AI-based network intrusion prevention data processing methods and systems

Abstract

This invention provides an AI-based network intrusion prevention data processing method and system. It acquires raw traffic data generated during network communication, discretizes and segments the raw traffic data to generate a set of traffic data units, identifies threat features in each traffic data unit, generates a threat assessment vector based on the matching degree of the identified threat features with a preset threat pattern library, calculates the threat feature correlation degree between adjacent traffic data units based on the threat assessment vectors within a continuous time window, constructs a threat evolution trajectory map, inputs it into a preset generative adversarial network model, optimizes the feature boundaries of the threat evolution trajectory map, and generates a threat determination matrix. It then performs protocol semantic parsing, and verifies the threat confidence of the threat determination matrix based on the parsed protocol field correlations, generating network intrusion prevention commands. This invention can improve the targeting and execution efficiency of network intrusion prevention responses.

Description

Technical Field

[0001] This invention relates to the field of data processing, and more specifically, to an AI-based network intrusion prevention data processing method and system. Background Technology

[0002] With the popularization of internet technology and the increasing complexity of network applications, analyzing and processing traffic data generated during network communication can identify potential intrusion threats and generate corresponding defense strategies. Currently, the typical approach involves acquiring network traffic data, extracting features, matching the extracted features against a pre-defined threat pattern library, generating threat identification results based on the matching results, and then generating network intrusion prevention commands based on these results. Some technical solutions incorporate traditional machine learning models to assist in improving threat identification efficiency. However, existing technologies struggle to effectively capture the evolutionary trends and inherent relationships of threat features over time when processing traffic data, resulting in insufficient accuracy in threat probability distribution, which affects the targeting and reliability of network intrusion prevention responses. Summary of the Invention

[0003] This invention provides an AI-based network intrusion prevention data processing method and system.

[0004] In a first aspect, embodiments of the present invention provide an AI-based network intrusion prevention data processing method, the method comprising: acquiring raw traffic data generated during network communication; discretizing the raw traffic data into segments according to a preset time window to generate a set of traffic data units with time-series labels; identifying threat features for each traffic data unit in the set of traffic data units; generating a threat assessment vector containing a threat type identifier and a corresponding matching degree based on the matching degree between the identified threat features and a preset threat pattern library; calculating the threat feature correlation degree between adjacent traffic data units based on the threat assessment vector of continuous time windows; constructing a threat evolution trajectory map with time-dimensional correlation through the threat feature correlation degree; inputting the threat evolution trajectory map into a preset generative adversarial network model; calling the discriminator therein to optimize the feature boundaries of the threat evolution trajectory map to generate a threat determination matrix containing a threat probability distribution; performing protocol semantic parsing on the threat determination matrix; verifying the threat confidence of the threat determination matrix in conjunction with the parsed protocol field correlation relationship; and generating network intrusion prevention instructions containing defense strategy priorities.

[0005] Secondly, embodiments of the present invention provide a computer system, including: a memory storing a computer program; and a processor for loading the computer program to implement the AI-based network intrusion prevention data processing method described above.

[0006] This invention transforms unordered raw traffic data into structured analytical units by discretizing and segmenting the raw traffic data according to a preset time window, generating a set of traffic data units with time-series labels. This provides a standardized data foundation for subsequent time-dimensional correlation analysis. By identifying threat features in each traffic data unit and generating a threat assessment vector containing threat type identifiers and corresponding matching degrees, the threat features in the traffic data are transformed into quantifiable and comparable vector forms, achieving accurate representation and multi-dimensional assessment of threat features. Based on the threat assessment vectors of continuous time windows, the invention calculates the threat feature correlation between adjacent traffic data units and constructs a threat evolution trajectory map with time-dimensional correlation, transforming isolated threat assessment results into a dynamically evolving trajectory model, thus breaking through the limitations of traditional static threat identification. This approach overcomes the limitations of traditional methods by capturing the changing trends and correlations of threat characteristics over time. It inputs the threat evolution trajectory map into a pre-defined generative adversarial network (GAN) model, optimizes the feature boundaries of the trajectory map using a discriminator, and generates a threat determination matrix containing threat probability distributions. The adversarial learning mechanism of the GAN improves the discriminative power of threat characteristics and the accuracy of probability distributions, enhancing the reliability of threat determination. Furthermore, it performs protocol semantic parsing on the threat determination matrix and verifies threat confidence by combining protocol field relationships. This deeply integrates the technical threat probability distribution with the inherent logical rules of the protocol, further validating the rationality of the threat determination results. Finally, it generates network intrusion prevention instructions containing defense strategy priorities, giving the generation of defense strategies a clear priority order and improving the targeting and execution efficiency of network intrusion prevention responses. Attached Figure Description

