Adaptive cooperative security protection method based on attack path deduction, medium and system

Abstract

The invention provides a self-adaptive collaborative security protection method based on attack path deduction, a medium and a system, and belongs to the technical field of network security. The method comprises the following steps: sampling possible paths from a current attack node to high-value assets based on an adaptive path sampling algorithm of Monte Carlo tree search to generate an attack path graph, calculating a protection effectiveness score and a service influence score according to key nodes and predicted attack actions, and generating an optimal protection instruction set based on a multi-target tradeoff function; an instruction is converted into a heterogeneous security device configuration command through a strategy execution cooperative controller, multi-device synchronous activation is realized by adopting a distributed transaction protocol based on a logic clock, and a protection effect is monitored and fed back to an artificial intelligence model for parameter optimization; the problem of protection strategy failure caused by asynchronous network security protection response and attack evolution is solved.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically relates to an adaptive collaborative security protection method, medium, and system based on attack path deduction. Background Technology

[0002] In the field of cybersecurity, traditional security systems primarily rely on rule matching and signature detection technologies to intercept known threats, and monitor and filter network traffic by deploying independent security devices such as firewalls and intrusion detection systems. However, existing security devices lack effective collaboration mechanisms, and the independent operation of each device prevents real-time sharing of threat intelligence. Protection strategies are formulated based on human experience, resulting in slow response times and an inability to predict attackers' subsequent actions. In current cyberattack scenarios, attackers employ multi-stage penetration strategies, and attack paths change dynamically. Existing protection systems can only passively respond to currently detected threats, unable to predict the attacker's next target and path. This causes protection measures to lag behind the attack evolution, allowing attackers to bypass deployed protection nodes and continue penetrating core assets. In other words, existing technologies suffer from a technical problem where the cybersecurity protection response is out of sync with the attack evolution, leading to the failure of protection strategies. Summary of the Invention

[0003] In view of this, the present invention provides an adaptive collaborative security protection method, medium and system based on attack path inference, which can solve the technical problem in the prior art where the network security protection response and attack evolution are not synchronized, resulting in the failure of protection strategies.

[0004] This invention is implemented as follows: The first aspect of this invention provides an adaptive collaborative security protection method based on attack path inference. This method uses an adaptive path sampling algorithm based on Monte Carlo tree search to probabilistically infer the subsequent attack paths that an attacker might choose, generating an attack path graph. Protective measures are deployed in advance before the threat reaches critical nodes. A distributed transaction protocol based on logical clocks is used to achieve synchronized activation of policies from multiple heterogeneous security devices, ensuring precise and coordinated deployment of protective actions at critical nodes of the attack path, and enabling the protection response to advance synchronously with the attack evolution process. The method includes the following steps: collecting firewall logs, intrusion detection system alarms, web application firewall records, and server system logs, and performing timestamp alignment and field standardization processing to construct a unified security event stream; inputting the unified security event stream into a sparse Bayesian inference model to perform threat confidence analysis. The system calculates and triggers an attack path deduction process when the threat confidence exceeds a threat threshold. An adaptive path sampling algorithm based on Monte Carlo tree search samples and expands possible paths from the current attack node to high-value assets in the network topology, generating an attack path graph. Based on key nodes in the attack path graph and predicted attack actions, it calculates the protection effectiveness score and business impact score for different response actions, generating an optimal protection instruction set based on a multi-objective trade-off function. The optimal protection instruction set is converted into configuration commands for heterogeneous security devices through a policy execution coordination controller, and a distributed transaction protocol based on a logical clock is used to achieve synchronous activation of multiple devices. The system monitors network state changes and attack behavior evolution after policy execution, calculates protection effectiveness evaluation indicators, and feeds them back to the sparse Bayesian inference model and the adaptive path sampling algorithm based on Monte Carlo tree search for parameter optimization.

[0005] The construction steps of the unified security event flow specifically involve filling missing values ​​and filtering outliers in the collected firewall logs, intrusion detection system alarms, web application firewall records, and server system logs, and extracting source IP address, target IP address, port number, protocol type, attack signature, and timestamp as standardized fields.

[0006] The steps for constructing a unified security event flow include aggregating events with a time interval of less than 300 seconds and the same source IP address into an event sequence based on time window correlation analysis, and classifying and labeling the event sequences according to attack stage tags.

[0007] Among them, the sparse Bayesian inference model is based on the construction of a sparse Bayesian network for variational inference. It utilizes the frequency domain feature learning mechanism of spectral convolution to map the temporal features in the unified security event stream to the frequency domain space through Fourier transform.

[0008] Among them, the sparse Bayesian inference model uses frequency domain filters to extract periodic patterns and spectral characteristics of attack behavior, and combines adaptive regularization terms to penalize invalid feature nodes, thereby reducing the instability of posterior probability calculation caused by the sparsity of the conditional probability table under high-dimensional sparse features.

[0009] Among them, the sparse Bayesian inference model also considers an asynchronous event concurrency mechanism, which processes event streams from different data sources in parallel through multi-threading. The asynchronous event concurrency mechanism is enabled by a concurrency control switch function.

[0010] The concurrency control switch function dynamically determines whether to enable the asynchronous event concurrency mechanism based on the event flow arrival rate and the system computing resource utilization rate. The asynchronous event concurrency mechanism is enabled when the concurrency control state value is greater than or equal to 1.0.

[0011] Among them, the adaptive path sampling algorithm of Monte Carlo tree search balances path exploration and utilization based on the upper confidence bound strategy, and prioritizes expanding nodes with low attack cost and high success probability.

[0012] The Monte Carlo tree search adaptive path sampling algorithm includes a selection phase, an expansion phase, a simulation phase, and a backtracking phase, and the attack path with the most visits to the output node is taken as the most likely attack path.

[0013] The calculation of the protection effectiveness score involves identifying key nodes in the attack path graph, enumerating response actions for each key node, and calculating the probability of each response action blocking the attack path graph.

[0014] The business impact score is calculated by obtaining a list of network assets and business traffic affected by each response action, and then calculating the ratio of the business interruption duration caused by the response action to the standard runtime.

[0015] The multi-objective trade-off function calculates a comprehensive score based on the protection effectiveness score and the business impact score, and selects the response action combination with the highest comprehensive score as the optimal protection instruction set.

[0016] The policy execution coordination controller includes an instruction conversion module and a synchronization activation module. The instruction conversion module has built-in adapters for various security devices to convert the optimal protection instruction set into the configuration command format of heterogeneous security devices.

[0017] Among them, the distributed transaction protocol based on logical clock sends policy preparation requests to all heterogeneous security devices participating in the protection through the coordination node, and calculates the maximum logical clock timestamp plus the preset delay time as the unified activation time.

[0018] The logical clock timestamp is maintained through a vector clock mechanism. The vector clock records the event sequence number of each heterogeneous security device node, which is used to track the causal dependencies between events.

[0019] The protection effectiveness evaluation indicators include attack termination rate, false alarm rate, and service availability retention rate. The parameter optimization steps calculate the model performance adjustment factor based on the protection effectiveness evaluation indicators and call the weight adjustment function to update the frequency domain filter weights of the sparse Bayesian inference model.

[0020] A second aspect of the present invention provides a computer-readable storage medium storing program instructions, which, when executed in a computer, are used to perform the aforementioned adaptive collaborative security protection method based on attack path deduction.

[0021] A third aspect of the present invention provides an adaptive collaborative security protection system based on attack path deduction, comprising the aforementioned computer-readable storage medium, wherein the system is a computer, the computer-readable storage medium is disposed within the system, and the system is provided with a microprocessor for executing program instructions stored in the computer-readable storage medium.

[0022] This invention constructs a predictive protection mechanism based on attack path deduction. It employs an adaptive path sampling algorithm using Monte Carlo tree search to probabilistically predict the subsequent attack paths that attackers might choose, deploying protective measures in advance before the threat reaches critical nodes, thus achieving a shift from passive response to proactive prevention. This invention utilizes a sparse Bayesian inference model combined with a frequency domain feature learning mechanism based on spectral convolution. Through Fourier transform, it maps time-domain security event features to the frequency domain space to extract periodic patterns of attack behavior, reducing the instability of conditional probability calculation under high-dimensional sparse features and improving the accuracy and real-time performance of threat identification. This invention uses a policy execution coordination controller employing a distributed transaction protocol based on logical clocks to achieve synchronized activation of policies across multiple heterogeneous security devices, ensuring precise coordinated deployment of protective actions at critical nodes of the attack path, enabling the protection response to advance synchronously with the attack evolution process. In summary, this invention solves the technical problem mentioned in the background art where the asynchronous response to network security protection and the attack evolution lead to the failure of protection strategies. Attached Figure Description

[0023] Figure 1 This is a flowchart of the method of the present invention.

[0024] Figure 2 This is a diagram illustrating the threat confidence calculation process for a sparse Bayesian inference model.

[0025] Figure 3 A diagram showing the results of Monte Carlo tree search attack path deduction.

[0026] Figure 4 This is a comparison chart of the comprehensive scores of the multi-objective trade-off function.

