Multi-source threat detection method based on hybrid expert model

Abstract

According to the multi-source threat detection method based on the hybrid expert model, real-time collection and structured processing of network flow, system logs and user behavior data are achieved through a multi-mode intelligent collection engine, and high-quality multi-source input is provided for upper-layer analysis; the double-branch feature extractor carries out deep analysis on the network flow time sequence mode and the log semantic context to generate fine-grained feature vectors; the hybrid expert reasoning framework is based on expert models in three fields of a dynamic routing gating network, intelligent scheduling network behaviors, log semantics and user portraits, combines space-time alignment features through a cross-modal attention mechanism, and constructs an interpretable attack evidence chain in combination with a causal reasoning engine. Finally, a full-link closed loop from multi-modal data acquisition, feature collaborative extraction and intelligent threat reasoning is realized, and while millisecond-level real-time response is ensured, the complex internal threat detection accuracy is obviously improved.

Description

Technical Field

[0001] This invention belongs to the fields of cybersecurity and artificial intelligence, specifically referring to a multi-source threat detection method based on a hybrid expert model. Background Technology

[0002] Internal threat detection requires the integration of multi-source heterogeneous data for behavioral pattern analysis. The detection process typically relies on security experts transforming fragmented system logs, network traffic, and user profiles into interpretable risk assessment models. However, traditional rule-based or statistical detection methods face the dual dilemma of high false positive and false negative rates: static rule bases struggle to adapt to dynamically evolving internal threat behaviors, while single-dimensional statistical anomaly detection fails to capture hidden contextual patterns. Therefore, current research focuses on the paradigm shift in intelligent detection, attempting to automate threat behavior modeling through deep learning methods. Methods using supervised learning to directly fit threat determination boundaries face challenges such as scarce labeled data and the curse of dimensionality in multimodal feature spaces, leading to advanced threats like covert data theft and privilege abuse in complex scenarios often exceeding the recognition capabilities of traditional detection models.

[0003] Existing research methods for internal threat detection can be categorized into the following three technical approaches:

[0004] (I) Rule Detection Framework Based on Expert System

[0005] Traditional detection systems build multi-dimensional rule engines, relying on the experience of security experts to establish explicit behavioral judgment paradigms. Splunk Enterprise Security uses an association analysis engine to generate real-time alerts through over 200 predefined violation patterns, such as exporting data from outside working hours. IBM QRadar builds a kill chain detection rule base based on the MITRE ATT&CK framework, enabling the identification of tactical phases such as lateral movement and privilege escalation. Elastic SIEM integrates the Sigma rule language, supporting custom detection logic such as abnormal login frequency and sensitive file access paths. These systems achieve threat attribution through interpretable decision tree structures, but face fundamental drawbacks such as exponentially increasing rule base maintenance costs and inability to cope with zero-day attack patterns.

[0006] (II) Supervised Learning-Driven Automated Detection Paradigm

[0007] Modern detection systems incorporate machine learning models to learn the intrinsic representations of threat behaviors through labeled datasets. Microsoft Azure Sentinel uses the LightGBM framework to build a multi-classification model based on User Entity Behavior Analysis (UEBA) to identify scenarios such as data breaches and account hijacking. Palo Alto Cortex XDR uses Graph Convolutional Networks (GCN) to model the access relationships between users, devices, and resources as a heterogeneous information network. Cisco Stealthwatch uses a BiLSTM-CRF model to analyze network traffic time-series patterns and detect covert data leakage behaviors. However, these methods are limited by the scarcity of labeled data, with actual threat samples typically accounting for less than 0.01%, and they face the disaster of dimensionality in feature engineering—a single user can generate 10^5 levels of log events daily, requiring the location of abnormal patterns in a 100-dimensional feature space.

[0008] (III) Unsupervised Anomaly Detection Methods

[0009] To address the challenges of data annotation, research has shifted towards self-supervised feature learning techniques. Google Chronicle employs a deep autoencoder (DAE) to measure the degree to which user behavior deviates from the baseline distribution through reconstruction errors; AWS GuardDuty uses the isolated forest algorithm to establish multivariate anomaly scoring based on metrics such as privileged command execution frequency and file access entropy; Darktrace's Antigena system introduces a variational inference framework to construct a dynamic Bayesian network to capture behavioral contextual dependencies. While these methods alleviate the dependence on annotation, they face the challenge of high false positive rates—normal business operations and real threats exhibit a high degree of overlap in statistical characteristics.

[0010] In internal threat detection, achieving semantic alignment and contextual modeling of multi-source heterogeneous data is a core challenge. This is particularly critical for deep learning-based detection systems, as raw log events, including SSH connection records and file operation audits, need to be transformed into behavioral trajectories with temporal correlations. Existing detection frameworks typically employ feature-level fusion strategies, such as concatenating long sequences of network traffic packets with system call frequency vectors, but these struggle to capture cross-modal causal relationships.

[0011] Current mainstream detection systems rely on a two-stage "detection-verification" architecture: a front-end neural network generates a candidate set of suspicious events, while a back-end expert system performs manual evaluation. This hybrid approach leads to increased system response latency and inconsistencies in feature representation—the latent spatial features extracted by deep models are difficult to directly interface with the explicit logic of rule engines. Recent research attempts to build end-to-end inference frameworks, such as FireEye Helix, which uses a graph attention mechanism to automatically construct threat evidence chains, but it faces real-time processing performance bottlenecks, with inference latency exceeding 15 seconds when processing millions of events per minute. Furthermore, adversarial attacks can significantly degrade the performance of detection models, and existing defense mechanisms struggle to maintain detection sensitivity while ensuring system robustness. Summary of the Invention

[0012] The present invention aims to solve the technical problems of fragmented cross-source heterogeneous data analysis and insufficient ability to capture covert threat behavior patterns in the prior art.

[0013] To address the aforementioned issues, this invention provides a multi-source threat detection method based on a hybrid expert model. It constructs a multi-channel data acquisition module to acquire network traffic metadata and host log events in real time; designs a dual-branch feature extractor, employing time-series Transformers to process traffic behavior patterns and a hierarchical attention mechanism to parse log context semantics; deploys a dynamic routing hybrid expert architecture, including multiple Transformer-based domain expert models and a learnable gating network, to achieve fine-grained threat feature extraction; and innovatively employs a multimodal cross-attention mechanism for feature fusion, outputting a threat score through a joint inference module. Compared to traditional detection methods, this system features strong real-time performance and high interpretability, effectively identifying internal threat behaviors such as data theft and privilege abuse.

[0014] To achieve the aforementioned technical effects, this invention provides a multi-source threat detection method based on a hybrid expert model. The method performs real-time multimodal acquisition and structured processing of network traffic, system logs, and user behavior data, providing high-quality multi-source input for upper-level analysis. It also performs deep analysis of network traffic temporal patterns and log semantic context to generate fine-grained feature vectors. Based on a dynamic routing gating network, it intelligently schedules three types of domain expert models—network behavior, log semantics, and user profiling—and fuses spatiotemporally aligned features through a cross-modal attention mechanism. Finally, it constructs an interpretable chain of attack evidence, ultimately achieving a closed-loop process encompassing multimodal data acquisition, collaborative feature extraction, and intelligent threat reasoning. Attached Figure Description

[0015] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments of the present invention will be briefly introduced below. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0016] Figure 1 A schematic diagram of an embodiment of the multi-source threat detection method based on a hybrid expert model of the present invention is shown;

[0017] Figure 2 This diagram illustrates another embodiment of the multi-source threat detection method based on a hybrid expert model according to the present invention.

