic transmission rate, total number of data packets, and terminal CPU utilization. The categorical data includes alarm types, alarm levels, and error types of application systems. S2: Clean and standardize the numerical data and categorical data to obtain numerical standardized data and categorical standardized data, respectively; S3: Extract numerical features from the numerical standardized data, and extract categorical features from the categorical standardized data; S4: Based on the numerical features, calculate the dynamic weights and dynamic fusion values ​​using a dynamic weight optimization algorithm. The dynamic weights are determined by the similarity between the numerical features and historical anomaly features. The dynamic fusion value is the weighted sum of the dynamic weights and the numerical features. Based on the categorical features, calculate the categorical feature fusion probability using DS evidence theory. Then, based on the dynamic fusion value and the categorical feature fusion probability, calculate the attention weights and the posterior probability of attention enhancement using an attention-enhanced Bayesian inference algorithm to obtain the enhanced situation feature matrix. S5: Perform a security situation assessment based on the enhanced situation feature matrix to obtain the situation assessment result; S6: Based on the situation assessment results and the enhanced situation feature matrix, perform anomaly detection and locate the anomaly type; S7: Based on the situation assessment results and anomaly types, output a structured assessment report and trigger response measures, while feeding back the response effect to S1, S2, S4, and S5 to optimize the parameters of each step; In step S4, the process of calculating dynamic weights by the dynamic weight optimization algorithm includes: calculating the real-time contribution of numerical features and historical abnormal features through cosine similarity, and adjusting the dynamic weights based on the real-time contribution and preset fixed weights. The dynamic weights are used to correct the evidence body weights in the DS evidence theory. In step S4, the process of calculating attention weights by the Bayesian inference algorithm includes: the fusion probability of classification features based on categorical features and the dynamic fusion value output by the dynamic weight optimization algorithm; amplifying the influence of high-risk features through an enhancement factor, wherein the enhancement factor is the sum of 1 and the dynamic fusion value; and the attention weights are used to adjust the degree of influence of conditional probability in Bayesian inference.

2. The multi-source situational data fusion and analysis method for an intelligent security platform according to claim 1, characterized in that, In step S4, the interaction process between the dynamic weight optimization algorithm and the Bayesian inference algorithm includes: the dynamic fusion value output by the dynamic weight optimization algorithm is used as the input parameter of the Bayesian inference algorithm to participate in the attention weight calculation; the dynamic weight output by the dynamic weight optimization algorithm is used to correct the fusion weight of the categorical features in the DS evidence theory, so that the fusion results of numerical features and categorical features are associated.

3. The multi-source situational data fusion and analysis method for an intelligent security platform according to claim 1, characterized in that, In step S6, feedback is sent to S2 regarding the optimization requirements for preprocessing rules, which include outlier filling strategies and invalid data filtering rules; feedback is also sent to S1 regarding the adjustment requirements for data collection strategies, which include collection frequency and key monitored data sources.

4. The multi-source situational data fusion and analysis method for an intelligent security platform according to claim 1, characterized in that, In step S7, a closed-loop feedback is formed: the change value of the situation assessment result after the implementation of the response measures is fed back to S5 to optimize the index weights of the situation assessment; the change value of the enhanced situation feature matrix after the response is fed back to S4 to iterate the parameters of the dynamic weight optimization algorithm and the Bayesian inference algorithm.

5. The multi-source situational data fusion and analysis method for an intelligent security platform according to claim 1, characterized in that, When performing a security situation assessment in step S5, the assessment index system includes dynamic risk index, attention weight index, and posterior probability index. The dynamic risk index is the dynamic fusion value output by the dynamic weight optimization algorithm, the attention weight index is the classification feature with a weight of not less than 0.4 in the Bayesian inference algorithm, and the posterior probability index is the sum of the probabilities of the danger level and the extremely dangerous level output by the Bayesian inference algorithm.

6. The multi-source situational data fusion and analysis method for an intelligent security platform according to claim 1, characterized in that, The process of locating the anomaly type in step S6 includes: when the dynamic fusion value exceeds the first threshold, it is determined to be a data layer anomaly; when the classification feature fusion probability exceeds the second threshold and the corresponding attention weight exceeds the third threshold, it is determined to be a feature layer anomaly; when the overall situation level is dangerous or extremely dangerous and the sum of the probabilities of the dangerous level and the extremely dangerous level exceeds the fourth threshold, it is determined to be a decision layer anomaly.

7. The multi-source situational data fusion and analysis method for an intelligent security platform according to claim 4, characterized in that, The termination conditions for the closed-loop feedback include: after three consecutive iterations, the overall situational level in the situational assessment results remains at the safe level and the anomaly rate of anomaly detection is lower than a preset threshold, or the adjustment range of parameters in each step is less than a preset adjustment threshold.

8. A multi-source situational data fusion and analysis system for an intelligent security platform, characterized in that, The multi-source situational data fusion and analysis method for the intelligent security platform according to any one of claims 1 to 7, wherein the multi-source situational data fusion and analysis system of the intelligent security platform comprises: The data acquisition module is used to collect multi-source data, which includes numerical data and categorical data. The numerical data includes the transmission rate of network traffic, the total number of data packets, and the CPU utilization of the terminal. The categorical data includes the alarm types and alarm levels of security devices and the error types of application systems. The processing module is used to clean and standardize the numerical data and categorical data to obtain numerical standardized data and categorical standardized data, respectively. The extraction module is used to extract numerical features from the numerical standardized data and extract categorical features from the categorical standardized data. The feature module is used to calculate dynamic weights and dynamic fusion values ​​based on the numerical features using a dynamic weight optimization algorithm. The dynamic weights are determined by the similarity between the numerical features and historical anomaly features, and the dynamic fusion values ​​are the weighted sum of the dynamic weights and the numerical features. Based on the categorical features, the module calculates the categorical feature fusion probability using DS evidence theory, and then calculates the attention weights and attention-enhanced posterior probabilities using an attention-enhanced Bayesian inference algorithm based on the dynamic fusion values ​​and categorical feature fusion probabilities to obtain an enhanced situational feature matrix. The assessment module is used to perform a security situation assessment based on the enhanced situation feature matrix and obtain the situation assessment result. The detection module is used to perform anomaly detection and locate the anomaly type based on the situation assessment results and the enhanced situation feature matrix. The feedback module is used to output a structured assessment report based on the situation assessment results and anomaly types and trigger response measures. At the same time, it feeds back the response effect to the acquisition module, processing module, feature module, and assessment module to optimize the parameters of each step.

Images