Network intrusion intelligent security detection method and system based on behavior analysis

Abstract

The application provides a network intrusion intelligent security detection method and system based on behavior analysis, relates to the technical field of network security, and first captures a behavior logic segment of an access subject in a network environment, forms a behavior logic segment set containing operation behavior logic relationship records and the like, then reconstructs an intention conduction chain reflecting a behavior intention transmission path based on the behavior logic segment set, then nodeizes and disassembles the intention conduction chain to obtain an intention conduction node set, reversely logically deduces and matches the intention conduction node set with a preset intrusion intention node library, obtains a deduction matching result, finally positions an intrusion intention initial conduction node and a full-link conduction path according to the deduction matching result, generates and sends a network intrusion security detection instruction to a security response system, and the application improves the accuracy and timeliness of network intrusion detection and guarantees network environment security.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a network intrusion intelligent security detection method and system based on behavior analysis. Background Technology

[0002] In today's digital age, the internet has become an indispensable part of people's lives and work, making the security and stability of the network environment crucial. However, frequent network intrusion incidents cause significant losses to individuals, businesses, and even nations. Traditional network intrusion detection methods primarily rely on rule-based and feature-based detection.

[0003] Rule-based detection requires pre-defining a set of explicit rules; when network behavior conforms to these rules, it is judged as an intrusion. However, this method has significant shortcomings. The formulation of rules often relies on known intrusion patterns, making it difficult to effectively identify new and unknown intrusion methods. Moreover, with the increasing complexity of network environments and the continuous evolution of attack methods, the cost of updating and maintaining rules is extremely high, making it difficult to guarantee the timeliness and accuracy of detection.

[0004] Feature-based detection determines the presence of an intrusion by extracting specific features from network traffic or system behavior and comparing them with a known intrusion signature database. However, these methods also have limitations. Feature selection and extraction require specialized knowledge and experience and are easily affected by changes in the network environment and attacker camouflage, leading to high false positive and false negative rates. Therefore, existing network intrusion detection methods struggle to meet the ever-increasing demands of network security. Summary of the Invention

[0005] In view of the aforementioned problems, and in conjunction with the first aspect of the present invention, embodiments of the present invention provide a network intrusion intelligent security detection method based on behavior analysis, the method comprising:

[0006] Capture behavioral logic fragments of all access subjects in the network environment to obtain a set of behavioral logic fragments. The set of behavioral logic fragments includes the operational behavior logic relationship of each access subject, behavior triggering premise, behavior execution consequence and response logic record of the behavior interaction object.

[0007] Based on the set of behavioral logic fragments, the intent transmission chain is reconstructed. The intent transmission chain is a chain structure formed by different behavioral logic fragments according to triggering logic, consequence continuity and interactive response correlation, which reflects the transmission path of the access subject's behavioral intent.

[0008] The intent transmission chain is decomposed into nodes to obtain an intent transmission node set, which includes the core behavioral logic, intent representation, and associated node pointers of each transmission link.

[0009] The set of intent transmission nodes is matched with a preset intrusion intent node library by reverse logical deduction to obtain the deduction matching result. The reverse logical deduction matching starts from each intent transmission node and traces the corresponding intrusion intent node and transmission mode in the intrusion intent node library according to logical association.

[0010] Based on the simulation and matching results, the initial transmission node and the entire transmission path of the intrusion intent are located, a network intrusion security detection command is generated, and the network intrusion security detection command is sent to the security response system.

[0011] In another aspect, embodiments of the present invention also provide a network intrusion intelligent security detection system based on behavior analysis, including a processor and a machine-readable storage medium connected to the processor. The machine-readable storage medium is used to store programs, instructions, or code, and the processor is used to run the programs, instructions, or code in the machine-readable storage medium to implement the above-described method.

[0012] Based on the above, this embodiment of the invention captures behavioral logic fragments of all access subjects in the network environment, constructs a set of behavioral logic fragments, and reconstructs the intent transmission chain based on this set of behavioral logic fragments. This allows the transmission path of the access subject's behavioral intent to be presented, connecting the originally scattered behavioral logics and making the intent transmission process of intrusion behavior visible. The intent transmission chain is decomposed into nodes to obtain a set of intent transmission nodes, further refining the key links of intrusion behavior and clarifying the core behavioral logic, intent representation, and associated node pointers of each transmission link. By performing reverse logical deduction and matching with a preset intrusion intent node library, it is possible to trace back to the corresponding intrusion intent node and transmission mode from each intent transmission node, effectively identifying potential intrusion behaviors and improving the accuracy and comprehensiveness of detection. Based on the deduction and matching results, the initial transmission node and the entire transmission path of the intrusion intent are located, and a network intrusion security detection command is generated and sent to the security response system. This achieves rapid connection from intrusion behavior detection to security response, enabling timely measures to prevent the further development of intrusion behavior, maintaining the security and stability of the network environment, and improving the overall efficiency of intelligent network intrusion security detection. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the execution flow of the network intrusion intelligent security detection method based on behavior analysis provided in the embodiments of the present invention.

[0014] Figure 2 This is a schematic diagram of the hardware architecture of the network intrusion intelligent security detection system based on behavior analysis provided in an embodiment of the present invention. Detailed Implementation

[0015] Figure 1 This is a flowchart illustrating a network intrusion intelligent security detection method based on behavior analysis provided in one embodiment of the present invention, which will be described in detail below.

[0016] Step S110: Capture the behavioral logic fragments of all access subjects in the network environment to obtain a set of behavioral logic fragments. The set of behavioral logic fragments includes the operational behavior logic relationship, behavior triggering premise, behavior execution consequences, and response logic records of the behavior interaction objects of each access subject.

[0017] In this embodiment, an internal office network environment is used as the application scenario to capture behavioral logic segments of all access entities. Access entities include desktop computers, laptops, and mobile office devices used by employees, as well as network devices such as servers, routers, and switches deployed in the network. Behavioral logic segment capture is achieved by deploying a traffic mirroring device at the network egress point to copy and parse all data packets entering and leaving the network in real time. Simultaneously, a behavior collection agent program is installed on the terminal devices to record behavioral events occurring on the terminals, such as process startup, file operations, and network connections.

[0018] The collection of operational behavior logic is achieved by parsing the system logs and application logs of the terminal device. For example, when an employee opens an email client on the terminal and sends an email with attachments, the behavior collection agent records the startup time of the email client process, the triggering order of the email sending operation (e.g., first filling in the recipient's address, then adding the attachment, and finally clicking the send button), and the dependency relationship between this operation and other related behaviors (e.g., selecting an attachment file from the file manager). The prerequisites for triggering the behavior include the preconditions required for the operation to execute. For example, the prerequisites for triggering the email sending operation include the email client being logged into an account, a normal network connection, and the recipient's address being in the correct format. These prerequisites are obtained by monitoring the terminal's network status, account login status, and application configuration information.

[0019] The record of the consequences of an action covers both direct and indirect results generated after the operation is completed. For example, after an email is successfully sent, a successful sending log is generated locally on the terminal, a new email transmission record is added to the mail server, and the recipient's terminal may receive a new email notification. This consequence information is obtained by collecting response data packets from terminal logs, server logs, and network traffic. The response logic record of the action interaction object includes feedback information from other devices or services that interact with the access subject, such as the status code returned by the mail server after receiving a send request, and the response time of the attachment storage server to a file upload request. This response logic is obtained by parsing application layer protocol fields in network data packets and log information from both parties involved in the interaction.

[0020] The behavioral logic fragments captured in the above manner are stored in a structured database. Each fragment contains fields such as access subject identifier, behavior occurrence timestamp, description of operation behavior logic relationship, behavior trigger prerequisite parameters, behavior execution consequence data, and interaction object response logic record, forming a set of behavioral logic fragments.

[0021] Step S120: Reconstruct the intent transmission chain based on the set of behavioral logic fragments. The intent transmission chain is a chain structure formed by different behavioral logic fragments according to triggering logic, consequence continuity and interactive response correlation, which reflects the transmission path of the access subject's behavioral intent.

[0022] Within an enterprise's internal office network environment, the intent transmission chain is reconstructed based on the set of behavioral logic fragments obtained in step S110. This reconstruction process involves connecting the dispersed behavioral logic fragments into an ordered chain structure according to their inherent logical relationships, thus demonstrating the complete transmission path of the access subject's behavioral intent from its generation to its realization. This process involves in-depth analysis and matching of the triggering logic, the continuity of execution consequences, and the correlation of interactive responses of the behavioral logic fragments.

[0023] Step S121: Extract the triggering logic condition of each behavior logic segment in the set of behavior logic segments. The triggering logic condition includes the specific result data generated by the preceding behavior logic required for the behavior logic segment to be activated, the logical state parameters corresponding to the network environment, and the logical signals fed back by the interactive object.

[0024] For each segment in the set of behavioral logic segments, the extraction of triggering logic conditions needs to be performed from multiple dimensions. The specific result data generated by the preceding behavioral logic refers to the specific results that must be produced by other behavioral logic segments before the current behavioral logic segment is executed. For example, in the behavioral logic segment of an employee terminal accessing an internal database, the preceding behavioral logic might be an authentication behavior. Its specific result data includes authentication success flags, user permission level codes, session tokens, etc. This data is obtained by parsing the execution consequence data field of the authentication behavior logic segment.

[0025] The logical state parameters corresponding to the network environment include environmental factors that affect the execution of behavior, such as network connection status, bandwidth utilization, network latency, and firewall rule configuration. For example, triggering a file transfer behavior logic segment requires an active network connection, bandwidth utilization below a certain threshold, and the firewall allowing this type of file transfer traffic to pass through. These parameters are obtained by real-time monitoring of network device status information and configuration files.

[0026] Logical signals fed back by interactive objects refer to specific signals sent by the interactive objects related to the current logical segment of behavior before the behavior is initiated. For example, when a terminal initiates a file download request to a server, the server will return a ready signal after receiving the request. This ready signal contains information such as file size and checksum, and serves as one of the trigger signals for the file download logical segment. The above signal is obtained by parsing control messages during the network interaction process.

[0027] The information from the above three aspects is integrated to form the triggering logic conditions for each behavioral logic segment, and stored as structured data containing a list of preceding result data, a set of environmental state parameters, and interaction signal types.

[0028] Step S122: Extract the execution consequence logic of each behavioral logic segment. The execution consequence logic includes the condition parameters required for triggering subsequent behaviors after the execution of the behavioral logic segment, the specific change data of the logical state of the network environment, and the logical response trigger signal of the interactive object.

[0029] The extraction of execution consequence logic is also unfolded from three dimensions. The condition parameters required to trigger subsequent behaviors refer to the triggering conditions provided for subsequent related behavior logic segments after the current behavior logic segment is executed. For example, the execution consequence of the file download completion behavior logic segment includes parameters such as file storage path, file integrity verification result, and file format identifier. These parameters can serve as the triggering conditions for the file decompression behavior logic segment.

[0030] The specific changes in the logical state of the network environment reflect the impact of the actions performed on the network environment. For example, downloading large files can lead to increased network bandwidth utilization, increased network interface traffic statistics for terminal devices, and changes in the number of concurrent connections on the server. These changes are obtained by monitoring the performance indicators of network devices and terminal devices before and after the actions are performed.

[0031] The logical response trigger signal of an interactive object refers to the signal sent by the interactive object to the access subject or other related objects after the behavior is executed, to trigger subsequent response behaviors. For example, after a database query operation is completed, the database server returns query result data and query status code to the terminal, which can trigger the terminal application to display the results.

[0032] The execution consequence logic is organized into structured data containing condition parameter key-value pairs, records of environmental state changes, and lists of response signals, and stored in association with the corresponding behavioral logic fragments.

[0033] Step S123: Extract the interaction response logic record of each behavior logic segment. The interaction response logic record includes a description of the interaction trigger relationship between the behavior logic segment and other behavior logic segments, the response logic pointing path, and the interaction data transmission logic rules.

[0034] The interaction trigger relationship description clarifies the triggering and being triggered relationships between the current behavior logic segment and other behavior logic segments. For example, the user login behavior logic segment triggers the permission verification behavior logic segment, and after the permission verification is successful, it triggers the desktop environment loading behavior logic segment. The above relationships are determined by analyzing the time sequence of the behavior occurrences and the association identifiers in the logs.

[0035] The response logic path describes the flow of data and control information during the interaction. For example, the path for a terminal to send a login request to the authentication server is terminal → access switch → firewall → authentication server, while the authentication server's response path is the reverse. This path information is obtained by parsing the source address, destination address, and routing records of network packets.

[0036] Interactive data transmission logic rules include the protocol type used for data transmission, data encoding method, encryption algorithm, and verification mechanism. For example, the RDP protocol used in the remote desktop connection behavior logic segment has data transmission rules including image data compression method, keyboard and mouse input encapsulation format, and session persistence mechanism. These rules are determined by analyzing the protocol specification document and the actual captured data packet structure.

[0037] Interaction response logic records are stored as structured data containing a list of interaction relationships, a sequence of path nodes, and a set of transmission rules.