[0018] Figure 3 A schematic diagram of the multi-source data log multi-channel acquisition process of the present invention is shown;

[0019] Figure 4 A schematic diagram of the framework design based on the hybrid expert model of the present invention is shown;

[0020] Figure 5 A schematic diagram of the routing gating unit in the hybrid expert model of the present invention is shown. Detailed Implementation

[0021] The features and exemplary embodiments of various aspects of the present invention will now be described in detail. To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only configured to explain the present invention and are not configured to limit the present invention. For those skilled in the art, the present invention can be practiced without some of these specific details. The following description of the embodiments is merely intended to provide a better understanding of the present invention by illustrating examples of the invention.

[0022] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising..." does not exclude the presence of additional identical elements in the process, method, article, or apparatus that includes said element.

[0023] This invention provides an embodiment of a multi-source threat detection method based on a hybrid expert model. It performs real-time multimodal acquisition and structured processing of network traffic, system logs, and user behavior data, providing high-quality multi-source input for upper-level analysis. It deeply analyzes the temporal patterns of network traffic and the semantic context of logs to generate fine-grained feature vectors. Based on a dynamic routing gating network, it intelligently schedules three types of domain expert models—network behavior, log semantics, and user profiling—and fuses spatiotemporally aligned features through a cross-modal attention mechanism. Finally, it constructs an interpretable chain of attack evidence, ultimately achieving a closed-loop process from multimodal data acquisition, collaborative feature extraction, and intelligent threat reasoning.

[0024] In some embodiments, within an internal threat detection scenario, two types of experts are typically designed: Log Experts and Traffic Experts. Log Experts are responsible for processing system log data and analyzing user behavior patterns, including permission changes and access to sensitive files. Traffic Experts are used to analyze network traffic data and detect abnormal data transmission, including outgoing encrypted traffic and unconventional protocol communication. The input data for Log Experts is log event tokens, such as an embedding vector of {user ID, operation type, file path}. Each Log Expert is a small Transformer layer focused on extracting the contextual dependencies of user behavior and capturing temporal anomalies, such as continuous access to sensitive files, operations outside of working hours, and sequences of permission abuse. The input data for Traffic Experts is network flow tokens, such as an embedding vector of {source IP, destination IP, protocol type, number of bytes}. Each Traffic Expert is a small Transformer layer used to extract spatiotemporal characteristics of traffic and detect abnormal data transmission, such as sudden outgoing patterns, low-frequency heartbeat packets, encrypted outgoing traffic, and unconventional port communication. The gating network takes as input a joint representation of the raw logs and traffic data, such as a concatenated embedding vector. The output is the weighted distribution of each expert, determining their contribution to the final decision. During model training, the weights are automatically adjusted based on the characteristics of the current input data. For example, in a data theft scenario, traffic experts dominate (weight > 0.7), focusing on verifying data leakage; in a privilege abuse scenario, log experts dominate (weight > 0.6), focusing on abnormal user behavior. Cross-modal association enhancement can also be performed. If the logs show "User A accessed a sensitive file," and traffic detection shows "User A's IP is leaking data," the gating network increases the joint weight of both.

[0025] In some embodiments, the gating network or routing component is used to determine which tokens are sent to which expert. For example, a token in the system log might be sent to a second expert, while a token in network traffic might be sent to the first expert. Sometimes, a single token can even be sent to multiple experts. Token routing is a key aspect of MoE usage because the routers are composed of learned parameters and are pre-trained along with the rest of the network.

[0026] In some embodiments, cross-modal alignment of system logs and network traffic faces the following core challenges. First, the complexity of modal differences lies in the fundamental difference in data types. System logs are typically semi-structured text containing timestamps, error codes, service names, and descriptive statements, and their semantic information needs to be extracted through natural language processing. Network traffic, on the other hand, consists of high-frequency time-series numerical signals, such as the number of packets per second, protocol type, and connection status, relying on time-series pattern analysis. This heterogeneity between textual semantics and time-series patterns makes direct integration difficult. Second, the time synchronization challenge stems from the difference in data collection frequency: log events may be sparse, while traffic data is often continuously captured with millisecond-level precision. Accurately aligning the temporal context of the same event in different modalities (e.g., the correspondence between log anomalies and traffic surges during an attack) becomes crucial. Finally, the complexity of semantic association manifests as implicit causal relationships: for example, "database connection failure" in the logs may have a potential correlation with "sudden drop in target port traffic" in the traffic, but this correlation often lacks explicit labels, requiring the model to autonomously discover deep cross-modal patterns.

[0027] In some embodiments, during the data preprocessing stage, differentiated feature engineering processes need to be designed for the two modalities. System log processing first extracts structured fields using regular expressions or parsers, and generates semantic vectors for unstructured text using a domain-fine-tuned BERT model to capture key semantics such as "connection timeout" and "authorization denied." Simultaneously, log events are aggregated by time windows (e.g., 5 minutes) to statistically analyze error frequency and service call chains, constructing temporal features. Network traffic processing focuses on temporal modeling and anomaly detection: basic statistical features include packets per second, TCP / UDP ratio, and connection duration; temporal features extract long-range dependency patterns using temporal convolutional networks, supplemented by Z-score detection of traffic spikes and the Isolation Forest algorithm to identify port scanning and other abnormal behaviors. The time alignment strategy employs dynamic time warping to address non-fixed time offset issues; for example, authentication errors may appear in the logs initially during the early stages of an attack, while traffic anomalies may appear a few seconds later. Simultaneously, multi-granularity sliding windows are combined to ensure precise correlation of cross-modal events on the timeline.

[0028] In some embodiments, the core of the model architecture lies in constructing a bimodal encoder and a cross-modal interaction module. In the bimodal encoder, the log encoder adopts a hybrid structure: structured fields are converted into low-dimensional vectors through an embedding layer, and text descriptions are processed by the BERT model to output semantic vectors. The two are dynamically weighted and fused through a gated attention mechanism. The traffic encoder uses a TCN network as its backbone, converting raw traffic data into temporal features and concatenating them with statistical features to form a 256-dimensional representation. The cross-modal interaction module achieves semantic alignment through a cross-attention mechanism: using log features as the query and traffic features as the key / value, attention weights are calculated, ensuring that "database errors" in the logs focus on port traffic changes within the corresponding time period. Contrastive learning is also introduced, constructing positive samples (log-traffic pairs within the same event window) and negative samples (random pairings with time offsets). The NT-Xent loss function is used to shorten the distance between positive samples and widen the distance between negative samples, forcing the model to learn cross-modal consistency. The hybrid expert dynamic routing module designs three types of experts: log parsing experts, traffic analysis experts, and correlation reasoning experts. The gating network generates expert weights based on fused features. For example, when "HTTP 500 error" and "surge in response time" are detected, the associated expert weight is increased to 0.8, driving the model's comprehensive judgment.