[0027] Figure 5 Activation sequence diagram for distributed transaction protocol strategy. Detailed Implementation

[0028] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0029] like Figure 1 The diagram shown is a flowchart of an adaptive collaborative security protection method based on attack path deduction provided by the first aspect of the present invention. This method includes the following steps: S01. Collect firewall logs, intrusion detection system alarms, web application firewall records, and server system logs, and perform timestamp alignment and field standardization processing to build a unified security event stream; S02. Input the unified security event stream into the sparse Bayesian inference model to calculate the threat confidence. When the threat confidence exceeds the threat threshold, trigger the attack path deduction process. S03. The adaptive path sampling algorithm based on Monte Carlo tree search samples and expands the possible paths from the current attack node to high-value assets in the network topology to generate an attack path graph. S04. Calculate the protection effectiveness score and business impact score of different response actions based on the key nodes in the attack path graph and the predicted attack actions, and generate the optimal protection instruction set based on the multi-objective trade-off function. S05. The optimal protection instruction set is converted into configuration commands for heterogeneous security devices through the policy execution coordination controller, and a distributed transaction protocol based on logical clock is used to achieve synchronous activation of multiple devices. S06. Monitor network state changes and attack behavior evolution after the implementation of the monitoring strategy, calculate the protection effect evaluation index, and feed it back to the sparse Bayesian inference model and the adaptive path sampling algorithm of Monte Carlo tree search for parameter optimization.

[0030] The construction steps of the unified security event flow specifically include: performing missing value imputation and outlier filtering on the collected firewall logs, intrusion detection system alarms, web application firewall records, and server system logs; extracting source IP address, target IP address, port number, protocol type, attack signature, and timestamp as standardized fields; aggregating events with a time interval of less than 300 seconds and the same source IP address into event sequences based on time window correlation analysis; and classifying and labeling the event sequences according to attack stage tags to form a structured unified security event flow.

[0031] The sparse Bayesian inference model is constructed based on a sparse Bayesian network of variational inference. It utilizes the frequency domain feature learning mechanism of spectral convolution to map the temporal features in the unified security event stream to the frequency domain space through Fourier transform. It employs frequency domain filters to extract the periodic patterns and spectral characteristics of attack behavior and combines adaptive regularization terms to penalize invalid feature nodes, thereby reducing the instability of posterior probability calculation caused by the sparsity of the conditional probability table under high-dimensional sparse features. The sparse Bayesian inference model also considers an asynchronous event concurrency mechanism, which improves the efficiency of real-time threat identification by processing event streams from different data sources in parallel through multi-threading.

[0032] The structure of the sparse Bayesian inference model is as follows: the input layer receives security event feature vectors of dimension N, where N is the total number of features; the frequency domain transformation layer performs a fast Fourier transform on the security event feature vectors, converting the time-domain signal into a frequency-domain representation; the spectral convolution layer contains M frequency-domain filters, each performing convolution operations in the frequency domain space, and the weights of the frequency-domain filters are obtained through variational lower bound optimization; the sparse constraint layer introduces an L1 regularization term to penalize the ratio of the sum of the absolute values ​​of the weights in the Bayesian network to the standard weight threshold, automatically pruning invalid feature nodes; probabilistic inference... The reasoning layer uses the expectation propagation algorithm to calculate the posterior probability distribution, performing numerical operations in logarithmic space to avoid underflow; the output layer outputs threat confidence and threat level assessment results; the asynchronous event concurrency mechanism establishes an event queue and multiple processing threads, with each processing thread independently processing the event stream from one data source, and the processing results of the processing threads are aggregated to the probabilistic inference layer for fusion calculation; the asynchronous event concurrency mechanism is controlled by a concurrency control switch function, which dynamically decides whether to enable the asynchronous event concurrency mechanism based on the event stream arrival rate and the system computing resource utilization rate.

[0033] The concurrency control switch function is used to dynamically control the activation state of the asynchronous event concurrency mechanism. Inputs include the event stream arrival rate, system computing resource utilization, standard arrival rate, and standard resource utilization. The output is the concurrency control state value. The calculation formula for the concurrency control switch function is as follows: the sum of the ratio of the event stream arrival rate to the standard arrival rate and the ratio of the system computing resource utilization to the standard resource utilization is divided by 2 to obtain the concurrency control state value. When the concurrency control state value is ≥ 1.0, the asynchronous event concurrency mechanism is enabled; when the concurrency control state value is < 1.0, the asynchronous event concurrency mechanism is disabled, and a single-threaded sequential processing mode is adopted.

[0034] The event stream arrival rate is the number of events received in the unified security event stream per unit time, expressed as events per second. The system computing resource utilization rate is the ratio of CPU resources used by the sparse Bayesian inference model to the total system CPU resources, expressed as a percentage. The standard arrival rate is set to 100 events per second, representing the event arrival frequency of the unified security event stream under normal circumstances. The standard resource utilization rate is set to 70%, representing a reasonable level of system computing resource utilization.

[0035] The concurrency control switch function functions as follows: when the event flow arrival rate is high or the system computing resource utilization rate is high, it automatically enables the asynchronous event concurrency mechanism to improve processing efficiency and avoid threat identification delays caused by event backlog; when the event flow arrival rate is low and the system computing resource utilization rate is low, it disables the asynchronous event concurrency mechanism to save thread scheduling overhead and reduce system complexity. In the structure of the sparse Bayesian inference model, the concurrency control switch function is integrated as a control module between the input layer and the frequency domain transformation layer. By monitoring the event flow arrival rate and system computing resource utilization rate received by the input layer in real time, it calculates the concurrency control state value. When the concurrency control state value meets the activation condition, the input layer distributes the security event feature vector to the event queues of multiple processing threads. Each processing thread independently calls the frequency domain transformation layer and subsequent layers for parallel computation, and the computation results are summarized in the probabilistic inference layer. When the concurrency control state value does not meet the activation condition, the input layer directly sends the security event feature vector to the frequency domain transformation layer in sequence for single-threaded processing.

[0036] The steps for establishing the training dataset for the sparse Bayesian inference model specifically include: collecting historical attack event samples and normal business behavior samples. The historical attack event samples include advanced persistent threat attack samples, ransomware attack samples, and vulnerability exploitation attack samples. The normal business behavior samples include user login behavior samples, file transfer behavior samples, and database query behavior samples. An N-dimensional feature vector is extracted from each historical attack event sample and normal business behavior sample. The N-dimensional feature vector includes connection frequency, data packet size distribution, port scan range, and number of abnormal login attempts. The threat levels of the historical attack event samples are labeled, categorized into low threat, medium threat, and high threat. The historical attack event samples and normal business behavior samples are divided into a training set and a validation set in an 8:2 ratio.

[0037] The specific steps for training the sparse Bayesian inference model include: initializing the conditional probability table and frequency domain filter weights of the Bayesian network; inputting training set samples into the sparse Bayesian inference model and calculating the predicted threat confidence through forward propagation; calculating the cross-entropy loss between the predicted threat confidence and the true label, with the cross-entropy loss including the product of the penalty coefficient of the L1 regularization term and the sum of the absolute values ​​of the feature weights; updating the frequency domain filter weights and conditional probability table parameters using the stochastic gradient descent algorithm, with the learning rate set to 0.001; evaluating the accuracy and recall of the sparse Bayesian inference model on the validation set, and stopping training when the validation set accuracy no longer improves for 10 consecutive rounds.

[0038] The frequency domain feature learning mechanism of the spectral convolution transforms temporal security event features into the frequency domain space, using frequency domain filters to capture the periodic patterns and energy distribution characteristics of attack behaviors in the frequency dimension. Compared with temporal convolution, it can more effectively identify periodic attack patterns such as port scanning and timed data theft with fixed time intervals. The feature dimension compression under the frequency domain representation reduces the size of the conditional probability table in the sparse Bayesian network, reduces the uncertainty and numerical instability of probability calculation in high-dimensional feature space, and improves the threat identification accuracy in scenarios with insufficient samples. The asynchronous event concurrency mechanism processes event streams from different security devices in parallel through multi-threaded parallel processing, avoiding event backlog and delay caused by single-threaded sequential processing, thus enabling the sparse Bayesian network to... The model can complete real-time inference of multi-source heterogeneous data within milliseconds, significantly shortening the time window from threat detection to response triggering, and gaining a critical time advantage for subsequent attack path deduction and collaborative protection. The concurrency control switch function realizes the adaptive activation and deactivation of the asynchronous event concurrency mechanism by dynamically monitoring the event flow arrival rate and system computing resource utilization. In high-load scenarios, it automatically enables multi-threaded parallel processing to improve throughput, and in low-load scenarios, it automatically switches to single-threaded mode to reduce thread scheduling overhead. This avoids the resource waste or performance bottleneck caused by fixed concurrency mode, enabling the sparse Bayesian inference model to flexibly adjust the computing mode according to the actual workload, maintaining optimal threat identification efficiency and system resource utilization.

[0039] The threat threshold is determined based on the threat confidence distribution of historical attack event samples. When the threat confidence is greater than 0.75, it is judged as a high-risk attack and the attack path deduction process is triggered. The current attack node is extracted from the unified security event stream, and the current attack node is the network node corresponding to the most recently detected attack behavior in the unified security event stream. The high-value assets are obtained from the asset value database, which stores the importance weights of all assets in the network. High-value assets are assets with an importance weight greater than 0.8.