[0007] Figure 1 This is a flowchart of an AI-based network intrusion prevention data processing method provided in an embodiment of the present invention.

[0008] Figure 2 This is a schematic diagram of the composition of a computer system provided in an embodiment of the present invention. Detailed Implementation

[0009] Please see Figure 1 This is a flowchart of an AI-based network intrusion prevention data processing method provided in an embodiment of the present invention. The method can be executed by a computer system and includes the following steps:

[0010] Step S100: Obtain the raw traffic data generated during network communication, and discretize the raw traffic data into segments according to a preset time window to generate a set of traffic data units with time series labels.

[0011] Raw traffic data is the unprocessed, most basic traffic information generated during network communication. It contains various details of network data packets, such as source IP address, destination IP address, port number, packet size, and transmission time. This data reflects the true state and characteristics of network communication. A preset time window is a fixed time length pre-defined for dividing the raw traffic data. For example, the time window can be set to 1 minute, 5 minutes, etc. Discretization segmentation divides continuous raw traffic data according to the preset time window, making the traffic data within each time period an independent unit. Time series labeling adds a time-related identifier to each traffic data unit so that these units can be analyzed and processed in chronological order later.

[0012] In practical applications, raw traffic data can be obtained using network traffic acquisition devices, such as network probes and switch mirroring ports. Taking a network probe as an example, it can be deployed at key nodes in the network to monitor data packets in real time and record them to form raw traffic data. Assuming a preset time window of one minute, the traffic data within that minute is divided into a traffic data unit every minute from the start of data collection, and the corresponding time is marked on it.

[0013] Step S200: Perform threat feature identification on each traffic data unit in the traffic data unit set, and generate a threat assessment vector containing threat type identifier and corresponding matching degree based on the degree of matching between the identified threat features and the preset threat pattern library.

[0014] Threat signature identification involves identifying characteristics from network traffic data units that may indicate a security threat. These characteristics can include defined network behavior patterns, abnormal packet formats, port usage, etc. A pre-built threat pattern library is a database that stores various known network threat patterns and their corresponding characteristics. These threat patterns can be common network attack types, such as DDoS attacks, SQL injection attacks, and Trojan virus propagation. The matching degree is the degree of similarity between an identified threat signature and a specific threat pattern in the pre-built threat pattern library, expressed numerically. A threat type identifier is a symbol or number used to uniquely identify a type of network threat; for example, "DDoS_01" represents a DDoS attack type. The matching degree is a value between 0 and 1, with a higher value indicating a higher degree of matching.

[0015] When identifying threat features, classification algorithms from machine learning can be used, such as decision trees and support vector machines. Taking the decision tree algorithm as an example, firstly, features are extracted from traffic data units, converting them into feature vectors suitable for algorithm processing. Then, a pre-trained decision tree model is used to classify these feature vectors, determining whether they belong to a certain threat type. When determining the degree of matching, the similarity between the feature vector and the feature vector of the corresponding pattern in a pre-set threat pattern library can be calculated, such as Euclidean distance or cosine similarity. Finally, the identified threat type identifier and the corresponding matching degree are combined to form a threat assessment vector.

[0016] For example, step S200 may specifically include the following steps S210 to S260:

[0017] Step S210: Perform network protocol stack layered parsing on the traffic data unit, extract the IP header field of the network layer, the port interaction field of the transport layer, and the payload behavior field of the application layer in sequence, and generate a multi-level original feature set containing inter-layer relationships.