[0029] This invention provides an embodiment of a multi-source threat detection method based on a hybrid expert model, comprising:

[0030] Data preprocessing and system log processing first extract structured fields using regular expressions or parsers, and then use a domain-fine-tuned BERT model to generate semantic vectors for unstructured text to capture key semantics; log events are aggregated by time window to count error frequency and service call chains, and time-series features are constructed; network traffic is processed and time-series modeling and anomaly detection are performed; dynamic time warping is used to solve the problem of non-fixed time offset;

[0031] A bimodal encoder and a cross-modal interaction module are constructed. In the modal encoder, the log encoder adopts a hybrid structure: structured fields are converted into low-dimensional vectors through an embedding layer, and text descriptions are output as semantic vectors by the BERT model. The two are dynamically weighted and fused through a gating attention mechanism.

[0032] In some embodiments, the traffic encoder uses a TCN network as its backbone to convert raw traffic data into time-series features, which are then concatenated with statistical features to form a 256-dimensional representation. The cross-modal interaction module achieves semantic alignment through a cross-attention mechanism: using log features as the query and traffic features as the key / value pair, attention weights are calculated to ensure that "database errors" in the logs focus on port traffic changes within the corresponding time period. Contrastive learning is also introduced, constructing positive samples (log-traffic pairs within the same event window) and negative samples (random pairings with time offsets). The NT-Xent loss function is used to shorten the distance between positive samples and widen the distance between negative samples, forcing the model to learn cross-modal consistency. The hybrid expert dynamic routing module designs three types of experts: log parsing experts, traffic analysis experts, and association reasoning experts. The gating network generates expert weights based on fused features; for example, when "HTTP 500 error" and "response time surge" are detected, the association expert weight increases to 0.8, driving the model to make a comprehensive judgment.

[0033] like Figure 1 As shown, this invention provides an embodiment of a multi-source threat detection method based on a hybrid expert model, comprising:

[0034] S101. Through a multimodal intelligent acquisition engine, real-time acquisition and structured processing of network traffic, system logs and user behavior data are achieved, providing high-quality multimodal input for upper-level analysis;

[0035] S102 and the dual-branch feature extractor perform in-depth analysis of network traffic temporal patterns and log semantic context, respectively, to generate fine-grained feature vectors.

[0036] S103, the hybrid expert reasoning framework is based on a dynamic routing gating network, intelligently scheduling three types of domain expert models: network behavior, log semantics, and user profiles, and fusing spatiotemporal alignment features through a cross-modal attention mechanism;

[0037] S104. Combine causal reasoning engine to construct an interpretable chain of attack evidence, and finally realize a closed loop of the whole chain from multimodal data collection, feature collaborative extraction and intelligent threat reasoning.

[0038] like Figure 2 As shown, this invention provides an embodiment of a multi-source threat detection method based on a hybrid expert model, specifically including:

[0039] S1. Construct a full-stack data governance system through a multimodal intelligent acquisition engine, build a distributed heterogeneous log acquisition architecture, set up an adaptive log processing pipeline, complete intelligent storage and retrieval optimization, and realize comprehensive real-time acquisition and deep structured processing of network traffic, system logs and user behavior data.

[0040] S2. Construct a network traffic temporal modeling branch, a log semantic parsing branch, and a dual-branch collaboration mechanism to achieve fine-grained feature extraction through the collaboration mechanism of network traffic temporal parsing and log semantic parsing;

[0041] S3. Implement multimodal feature encoding, build a dynamic routing gating network and a cross-modal reasoning mechanism. Through the dynamic routing gating network, intelligently schedule three types of expert models: network behavior experts, log semantic experts and user profiling experts, and calculate gating weights based on the concatenation of input features.

[0042] In some embodiments, S1 includes:

[0043] S11. Design a multi-source collaborative acquisition framework, build a log acquisition system for hybrid cloud environments, and adopt a layered distributed architecture to achieve unified governance of multimodal data;

[0044] S12. Dynamic pattern recognition application logs: Design an adaptive log parsing engine that matches log header features based on regular expressions and heuristic rules, and automatically selects the best parsing template.

[0045] S13. Deeply extract network traffic metadata and achieve in-depth characterization of traffic behavior through protocol reverse engineering and metadata enrichment technology;

[0046] S14. Construct a full lifecycle privileged operation audit chain, trace the process tree, record the process creation chain, detect abnormal parent processes, monitor permission changes, verify file integrity, and realize system privileged operation tracking.

[0047] S15. Design a dynamic resource scheduling system to ensure data integrity under high load, and achieve adaptive back pressure control and zero packet loss guarantee.

[0048] In some embodiments, S2 includes:

[0049] S21. Data preprocessing and feature extraction: Select a window to cut the raw traffic data, extract time-series features, calculate protocol distribution entropy, identify protocol distribution anomalies, and statistically analyze standard deviation, kurtosis, and the proportion of abnormal packets; stack the features of multiple consecutive windows into an input sequence for modeling.

[0050] S22. Construct a multi-granularity Transformer architecture. In the embedding layer, map multi-dimensional features to a multi-dimensional latent space and inject relative time interval information through complex field rotation.

[0051] S23. At the input encoding layer, the original logs are converted into structured fields through regular expression parsing, while the unstructured text retains its original content. Word vector sequences are generated through the embedding encoding layer. At the word-level attention layer, high-risk keywords are strengthened, a risk dictionary is defined, and matching words are given larger initial attention weights. The final word-level weights are calculated through learnable parameters. At the event-level attention layer, continuous log events are sorted by timestamps to construct an event sequence. Multi-head self-attention is used to capture the dependencies between events, with a focus on modeling key event chains.

[0052] S24. Achieve millisecond-level precision correlation through a cross-modal spatiotemporal alignment engine, align network traffic to log time slices using sliding window aggregation, calculate correlation matrix based on cross-attention module to locate causal events, adaptively allocate weights based on branch confidence, generate a visual attack chain graph after triggering alarms, annotate key evidence heatmaps, and output a compliance audit report.

[0053] In some embodiments, S3 includes:

[0054] S31. Select window segmentation traffic data, extract protocol distribution entropy, packet length dynamic index and transmission direction characteristics, and perform hierarchical modeling through the attention mechanism of spatiotemporal Transformer;

[0055] S32. Construct a heterogeneous graph neural network, parse logs into triples, aggregate multi-hop neighbor information through a relation-specific parameter matrix, calculate path confidence, output graph vectors, and support the detection of covert attack chains.

[0056] S33. Define the state and transition probability matrix, use the Transformer with relative position encoding to analyze the operation sequence context, detect rapid state transitions, output behavior vectors, and identify high-risk trajectories;

[0057] S34. Receive the concatenated input of network, log, and user behavior features, generate initial weights through linear projection after layer normalization, and output a normalized weight vector by adopting a sparsity strategy and temperature coefficient adjustment.

[0058] S35. Optimize the gating mechanism in stages, design load balancing loss based on activation frequency, count the number of recent resource calls, minimize the deviation of each resource call frequency from the average, and prevent resource idleness.