[0040] The adaptive path sampling algorithm for Monte Carlo tree search balances path exploration and utilization based on an upper confidence bound strategy, prioritizing the expansion of nodes with low attack costs and high success probabilities. The steps of the adaptive path sampling algorithm include: initializing the search tree with the current attack node as the root node; calculating the upper confidence bound value for each child node in the selection phase, where the upper confidence bound value is determined by the node's average reward value, the number of times the node is visited, the number of times the parent node is visited, and exploration parameters, and selecting the child node with the largest upper confidence bound value for expansion; generating new candidate attack nodes based on network topology and vulnerability information in the expansion phase; simulating attack paths using a random strategy starting from the expanded candidate attack nodes in the simulation phase until reaching high-value assets or encountering protection blocking; backpropagating the simulation results in the backtracking phase to update the number of times all nodes are visited and the average reward value of all nodes on the attack path; repeating the selection phase, expansion phase, simulation phase, and backtracking phase until a preset number of simulations or time limit is reached, and outputting the attack path with the most node visits as the most probable attack path.

[0041] The attack path graph includes the sequence of attack nodes, the transition probability between nodes, the attack action type corresponding to each attack node, the time required for a successful attack, and the defense difficulty coefficient. The attack cost is calculated by comprehensively considering the technical difficulty, time cost, and resource consumption required for the attacker to carry out the attack; a lower attack cost indicates that the attacker is more likely to choose that attack path. The network topology is obtained from the network management system, describing all nodes in the network and the connections between them. The vulnerability information is obtained from the vulnerability scanning system, including the security vulnerability number and severity level of each network node. The critical nodes are network nodes in the attack path graph that the attacker must traverse and for which there are no alternative paths. The predicted attack action is the attack action type corresponding to each attack node in the attack path graph.

[0042] The calculation steps for the protection effectiveness score specifically include: identifying key nodes in the attack path graph; enumerating response actions for each key node, including blocking the source IP address, modifying the firewall access control list, isolating the target host, and disabling high-risk ports; calculating the blocking probability of each response action on the attack path graph, the blocking probability being determined by the overlap between the coverage of the response action and the attack path graph; and normalizing the blocking probability values ​​to obtain the protection effectiveness score.

[0043] The specific steps for calculating the business impact score include: obtaining a list of network assets and a list of business traffic affected by each response action; querying the asset value library and the business priority configuration table to obtain the asset importance weight and business criticality weight; calculating the ratio of the business interruption duration caused by the response action to the standard runtime, multiplying the ratio of the business interruption duration to the standard runtime by the business criticality weight to obtain the initial value of business impact; and normalizing the initial value of business impact to obtain the business impact score.

[0044] The multi-objective trade-off function calculates a comprehensive score based on the protection effectiveness score and the business impact score. The comprehensive score formula is as follows: the comprehensive score is obtained by adding the product of the protection effectiveness score and the protection weight coefficient to the product of the negative number of the business impact score and the business weight coefficient, where the sum of the protection weight coefficient and the business weight coefficient is equal to 1; the response action combination with the highest comprehensive score is selected as the optimal protection instruction set.

[0045] The protection weight coefficient and business weight coefficient are dynamically adjusted according to the organization's security policy and business tolerance. When facing high-risk attacks, the protection weight coefficient is increased, and when business is at its peak, the business weight coefficient is increased.

[0046] The policy execution coordination controller includes an instruction conversion module and a synchronization activation module. The instruction conversion module has built-in adapters for various security devices, which convert abstract protection instructions from the optimal protection instruction set into configuration command formats for heterogeneous security devices. The synchronization activation module uses a distributed transaction protocol based on a logical clock to coordinate the policy activation time of multiple devices.

[0047] The heterogeneous security devices include firewalls, intrusion prevention systems, web application firewalls, and endpoint protection software.

[0048] The configuration command is a control instruction that heterogeneous security devices can recognize and execute.

[0049] The execution steps of the distributed transaction protocol based on logical clock specifically include: the coordinating node sends a policy preparation request to all participating heterogeneous security devices, the policy preparation request containing a logical clock timestamp and the optimal protection instruction set; each heterogeneous security device, upon receiving the policy preparation request, checks its resource status and configuration conflicts; if there are no configuration conflicts, it enters a ready state and returns a ready confirmation message to the coordinating node, the ready confirmation message containing the logical clock timestamp of the heterogeneous security device; the coordinating node collects the ready confirmation messages from all heterogeneous security devices, calculates the maximum logical clock timestamp plus a preset delay time as the unified activation time; the coordinating node sends a commit command to all heterogeneous security devices, the commit command containing the unified activation time; upon receiving the commit command, the heterogeneous security devices wait locally until the unified activation time arrives to synchronously activate the policy; the coordinating node monitors the policy activation status of each heterogeneous security device through a heartbeat mechanism, and if a heterogeneous security device's response timeout is detected, it dynamically adjusts the timeout threshold and resends the commit command.

[0050] The logical clock timestamp is maintained through a vector clock mechanism. The vector clock records the event sequence number of each heterogeneous security device node, which is used to track the causal dependencies between events and avoid policy activation order errors caused by network latency and clock drift.

[0051] The preset delay time is determined based on the 95th percentile value of historical network delay data, ensuring that the timing deviation between heterogeneous security devices is less than 50 milliseconds in 99.9% of scenarios.

[0052] The protection effectiveness evaluation indicators include attack termination rate, false positive rate, and service availability maintenance rate. Attack termination rate is the ratio of the reduction in the number of attack events after policy execution to the number of attack events before execution. False positive rate is the ratio of the number of normal service traffic instances that were mistakenly identified as attacks and triggering protection actions to the total number of protection actions. Service availability maintenance rate is the ratio of service uptime during policy execution to the total uptime. The number of attack events after policy execution is obtained by monitoring network status changes after policy execution, while the number of attack events before execution is obtained from statistics in the unified security event stream. The number of normal service traffic instances is obtained from statistics in the service traffic list, and the total number of protection actions is the number of response actions included in the optimal protection instruction set. Service uptime is obtained by monitoring service availability status during policy execution, and the total time is the duration of policy execution. The parameter optimization steps specifically include: calculating the model performance adjustment factor based on the protection effectiveness evaluation indicators; updating the frequency domain filter weights and conditional probability table parameters of the sparse Bayesian inference model by calling the weight adjustment function based on the model performance adjustment factor; and adjusting the exploration parameters and attack cost heuristic function coefficients of the adaptive path sampling algorithm of Monte Carlo tree search based on the deviation between the actual attack path and the predicted attack path.

[0053] The weight adjustment function is used to adjust the frequency domain filter weights of the sparse Bayesian inference model. The weight adjustment function calculates the model performance adjustment factor based on the attack termination rate, false positive rate, and service availability retention rate. The formula for the model performance adjustment factor is as follows: Subtract the ratio of the false positive rate to the standard false positive rate from the sum of the ratio of the attack termination rate to the standard termination rate and the ratio of the service availability retention rate to the standard availability rate. When the model performance adjustment factor is within the range [0.8, 1.2), the frequency domain filter weights are updated using a standard learning rate of 0.001. When the model performance adjustment factor is <0.8, the learning rate is increased by 0.005 to accelerate the frequency domain filter weight adjustment. When the model performance adjustment factor is ≥1.2, the learning rate is decreased by 0.0005 for fine-tuning of the frequency domain filter weights.

[0054] The standard termination rate is set to 0.9, meaning the protection strategy should effectively terminate 90% of attacks; the standard false positive rate is set to 0.05, meaning the proportion of correctly identifying normal business operations as attacks should be less than 5%; and the standard availability is set to 0.95, meaning business availability should be maintained above 95%. The actual attack path is the attack path actually taken by the attacker as detected after the strategy is executed, and the predicted attack path is the most probable attack path output by the adaptive path sampling algorithm of Monte Carlo tree search. The deviation between the actual and predicted attack paths is obtained by calculating their overlap, which is the ratio of the number of identical attack nodes in both paths to the total number of nodes in the predicted path. The exploration parameters of the adaptive path sampling algorithm of Monte Carlo tree search are dynamically adjusted based on the overlap. When the overlap is below 0.7, the exploration parameter value is increased to expand the search range; when the overlap is above 0.9, the exploration parameter value is decreased to accelerate the convergence speed. The attack cost heuristic function coefficient is set differently based on the historical success rate and protection difficulty coefficient of different attack types. A lower attack cost heuristic function coefficient is set for vulnerability exploitation attacks to reflect their high success rate, while a higher attack cost heuristic function coefficient is set for social engineering attacks to reflect their high uncertainty. The historical success rate is obtained statistically from historical attack event samples, and is the ratio of the number of successful attacks in the historical attack event samples to the total number of attacks. The protection difficulty coefficient is obtained from the attack path graph and is used to quantify the difficulty of implementing protection against attack nodes.

[0055] The specific implementation methods of the above steps are described in detail below.