[0018] Network protocol stack layered parsing involves analyzing and processing traffic data units layer by layer according to the layered structure of network protocols. A network protocol stack can be divided into layers such as the physical layer, data link layer, network layer, transport layer, and application layer. This step primarily focuses on the network layer, transport layer, and application layer. The IP header field of the network layer contains information related to network addresses and routing, such as source IP address, destination IP address, Time to Live (TTL), and Type of Service (ToS). The port interaction field of the transport layer records port usage, such as source port number, destination port number, and connection status flags. The payload behavior field of the application layer reflects the specific behavior and characteristics of application layer data, such as field length distribution, the location of key fields, and abnormal character sequences. Inter-layer relationships describe the interdependencies and correspondences between fields in different layers, such as the relationship between the IP address of the network layer and the port number of the transport layer.

[0019] When performing layered parsing of network protocol stacks, open-source network protocol parsing libraries such as Scapy can be used. Taking Scapy as an example, network packets can be parsed and manipulated. First, traffic data units are converted into packet objects that Scapy can process. Then, using methods provided by Scapy, the IP header fields of the network layer, the port interaction fields of the transport layer, and the payload behavior fields of the application layer are extracted sequentially. For example, "packet[IP].src" can be used to obtain the source IP address, and "packet[TCP].sport" can be used to obtain the source port number. When extracting the payload behavior fields of the application layer, further analysis of the application layer data is required. For example, the distribution of field lengths can be statistically analyzed by traversing the application layer data, recording the length of each field, and calculating its distribution range and dispersion. Finally, the extracted fields from each layer and the inter-layer relationships are integrated to generate a multi-level raw feature set containing layer identifiers and descriptions of relationships.

[0020] For example, step S210 may include the following steps S211 to S216:

[0021] Step S211: Perform data frame structure parsing on the traffic data unit, identify the frame start identifier and frame end identifier of the data frame, extract the network protocol type field contained in the frame, and determine the basic protocol type to which the data frame belongs.

[0022] Data frame structure parsing analyzes the underlying structure of traffic data units to determine the meaning and boundaries of each part. A data frame typically includes a start-of-frame (FOF) identifier, an end-of-frame (EOP) identifier, and a data portion. The FFO and EOP identifiers are character or byte sequences used to mark the beginning and end of a data frame, helping the receiver correctly identify and segment the frame. The network protocol type field indicates the type of network protocol the data frame follows, such as Ethernet, IP, or TCP. The base protocol type is the fundamental protocol category to which the data frame belongs, determined by the network protocol type field.

[0023] When parsing data frame structures, byte stream analysis techniques can be used. First, scan byte by byte starting from the beginning of the traffic data unit to find the frame start identifier. Once the frame start identifier is found, data recording begins until the frame end identifier is found. During this process, the network protocol type field is extracted. For example, in an Ethernet frame, the protocol type field is located at a specific position in the frame header. By reading the byte value at that position and comparing it with the known protocol type encoding, the underlying protocol type of the data frame can be determined.

[0024] Step S212: Based on the basic protocol type, call the corresponding protocol parsing module to parse the network layer header of the data frame, extract the source address field, destination address field, time to live field, and type of service field from the IP header, and record the original value and length of each field.

[0025] The corresponding protocol parsing module is a pre-developed program module for parsing the header information of different underlying protocols. For example, a dedicated IP protocol parsing module is set up for the IP protocol. Network layer header parsing involves detailed analysis of the header information of the network layer portion of the data frame to extract key fields. The source address field in the IP header records the IP address of the sender of the data packet, and the destination address field records the IP address of the receiver of the data packet. The Time-to-Live (TTL) field is used to limit the number of hops a data packet can travel through the network, preventing the data packet from looping indefinitely. The Type of Service (ToS) field indicates the quality of service requirements of the data packet, such as priority, latency, and throughput.