[0059] S36. To address the time granularity difference between network traffic and log events, expand the window with the log timestamp as the center, aggregate traffic features within the window, calculate the attention weights of log events and traffic features through a time-aligned attention layer, and generate a cross-modal aligned feature vector.

[0060] S37. Construct a causal graph model, define nodes and causal edges, and use PC algorithm and structural equation model to automatically learn the attack chain logic; calculate the joint probability of paths based on historical statistics, dynamically update parameters, and output an evidence graph with confidence.

[0061] S38. Introduce a gating weight mechanism to dynamically adjust the contribution of network and log features, and input concatenated features.

[0062] In some embodiments, a network traffic spatiotemporal encoder is constructed in S3 to segment traffic data with a 60-second window, extract protocol distribution entropy, packet length dynamic indicators and transmission direction features, and hierarchically model the data through the 6-head attention mechanism of the spatiotemporal Transformer: local header, periodic header, and global header to capture cross-protocol correlations.

[0063] In some embodiments, S3 constructs a heterogeneous graph neural network, parses the logs into "subject-action-object", injects tactical labels, aggregates multi-hop neighbor information through a relation-specific parameter matrix, calculates path confidence, and outputs a 192-dimensional graph vector combining entity embedding 64, relation strength 64, and tactical distribution 64 to detect covert attack chains.

[0064] The present invention also provides an embodiment of a system for implementing the above-described multi-source threat detection method based on a hybrid expert model, comprising:

[0065] The multi-source data acquisition module is configured to collect network traffic metadata and host system logs in parallel. The network traffic metadata includes encrypted session characteristics and protocol behavior sequences, and the host system logs include privileged operation records and file access trajectories.

[0066] The dual-modal feature extraction module includes a traffic analysis unit and a log parsing unit. The traffic analysis unit uses a Transformer network with causal masking to extract temporal behavior features. The log parsing unit uses a hierarchical graph attention network to construct an operation entity relationship graph.

[0067] The expert routing decision module includes 3-6 Transformer-based domain expert models and a dynamic gating network. The domain expert models are specifically designed to detect specific threat patterns. The dynamic gating network selects at least two expert models for collaborative reasoning based on feature similarity.

[0068] The multimodal fusion module aligns the traffic feature space and the log feature space through a cross-attention mechanism;

[0069] The threat assessment module outputs a three-dimensional decision vector that includes threat type, risk level, and confidence score.

[0070] In some embodiments, the step of selecting an expert in a dynamic gating network includes:

[0071] S01. Calculate the cosine similarity between the input features and the professional fields of each expert;

[0072] S02. Use the Top-k sparsity algorithm to select the 2-3 experts with the highest similarity.

[0073] S03. Use the Softmax function with an adjustable temperature coefficient to generate expert weights.

[0074] like Figure 3 As shown, the ELK (Elasticsearch, Logstash, Kibana) technology stack, with its flexible data processing capabilities and efficient visualization and analysis tools, has become the industry-standard solution for log and traffic management. The core advantage of this platform lies in its layered architecture design. The data acquisition layer uses lightweight proxies (such as the Beats family) to achieve low-intrusion log and traffic capture, avoiding significant impact on production environment performance. The data processing layer utilizes Logstash's pipeline mechanism to clean, format, and enhance fields of raw data, solving the problem of heterogeneous formats from multiple data sources. The storage and retrieval layer, based on Elasticsearch's distributed indexing technology, enables high-speed writing of massive amounts of data and complex queries, providing support for real-time analysis and historical backtracking. The visualization layer, leveraging Kibana's interactive dashboards, transforms abstract log events and traffic patterns into intuitive charts and alert rules, empowering security operations teams to make rapid decisions.

[0075] To meet the needs of collecting data in Windows environments and network traffic, the platform needs to expand its multimodal data integration capabilities, capture key information such as system security events and application error logs through Winlogbeat, and combine it with Packetbeat to perform in-depth analysis of network traffic, forming a full-link observation perspective of "host behavior-network interaction".

[0076] like Figure 4As shown, the Mixture of Experts (MoE) model is a technique that utilizes multiple different sub-models or "experts" to improve the quality of Large Language Models (LLMs). It uses multiple expert models to handle different tasks, dynamically selecting experts through a gating mechanism, making it suitable for handling heterogeneous data. Multimodal training means the model can simultaneously process different types of data, such as structured logs and unstructured traffic data. Inputting log and traffic data into MoE requires different experts to process data of different modalities; for example, one expert processes user behavior sequences in the logs, while another processes time series or protocol analysis of network traffic. The gating network dynamically adjusts the weights based on the features of the input data, integrating information from both. MoE's multimodality can integrate cross-modal features, such as the correlation between user behavior and data transmission, improving the ability to detect complex threats. Simultaneously, the model can automatically learn important features in different scenarios; for example, network traffic is more important in data theft, while logs are more critical in privilege abuse. Furthermore, MoE's flexibility allows for parallel processing and scalability, making it suitable for handling large amounts of data. In practical applications, independent expert networks are trained using log and traffic data respectively to learn intramodal features, such as user profiles in logs and outbound connection patterns in traffic. Joint fine-tuning is then performed, and by fixing expert parameters, a gating network is trained to learn cross-modal associations, such as triggering bimodal expert collaboration in a "data theft" scenario.

[0077] like Figure 5 As shown, in a large language model employing a Hybrid Expert (MoE) architecture, the "expertise" of the expert module lies in its ability to fine-tune specific contexts and tokens. When this architecture is migrated to multimodal detection scenarios involving log and traffic data, the expert module's expertise further focuses on the specialization of data features and cross-modal contextual relationships. The content learned by the experts is more detailed than the entire domain; the so-called "expert" is not specifically focused on a particular field, such as "psychology" or "biology," but rather on grammatical level expertise. Log data experts pay more attention to tokens such as user behavior sequences, permission changes, and access to sensitive resources. Traffic data experts focus on tokens such as protocol type, traffic volume, and target IP risk.

[0078] To ensure that the sum of the weights of all experts is 1, the router's output is typically processed by the softmax activation function. The softmax function transforms a real-valued vector into a probability distribution such that the weights of each expert are in the range [0,1], and the sum of all weights is 1. Thus, the weights can be interpreted as the probability that the input data belongs to each expert, providing a reasonable basis for the allocation of input data. For example, for a MoE model with three experts, the router might calculate weights of [0.2, 0.5, 0.3], meaning that there is a 20% probability that the input data will be processed by the first expert, a 50% probability by the second expert, and a 30% probability by the third expert.

[0079] 1. Multimodal intelligent acquisition engine

[0080] 1.1 Distributed Heterogeneous Log Collection Architecture

[0081] A multi-source collaborative data acquisition framework is constructed. By deploying Filebeat / Packetbeat / Winlogbeat data acquisition agent components in the cluster, dynamic pattern recognition of application logs, deep extraction of network traffic metadata, and tracking of privileged system operations are achieved. An adaptive backpressure algorithm dynamically adjusts the transmission rate to ensure zero packet loss data acquisition in high-concurrency scenarios.