[0056] The specific implementation of step S01 is as follows: First, raw security data is collected from four data sources: firewall logs, intrusion detection system alarms, web application firewall records, and server system logs. The collection process achieves real-time data capture through a standard log interface protocol. The collected raw data is preprocessed. Missing values ​​are filled using a forward imputation method, and outliers are identified and filtered out using a box plot method, removing data points exceeding three times the normal range. Six standardized fields—source IP address, target IP address, port number, protocol type, attack signature, and timestamp—are extracted from the preprocessed data. Regular expression matching technology is used for field extraction to achieve unified parsing of different log formats. Event aggregation is performed on the extracted standardized fields based on a time window correlation analysis method. The time window is set to 300 seconds. Events with a time interval less than 300 seconds and the same source IP address are grouped into an event sequence. The correlation analysis uses a sliding window algorithm to achieve dynamic aggregation of continuous events. The aggregated event sequences are categorized and labeled according to attack phase tags, which include seven categories: reconnaissance phase, weaponization phase, delivery phase, exploitation phase, installation phase, command and control phase, and objective achievement phase. The classification and labeling are implemented using a rule-based pattern matching method. The purpose of these steps is to address the issues of inconsistent data formats and data silos among heterogeneous security devices. Through standardization processing and correlation analysis, scattered security data is integrated into a structured, unified security event stream, providing high-quality input for subsequent threat analysis.

[0057] The specific implementation of step S02 is as follows: A unified security event stream is input into the input layer of the sparse Bayesian inference model. The dimension N of the security event feature vector received by the input layer is determined based on the number of feature types in the actual deployment environment, typically ranging from 500 to 2000 dimensions. A concurrency control switch function monitors the event stream arrival rate and system computing resource utilization in real time. The event stream arrival rate is calculated by counting the number of events received by the input layer per unit time, and the system computing resource utilization is obtained by querying the operating system resource monitoring interface. The concurrency control switch function sums the ratio of the event stream arrival rate to the standard arrival rate and the ratio of the system computing resource utilization to the standard resource utilization, then divides the sum by 2 to obtain the concurrency control status value. The reference value for the standard arrival rate is 100 events per second, and the reference value for the standard resource utilization is 70%. When the concurrency control status value is greater than or equal to 1.0, the asynchronous event concurrency mechanism is enabled, and the input layer distributes the security event feature vector to the event queues of multiple processing threads for parallel processing. When the concurrency control status value is less than 1.0, the asynchronous event concurrency mechanism is disabled, and single-threaded sequential processing is used. The frequency domain transformation layer performs a Fast Fourier Transform (FFT) on the security event feature vector, converting the time-domain signal into a frequency-domain representation. This FFT is implemented using the Cooley-Tucky algorithm, with a computational complexity of [missing value]. The system employs efficient frequency domain mapping. The spectral convolutional layer contains M frequency domain filters that perform convolution operations on the frequency domain representation. The typical value of the number of frequency domain filters, M, is 50 to 200. The frequency domain filters optimize weight parameters through variational inference to maximize the lower bound of the posterior probability. The sparse constraint layer introduces an L1 regularization term to penalize the ratio of the sum of the absolute values ​​of the weights to a standard weight threshold. A reference value for the standard weight threshold is 0.01. Invalid feature nodes with absolute weight values ​​less than the threshold are automatically pruned. The probabilistic inference layer uses the expectation propagation algorithm to calculate the posterior probability distribution in logarithmic space, avoiding numerical underflow problems under high-dimensional sparse features. The output layer outputs a threat confidence value ranging from 0 to 1. When the threat confidence exceeds the threat threshold of 0.75, the attack path inference process is triggered. The purpose of these steps is to achieve real-time threat identification and quantitative evaluation of a unified security event stream, capture periodic attack patterns through a frequency domain feature learning mechanism, and adapt to different load scenarios through a concurrency control mechanism, providing reliable triggering conditions for subsequent path inference.

[0058] The specific implementation of step S03 is as follows: Network nodes corresponding to events with threat confidence exceeding the threat threshold are extracted from the unified security event stream as the current attack node; assets with an importance weight greater than 0.8 are obtained from the asset value pool as high-value assets. A Monte Carlo search tree is initialized with the current attack node as the root node. Each node in the search tree records two statistics: the number of node visits and the average node reward value. During the selection phase, the upper confidence bound value of each child node is calculated. The upper confidence bound value consists of the average node reward value plus an exploration reward term. The exploration reward term is correlated with the logarithm of the number of visits to the parent node and the reciprocal of the number of visits to the node. A typical value for the exploration parameter is 1.414. The child node with the largest upper confidence bound value is selected for expansion. The selection strategy uses an upper confidence bound tree algorithm to balance the utilization of high-reward paths and the exploration of unexplored paths. During the expansion phase, new candidate attack nodes are generated based on the network topology obtained from the network management system and the vulnerability information obtained from the vulnerability scanning system. Candidate nodes must meet two conditions: a network connection with the current node and the existence of an exploitable vulnerability. In the simulation phase, a random strategy is used to select subsequent attack paths starting from the expanded candidate attack nodes. This random strategy employs a weighted random sampling of candidate paths based on an attack cost heuristic function. The attack cost is calculated comprehensively based on three dimensions: technical difficulty, time cost, and resource consumption. Paths with lower attack cost have a higher probability of being selected. The simulation continues until a high-value asset is reached or a defense block is encountered. Defense block conditions include no reachable successor nodes or the time required for a successful attack exceeding the time limit. In the backtracking phase, the simulation results are propagated backward along the path, updating the node access count and average node reward value for all nodes on the path. The average node reward value is updated using an incremental averaging algorithm. The iterative process of the selection phase, expansion phase, simulation phase, and backtracking phase is repeated, with a typical number of iterations ranging from 1000 to 10000, or a time limit of 1 to 5 seconds. After the iteration, the path corresponding to the child node with the highest node access count among all child nodes of the root node is output as the most probable attack path. The most probable attack path, along with its included attack node sequence, inter-node transition probability, attack action type, time required for successful attack, and defense difficulty coefficient, is organized into an attack path graph. The purpose of these steps is to efficiently sample the exponentially growing attack path space using the Monte Carlo tree search algorithm, predict the attacker's most likely subsequent attack steps and final target, and provide a forward-looking basis for generating proactive defense strategies.

[0059] The specific implementation of step S04 is as follows: Identify key nodes from the attack path graph. Key nodes are network nodes that the attacker must traverse and for which there are no alternative paths. The identification method is to traverse all paths from the current attack node to high-value assets in the attack path graph and mark nodes appearing in all paths as key nodes. Enumerate response actions for each key node. Response actions include four categories: blocking the source IP address, modifying the firewall access control list, isolating the target host, and disabling high-risk ports. Calculate the blocking probability of each response action on the attack path graph. The blocking probability is determined by the ratio of the number of attack nodes covered by the response action to the total number of nodes in the attack path graph. The coverage is determined by analyzing the scope of the response action and the topological relationship of the attack path graph. Normalize the blocking probability values ​​to obtain a protection effectiveness score. The normalization method is to divide the blocking probability of each response action by the maximum blocking probability of all candidate response actions. Obtain a list of network assets and a list of business traffic affected by each response action. The network asset list is queried from the asset management system, and the business traffic list is queried from the traffic monitoring system. Query the asset value library to obtain asset importance weights and query the business priority configuration table to obtain business criticality weights. The process calculates the ratio of service interruption duration caused by the response action to the standard runtime. The service interruption duration is estimated based on the blocking scope of the response action and the business dependencies of the affected assets, while the standard runtime is determined based on the normal operation cycle of the business. The ratio of service interruption duration to standard runtime is multiplied by the business criticality weight to obtain an initial business impact value. This initial value is then normalized to obtain a business impact score. The protection effectiveness score is multiplied by the protection weight coefficient, and the negative of the business impact score is multiplied by the business weight coefficient. The sum of these two scores yields a comprehensive score. The sum of the protection weight coefficient and the business weight coefficient equals 1, with a typical value of 0.7 for the protection weight coefficient and 0.3 for the business weight coefficient. All response actions and their combinations are iterated to calculate the comprehensive score, and the response action combination with the highest comprehensive score is selected as the optimal protection instruction set. The purpose of these steps is to generate an optimal response strategy that balances protection effectiveness and business impact based on the predictive information provided by the attack path graph, achieving a balance between precise protection and business continuity through a multi-objective trade-off function.

[0060] The specific implementation of step S05 is as follows: The instruction conversion module of the policy execution coordination controller receives the optimal protection instruction set and calls the corresponding security device adapter according to the target device type specified in the protection instruction. The security device adapter converts the abstract protection instruction into a configuration command format that heterogeneous security devices can recognize. The conversion process includes three stages: instruction syntax mapping, parameter format conversion, and device interface protocol adaptation. The coordination node sends a policy preparation request to all heterogeneous security devices participating in the protection. The policy preparation request includes a logical clock timestamp and the converted configuration command. After receiving the policy preparation request, each heterogeneous security device checks its resource status, including CPU utilization, memory utilization, and network bandwidth utilization, and checks for configuration conflicts, including compatibility analysis with existing policy rules. If there are no configuration conflicts, the heterogeneous security device enters the ready state and returns a ready confirmation message to the coordination node. The ready confirmation message includes the logical clock timestamp of the heterogeneous security device. The logical clock timestamp is maintained through a vector clock mechanism to record the event sequence number. The coordinating node collects readiness confirmation messages from all heterogeneous security devices, extracts the maximum logical clock timestamp, and adds a preset delay time to the maximum logical clock timestamp to obtain the unified activation time. The preset delay time is determined based on the 95th percentile of historical network latency data, typically ranging from 100 to 200 milliseconds. The coordinating node sends a commit command to all heterogeneous security devices, including the unified activation time. Upon receiving the commit command, the heterogeneous security devices wait locally until the unified activation time arrives to synchronously activate their policies. The activation process includes three steps: loading configuration commands, updating the rule table, and starting the protection function. The coordinating node monitors the policy activation status of each heterogeneous security device through a heartbeat mechanism, with a typical heartbeat interval of 1 to 5 seconds. If a heterogeneous security device's response times out, the timeout threshold is dynamically adjusted based on the current network latency, and the commit command is resent. The purpose of these steps is to achieve synchronous activation of collaborative protection policies across multiple heterogeneous security devices, ensuring consistency in policy effectiveness times through a distributed transaction protocol based on logical clocks, and avoiding protection failures caused by protection gaps and policy conflicts.