[0026] When calling the corresponding protocol parsing module, the appropriate parsing module is selected based on the basic protocol type determined in step S211. Taking the IP protocol parsing module as an example, it can accurately locate and extract each field in the IP header according to the IP protocol specification. For the source address and destination address fields, they can be converted to dotted decimal format for recording. For the Time to Live (TTL) and Type of Service (CTS) fields, their original values ​​are recorded directly. Simultaneously, the length of each field is recorded, which aids in subsequent data processing and analysis.

[0027] Step S213: Determine the transport layer protocol type based on the network layer parsing result, parse the transport layer header of the data frame, extract the source port field, destination port field, connection status flag field and window size field of the transport layer, and record the status value and change trend of each field.

[0028] The transport layer protocol type refers to the protocol used by the data frame at the transport layer, such as TCP and UDP. The transport layer protocol type can be determined based on the network layer parsing results. For example, in the protocol field of the IP header, a value of "6" indicates the use of TCP, while a value of "17" indicates the use of UDP. Transport layer header parsing involves a detailed analysis of the header information of the transport layer portion of the data frame to extract key fields. The source port and destination port fields identify the port numbers used by the sender and receiver of the data packet, respectively. The connection status flags field indicates the status of the TCP connection, such as SYN, ACK, and FIN. The window size field indicates the buffer size of the sender or receiver, used for flow control.

[0029] After determining the transport layer protocol type, the corresponding parsing method is invoked based on the protocol type. The source port and destination port fields are converted to decimal values ​​for recording. The connection status flag field is analyzed by examining the combination of flag bits to determine the current connection status. The window size field is recorded with its original value. Furthermore, to analyze the trends in each field, multiple data frames can be continuously monitored and recorded over a period of time, and then data analysis methods, such as trend analysis and statistical analysis, can be used to observe the changes in field values.

[0030] Step S214: Perform application layer protocol identification on the payload data parsed from the transport layer. Determine the application layer protocol type by matching the feature codes of the payload data. Extract the field length distribution, key field occurrence positions and abnormal character sequences from the payload data to obtain the payload behavior description field.

[0031] Application layer protocol identification determines the application layer protocol type from the payload data parsed from the transport layer. There are many types of application layer protocols, such as HTTP, FTP, and SMTP. Signature matching is a commonly used method for application layer protocol identification. It determines the application layer protocol type by comparing the payload data with predefined signatures. A signature is a representative sequence of bytes; different application layer protocols have unique signatures. Field length distribution describes the length distribution of various fields in the payload data, reflecting the structural characteristics of the data. Key field occurrence positions are the first occurrences of key fields in the payload data and the intervals between their subsequent occurrences. Abnormal character sequences are character sequences that do not conform to the application layer protocol specifications, potentially indicating abnormal or malicious behavior. The payload behavior description field integrates the field length distribution, key field occurrence positions, and abnormal character sequences into a descriptive information.

[0032] For example, step S214 may specifically include the following steps S2141 to S2146:

[0033] Step S2141: Filter invalid characters from the payload data parsed by the transport layer, remove consecutive empty character sequences and protocol padding characters from the payload data, and retain the valid payload content.

[0034] Invalid character filtering removes characters that do not contain valid information from the payload data parsed by the transport layer. Consecutive sequences of empty characters are multiple consecutive empty characters (such as spaces, tabs, etc.) in the payload data, which do not carry actual business information. Protocol padding characters are extra characters added to the payload data to meet protocol specifications; these characters are, for example, unnecessary in actual analysis. The valid payload content is the part of the payload data that actually contains business information.

[0035] String manipulation techniques can be used for invalid character filtering. First, the payload data parsed by the transport layer is converted into a string. Then, regular expressions are used to match consecutive sequences of null characters and protocol padding characters. For example, the regular expression "\s+" can match consecutive sequences of null characters. For protocol padding characters, their characteristics and positions need to be determined according to different protocol specifications. Assuming that in a certain protocol, padding characters are of fixed length and located at the end of the payload data, these padding characters can be removed by truncation. Finally, the valid payload content after removing invalid characters is retained for further analysis.

[0036] Step S2142: The payload content is segmented according to the preset sliding window length to generate multiple consecutive payload segmentation units. The length of each payload segmentation unit is consistent with the length of the feature code in the preset feature code library.