[0082] 1.2 Adaptive Log Processing Pipeline

[0083] The design incorporates a layered filtering engine that performs log instrumentation on application logs, injects network traffic packet header tags, loads the ATT&CK tactical rule base into system logs, and associates log and traffic data of the same host using IP address and hostname, outputting structured logs to a time-sharing partitioned elastic index.

[0084] 1.3 Intelligent Storage and Retrieval Optimization

[0085] Network traffic and system logs are stored using a distributed index architecture. Data is divided by time, and each log entry is stored as a JSON document containing fields such as timestamp, protocol type, and source IP. An inverted index is used to establish term mappings for key fields to accelerate retrieval. During writes, a sharding mechanism is used to distribute storage and automatically replicate copies to ensure high availability. During retrieval, combined queries are supported, such as abnormal traffic from a specific IP in the past hour. Combined with aggregation analysis and time series optimization, millisecond-level response times are achieved.

[0086] 2. Dual-branch feature extractor

[0087] 2.1 Network Traffic Temporal Modeling Branch

[0088] To analyze network traffic behavior patterns, a deep analysis framework based on time-series Transformers is constructed. Traffic data is segmented into 5-minute windows, extracting 32-dimensional temporal features such as protocol distribution entropy and packet length fluctuations to form hourly input sequences. A multi-granularity attention mechanism is designed, deploying eight attention heads to capture short-term bursts, medium-term periodic behaviors, and long-term baseline changes. Combined with rotational position encoding, the semantics of time intervals are accurately modeled, effectively identifying hidden behaviors such as abnormal outbound connections.

[0089] 2.2 Log Semantic Parsing Branch

[0090] A hierarchical attention network is employed to achieve deep understanding of log context. The bottom-level word-level attention layer strengthens the semantic weight of high-risk keywords, parsing fine-grained information from individual log entries. The upper-level event-level attention layer analyzes the temporal correlation of log sequences through a Transformer attention architecture, dynamically increasing the decision weight of key event chains. An adaptive gating mechanism is introduced to automatically adjust the fusion ratio of word-level and event-level features based on the operation type, emphasizing event sequence analysis when detecting data leakage chains.

[0091] 2.3 Dual-branch collaborative mechanism

[0092] Establish a cross-modal spatiotemporal alignment and joint decision-making system. By linking network traffic time slices with log event sequences through a cross-attention module, the causal relationship between protocol behavior and operational events can be located, such as a surge in data compression traffic after an abnormal login. A dynamic weighted fusion strategy is designed: when the network anomaly score exceeds a threshold, the network branch weight increases to 0.8; when log risk markers are significant, the log branch weight increases to 0.7, achieving accurate threat identification. The system supports outputting visualized attack chains, such as "22:03 abnormal login → 22:15 privilege escalation → 22:28 data leakage," as well as the weight distribution of key evidence, meeting audit tracing requirements.

[0093] 3. Hybrid Expert Reasoning Framework

[0094] 3.1 Multimodal Feature Encoding Method

[0095] A specialized coding architecture was designed for three types of heterogeneous data: network traffic, system logs, and user behavior. Network traffic processing employs a spatiotemporally aware Transformer model, analyzing TCP session sequences within a 60-second time window to extract temporal features such as protocol type, packet size, and transmission direction. A multi-head attention mechanism is used to capture cross-protocol behavioral patterns, such as identifying the correlation between HTTP long connections and SSH short sessions. The system log parsing module constructs a knowledge graph, transforming log events into triples <subject-action-object>. Heterogeneous graph neural networks are applied to analyze causal relationships between events, such as detecting the violation chain of "user A executing a sensitive program and then accessing a financial database." User behavior modeling uses a Transformer model to analyze the contextual dependencies of operation sequences, defining three states: "routine operation," "permission change," and "data export." Contextual dependency analysis is used to identify abnormal behavior trajectories, such as discovering high-risk patterns where users quickly jump from routine operations to data export.

[0096] 3.2 Dynamic Routing Gated Network

[0097] A smart weight allocation mechanism is constructed to achieve precise scheduling of expert resources. After receiving multimodal encoded input, the gating network calculates the activation weights of experts in each domain (network, logs, user behavior). A TopK sparsity strategy is adopted to ensure that at most two experts are called at a time, significantly reducing computational overhead. The training process is divided into three stages: initially, a forced uniform exploration of the capabilities of each expert is implemented; in the middle stage, a temperature coefficient is introduced to balance exploration and utilization; and in the later stage, routing parameters are frozen to focus on expert optimization. To prevent some experts from being idle for a long time, a load balancing loss function is designed to dynamically adjust the expert calling frequency. For example, when detecting data leakage attacks, the gating network may activate the network traffic expert with a weight of 0.8, call the user behavior expert with a weight of 0.15, and automatically skip the log expert whose weight is below the threshold.

[0098] 3.3 Cross-modal reasoning mechanism

[0099] Establish a deep correlation analysis system across data sources. Addressing the time granularity differences between network traffic and log events, a time-aligned attention layer is designed to aggregate high-frequency network events into log time windows for matching. A causal inference engine is built to automatically learn the causal relationships of attack chains such as "abnormal login → privilege escalation → data compression," outputting interpretable evidence graphs. The feature fusion module introduces an adaptive gating mechanism to dynamically adjust the contribution ratio of network features and log features. For example, in scenarios involving outbound data detection, the weight of network traffic features is increased to 70%, while in internal privilege abuse scenarios, the focus is on log behavior analysis.

[0100] 1. Multimodal intelligent acquisition engine

[0101] A full-stack data governance system is built through a multimodal intelligent acquisition engine to achieve comprehensive real-time acquisition and deep structured processing of network traffic, system logs, and user behavior data. On the network traffic side, a distributed Packetbeat cluster is deployed to capture multi-dimensional metadata such as five-tuples and packet length distribution. Session-level traffic reassembly is achieved through a parser, and filters are used to prioritize the acquisition of high-risk protocols such as SMB and RDP. On the system log side, a customized Filebeat agent is used to collect Windows event logs, Linux auditd audit records, and Kubernetes audit events in real time. Field-level parsing is performed using a regular expression engine and GROK pattern library to extract key entities such as process trees and file operation paths. On the user behavior side, a fine-grained operation audit pipeline is built. Hook technology is used to capture SSH command history, database query statements, and cloud platform API call chains, and user-resource access relationships are modeled based on a graph structure.

[0102] 1.1 Distributed Heterogeneous Log Collection Architecture

[0103] 1.1.1 Multi-source collaborative acquisition framework design

[0104] A log collection system for hybrid cloud environments is built, employing a layered distributed architecture to achieve unified governance of multimodal data. At the edge layer, a lightweight collection agent is deployed on each host / container node, with resource constraints preventing impact on business performance. Filebeat monitors application log directories, dynamically identifying new service logs based on an automatic discovery mechanism and applying predefined Grok templates for structured processing. Packetbeat captures network traffic using eBPF technology, extracting L2-L7 layer metadata through a protocol decoder to generate session-level stream records. Winlogbeat deeply integrates with Windows ETW, subscribing to security event channels and focusing on collecting privileged operation events. At the aggregation layer, a Logstash cluster is deployed as a regional data hub, configuring multi-level pipelines to achieve protocol conversion, field filtering, and preliminary correlation analysis, such as associating logs and traffic data from the same host via IP / MAC addresses. At the control layer, collection policies are dynamically distributed through the Elastic Agent management platform to ensure policy consistency.