[0061] The specific implementation of step S06 is as follows: After policy execution, continuously monitor network status changes, count the number of attack events after policy execution from the unified security event stream, obtain the number of attack events before execution from historical records, and calculate the attack termination rate by the ratio of the reduction in the number of attack events to the number of attack events before execution. Count the number of normal business traffic that was mistakenly identified as an attack and for which protective actions were executed from the business traffic list, count the total number of protective actions from the optimal protection instruction set, and calculate the false positive rate by the ratio of the number of normal business traffic to the total number of protective actions. Monitor the business availability status during policy execution, count the normal business uptime, obtain the duration of policy execution as the total time, and calculate the business availability retention rate by the ratio of the normal business uptime to the total time. Sum the ratio of the attack termination rate to the standard termination rate (0.9) and the ratio of the business availability retention rate to the standard availability (0.95), and subtract the ratio of the false positive rate to the standard false positive rate (0.05) to obtain the model performance adjustment factor. The frequency domain filter weights and conditional probability table parameters of the sparse Bayesian inference model are updated using the weight adjustment function based on the range of the model performance adjustment factor. When the model performance adjustment factor is between 0.8 and 1.2, the standard learning rate of 0.001 is used to update the frequency domain filter weights. When the model performance adjustment factor is less than 0.8, the learning rate is increased by 0.005 to accelerate the adjustment of the frequency domain filter weights. When the model performance adjustment factor is greater than or equal to 1.2, the learning rate is decreased by 0.0005 for fine-tuning of the frequency domain filter weights. The actual attack path taken by the attacker after the strategy execution is extracted from the monitoring data as the actual attack path. The actual attack path is compared with the predicted attack path output by the adaptive path sampling algorithm of Monte Carlo tree search. The overlap is calculated by the ratio of the number of identical attack nodes in the actual attack path and the predicted attack path to the total number of nodes in the predicted attack path. The exploration parameters of the adaptive path sampling algorithm of Monte Carlo tree search are dynamically adjusted based on the overlap. When the overlap is less than 0.7, the exploration parameter value is increased to expand the search range. When the overlap is greater than 0.9, the exploration parameter value is decreased to accelerate the convergence speed. The historical success rate is obtained by statistically analyzing the ratio of successful attacks of different attack types to the total number of attacks from historical attack event samples. This, combined with the protection difficulty coefficient in the attack path graph, allows for differentiated settings of the attack cost heuristic function coefficient. The purpose of this step is to continuously optimize the parameters of the sparse Bayesian inference model and the adaptive path sampling algorithm of Monte Carlo tree search through a closed-loop feedback mechanism. This enables the system to adaptively adjust the threat identification accuracy and attack path prediction precision based on actual protection effectiveness, achieving continuous evolution of protection capabilities.

[0062] It should be noted that the key technical ideas of this invention include: First, the construction of a sparse Bayesian inference model based on the spectral convolution frequency domain feature learning mechanism. Traditional threat identification methods analyze security event features in the time domain space, making it difficult to effectively capture periodic attack patterns with fixed time intervals. Furthermore, in high-dimensional sparse feature scenarios, the conditional probability table size is too large, leading to computational instability. This invention maps time domain features to the frequency domain space through Fourier transform, and uses frequency domain filters to extract periodic patterns and energy distribution features in the frequency dimension. The feature dimension compression under the frequency domain representation significantly reduces the size of the conditional probability table. Combined with variational inference optimization and expectation propagation algorithms, numerical calculations are performed in the logarithmic space, fundamentally solving the problem of probabilistic inference degradation under sparse features. This makes threat confidence calculation more stable and reliable, providing high-quality triggering basis for subsequent attack path deduction. Second, the design of an adaptive attack path prediction algorithm based on Monte Carlo tree search. Most existing security response technologies passively defend against attacks that have already occurred, failing to predict the attacker's subsequent actions, causing the defender to always lag behind the attacker. This invention employs a Monte Carlo tree search algorithm for intelligent sampling within an exponentially growing attack path space. It balances the utilization of high-success-rate paths with the exploration of unknown paths using an upper confidence bound strategy. Combined with an attack cost heuristic function, it prioritizes expanding the nodes most likely to be chosen by the attacker. This efficiently discovers the most probable attack paths with limited computational resources, achieving a fundamental shift from passive response to proactive prediction. This allows for pre-emptive deployment of protection strategies in the early stages of the attack chain, significantly improving the timeliness and proactivity of defense. Third, it utilizes a dynamic protection strategy generation mechanism based on a multi-objective trade-off function. Traditional protection strategy generation relies on static rules, often employing simple and crude blocking measures that fail to guarantee protection effectiveness and are prone to inadvertently harming normal business operations. This invention calculates the protection effectiveness score and business impact score of different response actions based on key nodes in the attack path graph and predicted attack actions. Through a multi-objective trade-off function, it comprehensively evaluates and selects the combination of response actions with the optimal protection effect and minimal business impact, achieving a dynamic balance between precise protection and business continuity. This avoids both over-protection and under-protection, making the protection strategy more intelligent and practical.

[0063] The synergistic effect of the three key technical approaches mentioned above is reflected in the following aspects: the sparse Bayesian inference model accurately identifies threats and quantifies confidence through a frequency domain feature learning mechanism, providing reliable triggering conditions and initial attack nodes for attack path prediction; the Monte Carlo tree search algorithm deduces the most likely attack path graph based on the threat identification results, providing forward-looking attack intent and target information for protection strategy generation; the multi-objective trade-off function generates an optimal protection instruction set that balances effectiveness and business impact based on key nodes and predicted actions in the attack path graph, achieving precise strikes; the distributed transaction protocol based on logical clocks ensures the temporal consistency of multi-device collaborative responses, avoiding protection gaps; and the closed-loop feedback mechanism uses actual protection effects to optimize model parameters, enabling the system to have continuous learning and adaptive capabilities. This synergy constructs a complete closed loop from threat perception, path prediction, strategy generation, collaborative execution to effect feedback, realizing a comprehensive leap in network security protection from passive response to proactive prediction, from isolated defense to collaborative joint defense, and from static rules to dynamic optimization. It fundamentally solves the core defects of existing technologies, such as the disconnect between analysis and response, low device collaboration capabilities, and a lack of policy adaptability.

[0064] It should be noted that this invention also solves the following technical problem: in scenarios with massive event streams generated by multi-source heterogeneous security devices, the traditional single-threaded sequential processing mode leads to event backlog and threat identification delays. This invention introduces an asynchronous event concurrency mechanism into the sparse Bayesian inference model, establishing an event queue and multiple processing threads to independently and concurrently process event streams from different data sources. A concurrency control switch function dynamically determines whether to enable the concurrency mechanism based on the event stream arrival rate and system computing resource utilization. Under high load scenarios, it automatically enables multi-threaded parallel processing to improve throughput and avoid event backlog; under low load scenarios, it automatically switches to single-threaded mode to reduce thread scheduling overhead. This allows the threat identification system to flexibly adjust its computing mode according to the actual workload, maintaining optimal processing efficiency and resource utilization. This enables real-time inference of multi-source heterogeneous data within milliseconds, significantly shortening the time window from threat detection to response triggering.

[0065] A second aspect of the present invention provides a computer-readable storage medium storing program instructions, which, when executed in a computer, are used to perform the aforementioned adaptive collaborative security protection method based on attack path deduction.

[0066] A third aspect of the present invention provides an adaptive collaborative security protection system based on attack path deduction, comprising the aforementioned computer-readable storage medium. The system is any one of a computer, a server, or a microcontroller. The computer-readable storage medium is disposed within the system, and the system is provided with a microprocessor that executes the program instructions stored in the computer-readable storage medium.

[0067] Specifically, the principle of this invention is as follows: This invention can solve the technical problem of asynchronous network security protection response and attack evolution. Its principle lies in combining threat detection and attack path prediction to build a forward-looking protection system. The sparse Bayesian inference model maps the temporal characteristics of security events to the frequency domain space through frequency domain transformation. It uses frequency domain filters to capture the periodic patterns of attack behavior in the time dimension. Compared with traditional time domain analysis, it can more effectively identify periodic attack patterns such as scanning probing and data theft with fixed time intervals. The feature dimension compression under the frequency domain representation reduces the uncertainty of probability calculation in the high-dimensional feature space. The Monte Carlo tree search adaptive path sampling algorithm is based on the upper confidence bound strategy balance exploration and utilization. By simulating the possible paths of attackers from the current node to high-value assets and evaluating the attack cost and success probability of each path, it outputs the most likely attack path sequence, enabling the system to identify key interception nodes before the attack reaches the target. The distributed transaction protocol based on logical clocks tracks the causal dependencies between devices through a vector clock mechanism, coordinating multiple security devices to activate protection strategies at a unified time point. This avoids policy activation timing errors caused by clock drift, ensuring that protection actions accurately cover the predicted key nodes of the attack path.