[0038] Step S124: Based on the correspondence between the triggering logic condition and the execution consequence logic, logically connect the condition parameters, state change data and trigger signals contained in the execution consequence logic of the previous behavior logic segment with the result data, state parameters and feedback signals in the triggering logic condition of the next behavior logic segment. Based on the logical connection results, select the combination of behavior logic segments with consistent logical connection. The consistent logical connection means that all condition parameters in the previous execution consequence logic are fully adapted to the requirements of the next triggering logic condition, and the state change data and feedback signals form a logical closed loop.

[0039] Step S1241: Extract the core logical elements from the execution consequence logic of the previous behavior logic segment. The core logical elements include condition parameters, state change data, trigger signals, and logical association descriptions that play a key role in triggering subsequent behaviors in the execution consequence.

[0040] In an enterprise internal office network environment, taking the previous action as an example of "successful user authentication," the core logical elements of its execution consequence logic are extracted as follows: Conditional parameters include the session token generated after successful authentication (containing user ID, permission level, validity period, etc.), the user's department identifier, and the MAC address of the terminal device; status change data includes the increase in the number of currently online users on the authentication server, the terminal device's authentication status changing from "unauthenticated" to "authenticated," and the activation of the user's permission entry in the network access control list; trigger signals include the "authentication passed" response message sent by the authentication server to the terminal (containing status code and session token), and the "preparing to establish connection" request signal sent by the terminal to the application server; the logical association is described as "successful user authentication is a necessary prerequisite for subsequent access to the application system, and the session token is the key credential for the access request." These core logical elements are obtained by parsing the execution logs of the authentication behavior and network interaction data packets to ensure accurate reflection of the key impact on triggering subsequent actions.

[0041] Step S1242: Extract the core logic elements from the trigger logic conditions of the next line logic segment. The core logic elements include the result data requirements that must be met in the trigger conditions, the state parameter standards, the feedback signal type, and the logic association rules.

[0042] Taking the following logic segment, "Accessing the financial data server," as an example, the core logical elements in its triggering logic conditions are extracted as follows: Result data requirements include: the session token must be valid (not expired, signature verification passed); the user's permission level must reach the "financial data access permission" level; and the terminal's MAC address must be in the list of allowed devices. Status parameter standards cover: the financial data server's CPU utilization is below the threshold, memory usage is within the normal range, and the number of network connections does not exceed the limit. Feedback signal types include the session token verification request signal sent by the terminal, the "token verification passed" response signal returned by the server, and the data transmission channel establishment confirmation signal. The logical association rule is: "A data access connection can only be established when the session token verification is successful, the user's permissions meet the requirements, and the server resource status allows it; and data transmission must use an encrypted channel." These core logical elements were determined through analysis of the financial data server's access control policy and application programming interface documentation, clarifying the key conditions required to trigger this behavior.

[0043] Step S1243: Logically map the condition parameters, state change data, trigger signals, and logical association descriptions in the previous core logic element to the result data requirements, state parameter standards, feedback signal types, and logical association rules in the next core logic element, and establish the element correspondence relationship.

[0044] The core logical elements of the "successful user authentication" action are logically mapped to the core logical elements of the "access to financial data server" action. The session token in the condition parameters corresponds to the session token validity verification in the result data requirements; the user permission level corresponds to the permission level requirements; and the terminal MAC address corresponds to the device list check. In the status change data, the terminal authentication status changing to "authenticated" corresponds to the user authentication status requirements in the status parameter standard; and the change in the number of online users on the authentication server corresponds to the reference factors in server load assessment. In the trigger signals, the "authentication passed" response message corresponds to the prerequisite of the token verification request signal in the feedback signal type; and the "preparing to establish connection" request signal corresponds to the trigger signal for establishing the data transmission channel. In the logical association description, "authentication is a prerequisite for access" corresponds to "passed token verification is a condition for connection establishment" in the logical association rule. Through this one-to-one mapping, the element correspondence between the core logical elements of the preceding and following actions is established.

[0045] Step S1244: Based on the established element correspondence, determine whether the condition parameter value in the previous execution consequence logic is equal to the result data requirement value in the subsequent trigger logic condition, whether the state change data value meets the standard value range of the state parameter, whether the trigger signal type belongs to the feedback signal type set, and whether the logical association description conforms to the logical association rules; if all judgment conditions are yes, then confirm that the relationship is satisfied.

[0046] The judgment is made based on the correspondence between elements. For conditional parameter values, check whether the validity period of the session token generated by authentication is within the time range required by the financial data server, whether the permission level reaches the "financial data access permission" level, and whether the MAC address is in the allowed list; for status change data values, check whether the terminal authentication status has been confirmed as "authenticated" and whether the number of online users on the authentication server is within the acceptable load range of the financial data server; for trigger signal types, verify whether the "authentication passed" response message meets the format requirements of the financial data server for token verification request signals, and whether the "preparing to establish connection" request signal belongs to the pre-signal type of the data transmission channel establishment confirmation signal; for logical association descriptions, confirm whether the description of "authentication is a prerequisite for access" is consistent with the rule of "token verification passed is a connection establishment condition". Only when all these judgments are affirmative is it confirmed that the execution consequence logic of the previous action satisfies the triggering logic condition of the subsequent action, and that a satisfaction relationship exists between the two.

[0047] Step S1245: Extract the complete matching core logical element combination in the element correspondence relationship, including the complete matching combination of condition parameters and result data requirements, state change data and state parameter standards, trigger signal and feedback signal types, and logical association description and rules, to form a logical matching element group.

[0048] The core logical element combinations that perfectly match are selected from the element correspondence. For example, the session token's validity period, permission level, and MAC address all meet the result data requirements; the terminal authentication status and server load status both conform to the status parameter standards; the "authentication successful" response message and the "preparing to establish connection" request signal both belong to the corresponding feedback signal types; and the logical association description is completely consistent with the rules. These perfectly matching elements are combined to form a logical matching element group, which contains all the key elements that enable logical connection between the preceding and following actions.

[0049] Step S1246: Based on the logical matching element group, generate a data structure as the docking logical channel. This data structure stores the core logical element combination of the match, the mapping relationship between the elements, and the logical connection rules derived from the matching elements.

[0050] A data structure for generating logical connection channels is generated based on logical matching element groups. This data structure adopts a nested dictionary form, with the top level containing three keys: "Matching Element Combination," "Element Mapping Relationship," and "Logical Connection Rule." The value of the "Matching Element Combination" key corresponds to the specific content in the logical matching element group, such as the matching items required by the condition parameters and the result data; the "Element Mapping Relationship" key records the correspondence between elements in the previous row and elements in the next row, such as "Session Token → Token Validation Verification"; the "Logical Connection Rule" key contains rules derived from the matching elements, such as "After successful session token verification, the terminal sends a data access request, the server checks the resource status, and if the status allows, a connection is established." This data structure clearly defines the logical connection method between the previous and subsequent rows.

[0051] For example, step S12461: Extract the core matching elements from the logical matching element group. The core matching elements are the condition parameter and result data requirement matching group, the state change data and state parameter standard matching group, the trigger signal and feedback signal type matching group, and the logical association description and rule matching group, which play a decisive role in the logical docking.

[0052] In the logical matching element group, the core matching element is the key to the success of logical integration. Taking the logical integration of "successful user authentication" and "access to financial data server" as an example, the matching group of condition parameters and result data requirements is "session token validity (authentication) - session token validity requirement (access)" and "user permission level (authentication) - financial data access permission level requirement (access)". The matching group of state change data and state parameter standards is "terminal authentication status changes to authenticated (authentication) - user authentication status requirement (access)" and "change in the number of online users on the authentication server (authentication) - server load status standard (access)". The matching group of trigger signal and feedback signal type is "authentication passed response message (authentication) - token verification request signal (access)" and "preparation to establish connection request signal (authentication) - data transmission channel establishment confirmation signal (access)". The matching group of logical association description and rule is "authentication is a prerequisite for access (authentication) - token verification passed is a connection establishment condition (access)". The above core matching elements directly determine whether the two behavioral logic segments can achieve logical integration.

[0053] Step S12462: Based on the preset logical relationship definition library, determine the logical relationship type between each matching group in the core matching element. The logical relationship type includes causal transmission, conditional adaptation, or progressive connection.

[0054] The pre-defined logical relationship definition library clearly defines three types of logical relationships: causal transitivity, conditional adaptation, and progressive connection. Causal transitivity means that the result of the previous matching group is the cause of the next matching group; conditional adaptation means that the output of the previous matching group serves as the input condition for the next matching group; progressive connection means that multiple matching groups advance the logical process sequentially. Analyzing the matching groups in the core matching elements, the "session token validity matching group" and the "user permission level matching group" have a conditional adaptation relationship, meaning that a valid session token is a prerequisite for verifying the user permission level; the "authentication pass response signal matching group" and the "preparation to establish connection request signal matching group" have a causal transitivity relationship, meaning that an authentication pass response leads to the sending of a preparation to establish connection request; all matching groups as a whole have a progressive connection relationship, advancing the logical connection process step by step in the order of condition parameter matching → status data matching → trigger signal matching → logical rule matching.

[0055] Step S12463: Based on the determined logical relationship type and the data flow between matching groups, construct a basic data structure that reflects the logical connection between elements, the data transmission order, and the triggering condition rules.

[0056] Based on the determined logical relationship types and data flow directions, a basic data structure is constructed. This basic data structure adopts the form of a directed graph, where nodes represent matching groups in the core matching elements, and directed edges represent the logical relationships and data flow directions between matching groups. For example, the "Session Token Validity Matching Group" node points to the "User Permission Level Matching Group" node, and the edge attribute is "Conditional Adaptation"; the "Authentication Successful Response Signal Matching Group" node points to the "Preparation to Establish Connection Request Signal Matching Group" node, and the edge attribute is "Causal Transmission". Simultaneously, the data structure records the data transmission order of each matching group (e.g., condition parameter matching groups precede state data matching groups) and triggering condition rules (e.g., the next matching group can only perform matching after the previous matching group has successfully matched).

[0057] Step S12464: Extract supplementary logic elements from the execution consequence logic of the previous behavior logic segment. The supplementary logic elements are auxiliary condition parameters, secondary state change data and auxiliary trigger signals in addition to the core matching elements, which are used to improve the docking logic.

[0058] The supplementary logical elements in the execution consequence logic of the previous action logic segment (successful user authentication) include auxiliary condition parameters (such as the user's last login time and the operating system version of the terminal device), minor state change data (such as minor changes in the CPU utilization of the authentication server and the increase in memory usage of the terminal device), and auxiliary trigger signals (such as the login log recording signal sent by the authentication server to the audit system and the time calibration request signal sent by the terminal to the time synchronization server). Although the above supplementary logical elements are not core matching elements, they can provide more comprehensive contextual information for logical docking and improve the docking logic.

[0059] Step S12465: Extract the supplementary logic elements from the subsequent logic segment trigger logic conditions. The supplementary logic elements are auxiliary result data requirements, secondary state parameter standards, and auxiliary feedback signal types in addition to the core matching elements, which are used to improve the docking logic.

[0060] The supplementary logical elements in the triggering logical conditions of the subsequent logical segment (accessing the financial data server) include auxiliary result data requirements (such as the consistency requirement between the user's department and the file's department, and the matching requirement between the terminal IP address and the pre-configured IP whitelist), secondary status parameter standards (such as the remaining disk space of the financial data server and the real-time utilization rate of network bandwidth), and auxiliary feedback signal types (such as the access audit signal sent by the server to the monitoring system and the signal indicating that the file list display has been completed by the terminal). The above supplementary logical elements correspond to the supplementary logical elements of the previous segment, together improving the details of the logical connection.

[0061] Step S12466: Adapt the supplementary logical elements before and after according to the transmission order and connection rules of the basic logical association structure, integrate the supplementary logical elements into the corresponding positions of the basic logical association structure, and fill the logical gaps between the core matching elements.

[0062] Following the transmission order of matching groups in the basic logical association structure (condition parameters → state data → trigger signal → logical rules), the supplementary logical elements are adapted. For example, the auxiliary condition parameter of the previous action (user's last login time) and the auxiliary result data requirement of the next action (department consistency) are adapted during the condition parameter matching stage; the secondary state change data of the previous action (authentication server CPU utilization) and the secondary state parameter standard of the next action (server disk space) are adapted during the state data matching stage. These supplementary logical elements are integrated into their corresponding positions in the basic logical association structure to fill any logical gaps between core matching elements. For instance, between the core session token matching and user permission matching, an auxiliary matching for department consistency is added, making the logical connection more rigorous.

[0063] Step S12467: Generate transition logic statements based on the adaptation results. The transition logic statements include the transmission path of supplementary logic elements, the connection relationship between core matching elements and supplementary elements, and logic transformation rules, connecting the supplementary logic elements and core matching elements before and after.