[0105] 1.1.2 Application Log Dynamic Pattern Recognition

[0106] An adaptive log parsing engine was designed to address the issue of format differences among multi-source logs. It automatically selects the best parsing template based on log header features matched using regular expressions and heuristic rules. For example, for log lines containing ERROR and PID=", a custom parser is triggered to extract the process ID and error code. A state machine is used to identify cross-line log features and merge them into a single event. A threat intelligence database is integrated to tag entities such as IP addresses and domain names in the logs and associate them with MITRE ATT&CK tactical tags.

[0107] 1.1.3 Deep Extraction of Network Traffic Metadata

[0108] Deep traffic behavior is characterized through protocol reverse engineering and metadata enrichment techniques. For protocol decoding, it supports the parsing of 50+ protocols, including TLS / SSL, MySQL, and SMB. For covert channel detection, it statistically analyzes DNS query entropy and ICMP payload length distribution to flag suspicious tunnel traffic.

[0109] 1.1.4 System Privileged Operation Tracking

[0110] Construct a full lifecycle audit chain for privileged operations. Track the process tree, record the process creation chain, and detect abnormal parent processes. Monitor permission changes, tracking Windows Token modifications and Linux sudo command execution. Verify file integrity: for file modification events in sensitive paths, calculate the SHA256 hash, associate it with the operator's identity, and generate an alert event.

[0111] 1.1.5 Adaptive Backpressure Control and Zero Packet Loss Guarantee

[0112] A dynamic resource scheduling system is designed to ensure data integrity under high load. Based on TCP congestion control principles, the transmission window is dynamically adjusted; for example, when downstream processing latency exceeds 1000ms, the sending window is reduced by 20%. A 5GB circular buffer is allocated on the local disk to temporarily cache unsent data during network interruptions, supporting resumeable transmission. Multiple Logstash terminal addresses are configured, automatically switching to a backup node and retrying transmission when the primary node becomes unreachable.

[0113] 1.2 Adaptive Log Processing Pipeline

[0114] 1.2.1 Layered Filtering Engine Design

[0115] A four-tier pipeline processing architecture is constructed, implementing data standardization, threat enhancement, and intelligent routing layer by layer. At the input standardization layer, multi-source data, including application logs, network traffic, and system logs, is received uniformly, converted to standard JSON format by a protocol parser, and timezone normalization and missing field imputation are performed. At the primary filtering layer, log tracking is implemented, and business tags are injected to support categorized routing. Traffic is tagged by adding business operation tags to the HTTP header. ATT&CK rules are loaded, mapping system log events to tactical IDs, such as associating the Process Create event with T1059. At the correlation analysis layer, hostname / IP is used to associate host multi-source data, and event frequency is statistically analyzed based on time windows.

[0116] 1.2.2 Multi-source association and storage optimization

[0117] The system integrates contextual data to construct a host profile, correlating logs, traffic, and vulnerability data. It analyzes event sequences based on time windows, such as login failure → privilege escalation → a surge in database queries, generating attack chain confidence levels.

[0118] 1.3 Intelligent Storage and Retrieval Optimization

[0119] 1.3.1 Distributed Index Architecture

[0120] A time-partitioning strategy is adopted, with indexes created daily. Combined with In-Lifecycle Management (ILM), data is automatically divided into three phases: hot phase (data from the latest 3 days is stored on SSD), warm phase (data from days 4-30 is migrated to HDD), and cold phase (data older than 30 days is archived to S3). Each index is split into 5 primary shards by default, dynamically allocated to cluster nodes. The shard size is controlled within 50GB to avoid performance skew and ensure balanced high-concurrency write and query loads.

[0121] 1.3.2 Data Storage Model

[0122] Define a structured JSON document model. Network traffic includes fields such as src_ip, protocol, and tls_fingerprint, while system logs include fields such as hostname, event_type, and command_line. Dynamic mapping automatically identifies field types, disabling columnar storage for high-cardinality numeric fields to optimize memory usage, and storing only the raw values ​​for low-frequency fields.

[0123] 1.3.3 Inverted Index and Retrieval Acceleration

[0124] The `text` field is split using a standard tokenizer and supports fuzzy search; the `keyword` field retains its original value and supports exact matching. Columnar storage is employed, with columnar storage enabled for sorting and aggregation fields to accelerate range queries. High-frequency fields are optimized: inverted indexes are generated for fields such as `protocol` and `event_type` to improve retrieval speed.

[0125] 2. Dual-branch feature extractor

[0126] The dual-branch feature extractor achieves fine-grained feature extraction through a collaborative mechanism of network traffic temporal parsing and log semantic parsing: the traffic branch employs multi-scale time window segmentation and a spatiotemporal Transformer model, combined with Rotated Position Encoding (RoPE) to capture sudden fluctuations, periodic behaviors, and baseline shifts, outputting 256-dimensional temporal features; the log branch extracts operational entities and intentions through regularization parsing and Transformer semantic embedding, and integrates ATT&CK tactical rules to construct a causal knowledge graph, generating 192-dimensional semantic features. The dual branches match traffic windows and log events through a spatiotemporal attention alignment layer, and dynamically fuse features using a gating network, outputting 128-dimensional key features after dimensionality reduction optimization.

[0127] 2.1 Network Traffic Temporal Modeling Branch

[0128] 2.1.1 Data Preprocessing and Feature Extraction

[0129] The raw traffic data was segmented into 5-minute windows to extract 32-dimensional time-series features: (a) Protocol distribution entropy: Shannon entropy of the traffic proportion of protocols such as HTTP and DNS was calculated to identify protocol distribution anomalies. (b) Packet length fluctuation: Standard deviation, kurtosis, and proportion of abnormal packets were statistically analyzed. (c) Session behavior: Session rate, median duration, and TCP flag combinations were captured.

[0130] The features of 12 consecutive windows (1 hour) are stacked into an input sequence X∈R12×32 for Transformer modeling.

[0131] 2.1.2 Multi-granularity Transformer architecture

[0132] In the embedding layer, 32-dimensional features are mapped to a 256-dimensional latent space. Rotation Position Encoding (RoPE): Relative time interval information is injected through complex field rotation, improving the ability to detect hidden leaks.

[0133] 2.2 Log Semantic Parsing Branch

[0134] 2.2.1 Hierarchical Attention Network Architecture

[0135] A word-level and event-level two-layer attention mechanism is designed to achieve deep semantic analysis and threat correlation of logs. At the input encoding layer, the raw logs are converted into structured fields through regular expression parsing, while unstructured text retains its original content. A word vector sequence is generated through the embedding encoding layer. At the word-level attention layer, high-risk keywords are enhanced: a risk dictionary is defined, and matching words are assigned larger initial attention weights. The final word-level weights are calculated using learnable parameters, with the weights of high-risk words further amplified. At the event-level attention layer, consecutive log events are sorted by timestamp to construct an event sequence S. Multi-head self-attention is used to capture dependencies between events, focusing on modeling key event chains.