[0068] The following provides a specific embodiment 1 of the present invention, and the specific implementation of each step in this embodiment 1 is described in detail below.

[0069] The specific implementation of step S01 involves collecting firewall logs, intrusion detection system alarms, web application firewall records, and server system logs. Missing values ​​are filled and outliers are filtered in the collected data. Source IP address, target IP address, port number, protocol type, attack signature, and timestamp are extracted as standardized fields. Based on time window correlation analysis, events with a time interval of less than 300 seconds and the same source IP address are aggregated into event sequences. The event sequences are classified and labeled according to attack stage tags to form a structured unified security event flow.

[0070] The specific implementation of step S02 involves inputting a unified security event stream into a sparse Bayesian inference model for threat confidence calculation. The input layer of the sparse Bayesian inference model receives security event feature vectors of dimension N, where N is the total number of features. The frequency domain transformation layer performs a Fast Fourier Transform on the security event feature vectors to convert the time-domain signal into a frequency-domain representation. The spectral convolution layer contains M frequency-domain filters performing convolution operations in the frequency domain space, where M is the number of frequency-domain filters, with an empirical value ranging from 32 to 128. The sparse constraint layer introduces an L1 regularization term to penalize the ratio of the sum of the absolute values ​​of the weights in the Bayesian network to the standard weight threshold. The probabilistic inference layer uses the expectation propagation algorithm to calculate the posterior probability distribution. The output layer outputs the threat confidence and threat level assessment results. Threat Confidence Calculated through the probabilistic inference layer, this represents the probability that a detected security event is a real threat, ranging from 0 to 1 and dimensionless. The asynchronous event concurrency mechanism establishes an event queue and multiple processing threads. Each thread independently processes the event stream from one data source, and the processing results are aggregated at the probabilistic inference layer for fusion calculation. The concurrency control switch function dynamically determines whether to enable the asynchronous event concurrency mechanism based on the event stream arrival rate and system computing resource utilization. The concurrency control status value... The calculation formula is expressed as follows: ; In the formula, These are concurrent control state values, dimensionless. The event stream arrival rate, expressed in events per second; The standard arrival rate is expressed in events per second, with a default value of 100 events per second. To calculate the system's resource utilization rate, the percentage is expressed and then divided by 100 to convert it into a dimensionless value in the range of 0 to 1. This represents the standard resource utilization rate, expressed as a percentage and then divided by 100 to convert it to a dimensionless value ranging from 0 to 1, with a default value of 0.7. This is used when the concurrency control status value is active. When the asynchronous event concurrency mechanism is enabled, the concurrency control state value is... When asynchronous event concurrency is disabled, a single-threaded sequential processing mode is adopted. When threat confidence... Exceeding the threat threshold Attack path deduction process triggered at any time, threat threshold The empirical value is 0.75, which is dimensionless.

[0071] The specific implementation of step S03 is to sample and expand the possible paths from the current attacking node to high-value assets in the network topology based on the adaptive path sampling algorithm of Monte Carlo tree search. The adaptive path sampling algorithm of Monte Carlo tree search initializes the search tree with the current attacking node as the root node, and calculates the upper confidence bound value for each child node during the selection phase. The calculation formula is expressed as follows: ; In the formula, is the upper confidence boundary of the node, which is dimensionless; The cumulative reward value obtained by the node in all simulation processes is calculated by summing up during the backtracking phase. The single reward value is 1 when the simulated attack path successfully reaches the high-value asset, and 0 when it encounters protection blocking. It is dimensionless. This represents the number of times a node has been accessed, in seconds. This represents the number of times the parent node has been accessed; For the purpose of exploration, the parameters are dimensionless and typically take the value of 1.414. The child node with the largest upper confidence threshold is selected for expansion. During the expansion phase, new candidate attack nodes are generated based on network topology and vulnerability information. During the simulation phase, attack paths are simulated using a random strategy starting from the expanded candidate attack nodes until a high-value asset is reached or a protection block is encountered. During the backtracking phase, the simulation results are backpropagated to update the node access count and average node reward value for all nodes on the attack path. The selection phase, expansion phase, simulation phase, and backtracking phase are repeated until the preset number of simulations or time limit is reached. The attack path with the most node access counts is output as the most probable attack path, generating an attack path graph.

[0072] The specific implementation of step S04 involves calculating the protection effectiveness score and business impact score of different response actions based on the key nodes in the attack path graph and the predicted attack actions. Key nodes in the attack path graph are identified, and for each key node, response actions are enumerated, including blocking the source IP address, modifying the firewall access control list, isolating the target host, and disabling high-risk ports. The blocking probability of each response action on the attack path graph is calculated. The calculation formula is expressed as follows: ; In the formula, The probability of blocking is dimensionless. The number of critical nodes in the attack path covered by the response action, expressed in units of; This represents the total number of critical nodes in the attack path graph, expressed in units. Defense effectiveness score. The initial value of the service impact is obtained by normalizing the blocking probability of all response actions, with a value ranging from 0 to 1 and being dimensionless. The network asset list and service traffic list affected by each response action are obtained. The asset importance weight and service criticality weight are obtained by querying the asset value library and service priority configuration table. The ratio of the service interruption duration caused by the response action to the standard runtime is calculated. This ratio is then multiplied by the service criticality weight to obtain the initial value of the service impact. The calculation formula is expressed as follows: ; In the formula, Initial values ​​for business impact, dimensionless; The duration of service interruption caused by the response action, in seconds; Standard runtime, in seconds; This represents the business criticality weight, which is dimensionless and ranges from 0 to 1. The initial business impact value is normalized to obtain the business impact score. The value ranges from 0 to 1 and is dimensionless. The multi-objective trade-off function calculates a comprehensive score based on the protection effectiveness score and the business impact score. The formula for the overall score is as follows: ; In the formula, The score is a composite score and is dimensionless. The score for protective effectiveness is dimensionless and ranges from 0 to 1. The score represents the impact on business operations; it is dimensionless and ranges from 0 to 1. The weighting coefficients are dimensionless to protect against weighting. The business weight coefficient is dimensionless; the protection weight coefficient and the business weight coefficient satisfy... The combination of response actions with the highest overall score is selected as the optimal protection instruction set.

[0073] The specific implementation of step S05 involves converting the optimal protection instruction set into configuration commands for heterogeneous security devices through a policy execution coordination controller. The policy execution coordination controller includes an instruction conversion module and a synchronization activation module. The instruction conversion module has built-in adapters for various security devices. These adapters convert abstract protection instructions from the optimal protection instruction set into configuration command formats for heterogeneous security devices, including firewalls, intrusion prevention systems, web application firewalls, and endpoint protection software. The synchronization activation module employs a distributed transaction protocol based on logical clocks to coordinate the policy activation time of multiple devices. The coordinating node sends a policy preparation request to all participating heterogeneous security devices. This request includes a logical clock timestamp and the optimal protection instruction set. Each heterogeneous security device, upon receiving the request, checks its resource status and configuration for conflicts. If no conflicts are found, it enters a ready state and returns a ready confirmation message to the coordinating node. This message contains the logical clock timestamp of the heterogeneous security device. The coordinating node collects all ready confirmation messages from all heterogeneous security devices, calculates the maximum logical clock timestamp plus a preset delay time as the unified activation time, and sends a commit command to all heterogeneous security devices. This command includes the unified activation time. Upon receiving the commit command, each heterogeneous security device waits locally until the unified activation time arrives to synchronously activate its policy. The logical clock timestamp is maintained using a vector clock mechanism. The vector clock records the event sequence number of each heterogeneous security device node, used to track causal dependencies between events. The preset delay time is determined based on the 95th percentile of historical network latency data, with an empirical value of 50 milliseconds.

[0074] The specific implementation of step S06 involves monitoring network state changes and attack behavior evolution after policy execution, calculating protection effectiveness evaluation indicators, and feeding these indicators back to the sparse Bayesian inference model and the adaptive path sampling algorithm of Monte Carlo tree search for parameter optimization. The protection effectiveness evaluation indicators include attack termination rate, false positive rate, and service availability maintenance rate. Attack termination rate... The calculation formula is expressed as follows: ; In the formula, The attack termination rate is dimensionless. The number of attack events prior to strategy execution, expressed in units of individuals. The number of attack events after the strategy was executed, in units of individual attacks. False positive rate. The calculation formula is expressed as follows: ; In the formula, False alarm rate, dimensionless; The number of normal business traffic instances that were mistakenly identified as attacks and triggered protective actions, expressed in units. Total number of protective actions, in units. Service availability retention rate. The calculation formula is expressed as follows: ; In the formula, Business availability retention rate, dimensionless; The time during which the business operates normally during the strategy execution period, in seconds; The duration of the strategy execution, in seconds. The model performance adjustment factor is calculated based on the protection effectiveness evaluation indicators. The formula for the model performance adjustment factor is expressed as follows: ; In the formula, This is a dimensionless adjustment factor for model performance. The attack termination rate is dimensionless. The standard termination rate is dimensionless and defaults to 0.9. Business availability retention rate, dimensionless; For standard availability, dimensionless, default value is 0.95; False alarm rate, dimensionless; The standard false positive rate, dimensionless, defaults to 0.05. This is the model performance adjustment factor. When the value falls within the range of 0.8 to 1.2, the frequency domain filter weights are updated using a standard learning rate of 0.001. This is based on the model performance adjustment factor. At this time, the learning rate is increased by 0.005 to accelerate the adjustment of frequency domain filter weights, when the model performance adjustment factor is... Fine-tuning of the frequency domain filter weights was performed by reducing the learning rate by 0.0005. The exploration parameters and attack cost heuristic function coefficients of the adaptive path sampling algorithm for Monte Carlo tree search were adjusted based on the deviation between the actual and predicted attack paths, and the overlap between the actual and predicted attack paths was also considered. The calculation formula is expressed as follows: ; In the formula, The degree of overlap is dimensionless. The number of identical attack nodes in the actual attack path and the predicted attack path, expressed in units of nodes. The total number of nodes in the predicted attack path is expressed in units of [number]. When the overlap is [percentage]... Increase the exploration parameters when the value is below 0.7 Values ​​are used to broaden the search scope, when the overlap is high. Decrease the exploration parameter when it is higher than 0.9 This value is used to accelerate the convergence speed.