[0064] Based on the adaptation results of the supplementary logical elements, transitional logical statements are generated. For example, "After successful user authentication, the authentication server sends the user's last login time (supplementary condition parameter) to the financial data server. The server checks whether the user's department matches the department of the requested file (auxiliary result data requirement); simultaneously, the CPU utilization change of the authentication server (minor state data) is recorded by the monitoring system, and the financial data server checks whether its remaining disk space (minor state parameter standard) meets the file transfer requirements; only when the departments match and disk space is sufficient, the authentication pass response signal (core trigger signal) can trigger the connection establishment request signal (core trigger signal), and data transmission is performed according to the HTTPS protocol (logical conversion rule)." This transitional logical statement connects the preceding and following supplementary logical elements and core matching elements, describing in detail the logical integration process.

[0065] Step S12468: Adjust the logical expression of the transition logic statement. The logical elements before and after are seamlessly connected through the transition statement. The expression of the transition statement is consistent with the logical description of the core matching element, and the overall logic presents a coherent state.

[0066] The generated transition logic statements were adjusted to ensure consistency in the expression of logical elements before and after. For example, "The authentication server sends the user's last login time to the financial data server" was changed to "The authentication server passes the user's last login time parameter to the access control module of the financial data server through a dedicated interface," making it consistent with the expression "The session token is passed through the HTTP request header field" in the core matching element (both clearly specify the transmission method and the receiving module). The adjusted transition logic statements are consistent with the logical description style of the core matching elements, with smooth overall logic and no expression conflicts or gaps.

[0067] Step S12469: Integrate the basic logical association structure, supplementary logical elements, and transitional logical statements to form a complete logical association structure. The complete logical association structure contains complete information on core matching elements, supplementary elements, transitional statements, and internal logical rules.

[0068] This process integrates the basic logical association structure (in the form of a directed graph), supplementary logical elements (auxiliary condition parameters, secondary state data, etc.), and transitional logical statements (text describing the logical process). Supplementary logical element information is added to the nodes and edges of the basic logical association structure, and transitional logical statements are embedded in the connections between nodes, forming a complete logical association structure that includes core matching elements, supplementary elements, transitional statements, and inherent logical rules (such as matching order and triggering conditions). This complete logical association structure reflects the logical connection details between previous and subsequent logical segments.

[0069] Step S124610: Construct a docking logic channel based on the complete logical association structure, wherein the docking logic channel realizes the complete logical docking between the previous logical segment and the next logical segment.

[0070] Based on a complete logical association structure, a docking logic channel is constructed. This docking logic channel includes data transmission interface definitions (such as parameter formats and protocol types for dedicated interfaces), logical control flow (such as the execution order of matching groups and conditional judgment branches), and error handling mechanisms (such as retry strategies and exception logging when matching fails). Through the docking logic channel, the execution consequences of the preceding logical segment can be accurately and completely transmitted to the triggering conditions of the following logical segment according to the predetermined logical association structure, achieving seamless logical docking between the two.

[0071] Step S1247: According to the logical connection rules in the docking logic channel, supplement the transition logic description between the previous logical segment and the next logical segment. The transition logic description includes the transmission path, conversion rules and related relationship continuation content of the core logical elements from the execution consequence logic to the triggering logic condition. The previous execution consequence logic smoothly transitions to the next triggering logic condition through the transition logic description.

[0072] Based on the logical connection rules in the docking logic channel, supplement the transition logic description. For example, describe the path of the session token from the authentication server to the financial data server (through the HTTP request header field of the terminal), the token format conversion rules (from the raw string to the encrypted format that the server can recognize), and the continuation of the association relationship of user permission information between different systems (the permission level in the authentication system maps to the access control list entries in the financial data server). Through these transition logic descriptions, the execution consequence logic of the previous action can naturally and smoothly transition to the triggering logic condition of the next action, ensuring the coherence between the behavioral logic segments.

[0073] Step S1248: Extract the core logic connection points in the transition logic description. The core logic connection points are the key nodes in the core logic element transmission path, the core content of the transformation rules, and the key links in the continuation of the association relationship.

[0074] Extract the core logical connection points from the transition logic description. For example, the key node in the session token transmission path is the establishment of the TCP connection between the terminal and the financial data server; the core content of the transition rules is the token encryption algorithm and signature verification steps; the key link in the continuation of the association is that the financial data server dynamically generates temporary access credentials according to the authorization level of the authentication system. These core logical connection points are crucial to ensuring the correct execution of the transition logic and need to be carefully recorded and verified.

[0075] Step S1249: Integrate the core logic connection points with the logic matching element group and the docking logic channel to form a complete docking logic structure. The complete docking logic structure includes complete logical information of matching elements, connection rules, transition descriptions and key nodes.

[0076] The core logical connection points, logical matching element groups, and docking logical channels are integrated to form a complete docking logical structure. This complete docking logical structure is based on the data structure of the docking logical channels. Information about the core logical connection points is supplemented in the "Logical Connection Rules," and the transition logic content is recorded in detail in the "Transition Logic Description" section. The logical matching element groups serve as the foundational data for the entire structure. The complete docking logical structure comprehensively includes all the information required for logical docking between the preceding and following rows, ensuring the accuracy and completeness of the logical docking.

[0077] Step S12410: Based on the complete docking logic structure, complete the logical docking of the previous behavior logic segment and the next behavior logic segment to form a logically consistent combination of behavior logic segments.

[0078] By utilizing the matching elements, connection rules, transition descriptions, and key node information contained in the complete docking logic structure, the preceding behavioral logic segment (such as "user authentication successful") is logically docked with the following behavioral logic segment (such as "access financial data server"). During the docking process, the transfer and transformation of core logical elements are strictly executed according to the logical connection rules to ensure that the content in the transition logic description is accurately implemented, and necessary verification is performed at the core logical connection points, ultimately forming a combination of behavioral logic segments with consistent logical connection.

[0079] Step S125: Combine the selected behavioral logic fragments according to the interactive trigger relationship description in the interactive response logic record, supplement the logical transmission rules of the associated links, so that the behavioral logic fragments in the behavioral logic fragment combination form a complete association through the pointing path in the interactive response logic record.

[0080] After obtaining the initial combination of behavioral logic fragments, it is necessary to supplement the logical transmission rules of the associated links based on the interaction response logic records. For example, in the combination of user login behavior logic fragments and file access behavior logic fragments, the interaction triggering relationship in the interaction response logic record is described as "triggers a file access request after successful login." Based on this description, the data transmission rules between the two need to be supplemented, such as how the session token generated during the login process is passed to the file server through the HTTP request header field, how the file server verifies the validity of the session token, and how a file transfer channel is established after the token verification is successful.

[0081] Simultaneously, based on the paths indicated in the interactive response logic records, the transmission paths of data between behavioral logic segments are determined. For example, a file access request originates from the terminal, passes through an internal switch and firewall, and reaches the file server; the server's response data returns along the original path. Routing rules, port mappings, and data forwarding policies along these paths are supplemented to ensure the integrity and executable nature of the interconnected links between behavioral logic segments.

[0082] Step S126: Extract the intent representation information of each behavioral logic segment in the combination of behavioral logic segments. The intent representation information includes the core content of the behavioral intent corresponding to the behavioral logic segment, the direction tendency of intent transmission, and the logical path description of intent realization.

[0083] Extracting intent representation information requires analyzing the operational purpose and expected result of the behavioral logic segment. For example, the core intent of the file download behavioral logic segment is to obtain specific file data; the direction of intent transmission tends to be from the server to the terminal; the logical path for intent realization is described as "sending a file download request to the server via the HTTP protocol, the server verifying the validity of the request, transmitting the file data in segments to the terminal, and the terminal receiving and storing the file."

[0084] For each behavioral logic segment, natural language processing techniques are used to analyze its operation description, parameter configuration, and execution consequences, extracting the aforementioned intent representation information and storing it as structured text data.

[0085] Step S127: Based on the intent transmission direction and logical path defined in the intent representation information, the behavioral logic fragments are reordered in the order from the previous intent to the next intent, so that the reordered behavioral logic fragments form a chain structure with consistent direction.

[0086] After extracting the intent representation information, the behavioral logic fragments are sorted according to the intent transmission direction. For example, the intent of a user login behavior is to obtain system access permissions, the intent of a file access behavior is to obtain file data, and the intent of a file download behavior is to store the file locally. Following the intent transmission direction from obtaining permissions to obtaining data and then to local storage, the login behavior, file access behavior, and file download behavior are sequentially sorted to form a chain structure.

[0087] If inconsistencies occur in the direction of intent transmission during the sorting process, it is necessary to check whether the relationship between the behavioral logic segments is correct. If necessary, the segment combination should be adjusted or the intent representation information should be re-extracted to ensure the consistency of the direction of the chain structure.

[0088] Step S128: Generate and store a logic transmission identifier for each connection point between adjacent behavioral logic segments in the chain structure. The logic transmission identifier records the intention transmission relationship from the previous behavioral logic segment to the next behavioral logic segment, the data interface for triggering logic, and the triggering conditions for response logic.

[0089] The generation of logical transmission identifiers requires a comprehensive understanding of the intent transmission relationship, data interface, and triggering conditions of adjacent behavioral logic segments. For example, at the connection point between the login behavior and the file access behavior, the intent transmission relationship is "login success intent triggers file access intent"; the data interface for triggering logic is the session token transmission interface, which includes the token format, encryption method, and transmission protocol; the triggering condition for response logic is that the file server receives an access request containing a valid session token.

[0090] The above information is encoded as a unique logical transmission identifier and stored at the connection point of the chain structure to identify and track the transmission process of intent between behavioral logic segments.

[0091] Step S129: Integrate the chain structure with logical transmission identifiers and the intent representation information of each behavioral logic segment to form an intent transmission chain, wherein the intent transmission chain includes the logical association of each behavioral logic segment and the intent transmission trajectory.

[0092] The chain structure with logical transmission identifiers is integrated with the intent representation information of each behavioral logic segment to form a complete intent transmission chain. During the integration process, the intent representation information of each behavioral logic segment is associated with its position in the chain structure, and the intent transmission relationship of adjacent segments is connected through logical transmission identifiers. The final intent transmission chain is displayed in a tree or network structure, clearly showing the transmission trajectory of the access subject's behavioral intent and the logical relationship between each behavioral logic segment.

[0093] Step S130: Decompose the intent transmission chain into nodes to obtain an intent transmission node set, which includes the core behavioral logic, intent representation, and associated node pointers of each transmission link.

[0094] In an enterprise's internal office network environment, the reconstructed intent transmission chain is decomposed into nodes, breaking down the chain structure into multiple independent transmission links, each forming an intent transmission node. The purpose of this node-based decomposition is to break down the complex intent transmission chain into basic units that are easier to analyze and process, facilitating subsequent matching with a database of intrusion intent nodes.

[0095] Step S131: Extract the logical transmission identifiers in the intent transmission chain, and divide the intent transmission chain into multiple independent transmission links by taking the connection position corresponding to each logical transmission identifier as the dividing point, thus obtaining a preliminary set of transmission links.

[0096] Logical transmission markers serve to separate different transmission stages in the intent transmission chain. For example, in an intent transmission chain that includes login, file access, and file download actions, the logical transmission markers between login and file access actions, and between file access and file download actions, serve as demarcation points, dividing the entire transmission chain into three independent preliminary transmission stages: the login stage, the file access stage, and the file download stage, forming a set of preliminary transmission stages.

[0097] Step S132: Extract the core behavioral logic information of each preliminary transmission link in the preliminary transmission link set. The core behavioral logic information includes the key operation logic steps of the preliminary transmission link, the order of operation execution, the core correlation between triggering conditions and execution consequences, and the implementation path of the operation logic.

[0098] Taking the file download and transmission process as an example, the extraction of core behavioral logic information includes key operational logic steps (such as sending a download request, receiving file data, verifying file integrity, and storing the file); the order of operation execution (send the request first, then receive the data, then verify, and finally store); the core correlation between triggering conditions and execution consequences (file data can only be received if the download request is accepted by the server; file data can only be successfully stored if the file data verification passes); and the implementation path of the operation logic (establish a connection via TCP protocol, transmit file data using HTTP protocol, perform integrity verification using MD5 algorithm, and store the file in a specified local directory).

[0099] By analyzing the behavioral description and execution process of the initial transmission link, the core behavioral logic information mentioned above is extracted and stored as structured data.

[0100] Step S133: Extract the content corresponding to the preset intent representation field from the complete description of each preliminary transmission link, and use it as the core of intent representation for that preliminary transmission link.

[0101] The pre-defined intent representation fields include "intent goal," "intent type," and "intent priority." For example, in the complete description of the file download delivery stage, the "intent goal" field contains "obtain the latest version of the project document," the "intent type" field contains "data acquisition," and the "intent priority" field contains "medium." These fields are extracted and combined to form the core intent representation for this initial delivery stage.

[0102] Step S134: Analyze the logical connections between each preliminary transmission link and its adjacent preceding and following preliminary transmission links. The logical connections include the response logic of the preliminary transmission link to the execution result of the preceding preliminary transmission link, the triggering logic requirements for the following preliminary transmission link, and the logical description of the connection relationship.