[0037] The preset sliding window length is a fixed, pre-defined length used to segment the payload content. A sliding window is a method that performs a sliding operation on a data sequence; by continuously moving the window's position, the data sequence can be divided into multiple subsequences. A payload segmentation unit is each subsequence obtained after segmenting the payload content according to the preset sliding window length. The feature code length in the preset feature code library is the byte length of each feature code in the library. Maintaining the length of the payload segmentation unit consistent with the feature code length facilitates subsequent feature code matching operations.

[0038] During the fragmentation process, starting from the beginning of the payload content, payload data is sequentially extracted with a preset sliding window length as the step size. In this way, multiple consecutive payload fragmentation units are generated, and the length of each unit is the same as the length of the feature codes in the preset feature code library.

[0039] Step S2143: Call the preset feature code library, compare each payload fragment unit with the application layer protocol feature code in the feature code library byte by byte, record the number, position and protocol type of the successfully matched feature codes, and generate a feature code matching result table.

[0040] The pre-built signature database is a pre-established database that stores signatures for various application layer protocols and their corresponding protocol types. Byte-by-byte comparison compares each byte of each payload fragment unit with each byte of the signatures in the database to determine if a match exists. A successful match occurs when all bytes of the payload fragment unit are identical to a particular signature. The number of successfully matched signatures is the number of times a signature has been successfully matched with a signature in the database across all payload fragment units. The position is the starting position of the successfully matched signature within the payload content. The corresponding protocol type is the application layer protocol type associated with the successfully matched signature. The signature matching result table is a table that records the matching results, including the number of successfully matched signatures, their positions, and their corresponding protocol types.

[0041] During byte-by-byte comparison, a loop structure can be used to compare each payload fragment unit with each feature in the feature library. For example, a nested loop can be used: the outer loop iterates through all payload fragment units, and the inner loop iterates through all features in the feature library. For each comparison, a byte-by-byte comparison method is used to determine if a match occurs. If a match is successful, the number, position, and protocol type of the successfully matched feature are recorded. Finally, these records are compiled into a feature matching result table for convenient subsequent analysis and processing.

[0042] Step S2144: Based on the proportion of protocol types to which successfully matched feature codes belong in the feature code matching result table, determine the application layer protocol type corresponding to the payload data. When multiple protocol types match, select the protocol type with the highest proportion as the final result.

[0043] The percentage is the proportion of successfully matched signatures for a certain protocol type out of all successfully matched signatures. By calculating the percentage, we can determine which application layer protocol type the payload data is more likely to conform to. When multiple protocol types of signatures match, it means that the payload data may contain information from multiple protocol types, but in order to determine a dominant protocol type, the protocol type with the highest percentage is selected as the final result.

[0044] When calculating the percentage, the number of successfully matched signatures for each protocol type is first counted from the signature matching result table. Then, the number of successfully matched signatures for each protocol type is divided by the total number of successfully matched signatures to obtain the percentage for each protocol type.

[0045] Step S2145: Perform field boundary detection on the payload data of the determined protocol type. Based on the delimiters and keyword identifiers defined in the protocol specification, split the payload data into multiple protocol field units and record the start and end offsets of each field unit.

[0046] Field boundary detection identifies the start and end positions of each protocol field within the payload data that determines the protocol type. Delimiters defined in the protocol specification are characters or character sequences used to separate different protocol fields, such as commas, semicolons, and spaces. Keyword identifiers are keywords used in the protocol specification to identify fields, such as "Content-Type" and "User-Agent". A protocol field unit is an independent field obtained by splitting the payload data according to the delimiters and keyword identifiers. The start offset and end offset represent the start and end positions of each protocol field unit within the payload data, respectively.

[0047] When performing field boundary detection, it is first necessary to understand the protocol specification of the determined protocol type and identify the defined delimiters and keyword identifiers. Then, starting from the beginning of the payload data, the payload data is split into multiple protocol field units based on the positions of the delimiters and keyword identifiers. By locating these delimiters and keyword identifiers, the start and end positions of each protocol field unit can be determined. Finally, the start and end offsets of each protocol field unit are recorded for further analysis.