[0075] To better understand and implement this invention, the following is a specific application scenario of this invention, Example 2: To verify the effectiveness of this invention, technicians built a test environment to simulate an advanced persistent threat (APS) attack on an enterprise intranet, verifying the protective capabilities of the adaptive collaborative security protection method based on attack path deduction. The test environment included one firewall, two intrusion detection systems, one web application firewall, and 15 servers. The network topology covered three security domains: the external network access zone, the DMZ zone, and the core business zone. Technicians configured the importance weights in the asset value library as follows: database server 0.95, application server 0.85, and file server 0.82. They also set the threat threshold to 0.75, the standard arrival rate to 100 events per second, and the standard resource utilization rate to 70%.

[0076] After the test began, technicians simulated an attacker launching a multi-stage penetration attack from the outside. The attacker first performed a port scan on the web server in the external network access zone, triggering an alert from the intrusion detection system. Firewall logs showed that the host with source IP address 203.128.45.67 sent 327 TCP SYN packets to ports 80, 443, and 8080 of the target IP address 192.168.1.10 within 180 seconds. The web application firewall captured an SQL injection attempt targeting the web server login page, with the attack signature SQLI-2024-0156 and a timestamp of 2025-01-15T14:23:18Z. The server system log showed an abnormal login attempt at 2025-01-15T14:24:32Z, with 8 attempts. After collecting these logs, the system performs timestamp alignment and field standardization. Events with a time interval of less than 300 seconds and the same source IP address are aggregated into an event sequence, and a unified security event flow containing three attack phases, namely port scanning, vulnerability detection, and privilege escalation, is constructed, as shown in Table 1.

[0077] Table 1 Sample Data of Unified Security Incident Flow

[0078] After receiving the unified security event stream, the sparse Bayesian inference model calculates the concurrency control state value based on the current event stream arrival rate of 135 events per second and the system computing resource utilization rate of 78%. The ratio of the event stream arrival rate to the standard arrival rate is 1.35, and the ratio of the system computing resource utilization rate to the standard resource utilization rate is 1.11. Dividing the sum of these two by 2 yields a concurrency control state value of 1.23. Since the concurrency control state value is greater than or equal to 1.0, the system automatically enables the asynchronous event concurrency mechanism, distributing the event stream to four processing threads for parallel computation. The frequency domain transformation layer performs a Fast Fourier Transform on the 327-dimensional security event feature vector, converting the time-domain signal of the port scan into a frequency-domain representation. The eight frequency-domain filters of the spectral convolution layer perform convolution operations in the frequency domain space, extracting the periodic energy peak of the attack behavior at a frequency of 0.0056Hz, identifying this as a timed scanning pattern that repeats every 180 seconds. The sparse constraint layer automatically pruned 112 invalid feature nodes using L1 regularization, compressing the feature dimension from 327 to 215. The probabilistic inference layer uses the expectation propagation algorithm to calculate the posterior probability distribution in logarithmic space. The calculation results from the four processing threads are aggregated and fused at this layer, ultimately outputting a threat confidence score of 0.83, with a threat level assessment of high threat. Figure 2 As shown.

[0079] Because the threat confidence level of 0.83 exceeds the threat threshold of 0.75, the system triggers the attack path deduction process. The Monte Carlo tree search adaptive path sampling algorithm initializes the search tree with the current attack node 192.168.1.10 as the root node, obtaining network topology and vulnerability information from the vulnerability scanning system. The network topology shows three possible paths from the external network access area to the core business area. The vulnerability information shows that the web server 192.168.1.10 has an Apache Struts remote code execution vulnerability CVE-2024-1234, the application server 192.168.2.25 has an unpatched Windows privilege escalation vulnerability CVE-2023-5678, and the MySQL service on the database server 192.168.3.50 uses a weak password. During the selection phase, the algorithm calculates the upper confidence bound for each child node, and the exploration parameter is set to 1.41. Node 192.168.2.25 has an average reward of 0.68 and 15 visits, with a calculated upper confidence threshold of 0.82. Node 192.168.3.50 has an average reward of 0.71 and 23 visits, with a calculated upper confidence threshold of 0.79. The system selects node 192.168.2.25, which has the highest upper confidence threshold, for expansion. During the expansion phase, new candidate attack nodes are generated based on Windows privilege escalation vulnerabilities. In the simulation phase, a random strategy is used to start from node 192.168.2.25, simulating an attack path that bypasses firewall rules, moves laterally, and accesses the database, ultimately reaching the high-value asset database server 192.168.3.50. In the backtracking phase, the successful simulation results are propagated backward, updating the visit counts and average reward values ​​for all nodes along the path. After 500 simulation iterations, the algorithm output the attack path with the most accesses: 192.168.1.10 → 192.168.2.25 → 192.168.3.50. The attack path graph contains three attack nodes with inter-node transition probabilities of 0.87 and 0.92, respectively. The attack actions are, in order, remote code execution, privilege escalation, and data theft. The total time required for a successful attack is 450 seconds, with defense difficulty coefficients of 0.65, 0.78, and 0.82, respectively. Figure 3 As shown.

[0080] The system identified the application server 192.168.2.25 as the key node in the attack path graph, as this node is the only path for attackers to enter the core business area from the external network access zone, and there is no alternative path. For the key node 192.168.2.25, the system enumerated four response actions: blocking the source IP address 203.128.45.67, modifying the firewall access control list to prevent 192.168.1.10 from accessing 192.168.2.25, isolating the target host 192.168.2.25, and disabling the high-risk port 3389. The blocking probability for each response action was calculated. The overlap between the coverage of blocking the source IP address and the attack path graph was 0.33, and the normalized blocking probability yielded a protection effectiveness score of 0.42. The overlap between the coverage of modifying the firewall access control list and the attack path graph was 0.89, and the normalized blocking probability yielded a protection effectiveness score of 0.91. The overlap between the coverage area of ​​the isolated target host and the attack path graph is 1.0, and the protection effectiveness score after normalizing the blocking probability is 1.0. The overlap between the coverage area of ​​the disabled high-risk ports and the attack path graph is 0.56, and the protection effectiveness score after normalizing the blocking probability is 0.63.

[0081] The system obtains a list of network assets and business traffic affected by each response action. Blocking the source IP address affects 0 internal assets, with a business interruption duration of 0 seconds and a business impact score of 0.0. Modifying the firewall access control list affects 3 business traffic flows between the web server and application server. Querying the business priority configuration table yields a business criticality weight of 0.65, a business interruption duration of 120 seconds, a ratio of 0.0014 to the standard runtime of 86400 seconds, an initial business impact value of 0.00091, and a normalized business impact score of 0.18. Isolating the target host 192.168.2.25 affects 8 business traffic flows, with a business criticality weight of 0.88, a business interruption duration of 3600 seconds, a ratio of 0.042 to the standard runtime, an initial business impact value of 0.037, and a normalized business impact score of 0.72. Disabling high-risk ports affected two service traffic flows of the remote desktop service. The service criticality weight was 0.35, the service interruption duration was 600 seconds, the ratio of the interruption duration to the standard runtime was 0.0069, the initial service impact value was 0.0024, and the normalized service impact score was 0.25, as shown in Table 2.

[0082] Table 2 Response Action Evaluation Results

[0083] The multi-objective tradeoff function calculates a comprehensive score based on a protection weight coefficient of 0.7 and a service weight coefficient of 0.3. The comprehensive score for blocking the source IP address is 0.42 multiplied by 0.7 plus the opposite of 0.0 multiplied by 0.3, equaling 0.29. The comprehensive score for modifying the firewall access control list is 0.91 multiplied by 0.7 plus the opposite of 0.18 multiplied by 0.3, equaling 0.59. The comprehensive score for isolating the target host is 1.0 multiplied by 0.7 plus the opposite of 0.72 multiplied by 0.3, equaling 0.42. The comprehensive score for disabling high-risk ports is 0.63 multiplied by 0.7 plus the opposite of 0.25 multiplied by 0.3, equaling 0.32. The system selects the response action with the highest comprehensive score—modifying the firewall access control list—as the optimal protection command set, such as... Figure 4 As shown.