[0103] Taking the file access transmission process as an example, the preceding preliminary transmission process is the login transmission process, and the response logic for the execution result of the login transmission process is "verify the validity of the login session token and extract user permission information"; the following preliminary transmission process is the file download transmission process, and the triggering logic requirement for it is "the file access request has been accepted by the server and file list information is returned"; the logical description of the relationship is "the file access behavior depends on the successful execution of the login behavior, and provides access permissions and file information for the file download behavior".

[0104] By analyzing the interaction process and logical dependencies between the initial transmission links, the content to which the above-mentioned related logic points is determined.

[0105] Step S135: Bind the core behavioral logic information, the core intent representation, and the associated logic pointers to form an initial intent transmission node. This initial intent transmission node fully carries the logical information, core intent, and associated relationships of the corresponding initial transmission stage.

[0106] Step S1351: Arrange the key operation logic steps, operation execution sequence, trigger and consequence relationship and implementation path in the core behavior logic information according to the natural order of operation logic to form an ordered core behavior logic sequence. The ordered core behavior logic sequence includes the execution sequence and logical association of the core behavior logic.

[0107] Taking the initial transmission stage of "file download" as an example, the key operational logic steps in the core behavioral logic information include "sending a download request," "receiving file data," "verifying file integrity," and "storing the file." The execution order of the operations is: first send the download request, then receive the file data, then verify the file integrity, and finally store the file. The trigger-consequence relationship is: after sending the download request, if the server responds, the data is received; after receiving the data, the verification operation is triggered; after the verification passes, the storage operation is triggered. The implementation path is "terminal → switch → server → terminal." Arranging the above information according to the natural order of the operational logic forms an ordered core behavioral logic sequence: [Send a download request (trigger: user clicks the download button; consequence: server returns file data) → receive file data (trigger: server responds to the request; consequence: data receiving buffer is full) → verify file integrity (trigger: data reception is complete; consequence: verification result is generated) → store the file (trigger: verification result is successful; consequence: file is saved to the local directory)]. This ordered core behavioral logic sequence demonstrates the sequential execution relationship and logical association of the core behavioral logic.

[0108] Step S1352: Based on the preset intent delivery priority rules, sort the intent delivery core content, directional tendency and implementation path contained in the intent representation core to form an ordered intent representation sequence.

[0109] The preset intent delivery priority rules are as follows: the core intent delivery content has the following priority from high to low: "data acquisition," "system control," and "status monitoring"; the direction of inclination has the following priority: "from server to terminal" is higher than "from terminal to server"; and the implementation path has the following priority: "encrypted channel" is higher than "plaintext channel." Taking the core intent representation of the initial transmission stage of "file download" as an example, the core intent delivery content is "data acquisition," the direction of inclination is "from server to terminal," and the implementation path is "encrypted channel (HTTPS)." According to the priority rules, the above content is sorted to form an ordered intent representation sequence: [Core intent delivery content: data acquisition → Direction of inclination: from server to terminal → Implementation path: encrypted channel (HTTPS)]. This ordered intent representation sequence clarifies the priority and order of each element of the intent representation.

[0110] Step S1353: Classify the response logic content of the previous stage, the trigger logic requirements of the next stage, and the description of the relationship in the association logic according to the direction of the association, to form a forward association logic set and a backward association logic set. The forward association logic set corresponds to the response logic of the previous stage, and the backward association logic set corresponds to the trigger logic of the next stage.

[0111] Taking the initial transmission logic of "file download" as an example, the response logic of the previous stage is "receiving the file list and access permission information returned by the file access stage," and the triggering logic of the next stage is "providing the downloaded file path and format information to the file decompression stage." The relationship is described as "the file download stage depends on the authorization of the file access stage and provides a data source for the file decompression stage." Categorized by the direction of the forward and backward associations, the forward association logic set includes "receiving the file list and access permission information returned by the file access stage"; the backward association logic set includes the content related to the backward triggering in "providing the downloaded file path and format information to the file decompression stage" and "the file download stage depends on the authorization of the file access stage and provides a data source for the file decompression stage."

[0112] Step S1354: Establish a mapping relationship between the ordered core behavior logic sequence and the ordered intention representation sequence, so that the identifier of each logical link in the ordered core behavior logic sequence is mapped to an intention representation unit with the same identifier in the ordered intention representation sequence.

[0113] Each logical step in the ordered core behavior logic sequence (such as "sending a download request" or "receiving file data") has a unique identifier (such as ID1, ID2, etc.). Similarly, each intent representation unit in the ordered intent representation sequence (such as "data acquisition" or "from server to terminal") also has a corresponding identifier (such as IDa, IDb, etc.). A mapping relationship is established by analyzing the intent goal of each logical step and the content of the intent representation unit. For example, the intent goal of the "sending a download request" step is to acquire file data, corresponding to the "data acquisition" unit in the ordered intent representation sequence; therefore, ID1 is mapped to IDa. The direction of the "receiving file data" step is from the server to the terminal, corresponding to the "from server to terminal" unit, so ID2 is mapped to IDb. Through this method, each logical step identifier can find a corresponding intent representation unit identifier, establishing a mapping relationship between the two.

[0114] For example, step S13541: Extract the logical objective of each behavioral logic step in the ordered core behavioral logic sequence. The logical objective is the core purpose of the execution of the behavioral logic step, the specific effect to be achieved, and the corresponding operational logic endpoint.

[0115] In the ordered core behavioral logic sequence, taking the "file download" step as an example, the logical objectives of each behavioral logic step are as follows: The core objective of the "send download request" step is to request a specific file from the server. The specific effect to be achieved is that the server receives the request and prepares to transfer the file. The corresponding operational logic endpoint is that the server returns a request response. The core objective of the "receive file data" step is to obtain the binary data stream of the file. The specific effect to be achieved is that the data is completely received into the local buffer. The corresponding operational logic endpoint is that the buffer is full or the file transfer is complete. The core objective of the "verify file integrity" step is to ensure that the received file is consistent with the original file. The specific effect to be achieved is to generate a verification result (pass or fail). The corresponding operational logic endpoint is that the verification algorithm has finished executing. The core objective of the "store file" step is to save the file to the local storage medium. The specific effect to be achieved is that the file is successfully written to the specified path. The corresponding operational logic endpoint is that the file system returns a write success status.

[0116] Step S13542: Extract the intent direction of each intent representation focus in the ordered intent representation sequence. The intent direction is the core direction of the transmission of the intent representation focus, the intent goal to be achieved, and the corresponding transmission path.

[0117] The key intent representations in the ordered intent representation sequence include "data acquisition," "from server to terminal," and "encrypted channel (HTTPS)." The core direction of the "data acquisition" intent representation is acquiring file content, with the goal of having a complete copy of the file locally. The corresponding transmission path is "server file storage → network transmission → terminal receiving buffer → terminal storage." The core direction of the "from server to terminal" intent representation is data flow, with the goal of successfully transmitting data from the server to the terminal. The corresponding transmission path is "server network interface → router → switch → terminal network interface." The core direction of the "encrypted channel (HTTPS)" intent representation is secure transmission, with the goal of preventing data from being stolen or tampered with during transmission. The corresponding transmission path is "SSL handshake → encrypted data transmission → SSL disconnection."

[0118] Step S13543: Compare the logical target field recorded in each behavioral logic link of the ordered core behavioral logic sequence with the intent pointing field recorded in each intent representation key record of the ordered intent representation sequence, and select the combination in which the logical target field value and the intent pointing field value are exactly the same.

[0119] The logical target fields in the "Send Download Request" stage (e.g., "Request a specific file from the server") are compared with the intent-oriented fields (e.g., "Get file content") that represent the key intent of the "Data Acquisition" stage to determine if they describe the same goal. Similarly, the logical target fields in the "Receive File Data" stage (e.g., "Get the binary data stream of the file") are compared with the intent-oriented fields (e.g., "Data is transferred from the server to the terminal") that represent the key intent of the "From Server to Terminal" stage. Finally, the logical target fields in the "Verify File Integrity" stage (e.g., "Ensure the received file is consistent with the original file") are compared with the intent-oriented fields (e.g., "Data is not tampered with during transmission") that represent the key intent of the "Encrypted Channel (HTTPS)" stage. Combinations where the logical target field values ​​and intent-oriented field values ​​are semantically and content-completely identical are identified, such as the logical target in the "Receive File Data" stage being completely identical to the intent-oriented field representing the key intent of the "From Server to Terminal" stage.

[0120] Step S13544: Select logically compatible behavioral logic links and key combinations of intent representations to form a logically compatible combination set, which includes all combinations where the goals and directions are completely matched.

[0121] Based on the comparison, combinations with consistent logical compatibility are selected. For example, the logical goal of the "send download request" step (requesting a specific file) aligns with the intent of the "data acquisition" intent (acquiring file content); the logical goal of the "receive file data" step (acquiring binary data stream) aligns with the intent of the "from server to terminal" intent (data being transmitted from the server to the terminal); and the logical goal of the "verify file integrity" step (ensuring file consistency) aligns with the intent of the "encrypted channel (HTTPS)" intent (ensuring data is not tampered with). These combinations are then included in the set of logically compatible combinations.

[0122] Step S13545: Extract the association strength related description of each combination in the logical adaptation combination set. The association strength related description is a description of the degree of fit between the logical goal of the behavioral logic link and the intention of the intention representation focus in terms of core content, implementation path and effect description.

[0123] For each combination in the logical adaptation combination set, extract the description related to the association strength. For example, the association strength description of the combination "send download request" and "data acquisition" is "the core content of the logical target (requesting file) is completely consistent with the core content of the intent (acquiring file), the implementation path involves server interaction, and the effect description is the acquisition of file content, so the association strength is high"; the association strength description of the combination "receive file data" and "from server to terminal" is "the implementation path of the logical target (data reception) is exactly the same as the transmission path of the intent (server to terminal), and the effect description is the arrival of data at the terminal, so the association strength is extremely high".

[0124] Step S13546: According to the preset association weight rules, sort the combinations in the logical adaptation combination set to form a priority adaptation sequence; then rearrange the combinations in the priority adaptation sequence according to the original position order of their behavioral logic links in the ordered core behavioral logic sequence; generate a unique association logic identifier for each rearranged combination, the association logic identifier containing the adaptation basis description, the sum of matching points and the related content of the association relationship of the rearranged combination, used to distinguish the association logic of different rearranged combinations.

[0125] The preset association weighting rules are as follows: "Extremely high association strength" has a weight of 3, "high association strength" has a weight of 2, and "medium association strength" has a weight of 1. Based on this rule, the combinations in the logical adaptation combination set are sorted, with the combination of "receiving file data" and "from server to terminal" (weight 3) ranked first, followed by the combination of "sending download request" and "data acquisition" (weight 2), forming a priority adaptation sequence. Then, the priority adaptation sequence is rearranged according to the original position order of the behavioral logic steps in the ordered core behavioral logic sequence (sending download request → receiving file data → verifying file integrity → storing file). A unique association logic identifier is generated for each rearranged combination, such as "FA-DT-001" (FA represents the file download step, DT represents the data transmission intention, and 001 is the sequence number). The identifier includes the adaptation basis (such as "data flow matching"), a summary of matching points (such as "same implementation path"), and the association relationship (such as "step and intention directly correspond").

[0126] Step S13547: Analyze all the permuted combinations, extract the common field names used for comparing logical goals and intents, as well as the common mapping relationships between fields, to obtain the common association logic.

[0127] Analysis of the permuted combinations revealed that all combinations used the three field names "Core Content," "Implementation Path," and "Effect Description" when comparing logical goals with intended targets. The mapping relationships between these fields were: "Logical Goal Core Content → Intended Target Core Content," "Logical Goal Implementation Path → Intended Target Transmission Path," and "Logical Goal Effect Description → Intended Target Achieved Effect." These shared field names and mapping relationships constituted common logical associations, reflecting the general pattern of matching between behavioral logic steps and the key points of intent representation.

[0128] Step S13548: Based on the common association logic, integrate all the permutations and combinations to form a mapping relationship between the ordered core behavior logic sequence and the ordered intention representation sequence.

[0129] Based on common association logic, all permutations and combinations are integrated. Each behavioral logic step in the ordered core behavioral logic sequence is connected to the corresponding intent representation focus in the ordered intent representation sequence through field mapping relationships in the common association logic. For example, the "send download request" step is mapped to the intent representation focus of "data acquisition" through the "core content" field, and the "receive file data" step is mapped to the intent representation focus of "from server to terminal" through the "implementation path" field. This ultimately forms a complete mapping relationship table, clarifying the correspondence between the elements in the ordered core behavioral logic sequence and the ordered intent representation sequence.

[0130] Step S1355: Bind the sequence after establishing the mapping relationship to the forward association logic set. The response logic content of the ordered core behavioral logic sequence corresponds to the response requirements in the forward association logic set. Each behavioral logic link can match the execution consequences of the previous preliminary transmission link.