[0136] 2.3 Dual-branch collaborative mechanism

[0137] The dual-branch collaboration mechanism achieves millisecond-level precision correlation through a cross-modal spatiotemporal alignment engine: it uses sliding window aggregation to align network traffic to log time slices, calculates the correlation matrix based on the cross-attention module, and locates causal events; it designs a dynamic weighted fusion strategy, adaptively allocates weights based on branch confidence, generates a visual attack chain graph after triggering an alarm, marks key evidence heatmaps, and outputs a compliance audit report.

[0138] 3. Hybrid Expert Reasoning Framework

[0139] The hybrid expert reasoning framework intelligently schedules three types of expert models—network behavior experts, log semantic experts, and user profiling experts—through a dynamic routing gating network. It calculates gating weights based on input features and achieves millisecond-level spatiotemporal alignment through cross-modal attention. It dynamically weights and fuses expert results to generate a comprehensive threat score. It combines a causal reasoning engine to construct an attack chain and outputs an interpretable report with a heatmap. The entire process enables real-time multimodal data acquisition, collaborative feature extraction, and intelligent response.

[0140] 3.1 Multimodal Feature Encoding Method

[0141] 3.1.1 Network Traffic Spatiotemporal Encoder

[0142] Traffic data is segmented into 60-second windows, and protocol distribution entropy, packet length dynamic indicators, and transmission direction features are extracted. The spatiotemporal Transformer uses a 6-head attention mechanism for hierarchical modeling: local head (burst fluctuations in adjacent windows), periodic head (hourly encrypted traffic peaks), and global head (day-night baseline differences) to capture cross-protocol correlations, such as concurrent HTTP long connections and SSH short sessions. The output is a 256-dimensional vector (64 for protocol fingerprints + 96 for traffic fluctuations + 96 for session features) to accurately identify encrypted tunnels and covert outbound connections.

[0143] 3.1.2 System Log Knowledge Graph Encoding

[0144] A heterogeneous graph neural network is constructed to parse logs into triples <subject-action-object>, inject MITRE ATT&CK tactical labels, aggregate multi-hop neighbor information through a relation-specific parameter matrix, calculate path confidence, and output a 192-dimensional graph vector (entity embedding 64 + relation strength 64 + tactical distribution 64), which supports the detection of covert attack chains.

[0145] 3.1.3 User Behavior Sequence Modeling

[0146] We define three types of states and transition probability matrices: “routine operation → permission change → data export”. We use Transformer with relative position encoding to analyze the context of the operation sequence, detect rapid state transitions within 10 minutes, and output a 128-dimensional behavior vector (64 for state transitions + 64 for context dependencies) to accurately identify high-risk trajectories.

[0147] 3.2 Dynamic Routing Gated Network

[0148] 3.2.1 Gated Network Architecture Design

[0149] The gated network receives a concatenated input of network (256-dimensional), log (192-dimensional), and user behavior (128-dimensional) features (576-dimensional). After layer normalization, initial weights are generated through linear projection. A Top-2 sparsity strategy and temperature coefficient adjustment are adopted to output a normalized weight vector, ensuring reduced computational overhead and supporting deployment on edge devices.

[0150] 3.2.2 Three-stage training strategy

[0151] The gating mechanism is optimized in stages: In the initial stage, weights are forcibly and evenly distributed to avoid underfitting; in the middle stage, temperature annealing is introduced and load balancing loss is added to balance exploration and utilization; in the later stage, gating parameters are frozen and expert fine-tuning is focused on.

[0152] 3.2.3 Load Balancing Optimization

[0153] The design incorporates load balancing loss based on activation frequency. It counts the number of expert calls in the last 1000 steps, minimizes the deviation of each expert's call frequency from the mean, and prevents experts from being idle. For continuously inactive experts, the weight is temporarily forced to be increased to 0.5. Combined with dynamic expansion of high-load experts, this achieves high utilization of experts and ensures efficient resource allocation.

[0154] 3.3 Cross-modal reasoning mechanism

[0155] 3.3.1 Cross-modal temporal alignment engine

[0156] To address the time granularity differences between network traffic and log events, a sliding window aggregation strategy is designed: expanding the window by ±500ms centered on the log timestamp, aggregating traffic features within the window, including: packet burst rate, encrypted traffic percentage, and target IP risk. The attention weights of log events and traffic features are calculated through a time-aligned attention layer to generate cross-modal aligned feature vectors, solving the millisecond-level time-series synchronization problem with an alignment error of <10ms, supporting accurate causal relationships.

[0157] 3.3.2 Causal Reasoning Engine

[0158] Construct a causal graph model, define nodes (login, privilege escalation, etc.) and causal edges (e.g., login → privilege escalation), and use PC algorithm and structural equation model to automatically learn the attack chain logic; calculate the joint probability of paths based on historical statistics, dynamically update parameters, output evidence graph with confidence, support interpretable threat assessment, and trigger an alarm when the attack chain confidence is >0.9.

[0159] 3.3.3 Adaptive Feature Fusion Module

[0160] A gating weight mechanism is introduced to dynamically adjust the contribution of network and log features: the input concatenated features are processed by a Sigmoid fully connected layer to generate weights g∈[0,1]. In the data transmission scenario, the network weight is increased to g=0.7, and in the permission abuse scenario, log analysis is emphasized. The fusion formula is F_fused=g·F_net+(1-g)·F_log.

[0161] Compared with existing technologies, this invention achieves real-time collection and structured processing of network traffic, system logs, and user behavior data through a multimodal intelligent acquisition engine, providing high-quality multi-source input for upper-level analysis; a dual-branch feature extractor performs in-depth analysis of network traffic temporal patterns and log semantic context, generating fine-grained feature vectors; the hybrid expert reasoning framework is based on a dynamic routing gating network, intelligently scheduling three types of domain expert models: network behavior, log semantics, and user profiling, fusing spatiotemporally aligned features through a cross-modal attention mechanism, and constructing an interpretable chain of attack evidence in conjunction with a causal reasoning engine, ultimately achieving a closed-loop process from multimodal data collection, collaborative feature extraction, and intelligent threat reasoning, significantly improving the accuracy of complex internal threat detection while ensuring millisecond-level real-time response.

[0162] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0163] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0164] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0165] This application can be described in the general context of computer-executable instructions, such as program modules, that are executed by a computer. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This application can also be practiced in distributed computing environments where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0166] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0167] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0168] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0169] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0170] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0171] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0172] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions in the method embodiments.

[0173] The above description is merely an embodiment of this application and is not intended to limit this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of this application should be included within the scope of the claims of this application.

Claims

1. A multi-source threat detection method based on a hybrid expert model, characterized in that... The method performs real-time multimodal acquisition and structured processing of network traffic, system logs, and user behavior data, providing high-quality multi-source input for upper-level analysis; it performs in-depth analysis of network traffic temporal patterns and log semantic context to generate fine-grained feature vectors; and it intelligently schedules three types of domain expert models—network behavior, log semantics, and user profiles—based on a dynamic routing gating network, fusing spatiotemporal aligned features through a cross-modal attention mechanism. Construct an interpretable chain of attack evidence to ultimately achieve a closed loop across the entire chain, from multimodal data collection, collaborative feature extraction, and intelligent threat reasoning.