[0084] The instruction translation module of the policy execution coordinating controller converts the optimal protection instruction set into configuration commands for heterogeneous security devices. The firewall adapter generates the configuration command "deny ip 192.168.1.10 192.168.2.25", the intrusion prevention system adapter generates the configuration command "block-connection src 203.128.45.67 dst 192.168.2.25", and the web application firewall adapter generates the configuration command "add-rule deny uri / admin src 192.168.1.10". The synchronization activation module uses a distributed transaction protocol based on a logical clock to coordinate the policy activation of the three devices. The coordinating node sends policy preparation requests to the firewall, intrusion prevention system, and web application firewall. These requests include a logical clock timestamp vector [5, 3, 2] and the optimal protection instruction set. After checking the resource status, the firewall enters a ready state and returns a ready confirmation message containing a logical clock timestamp [6, 3, 2]. The intrusion prevention system returns a logical clock timestamp [5, 4, 2], and the web application firewall returns a logical clock timestamp [5, 3, 3]. The coordinating node collects all ready confirmation messages, calculates the maximum logical clock timestamp to be 6, and adds a preset delay of 15 milliseconds as the unified activation time. The coordinating node sends a submit command to the three devices. After receiving the command, the devices wait locally until the unified activation time arrives to synchronize their activation policies. The actual activation time deviation of the three devices is 8 milliseconds. Figure 5 As shown.

[0085] After the policy was implemented, technicians monitored network status changes and the evolution of attack behavior. Monitoring data showed that before the policy implementation, the number of attack events in the unified security event stream was 47, and after the policy implementation, the number of attack events decreased to 6, with an attack termination rate of 0.87. During the policy implementation period, the system misclassified 2 normal business traffic flows as attacks, with a total of 1 protection action and a false positive rate of 0.02. Business availability monitoring showed that the normal business uptime during the policy implementation period was 3480 seconds, the policy implementation duration was 3600 seconds, and the business availability maintenance rate was 0.97. Based on the protection effectiveness evaluation indicators, the model performance adjustment factor was calculated. The ratio of the attack termination rate (0.87) to the standard termination rate (0.9) is 0.97, the ratio of the business availability maintenance rate (0.97) to the standard availability (0.95) is 1.02, and the ratio of the false positive rate (0.02) to the standard false positive rate (0.05) is 0.4. The model performance adjustment factor is 0.97 + 1.02 - 0.4 = 1.59. Since the model performance adjustment factor is greater than or equal to 1.2, the weight adjustment function uses a reduction in the learning rate of 0.0005 to fine-tune the frequency domain filter weights. The overlap calculation between the actual attack path and the predicted attack path shows that three of the three attack nodes are identical, with an overlap of 1.0. Because the overlap is higher than 0.9, the system reduces the exploration parameter value of the adaptive path sampling algorithm for Monte Carlo tree search from 1.41 to 1.2 to accelerate convergence. For remote code execution attacks, the system sets the attack cost heuristic function coefficient to 0.45 based on the historical success rate of 0.82 and the protection difficulty coefficient of 0.65; for privilege escalation attacks, the coefficient is set to 0.58.

[0086] This invention represents a significant technological advancement over traditional security measures. Traditional rule-based security methods rely on predefined attack signature libraries, which can only identify known attack patterns and offer limited protection against advanced persistent threats where attackers dynamically adjust their strategies. This invention, through a spectral convolutional frequency domain feature learning mechanism using a sparse Bayesian inference model, transforms temporal security event features into the frequency domain. It utilizes frequency domain filters to capture the periodic patterns and energy distribution characteristics of attack behavior along the frequency dimension, effectively identifying periodic attack patterns such as port scanning and timed data theft with fixed time intervals—something traditional temporal convolution methods struggle to achieve. The feature dimension compression in the frequency domain representation reduces the size of the conditional probability table in the Bayesian network, mitigating the uncertainty and numerical instability of probability calculations in high-dimensional feature spaces, maintaining high threat identification accuracy even with insufficient samples. The asynchronous event concurrency mechanism processes event streams from different security devices in parallel using multiple threads, avoiding event backlog and delays caused by single-threaded sequential processing. This enables the system to complete real-time inference of multi-source heterogeneous data within milliseconds, significantly shortening the time window from threat detection to response triggering. The concurrency control switch function dynamically adjusts the computing mode based on the event flow arrival rate and system computing resource utilization. Under high load scenarios, it automatically enables multi-threaded parallel processing to improve throughput, while under low load scenarios, it automatically switches to single-threaded mode to reduce thread scheduling overhead, avoiding resource waste or performance bottlenecks caused by a fixed concurrency mode. The Monte Carlo tree search adaptive path sampling algorithm balances path exploration and utilization based on an upper confidence bound strategy, prioritizing the expansion of nodes with low attack cost and high success probability. This allows for rapid convergence to the most probable attack path with limited computing resources, providing accurate threat intelligence for subsequent protection decisions. The distributed transaction protocol based on logical clocks tracks causal dependencies between events through a vector clock mechanism, avoiding policy activation order errors caused by network latency and clock drift. This ensures that multiple heterogeneous security devices can synchronously activate protection policies at the same time, eliminating the timing inconsistencies caused by traditional manual configuration and forming a truly collaborative protection system.

[0087] It should be noted that the variables involved in this invention are explained in detail in Table 3.

[0088] Table 3. Variable Explanation Table

[0089] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. An adaptive collaborative security protection method based on attack path deduction, characterized in that, An adaptive path sampling algorithm based on Monte Carlo tree search is used to probabilistically infer the subsequent attack paths that attackers may choose, generating an attack path graph. Protective measures are deployed in advance before the threat reaches critical nodes. A distributed transaction protocol based on logical clocks is used to synchronize the activation of policies across multiple heterogeneous security devices, ensuring precise and coordinated deployment of protective actions at critical nodes of the attack path, and synchronizing the protection response with the attack evolution process. The process includes the following steps: collecting firewall logs, intrusion detection system alerts, web application firewall records, and server system logs, and performing timestamp alignment and field standardization to construct a unified security event stream; inputting the unified security event stream into a sparse Bayesian inference model to calculate threat confidence; triggering an attack when the threat confidence exceeds a threat threshold. The path deduction process involves: An adaptive path sampling algorithm based on Monte Carlo tree search samples and expands possible paths from the current attack node to high-value assets in the network topology to generate an attack path graph; based on key nodes and predicted attack actions in the attack path graph, the protection effectiveness score and business impact score of different response actions are calculated, and an optimal protection instruction set is generated based on a multi-objective trade-off function; the optimal protection instruction set is converted into configuration commands for heterogeneous security devices through a policy execution coordination controller, and a distributed transaction protocol based on a logical clock is used to achieve synchronous activation of multiple devices; network state changes and attack behavior evolution are monitored after policy execution, protection effectiveness evaluation indicators are calculated, and feedback is given to the sparse Bayesian inference model and the adaptive path sampling algorithm based on Monte Carlo tree search for parameter optimization.

2. The method according to claim 1, characterized in that, The steps for building a unified security event flow are as follows: missing value filling and outlier filtering are performed on the collected firewall logs, intrusion detection system alarms, web application firewall records, and server system logs; and the source IP address, target IP address, port number, protocol type, attack signature, and timestamp are extracted as standardized fields.

3. The method according to claim 2, characterized in that, The steps for constructing a unified security event flow also include aggregating events with a time interval of less than 300 seconds and the same source IP address into an event sequence based on time window correlation analysis, and classifying and labeling the event sequences according to attack stage tags.

4. The method according to claim 3, characterized in that, The sparse Bayesian inference model is built on a sparse Bayesian network based on variational inference. It utilizes the frequency domain feature learning mechanism of spectral convolution to map the temporal features in the unified security event stream to the frequency domain space through Fourier transform.

5. The method according to claim 4, characterized in that, The sparse Bayesian inference model uses frequency domain filters to extract periodic patterns and spectral characteristics of attack behavior, and combines adaptive regularization terms to penalize invalid feature nodes, thereby reducing the instability of posterior probability calculation caused by the sparsity of the conditional probability table under high-dimensional sparse features.

6. The method according to claim 5, characterized in that, The sparse Bayesian inference model also considers an asynchronous event concurrency mechanism, which processes event streams from different data sources in parallel through multi-threading. The asynchronous event concurrency mechanism is enabled by a concurrency control switch function.

7. The method according to claim 6, characterized in that, The concurrency control switch function dynamically determines whether to enable the asynchronous event concurrency mechanism based on the event flow arrival rate and the system computing resource utilization rate. The asynchronous event concurrency mechanism is enabled when the concurrency control status value is greater than or equal to 1.

0.

8. The method according to claim 7, characterized in that, The adaptive path sampling algorithm of Monte Carlo tree search balances path exploration and exploitation based on the upper confidence bound strategy, prioritizing the expansion of nodes with low attack cost and high success probability.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program instructions, which, when executed in a computer, are used to perform an adaptive collaborative security protection method based on attack path deduction as described in any one of claims 1-8.

10. An adaptive collaborative security protection system based on attack path deduction, characterized in that, The system comprises the computer-readable storage medium of claim 9, wherein the system is a computer, the computer-readable storage medium is disposed within the system, and the system is provided with a microprocessor that executes program instructions stored in the computer-readable storage medium.

Images