[0131] After establishing the mapping relationship, the ordered core behavioral logic sequence and the ordered intent representation sequence need to be bound to the forward association logic set. For example, the "receiving the file list and access permission information returned by the file access step" in the forward association logic set is the response requirement of the "sending download request" step. This response requirement is bound to the "sending download request" step in the ordered core behavioral logic sequence, clarifying that this step needs to receive the file list and permission information from the previous step (file access) as input. Simultaneously, it is ensured that each behavioral logic step matches the execution consequence of the previous preliminary transmission step; for example, the "sending download request" step matches the file list returned by the file access step, and the "receiving file data" step matches the file data stream returned by the server.

[0132] Step S1356: Integrate the bound overall structure with the backward association logic set. The trigger logic content of the ordered core behavior logic sequence corresponds to the trigger requirements in the backward association logic set. Each behavior logic link can trigger the execution conditions of the next preliminary transmission link.

[0133] The bound overall structure (including an ordered core behavioral logic sequence, an ordered intent representation sequence, and a forward association logic set) is integrated with the backward association logic set. For example, "providing the downloaded file path and format information to the file decompression stage" in the backward association logic set is the trigger requirement for the "storing file" stage. This trigger requirement is integrated with the "storing file" stage in the ordered core behavioral logic sequence, clarifying that after this stage is completed, the file path and format information needs to be passed to the next stage (file decompression) to trigger its execution conditions. Simultaneously, it ensures that each behavioral logic stage can trigger the execution conditions of the next preliminary transmission stage based on its own execution consequences; for example, the passing result of the "verifying file integrity" stage triggers the execution of the "storing file" stage.

[0134] Step S1357: Add node logic identifiers to the integrated overall structure. The node logic identifiers include a type description of the core behavioral logic, category-related content of the intent representation, and a specific description of the association direction. Different types of initial intent transmission nodes have distinguishable identifier content.

[0135] Add node logical identifiers to the integrated overall structure. For the initial "file download" transmission stage, the core behavioral logic type is described as "data transfer class," the intent representation category is "file acquisition," and the specific description of the association direction is "forward depends on file access, backward triggers file decompression." Encode the above information into node logical identifiers, such as "DT-FA-FD-001" (where DT represents data transfer class, FA represents file acquisition, and FD represents forward and backward association direction). Different types of initial intent transmission nodes (such as file access, file decompression, etc.) have different node logical identifiers for easy differentiation and identification.

[0136] Step S1358: From the integrated overall structure, identify the logical links that are marked as key steps in both the ordered core behavior logic sequence and the ordered intention representation sequence, and use them as key logical nodes.

[0137] Within the integrated overall structure, the ordered core behavior logic sequence and the ordered intent representation sequence are analyzed to identify the logical steps marked as critical. For example, in the ordered core behavior logic sequence, "verifying file integrity" is marked as a critical step (because it directly affects file availability); in the ordered intent representation sequence, "data acquisition" is marked as a critical step (because it is the core objective of the intent). If a logical step is marked as a critical step in both sequences, it is identified as a critical logical node. For example, if the "receiving file data" step is a critical step in both sequences, it becomes a critical logical node.

[0138] Step S1359: Associate the key logic node with the node logic identifier. The logical representation of the key logic node in the overall structure is enhanced, and the node logic identifier directly reflects the core content of the key logic node.

[0139] Associate key logical nodes (such as "receiving file data") with node logical identifiers (such as "DT-FA-FD-001"). Add identification information for key logical nodes to the node logical identifiers, for example, modifying it to "DT-FA-FD-001-K" (where K represents a key node). Simultaneously, strengthen the description of key logical nodes in the overall structure, adding explanations of their importance in the logical flow, such as "receiving file data is the core step in achieving the data acquisition intention, and its data integrity directly determines the feasibility of subsequent operations." Through this association, the node logical identifiers can directly reflect the core content of the key logical nodes, facilitating rapid identification and analysis.

[0140] Step S13510: Integrate all associated information to form an initial intent transmission node containing an ordered core behavioral logic sequence, an ordered intent representation sequence, a forward and backward association logic set, and node logic identifiers.

[0141] The ordered core behavioral logic sequence, ordered intent representation sequence, forward and backward association logic set, and key logic nodes and node logic identifiers after association are finally integrated. All information is organized in a structured data object, which contains detailed content of each of the above parts, forming a complete initial intent transmission node. For example, the initial intent transmission node for "file download" contains the core behavioral logic steps arranged in sequence, the intent representation sequence, forward and backward association logic, node logic identifiers, and key logic node information, fully carrying the logical information, core intent, and association relationships of this transmission link.

[0142] Step S136: Compare the transmission logic implementation path field, the associated logical description field, and the intent transmission pattern field recorded in all initial intent transmission nodes to identify initial intent transmission nodes with completely identical field content.

[0143] The `transmission logic implementation path` field describes the specific method and steps of intent transmission; the `association pointing logic description` field describes the relationship between nodes; and the `intent transmission mode` field indicates the type of intent transmission (e.g., direct transmission, indirect transmission, conditional transmission, etc.). By comparing the contents of these fields, all initial intent transmission nodes that are completely identical in these three fields are identified. For example, initial intent transmission nodes in multiple file download transmission stages may have the same transmission logic implementation path (all downloading via HTTP protocol), associated pointing logic description (all depending on the result of the file access stage), and intent transmission mode (all direct transmission). These nodes are then identified as nodes with completely identical content.

[0144] Step S137: Identify initial intent transmission nodes that are identical in the fields of transmission logic implementation path, associated pointing logic description, and intent transmission mode, and group them into the same group to form a node group.

[0145] Initial intent transmission nodes identified in step S136 that have identical content are grouped together. For example, all file download nodes with the same transmission logic implementation path, associated pointing logic description, and intent transmission mode are grouped into a file download node group. Each node group contains multiple initial intent transmission nodes with the same characteristics.

[0146] Step S138: Add a node group association identifier to each node group. The node group association identifier includes a description of the common transmission logic path of the node group, the association pointing type, and the relevant content of the intent transmission mode.

[0147] The node group association identifier added to a file download node group includes a description of the common transmission logic path (the path from which the file is downloaded from the server via the HTTP protocol), the association pointing type (depending on the result of the file access process), and the intent transmission mode (direct transmission). The node group association identifier is used to quickly identify the common characteristics and relationships of the node group.

[0148] Step S139: Adjust the association pointers of the initial intent transmission nodes within the node group. The initial intent transmission nodes within the node group form an ordered logical association based on the common transmission logic implementation path and association pointer type.

[0149] In a file download node group, the initial intent transmission nodes may come from different intent transmission chains, but they share a common transmission logic implementation path and associated pointing type. The associated pointing of the initial intent transmission nodes within the node group is adjusted according to the order of file download request initiation time or file size, so that they form an ordered logical association, such as arranging them in chronological order to form an ordered sequence of file download nodes.

[0150] Step S1310: Integrate all node groups and the initial intent transmission nodes within each node group to form an intent transmission node set. The intent transmission node set contains complete logical association information of all categorized and integrated node groups and the initial intent transmission nodes within each node group.

[0151] All node groups (such as login node groups, file access node groups, file download node groups, etc.) and their contained initial intent transmission nodes are integrated to form an intent transmission node set. This intent transmission node set uses node groups as the basic unit, and each node group contains multiple ordered and related initial intent transmission nodes, which completely record the logical relationship information of each transmission link.

[0152] Step S140: Perform reverse logic deduction matching between the set of intent transmission nodes and the preset intrusion intent node library to obtain the deduction matching result. The reverse logic deduction matching starts from each intent transmission node and traces the corresponding intrusion intent node and transmission mode in the intrusion intent node library according to logical association.

[0153] In an enterprise's internal office network environment, a pre-defined intrusion intent node database contains intent node information for various known network intrusion behaviors, such as unauthorized access, data theft, and malicious code propagation. The reverse logic deduction and matching process starts from each node in the intent propagation node set, and searches for matching intrusion intent nodes and their corresponding propagation patterns in the intrusion intent node database based on their core logical characteristics and relationships.

[0154] Step S141: Parse the preset intrusion intent node library, extract the core logical features, specific modes of intent transmission, and logical structure of the associated node chains of all intrusion intent nodes in the intrusion intent node library, and obtain the intrusion intent node feature set.

[0155] Each intrusion intent node in the intrusion intent node library contains core logical characteristics (such as the operational steps, triggering conditions, and execution consequences of the intrusion behavior), the specific mode of intent transmission (such as gradual penetration, direct attack, and roundabout attack), and the logical structure of the associated node chain (such as the order and dependencies between intrusion nodes). By parsing the intrusion intent node library, the above information is extracted to form an intrusion intent node feature set, which is stored as structured feature data.

[0156] Step S142: Extract the core logical features of each intent transmission node in the intent transmission node set, the logical description pointed to by the associated nodes, and the specific method of intent transmission, and generate a node logic index table.

[0157] For each node in the intent transmission node set, extract its core logical features (such as key operation steps, the relationship between triggering conditions and execution consequences), the logical descriptions pointed to by associated nodes (such as the association methods with preceding and subsequent nodes), and the specific method of intent transmission (such as data transmission protocols and interaction modes). Organize the above information according to node identifiers to generate a node logical index table for quick querying and matching of node information.

[0158] Step S143: Build a reverse logic deduction channel based on the node logic index table. The reverse logic deduction channel sets the transmission path according to the core logic feature content of each intent transmission node, and connects to the corresponding feature content in the feature set of the intrusion intent node.

[0159] Based on the classification of the core logical features of intent-transmitting nodes in the node logical index table (such as file operation, network connection, and data transmission), a reverse logical deduction channel is constructed. Each category corresponds to a transmission path, which is directed to the feature content of the same category in the feature set of intrusion intent nodes. For example, intent-transmitting nodes of the file operation category connect to the feature content of intrusion nodes such as file theft and file tampering in the feature set of intrusion intent nodes through the file operation feature transmission path.

[0160] Step S144: By following the corresponding transmission path of the reverse logic deduction channel, compare the values ​​of each field contained in the core logical feature content of each intent transmission node with the corresponding fields in the core logical feature content of the intrusion intent node in the intrusion intent node feature set, and record the results of consistent field value comparison.

[0161] Step S1441: Extract the logic comparison rules for each transmission branch in the reverse logic deduction channel. The logic comparison rules include the point-to-point correspondence method of core logic features, the matching criteria of related logic, and the judgment rules of matching content.

[0162] The reverse logic deduction channel contains multiple propagation branches, such as file operation branches, network connection branches, and system call branches. Each propagation branch has its specific logical comparison rules. Taking the file operation branch as an example, the point-to-point correspondence method of the core logical features specifies the comparison order and method for features such as file operation type (e.g., create, read, modify, delete), operation object path, operation permissions, and operation timestamp; the matching criteria of the associated logic define the dependency relationship between different file operations (e.g., a modification operation must follow a read operation), the relationship between the operation subject and the file owner (e.g., whether it is an authorized user), and other matching conditions; the judgment rules for matching content clarify the threshold for feature matching (e.g., more than 80% of feature points match is considered a match), the mandatory matching requirements for key features (e.g., the operation object path must match completely), etc. The above logical comparison rules are summarized by analyzing historical intrusion cases and normal behavior patterns and stored in the configuration file of the propagation branch.

[0163] Step S1442: Classify the core logical features of the intent transmission node according to logical type, into operation logic type, trigger condition type, execution consequence type, association type and intent representation type, forming a logical type subset. Each logical type subset contains all core logical features of the same type.

[0164] Taking an "abnormal file transfer" intent transmission node as an example, its core logical characteristics include operation logic (such as "using FTP protocol to transfer files" or "the size of the transferred file exceeds the threshold"), triggering conditions (such as "initiating the transfer during non-working hours" or "the target IP is an unfamiliar external address"), execution consequences (such as "multiple login failure records appear in the server logs" or "network traffic increases abnormally"), correlations (such as "multiple connection attempts with malicious IP addresses" or "unauthorized port scanning behavior before the transfer"), and intent representation (such as "the intent target is to send sensitive data out" or "the intent priority is high"). These contents are categorized by logical type, forming five logical type subsets, each containing all the core logical characteristics of that type.

[0165] Step S1443: Classify the core logical features of the intrusion intent nodes in the intrusion intent node feature set according to the same logical type classification standard to form corresponding intrusion logical type subsets. The classification dimensions of the logical type subsets and the intrusion logical type subsets are kept consistent.

[0166] The "data theft" intrusion intent nodes in the intrusion intent node feature set are categorized according to the same classification criteria into operation logic type (e.g., "transferring sensitive files via FTP protocol" or "transferring files containing key fields"), trigger condition type (e.g., "transferring when system load is low" or "using a forged user identity"), execution consequence type (e.g., "sensitive files disappear from the server" or "external IP address has a large number of data receiving records"), association type (e.g., "communication records with the C&C server" or "privilege escalation operation performed before transmission"), and intent representation type (e.g., "intent target is to steal trade secrets" or "intent priority is high"). This forms a corresponding subset of intrusion logic types, ensuring complete consistency with the subset of logic types of intent propagation nodes in terms of classification dimensions, facilitating subsequent comparison operations.