2. The multi-source threat detection method based on a hybrid expert model according to claim 1, characterized in that... The method specifically includes: S1. Construct a full-stack data governance system through a multimodal intelligent acquisition engine, build a distributed heterogeneous log acquisition architecture, set up an adaptive log processing pipeline, complete intelligent storage and retrieval optimization, and realize comprehensive real-time acquisition and deep structured processing of network traffic, system logs and user behavior data. S2. Construct a network traffic temporal modeling branch, a log semantic parsing branch, and a dual-branch collaboration mechanism to achieve fine-grained feature extraction through the collaboration mechanism of network traffic temporal parsing and log semantic parsing; S3. Implement multimodal feature encoding, build a dynamic routing gating network and a cross-modal reasoning mechanism. Through the dynamic routing gating network, intelligently schedule three types of expert models: network behavior experts, log semantic experts and user profiling experts, and calculate gating weights based on input feature concatenation.

3. The multi-source threat detection method based on a hybrid expert model according to claim 2, characterized in that, The method S1 includes: S11. Design a multi-source collaborative acquisition framework, build a log acquisition system for hybrid cloud environments, and adopt a layered distributed architecture to achieve unified governance of multimodal data; S12. Dynamic pattern recognition application logs: Design an adaptive log parsing engine that matches log header features based on regular expressions and heuristic rules, and automatically selects the best parsing template. S13. Deeply extract network traffic metadata and achieve in-depth characterization of traffic behavior through protocol reverse engineering and metadata enrichment technology; S14. Construct a full lifecycle privileged operation audit chain, trace the process tree, record the process creation chain, detect abnormal parent processes, monitor permission changes, verify file integrity, and realize system privileged operation tracking. S15. Design a dynamic resource scheduling system to ensure data integrity under high load, and achieve adaptive back pressure control and zero packet loss guarantee.

4. The multi-source threat detection method based on a hybrid expert model according to claim 2, characterized in that, The method S2 includes: S21. Data preprocessing and feature extraction: Select a window to cut the raw traffic data, extract time-series features, calculate protocol distribution entropy, identify protocol distribution anomalies, and statistically analyze standard deviation, kurtosis, and the proportion of abnormal packets; stack the features of multiple consecutive windows into an input sequence for modeling. S22. Construct a multi-granularity Transformer architecture. In the embedding layer, map multi-dimensional features to a multi-dimensional latent space and inject relative time interval information through complex field rotation. S23. At the input encoding layer, the original logs are converted into structured fields through regular expression parsing, while the unstructured text retains its original content. Word vector sequences are generated through the embedding encoding layer. At the word-level attention layer, high-risk keywords are strengthened, a risk dictionary is defined, and matching words are given larger initial attention weights. The final word-level weights are calculated through learnable parameters. At the event-level attention layer, continuous log events are sorted by timestamps to construct an event sequence. Multi-head self-attention is used to capture the dependencies between events, with a focus on modeling key event chains. S24. Achieve millisecond-level precision correlation through a cross-modal spatiotemporal alignment engine, align network traffic to log time slices using sliding window aggregation, calculate correlation matrix based on cross-attention module to locate causal events, adaptively allocate weights based on branch confidence, generate a visual attack chain graph after triggering alarms, annotate key evidence heatmaps, and output a compliance audit report.

5. The multi-source threat detection method based on a hybrid expert model according to claim 2, characterized in that... The method S3 includes: S31. Select window segmentation traffic data, extract protocol distribution entropy, packet length dynamic index and transmission direction characteristics, and perform hierarchical modeling through the attention mechanism of spatiotemporal Transformer; S32. Construct a heterogeneous graph neural network, parse logs into triples, aggregate multi-hop neighbor information through a relation-specific parameter matrix, calculate path confidence, output graph vectors, and support the detection of covert attack chains. S33. Define the state and transition probability matrix, use the Transformer with relative position encoding to analyze the operation sequence context, detect rapid state transitions, output behavior vectors, and identify high-risk trajectories; S34. Receive the concatenated input of network, log, and user behavior features, generate initial weights through linear projection after layer normalization, and output a normalized weight vector by adopting a sparsity strategy and temperature coefficient adjustment. S35. Optimize the gating mechanism in stages, design load balancing loss based on activation frequency, count the number of recent resource calls, minimize the deviation of each resource call frequency from the average, and prevent resource idleness. S36. To address the time granularity difference between network traffic and log events, expand the window with the log timestamp as the center, aggregate traffic features within the window, calculate the attention weights of log events and traffic features through a time-aligned attention layer, and generate a cross-modal aligned feature vector. S37. Construct a causal graph model, define nodes and causal edges, and use PC algorithm and structural equation model to automatically learn the attack chain logic; calculate the joint probability of paths based on historical statistics, dynamically update parameters, and output an evidence graph with confidence. S38. Introduce a gating weight mechanism to dynamically adjust the contribution of network and log features, and input concatenated features.

6. The multi-source threat detection method based on a hybrid expert model according to claim 2, characterized in that, In method S3, a network traffic spatiotemporal encoder is constructed, which segments the traffic data with a 60-second window, extracts protocol distribution entropy, packet length dynamic indicators and transmission direction features, and uses the spatiotemporal Transformer's 6-head attention mechanism for hierarchical modeling: local header, periodic header, and global header to capture cross-protocol correlations.

7. The multi-source threat detection method based on a hybrid expert model according to claim 2, characterized in that, The method S3 constructs a heterogeneous graph neural network, parses the log into "subject-action-object", injects tactical labels, aggregates multi-hop neighbor information through a relation-specific parameter matrix, calculates path confidence, and outputs a 192-dimensional graph vector combining entity embedding 64, relation strength 64, and tactical distribution 64 to detect covert attack chains.

8. A system for implementing the multi-source threat detection method based on a hybrid expert model as described in any one of claims 1-6, characterized in that... include: The multi-source data acquisition module is configured to collect network traffic metadata and host system logs in parallel. The network traffic metadata includes encrypted session characteristics and protocol behavior sequences, and the host system logs include privileged operation records and file access trajectories. The dual-modal feature extraction module includes a traffic analysis unit and a log parsing unit. The traffic analysis unit uses a Transformer network with causal masking to extract temporal behavior features. The log parsing unit uses a hierarchical graph attention network to construct an operation entity relationship graph. The expert routing decision module includes 3-6 Transformer-based domain expert models and a dynamic gating network. The domain expert models are specifically designed to detect specific threat patterns. The dynamic gating network selects at least two expert models for collaborative reasoning based on feature similarity. The multimodal fusion module aligns the traffic feature space and the log feature space through a cross-attention mechanism; The threat assessment module outputs a three-dimensional decision vector that includes threat type, risk level, and confidence score.

9. The system according to claim 8, characterized in that, The steps for selecting experts in the dynamic gating network include: S01. Calculate the cosine similarity between the input features and the professional fields of each expert; S02. Use the Top-k sparsity algorithm to select the 2-3 experts with the highest similarity. S03. Use the Softmax function with an adjustable temperature coefficient to generate expert weights.

10. A computer-readable storage medium having a computer program stored thereon that, when executed by a processor, implements the method of any one of claims 1-7.

Images