[0048] Step S2146: Calculate the length value of each protocol field unit, and calculate the distribution range and dispersion of the length value as the field length distribution; record the first occurrence position and subsequent occurrence interval of the key fields defined in the protocol specification in the payload data as the key field occurrence position; scan the character sequences in the payload data that do not conform to the protocol character set, and record their starting position and length as abnormal character sequences; integrate the field length distribution, key field occurrence positions and abnormal character sequences into a payload behavior description field.

[0049] The length values ​​of each protocol field unit are measured and recorded in bytes. The distribution range of the length values ​​is the interval between the minimum and maximum length values ​​of all protocol field units. Dispersion is the degree to which the length values ​​are dispersed relative to the mean, which can be measured using statistical indicators such as standard deviation. The field length distribution can reflect the length characteristics and variations of protocol fields. Key fields are fields that are important in the protocol specification, such as "Content-Length" and "Host". The first occurrence position is the position of the first occurrence of the key field in the payload data, and the subsequent occurrence interval is the number of bytes between two consecutive occurrences of the key field. Abnormal character sequences are character sequences in the payload data that do not conform to the protocol character set, which is the set of characters allowed in the protocol specification.

[0050] When calculating the length of each protocol field unit, the length of each unit can be calculated by iterating through all protocol field units and using a string length function. Then, the minimum and maximum length values ​​are identified to obtain the distribution range. Statistical analysis methods, such as calculating the standard deviation, are used to determine the dispersion. For the location of key fields, a string search algorithm, such as the KMP algorithm, is used to find the first occurrence of the key field and record the intervals between subsequent occurrences. For abnormal character sequences, the payload data is traversed to check if each character belongs to the protocol character set; if not, its starting position and length are recorded. Finally, the field length distribution, the location of key fields, and the abnormal character sequences are integrated to form a payload behavior description field, used to describe the behavioral characteristics of the payload data.

[0051] Step S215: Establish an inter-layer feature association table to record the correspondence between network layer fields and transport layer fields, the dependency between transport layer fields and application layer fields, and mark the offset position and extraction order of each layer feature field in the data frame.

[0052] The inter-layer feature association table is used to record the relationships between feature fields across different layers. The correspondence between network layer fields and transport layer fields represents the logical connection between certain fields in the network layer and certain fields in the transport layer, such as the correspondence between IP addresses in the network layer and port numbers in the transport layer. The dependency between transport layer fields and application layer fields means that certain fields in the transport layer can affect the values ​​or meanings of application layer fields; for example, the port number in the transport layer can determine the protocol type used by the application layer. The offset position is the starting position of each feature field in the data frame relative to the number of bytes at the beginning of the data frame. The extraction order refers to the order in which feature fields from each layer are extracted during feature extraction.

[0053] When establishing the inter-layer feature association table, it is first necessary to analyze the feature fields of the network layer, transport layer, and application layer to find the relationships between them. For example, by observing multiple data frames, it can be found that the source IP address and source port number are used together, indicating a correspondence. The dependency relationship between transport layer fields and application layer fields is analyzed according to different protocol specifications. For example, in the TCP protocol, if the port number is 80, it indicates the use of the HTTP protocol, thus establishing a dependency relationship between the transport layer port number and the application layer protocol type. Then, the offset position and extraction order of each layer's feature fields in the data frame are recorded. The offset position can be determined by the protocol specification and the actual parsing results, while the extraction order is determined according to the execution order of steps S210-S214. Finally, this information is organized into the inter-layer feature association table.

[0054] Step S216: Structure and integrate the IP header field of the network layer, the port interaction field of the transport layer, the payload behavior field of the application layer, and the inter-layer feature association table to generate a multi-level original feature set containing layer identifiers and relationship descriptions.