[0167] Step S1444: Import each logical type subset and the corresponding intrusion logical type subset into the corresponding propagation branch of the reverse logic deduction channel, and compare the feature content of the same logical type in the same propagation branch.

[0168] The subset of operational logic classes for the "abnormal file transfer" intent transmission node is imported into the file operation transmission branch of the reverse logic deduction channel; the subset of trigger conditions is imported into the condition judgment transmission branch; the subset of execution consequences is imported into the consequence analysis transmission branch; the subset of association relationships is imported into the association analysis transmission branch; and the subset of intent representation is imported into the intent recognition transmission branch. Simultaneously, the corresponding subset of intrusion logic types for the "data theft" intrusion intent node is also imported into the same transmission branch. For example, both subsets of operational logic classes are imported into the file operation transmission branch, where operational logic features are compared.

[0169] Step S1445: According to the logical comparison rules of the transmission branch, compare the logical element of the logical type subset with the intrusion logical type subset one by one. Each logical element is precisely compared with the same type of element in the intrusion logical type subset.

[0170] Within the file operation propagation branch, each logical element in the "abnormal file transfer" intent propagation node's operation logic class subset (e.g., "using FTP protocol to transfer files" or "transferring file size exceeds the threshold") is compared one by one with similar elements in the "data theft" intrusion intent node's operation logic class subset (e.g., "transferring sensitive files via FTP protocol" or "transferring files containing key fields") according to its logical comparison rules. During the comparison, it checks whether the element descriptions are consistent, whether the parameters are within the allowed range, and whether the behavior patterns match. For example, it determines whether "using FTP protocol to transfer files" and "transferring sensitive files via FTP protocol" are consistent in protocol type, and whether the characteristics of the transferred file (size, key fields) meet the requirements of the intrusion intent node.

[0171] Step S1446: Record the situation where the current element of the logical type subset and a certain element in the intrusion logical type subset have completely consistent values ​​in all preset comparison dimensions during the comparison process of each logical element, including logical expression text, core content keywords, implementation path step sequence and relationship definition.

[0172] When comparing the elements "using FTP protocol to transfer files" and "transferring sensitive files via FTP protocol," the preset comparison dimensions include protocol type, target of operation, and direction of transfer. If the logical description text explicitly mentions "FTP protocol," the core keywords both contain "transfer" and "file," the implementation path steps are both "establish FTP connection → log in → transfer file → disconnect," and the relationship definition is "data interaction with external IP," then the cases where these two elements are completely consistent across all comparison dimensions are recorded. For each logical element comparison, the cases where they are completely consistent are recorded in detail as a basis for subsequent screening.

[0173] For example, step S14461: Extract the description of the preceding logical elements in the comparison process of each logical element. The description of the preceding logical elements includes the specific logical expression, core content details, implementation path description and association description in the core logical features of the intent transmission node.

[0174] In comparing the logical elements of the "abnormal file transfer" intent transmission node and the "data theft" intrusion intent node, taking the operational logic element of the "abnormal file transfer" node, "using the FTP protocol to transfer files, the transfer object is a .docx document containing customer information," as an example, its specific logical description is "actively initiating a connection with an external IP address through FTP client software to transfer customer information documents under the local path"; core content details include "FTP protocol version is FTP-7.0, the transfer mode is active mode, the document size is 5MB, and it contains fields such as customer name, contact information, and purchase records"; the implementation path description is "terminal → local network → firewall → external network → target server, and no data encryption is performed during the transfer"; the correlation description is "the transfer behavior occurs outside of working hours, and the target IP address has no business transaction records in the past three months." The above description of the preceding logical elements is obtained by parsing the core logical characteristics of the intent transmission node.

[0175] For example, step S14462: Extract the description of the post-logical element in the comparison process of each logical element. The post-logical element description is the specific logical expression, core content details, implementation path description and association description in the core logical features of the intrusion intent node.

[0176] The corresponding post-logic element is the operational logic element of the "data theft" intrusion intent node: "Transferring sensitive files via FTP protocol, the files contain customer personal information." Its specific logic is described as "The attacker uses the FTP protocol to transfer files containing sensitive personal information from within the target network to an external control server." Core details include: "The FTP protocol version is FTP-7.0, the transfer mode is active mode, the file type is .docx, and it contains sensitive fields such as name, ID number, and contact information." The implementation path is described as: "Internal terminal → Internal network → Border firewall (which may have been bypassed) → External C&C server, the transmission process is unencrypted or uses weak encryption." The association is explained as: "The transmission behavior usually occurs late at night or during holidays when network monitoring is weak, and the target IP address is a known malicious server IP." The above post-logic element description is obtained by parsing the core logical features in the intrusion intent node feature set.

[0177] Step S14463: Using a natural language processing model, perform semantic similarity calculation on the text describing the preceding logical elements and the text describing the following logical elements, and identify text fragments whose semantic similarity reaches a preset threshold and refers to the same technical entity.

[0178] Using a BERT-based natural language processing model, word segmentation, word vector generation, and semantic similarity calculation are performed on the text describing the preceding and following logical elements. The preset semantic similarity threshold is 0.85. The model decomposes two text segments into multiple text fragments, such as "using FTP protocol to transfer files" and "transferring sensitive files via FTP protocol," or "a .docx document containing customer information" and "a file containing customer personal information," etc. The semantic similarity of each corresponding fragment is calculated, and text fragments with a similarity of 0.85 or higher that refer to the same technical entity (such as FTP protocol or customer information document) are identified. For example, "using FTP protocol to transfer files" and "transferring sensitive files via FTP protocol" have a semantic similarity of 0.92 and both refer to the technical entity "transferring files via FTP protocol," therefore they are identified as similar fragments.

[0179] Step S14464: Mark the identified text fragments as preliminary matching fragments. The preliminary matching fragments contain specific overlapping expressions and positional information, forming the basic unit of logical matching.

[0180] Text segments with semantic similarity reaching a threshold and referring to the same technical entity are marked as preliminary matching segments. For example, "transferring files using the FTP protocol" and "transferring sensitive files via the FTP protocol" are marked as preliminary matching segments, with the overlapping content being "transferring files using the FTP protocol," and the location information being the beginning of the preceding logical element description and the beginning of the following logical element description; "a .docx document containing customer information" and "a file containing customer personal information" are marked as preliminary matching segments, with the overlapping content being "a file containing customer information," and the location information being the middle of the preceding logical element description and the middle of the following logical element description. The above preliminary matching segments are the basic units constituting logical matching.

[0181] Step S14465: Based on the preset list of key technical entities and relationships, select the segments in the preliminary matching segments that involve technical entities or relationships in the preset list of key technical entities and relationships, and remove the segments that are not involved.

[0182] The pre-defined list of key technical entities and relationships includes entities and relationships such as "FTP protocol," "sensitive file transfer," "customer personal information," "operations outside of working hours," and "malicious external IPs." Preliminary matching fragments are filtered, retaining those involving entities or relationships from the list, such as those containing "FTP protocol" or "customer information"; fragments not involved, such as those describing file size or transfer mode, are removed. This filtering ensures that the retained preliminary matching fragments are all key content relevant to the intrusion determination.

[0183] Step S14466: Arrange the selected preliminary matching fragments in the natural order of the logical element descriptions to form an ordered matching fragment sequence, preserving the sequential expression relationship and internal logical connection of the logical elements.

[0184] The selected preliminary matching fragments are arranged according to their natural order in the original logical element description text. For example, in the earlier logical element description, the fragment "using FTP protocol to transfer files" comes first, followed by the fragment ".docx document containing customer information"; in the later logical element description, the fragment "transferring sensitive files via FTP protocol" comes first, followed by the fragment "file containing customer personal information". The corresponding fragments are arranged in order to form an ordered matching fragment sequence: [("using FTP protocol to transfer files", "transferring sensitive files via FTP protocol") → (".docx document containing customer information", "file containing customer personal information")]. This ordered matching fragment sequence preserves the sequential expression relationship and inherent logical connection of the logical element descriptions (the transfer protocol is described first, followed by the transfer content).

[0185] Step S14467: Extract the logical connection relationship between adjacent segments in the ordered matching segment sequence, analyze the continuity of adjacent segments in core content and implementation path, and determine the connection rules and association methods.

[0186] Analyze the logical connections between adjacent segments in an ordered sequence of matching segments. For example, the logical connection between the first segment (FTP protocol transfer) and the second segment (customer information file) in the sequence is "the transfer protocol is the means of transferring customer information files." In terms of core content, the former is a tool, and the latter is an object; in terms of implementation path, the former describes the transfer method, and the latter describes the transferred content. The two are logically continuous. The connection rule is determined as "the transfer protocol segment must directly point to the transferred content segment," and the association method is "means-object" association. Through the above analysis, the logical connections between adjacent segments are clarified.

[0187] Step S14468: Integrate the logical connection relationship with the ordered matching segment sequence to form a complete matching logical segment. The complete matching logical segment includes ordered matching segments, adjacent segment connection relationships, and overall logical structure.

[0188] By integrating logical connections (such as "means-object" associations) with ordered matching segments, a complete matching logical segment is formed. For example, a complete matching logical segment is "transferring a file (object) containing customer personal information via FTP protocol (means), using active mode during transmission, with the target being an external IP address." This complete matching logical segment includes ordered matching segments (FTP protocol transmission, customer information file), the connection relationship between adjacent segments (means-object), and the overall logical structure (protocol → content → transmission mode → target).

[0189] Step S14469: Analyze the proportion of the corresponding logical elements covered by the complete matching logical fragments, and count the share of the core content contained in the complete matching logical fragments in the total core content of the logical elements.

[0190] The core content of the corresponding logical elements includes the transmission protocol, file type, file content, transmission direction, target IP characteristics, and time characteristics. A complete matching logical fragment includes the core content of transmission protocol (FTP), file content (customer personal information), transmission direction (external), and target IP characteristics (external IP), covering four of the core elements. If there are five core elements in total, the coverage rate is 80%. This share is used as the basis for judging the degree of matching of logical elements.

[0191] Step S144610: Record the complete matching logical segment and the corresponding coverage ratio as logical matching points. Each logical element comparison process corresponds to a set of logical matching points. The set of logical matching points includes the complete matching logical segment, coverage ratio and matching position information.

[0192] The complete matching logical segment (such as "transferring a file containing customer personal information to an external IP via FTP protocol"), the coverage ratio (80%), and the matching location information (lines 1-3 of the preceding logical element description and lines 2-4 of the following logical element description) are recorded as logical matching points. Each logical element comparison process (such as operation logic element comparison, trigger condition element comparison, etc.) corresponds to a set of the above logical matching points, reflecting the matching situation in the comparison process.

[0193] Step S1447: Extract all logical fit points to form a logical fit set, which includes all successfully matched logical elements, fit fragments and specific descriptions under the transmission branch.

[0194] Within the file operation propagation branch, after comparing each element, all successfully matching logical elements (such as "transferring files using the FTP protocol" and "transferring sensitive files via the FTP protocol"), matching segments (such as the step sequence of "establishing an FTP connection → logging in → transferring files"), and specific descriptive content (such as "the object being transferred is a .docx format document") are extracted to form the logical matching set for that propagation branch. Other propagation branches (such as conditional judgments, consequence analysis, etc.) undergo similar operations, each forming its own logical matching set.

[0195] Step S1448: Analyze the proportion of the corresponding logical elements covered by the complete matching logical fragments, and count the share of the core content contained in the complete matching logical fragments in the total core content of the logical elements.

[0196] Taking the logical fit set of file operation transmission branches as an example, the complete fit logic segment is "using the FTP protocol to transfer files, the transfer object is a .docx document containing customer information". The core content of the corresponding logical elements includes protocol type, file format, file content, and transmission direction. The percentage of the core content (protocol type, file format, file content) contained in this complete fit logic segment relative to the total core content is calculated; for example, if the percentage reaches 75%. The degree of fit is then evaluated using the above method.

[0197] Step S1449: Summarize the logical fit sets and coverage ratios of each conduction branch to form a comprehensive logical fit result, which includes the matching status of all conduction branches and the overall coverage ratio.

[0198] This dataset summarizes the logical fit and coverage percentages of all transmission branches, including file operations, conditional judgments, consequence analysis, correlation analysis, and intent recognition. For example, the file operation branch might have a coverage percentage of 75%, the conditional judgment branch 80%, the consequence analysis branch 65%, the correlation analysis branch 90%, and the intent recognition branch 85%. The overall coverage percentage is then calculated (e.g., (75%+80%+65%+90%+85%) / 5=79%), forming a comprehensive logical fit result that reflects the degree of matching between the intent transmission node and the intrusion intent node.

[0199] Step S14410: Based on the comprehensive logical matching results, intrusion intent nodes that meet the set requirements in terms of the number of logical element matches and the coverage ratio are selected to form a candidate intrusion intent node set, which includes all intrusion intent nodes that meet the matching criteria.

[0200] The logical element matching rate must reach at least 80% of the total number of elements, and the coverage rate must reach at least 75%. Based on the comprehensive logical fit results, if the logical element matching rate of a "data theft" intrusion intent node is 85% and the coverage rate is 79%, both meeting the set requirements, it is added to the candidate intrusion intent node set. All nodes in the intrusion intent node feature set are then filtered to ultimately form a candidate intrusion intent node set containing all intrusion intent nodes that meet the matching criteria.

[0201] Step S145: Filter out all intrusion intent nodes whose core logical feature content fields are completely consistent with the corresponding field values ​​of the intent transmission node, and form a candidate intrusion intent node set.

[0202] After comparing the field values ​​of all intrusion intent nodes, intrusion intent nodes whose core logical characteristics all field values ​​are completely consistent with the corresponding field values ​​of a certain intent transmission node are selected. For example, if all the core logical characteristic fields (operation type, target path, protocol, source IP, etc.) of a "file theft" intrusion node are consistent with the corresponding field values ​​of a certain file download intent transmission node, then the intrusion node is added to the candidate intrusion intent node set.

[0203] Step S146: Match the field values ​​of the intent transmission mode field and the associated node pointing logical field of each intrusion intent node record in the candidate intrusion intent node set with the intent transmission method field and the associated node pointing logical description field corresponding to the intent transmission node.

[0204] Each node in the candidate intrusion intent node set has an intent transmission pattern field (e.g., "pretending to download normally," "exploiting vulnerabilities for transmission") and an associated node pointing logic field (e.g., "nodes that require permission to acquire data," "nodes that trigger data outgoing transmission"). These fields are matched against the intent transmission method field (e.g., "HTTP normal download") and the associated node pointing logic description field (e.g., "nodes that require file access"). For example, it determines whether the "pretending to download normally" pattern matches the "HTTP normal download" method, and whether the "nodes that require permission to acquire data" match the logical description of the "nodes that require file access."

[0205] Step S147: Filter out intrusion intent nodes whose intent transmission mode field value, associated node pointing logic field value and intent transmission node corresponding field value are completely matched, and form a valid intrusion intent node set.

[0206] After matching field values, intrusion intent nodes that completely match the intent transmission pattern and associated node pointing logic are selected. For example, if the intent transmission pattern of the "file theft" intrusion node is "pretending to be a normal download," which matches the "HTTP normal download" method of the file download intent transmission node, and its associated node pointing logic is "dependent on file access node," which is consistent with the association description of the intent transmission node, then the intrusion node is added to the set of valid intrusion intent nodes.

[0207] Step S148: Establish a logical association mapping between valid intrusion intent nodes and corresponding intent transmission nodes. The logical association mapping includes the core logical feature matching points between valid intrusion intent nodes and corresponding intent transmission nodes, the corresponding content of intent transmission modes, and the pointing matching relationship of associated nodes.

[0208] To establish a logical association mapping between the intent nodes and the corresponding intent transmission nodes, the system records the points of convergence between the two in terms of core logical features (such as the same target file path and transmission protocol), the corresponding content of intent transmission modes (such as "pretending to download normally" corresponding to "HTTP normal download"), and the matching relationship pointed to by the associated nodes (such as "depending on permission acquisition node" corresponding to "depending on file access node").

[0209] Step S149: Extract the core matching logic from all logical association mappings. The core matching logic is the core logical feature matching point, the correspondence of intent transmission mode, and the matching content pointed to by the associated node, which play a key role in intrusion determination.

[0210] Extracting the core matching logic that is crucial for intrusion determination from the logical association mapping, such as the target file path being a sensitive data path, the transmission protocol having abnormal configuration, and the associated node pointing to an unauthorized external server, etc., the above core matching logic is the key basis for judging whether the behavior has an intrusion intent.

[0211] Step S1410: Integrate the core matching logic, logical association mapping, and complete information of the corresponding intent transmission nodes and intrusion intent nodes to generate a deduction matching result. The deduction matching result includes all valid matching relationships and key matching content.

[0212] The core matching logic, logical association mapping, and complete information on related intent transmission nodes and intrusion intent nodes are integrated to form a deductive matching result. This deductive matching result is presented in the form of a structured report, listing all valid matching relationships and key matching content.

[0213] Step S150: Based on the simulation and matching results, locate the initial transmission node and the entire transmission path of the intrusion intent, generate a network intrusion security detection command, and send the network intrusion security detection command to the security response system.

[0214] Based on the simulation and matching results, the initial transmission node of the intrusion intent is determined, i.e., the earliest node exhibiting intrusion characteristics, such as an unauthorized file access node. Then, according to the logical connections of the intent transmission chain, the entire transmission path from the initial transmission node is traced, including subsequent nodes such as file downloads and data outgoing. Based on the initial transmission node and the entire transmission path, a network intrusion security detection command is generated. This command includes intrusion node identification, transmission path information, and threat level assessment. This command is sent to the enterprise's security response system, such as an intrusion detection system and firewall, via a network interface, so that the security response system can take appropriate defensive measures.

[0215] Figure 2 The diagram illustrates the hardware structure of a network intrusion intelligent security detection system 100 based on behavior analysis provided by an embodiment of the present invention, as follows: Figure 2 As shown, the network intrusion intelligent security detection system 100 based on behavior analysis may include a processor 1a, a machine-readable storage medium 1b, a bus 1c, and a communication unit 1d.

[0216] Machine-readable storage medium 1b can store data and / or instructions. In some embodiments, machine-readable storage medium 1b can store data acquired from an external terminal. In some embodiments, machine-readable storage medium 1b can store data and / or instructions used by the behavior analysis-based intelligent network intrusion detection system 100 to execute or use in order to complete the exemplary methods described in this invention. In a specific implementation, one or more processors 1a execute the computer-executable instructions stored in machine-readable storage medium 1b, enabling processor 1a to execute the behavior analysis-based intelligent network intrusion detection method as described in the above method embodiments. Processor 1a, machine-readable storage medium 1b, and communication unit 1d are connected via bus 1c, and processor 1a can be used to control the transmission and reception actions of communication unit 1d. The specific implementation process of processor 1a can be found in the various method embodiments executed by the behavior analysis-based intelligent network intrusion detection system 100 described above, and their implementation principles and technical effects are similar, so they will not be repeated here.

[0217] Furthermore, this embodiment of the invention also provides a readable storage medium containing computer-executable instructions. When the processor executes the computer-executable instructions, the above-mentioned intelligent security detection method for network intrusion based on behavior analysis is implemented.

[0218] It should be noted that, in order to simplify the description of this invention and thus aid in the understanding of one or more embodiments, the foregoing description of the embodiments of this invention sometimes combines multiple features into a single embodiment, drawing, or description thereof. Similarly, it should be noted that, in order to simplify the description of this invention and thus aid in the understanding of one or more embodiments, the foregoing description of the embodiments of this invention sometimes combines multiple features into a single embodiment, drawing, or description thereof.

Claims

1. A network intrusion intelligent security detection method based on behavior analysis, characterized in that, The method includes: Capture behavioral logic fragments of all access subjects in the network environment to obtain a set of behavioral logic fragments. The set of behavioral logic fragments includes the operational behavior logic relationship of each access subject, behavior triggering premise, behavior execution consequence and response logic record of the behavior interaction object. Based on the set of behavioral logic fragments, an intent transmission chain is reconstructed. This intent transmission chain is a chain structure formed by different behavioral logic fragments according to triggering logic, consequence continuity, and interaction response correlation, reflecting the transmission path of the access subject's behavioral intent. Specifically, the selected behavioral logic fragments are combined according to the interaction triggering relationship described in the interaction response logic record, supplementing the logical transmission rules of the associated links, so that the behavioral logic fragments in the combination form a complete association through the pointing paths in the interaction response logic record. Intent representation information of each behavioral logic fragment in the combination is extracted. This intent representation information includes the core content of the behavioral intent corresponding to the behavioral logic fragment, the directional tendency of intent transmission, and the logical path for intent realization. Description: Based on the intent transmission direction and logical path defined in the intent representation information, the behavioral logic segments are reordered in order from the previous intent to the next intent, so that the reordered behavioral logic segments form a chain structure with consistent direction; a logical transmission identifier is generated and stored for each connection point between adjacent behavioral logic segments in the chain structure. The logical transmission identifier records the intent transmission relationship from the previous behavioral logic segment to the next behavioral logic segment, the data interface for triggering logic, and the triggering condition for response logic; the chain structure with logical transmission identifiers and the intent representation information of each behavioral logic segment are integrated to form an intent transmission chain. The intent transmission chain contains the logical association and intent transmission trajectory of each behavioral logic segment. The intent transmission chain is decomposed into nodes to obtain an intent transmission node set, which includes the core behavioral logic, intent representation, and associated node pointers of each transmission link; The set of intent transmission nodes is matched with a preset intrusion intent node library by reverse logical deduction to obtain the deduction matching result. The reverse logical deduction matching starts from each intent transmission node and traces the corresponding intrusion intent node and transmission mode in the intrusion intent node library according to logical association. Based on the simulation and matching results, the initial transmission node and the entire transmission path of the intrusion intent are located, a network intrusion security detection command is generated, and the network intrusion security detection command is sent to the security response system.

2. The intelligent security detection method for network intrusion based on behavior analysis according to claim 1, characterized in that, The reconstructing of the intent transmission chain based on the set of behavioral logic fragments includes: Extract the triggering logic conditions for each behavior logic segment in the set of behavior logic segments. The triggering logic conditions include the specific result data generated by the preceding behavior logic required for the behavior logic segment to be activated, the logical state parameters corresponding to the network environment, and the logical signals fed back by the interactive object. Extract the execution consequence logic of each behavioral logic segment. The execution consequence logic includes the condition parameters required to trigger subsequent behaviors after the execution of the behavioral logic segment, the specific change data of the logical state of the network environment, and the logical response trigger signal of the interactive object. Extract the interaction response logic record for each behavioral logic segment. The interaction response logic record includes a description of the interaction triggering relationship between the behavioral logic segment and other behavioral logic segments, the response logic pointing path, and the interaction data transmission logic rules. Based on the correspondence between triggering logic conditions and execution consequence logic, the condition parameters, state change data, and trigger signals contained in the execution consequence logic of the previous behavior logic segment are logically matched with the result data, state parameters, and feedback signals in the triggering logic conditions of the subsequent behavior logic segment. Based on the logical matching results, combinations of behavior logic segments with consistent logical connection are selected. The consistent logical connection means that all condition parameters in the previous execution consequence logic are fully adapted to the requirements of the subsequent triggering logic conditions, and the state change data and feedback signals form a logical closed loop.

3. The intelligent security detection method for network intrusion based on behavior analysis according to claim 1, characterized in that, The node-based decomposition of the intent transmission chain yields a set of intent transmission nodes, including: Extract the logical transmission markers from the intent transmission chain, and divide the intent transmission chain into multiple independent transmission links using the connection position corresponding to each logical transmission marker as the dividing point to obtain a preliminary set of transmission links; Extract the core behavioral logic information of each preliminary transmission link in the preliminary transmission link set. The core behavioral logic information includes the key operation logic steps of the preliminary transmission link, the order of operation execution, the core correlation between triggering conditions and execution consequences, and the implementation path of the operation logic. Extract the content corresponding to the preset intent representation field from the complete description of each initial transmission link, and use it as the core of intent representation for that initial transmission link; Analyze the logical connections between each initial transmission step and its adjacent preceding and following initial transmission steps. The logical connections include the response logic of the initial transmission step to the execution result of the previous initial transmission step, the triggering logic requirements for the subsequent initial transmission step, and the logical description of the connection relationship. The core behavioral logic information, the core intent representation, and the associated logic are bound together to form an initial intent transmission node. This initial intent transmission node fully carries the logical information, core intent, and associated relationships of the corresponding initial transmission stage. The transmission logic implementation path field, the associated logical description field, and the intent transmission pattern field recorded in all initial intent transmission nodes are compared to identify initial intent transmission nodes with completely identical field content. Initial intent transmission nodes that are identical in the fields of transmission logic implementation path, associated pointing logic description, and intent transmission mode are grouped into the same group to form a node group. Add a node group association identifier to each node group. The node group association identifier contains a description of the common transmission logic path of the node group, the association pointing type, and the relevant content of the intent transmission mode. Adjust the association of the initial intent transmission nodes within the node group. The initial intent transmission nodes within the node group form an ordered logical association based on the common transmission logic implementation path and association type. Integrate all node groups and the initial intent transmission nodes within each node group to form an intent transmission node set. The intent transmission node set contains complete logical association information of all categorized and integrated node groups and the initial intent transmission nodes within each node group.

4. The intelligent security detection method for network intrusion based on behavior analysis according to claim 1, characterized in that, The step of performing reverse logical deduction and matching between the set of intent transmission nodes and a preset intrusion intent node library to obtain the deduction and matching result includes: The pre-defined intrusion intent node library is parsed, and the core logical features, specific modes of intent transmission, and logical structures of related node chains of all intrusion intent nodes in the library are extracted to obtain the intrusion intent node feature set. Extract the core logical features of each intent transmission node in the intent transmission node set, the logical description pointed to by the associated nodes, and the specific method of intent transmission, and generate a node logic index table; A reverse logic deduction channel is built based on the node logic index table. The reverse logic deduction channel sets the transmission path according to the core logical feature content of each intent transmission node, and connects to the corresponding feature content in the feature set of the intrusion intent node. By deducing the corresponding transmission path of the reverse logic channel, the values ​​of each field contained in the core logical feature content of each intent transmission node are compared with the corresponding fields in the core logical feature content of the intrusion intent node in the intrusion intent node feature set, and the results of the field value comparison are recorded. Filter out all intrusion intent nodes whose core logical feature content fields are completely consistent with the corresponding field values ​​of the intent transmission node, and form a candidate intrusion intent node set; The intent transmission mode field and associated node pointing logical field of each intrusion intent node in the candidate intrusion intent node set are matched with the intent transmission method field and associated node pointing logical description field corresponding to the intent transmission node. Filter out intrusion intent nodes whose intent transmission pattern field value, associated node pointing logical field value and intent transmission node corresponding field value are completely matched, and form a valid intrusion intent node set; Establish a logical association mapping between valid intrusion intent nodes and corresponding intent transmission nodes. The logical association mapping includes the core logical feature matching points between valid intrusion intent nodes and corresponding intent transmission nodes, the corresponding content of intent transmission modes, and the pointing matching relationship between associated nodes. Extract the core matching logic from all logical association mappings. The core matching logic is the core logical feature matching point, the correspondence of intent transmission mode, and the matching content pointed to by the associated node, which plays a key role in intrusion determination. Integrate the core matching logic, logical association mapping, and complete information of the corresponding intent transmission nodes and intrusion intent nodes to generate a deductive matching result. The deductive matching result includes all valid matching relationships and key matching content.

5. The intelligent security detection method for network intrusion based on behavior analysis according to claim 2, characterized in that, The method of connecting the preceding and following behavioral logic segments according to the correspondence between triggering logic conditions and execution consequence logic includes: Extract the core logical elements from the execution consequence logic of the previous behavior logic segment. The core logical elements include condition parameters, state change data, trigger signals and logical association descriptions that play a key role in triggering subsequent behaviors in the execution consequence. Extract the core logical elements from the triggering logical conditions of the subsequent logical segment. The core logical elements include the result data requirements that must be met in the triggering conditions, the state parameter standards, the feedback signal types, and the logical association rules. The condition parameters, state change data, trigger signals and logical association descriptions in the previous core logical element are logically mapped one by one to the result data requirements, state parameter standards, feedback signal types and logical association rules in the subsequent core logical element to establish the element correspondence relationship. Based on the established element correspondence, determine whether the condition parameter value in the previous execution consequence logic is equal to the result data requirement value in the subsequent trigger logic condition, whether the state change data value meets the standard value range of the state parameter, whether the trigger signal type belongs to the feedback signal type set, and whether the logical association description conforms to the logical association rules; if all judgment conditions are yes, then the relationship is confirmed to be satisfied. Extract the core logical element combination that is completely matched in the element correspondence relationship, including the complete matching combination of condition parameters and result data requirements, state change data and state parameter standards, trigger signal and feedback signal types, and logical association descriptions and rules, to form a logical matching element group; Based on the logical matching element group, a data structure is generated as the docking logic channel. This data structure stores the core logical element combination of matching, the mapping relationship between elements, and the logical connection rules derived from the matching elements. According to the logical connection rules in the docking logic channel, supplement the transition logic description between the previous logical segment and the next logical segment. The transition logic description includes the transmission path, conversion rules and related relationship continuation content of the core logical elements from the execution consequence logic to the triggering logic condition. The previous execution consequence logic smoothly transitions to the next triggering logic condition through the transition logic description. Extract the core logic connection points in the transition logic description. These core logic connection points are key nodes in the transmission path of core logic elements, the core content of transformation rules, and key links in the continuation of related relationships. The core logical connection points are integrated with the logical matching element groups and docking logical channels to form a complete docking logical structure. The complete docking logical structure includes complete logical information of matching elements, connection rules, transition descriptions and key nodes. Based on the complete docking logic structure, the logical docking of the previous behavior logic segment and the next behavior logic segment is completed, forming a combination of behavior logic segments with consistent logical connection.

6. The intelligent security detection method for network intrusion based on behavior analysis according to claim 3, characterized in that, The process of binding core behavioral logic information, core intent representation, and related logical pointers to form an initial intent transmission node includes: The key operational logic steps, the order of operation execution, the relationship between triggers and consequences, and the implementation path in the core behavioral logic information are arranged in the natural order of the operational logic to form an ordered core behavioral logic sequence. The ordered core behavioral logic sequence includes the sequential execution relationship and logical association of the core behavioral logic. Based on the preset intent delivery priority rules, the intent delivery core content, directional tendency and implementation path contained in the intent representation core are sorted to form an ordered intent representation sequence. The response logic content of the previous stage, the triggering logic requirements of the next stage, and the description of the relationship in the association logic are classified according to the direction of the association, forming a forward association logic set and a backward association logic set. The forward association logic set corresponds to the response logic of the previous stage, and the backward association logic set corresponds to the triggering logic of the next stage. A mapping relationship is established between the ordered core behavior logic sequence and the ordered intention representation sequence, so that the identifier of each logical link in the ordered core behavior logic sequence is mapped to an intention representation unit with the same identifier in the ordered intention representation sequence. The sequence after establishing the mapping relationship is bound to the forward association logic set. The response logic content of the ordered core behavioral logic sequence corresponds to the response requirements in the forward association logic set. Each behavioral logic link can match the execution consequences of the previous preliminary transmission link. The bound overall structure is integrated with the backward association logic set. The triggering logic content of the ordered core behavioral logic sequence corresponds to the triggering requirements in the backward association logic set. Each behavioral logic link can trigger the execution conditions of the next initial transmission link. Add node logic identifiers to the integrated overall structure. The node logic identifiers include a type description of the core behavioral logic, category-related content of intent representation, and a specific description of the association direction. Different types of initial intent transmission nodes have distinguishable identifier content. From the integrated overall structure, identify the logical links that are marked as key steps in both the ordered core behavior logic sequence and the ordered intention representation sequence, and use them as key logical nodes; By associating key logic nodes with node logic identifiers, the logical representation of the key logic nodes in the overall structure is enhanced, and the node logic identifiers directly reflect the core content of the key logic nodes. Integrate all the associated information to form an initial intent transmission node that includes an ordered core behavioral logic sequence, an ordered intent representation sequence, a set of forward and backward association logics, and node logic identifiers.

7. The intelligent security detection method for network intrusion based on behavior analysis according to claim 4, characterized in that, The comparison of core logical features through reverse logic deduction includes: Extract the logic comparison rules for each transmission branch in the reverse logic deduction channel. The logic comparison rules include the point-to-point correspondence method of core logic features, the matching criteria of related logic, and the judgment rules for matching content. The core logical features of the intent transmission nodes are classified according to logical type into operation logic, trigger condition, execution consequence, association relationship and intent representation, forming a logical type subset. Each logical type subset contains all the core logical features of the same type. The core logical features of the intrusion intent nodes in the intrusion intent node feature set are classified according to the same logical type classification standard to form corresponding intrusion logical type subsets. The classification dimensions of the logical type subsets and the intrusion logical type subsets are kept consistent. Each subset of logical types and its corresponding subset of intrusive logical types are imported into the corresponding propagation branch of the reverse logic deduction channel, and the feature content of the same logical type is compared within the same propagation branch; According to the logical comparison rules of the transmission branches, the logical type subset and the intrusion logical type subset are compared one by one. Each logical element is precisely compared with the same type of element in the intrusion logical type subset. Record the situation where the current element of the logical type subset and a certain element in the intrusion logical type subset have completely consistent values ​​across all preset comparison dimensions during the comparison process of each logical element, including logical expression text, core content keywords, implementation path step sequence and relational definition; Extract all logical fit points to form a logical fit set, which includes all successfully matched logical elements, fit fragments and specific descriptions under this transmission branch; Analyze the proportion of complete and fitting logical segments that cover the corresponding logical elements, and statistically analyze the share of the core content contained in complete and fitting logical segments in the total core content of logical elements; The logical fit sets and coverage ratios of each conduction branch are summarized to form a comprehensive logical fit result, which includes the matching status of all conduction branches and the overall coverage ratio. Based on the comprehensive logical matching results, intrusion intent nodes that meet the set requirements in terms of the number of logical element matches and the coverage ratio are selected to form a candidate intrusion intent node set, which includes all intrusion intent nodes that meet the matching criteria.

8. The intelligent security detection method for network intrusion based on behavior analysis according to claim 5, characterized in that, The process of generating a data structure based on logically matched element groups as a logical interface channel includes: Extract the core matching elements from the logical matching element group. The core matching elements are the condition parameter and result data requirement matching group, the state change data and state parameter standard matching group, the trigger signal and feedback signal type matching group, and the logical association description and rule matching group, which play a decisive role in logical docking. Based on the preset logical relationship definition library, determine the logical relationship type between each matching group in the core matching element. The logical relationship type includes causal transmission, conditional adaptation, or progressive connection. Based on the determined logical relationship type and the data flow between matching groups, a basic data structure is constructed that reflects the logical connection between elements, the data transmission order, and the triggering condition rules. Extract supplementary logical elements from the execution consequence logic of the previous behavior logic segment. The supplementary logical elements are auxiliary condition parameters, secondary state change data and auxiliary trigger signals in addition to the core matching elements, which are used to improve the docking logic. Extract the supplementary logical elements from the subsequent logical segment trigger logical conditions. The supplementary logical elements are auxiliary result data requirements, secondary state parameter standards, and auxiliary feedback signal types in addition to the core matching elements, which are used to improve the docking logic. The supplementary logical elements are adapted according to the transmission order and connection rules of the basic logical association structure. The supplementary logical elements are integrated into the corresponding positions of the basic logical association structure to fill the logical gaps between the core matching elements. Transition logic statements are generated based on the adaptation results. These transition logic statements include the transmission path of supplementary logic elements, the connection relationship between core matching elements and supplementary elements, and logic transformation rules, connecting the supplementary logic elements and core matching elements before and after. Adjust the logical expression of the transition logic statement so that the logical elements before and after are seamlessly connected through the transition statement. The expression of the transition statement is consistent with the logical description of the core matching element, and the overall logic presents a coherent state. The basic logical association structure, supplementary logical elements, and transitional logical statements are integrated to form a complete logical association structure. The complete logical association structure contains complete information on core matching elements, supplementary elements, transitional statements, and internal logical rules. A docking logic channel is constructed based on a complete logical association structure, which enables complete logical docking between the preceding and following logical segments.

9. The intelligent security detection method for network intrusion based on behavior analysis according to claim 6, characterized in that, The establishment of a mapping relationship between the ordered core behavioral logic sequence and the ordered intention representation sequence includes: Extract the logical objective of each behavioral logic step in the ordered core behavioral logic sequence. The logical objective is the core purpose of the execution of the behavioral logic step, the specific effect to be achieved, and the corresponding operational logic endpoint. Extract the intent direction of each intent representation focus in the ordered intent representation sequence. The intent direction is the core direction of the transmission of the intent representation focus, the intent goal to be achieved, and the corresponding transmission path. The logical target field recorded in each behavioral logic step of the ordered core behavioral logic sequence is compared with the intent pointing field recorded in each intent representation of the ordered intent representation sequence, and the combination of logical target field value and intent pointing field value that are exactly the same is selected. Select logically compatible behavioral logic links and key combinations of intent representations to form a set of logically compatible combinations. The set of logically compatible combinations includes all combinations that perfectly match the target and the direction. Extract the association strength description of each combination in the logical adaptation combination set. The association strength description is a description of the degree of fit between the logical goal of the behavioral logic link and the intent of the intent representation focus in terms of core content, implementation path and effect description. According to the preset association weight rules, the combinations in the logical adaptation combination set are sorted to form a priority adaptation sequence; then, the combinations in the priority adaptation sequence are rearranged according to the original position order of their behavioral logic links in the ordered core behavioral logic sequence; a unique association logic identifier is generated for each rearranged combination, the association logic identifier includes the adaptation basis description, the sum of the matching points and the related content of the association relationship of the rearranged combination, which is used to distinguish the association logic of different rearranged combinations; Analyze all the combinations after permutation, extract the common field names used for comparing logical goals and intents, as well as the common mapping relationships between fields, to obtain the common association logic; Based on the common association logic, all permutations are integrated to form a mapping relationship between an ordered core behavioral logic sequence and an ordered intention representation sequence.

10. A network intrusion intelligent security detection system based on behavior analysis, characterized in that, The device includes a processor and a memory, the memory and the processor being connected. The memory is used to store programs, instructions or code, and the processor is used to run the programs, instructions or code in the memory to implement the network intrusion intelligent security detection method based on behavior analysis as described in any one of claims 1-9.

Images