[0055] Structured integration involves organizing and merging information from different sources and types according to a specific structure. The IP header field of the network layer, the port interaction field of the transport layer, and the payload behavior field of the application layer are feature information extracted in the previous steps. The inter-layer feature association table records the relationships between feature fields of different layers. Layer identifiers are used to distinguish feature fields of different layers, such as "Network Layer," "Transport Layer," and "Application Layer." The association description is textual information that details the associations recorded in the inter-layer feature association table. The multi-level raw feature set is a data set that integrates all the above information, comprehensively reflecting the characteristics and structure of traffic data units.

[0056] During structured integration, the IP header fields of the network layer, the port interaction fields of the transport layer, and the payload behavior fields of the application layer are first organized, and a layer identifier is added to each field. For example, the source IP address field is labeled "Network Layer - Source IP Address". Then, based on the information in the inter-layer feature association table, a relationship description is added to each field. For example, for the source IP address field, the relationship description "Corresponds to the source port number of the transport layer" is added. Finally, all fields with added layer identifiers and relationship descriptions are merged to form a multi-level raw feature set containing layer identifiers and relationship descriptions. This set can be stored in the form of tables, database records, etc., for convenient subsequent processing and analysis.

[0057] Step S220: Based on the preset feature space mapping rules, perform feature dimension unification processing on the multi-level original feature set, map the feature fields of different levels to the same feature space, and obtain a standardized threat feature vector with fixed dimensions.

[0058] Preset feature space mapping rules are a predefined set of rules used to map feature fields from different levels to the same feature space. A feature space is an abstract mathematical space where each dimension represents a feature. Feature dimension unification processing transforms feature fields with different dimensions from multi-level original feature sets into feature representations with the same dimensions. Feature fields at different levels may have different dimensions and value ranges due to their different origins and meanings. Mapping them to the same feature space makes features at different levels comparable, facilitating subsequent analysis and processing. The standardized threat feature vector is a vector with fixed dimensions obtained after feature dimension unification processing, where each dimension corresponds to a feature, and the vector's value range is standardized, for example, between 0 and 1.

[0059] During the unified feature dimension processing, each feature field in the multi-level original feature set is transformed according to a preset feature space mapping rule. For example, a linear mapping method is used to map the value range of each feature field to between 0 and 1. Finally, all the mapped feature fields are combined to form a standardized threat feature vector with fixed dimensions.

[0060] Step S230: Call the threat pattern feature templates stored in the preset threat pattern library, calculate the feature similarity between the standardized threat feature vector and each threat pattern feature template, and generate a similarity matching matrix covering all threat types.

[0061] The threat pattern feature templates stored in the preset threat pattern library are a pre-built set of vectors, each representing a feature of a known threat pattern. These feature templates are derived from a large amount of historical attack data and the experience of security experts. Feature similarity is the degree of similarity between a standardized threat feature vector and a specific threat pattern feature template, expressed numerically. The similarity matching matrix is ​​a two-dimensional matrix where rows represent standardized threat feature vectors, columns represent threat pattern feature templates from the preset threat pattern library, and the values ​​of the matrix elements are the feature similarity between the corresponding standardized threat feature vector and the threat pattern feature template.

[0062] When calculating feature similarity, various similarity calculation methods can be used, such as cosine similarity and Euclidean distance. By traversing all threat pattern feature templates in a preset threat pattern library, the feature similarity between the standardized threat feature vector and each template is calculated. The calculated similarity values ​​are then filled into a similarity matching matrix, ultimately generating a similarity matching matrix covering all threat types.

[0063] Step S240: Based on the similarity values ​​of each threat pattern feature template in the similarity matching matrix, filter out threat pattern feature templates with similarity exceeding the preset matching threshold, and extract their corresponding threat type identifiers.

[0064] The preset matching threshold is a pre-defined value used to determine whether the similarity between a standardized threat feature vector and a threat pattern feature template is high enough to indicate that the standardized threat feature vector may represent the corresponding threat type. The similarity value is the value of each element in the similarity matching matrix, representing the degree of similarity between the standardized threat feature vector and a threat pattern feature template. The threat type identifier is a symbol or number used to uniquely identify a certain type of network threat, such as "DDoS_01" or "SQL_02".

[0065] When filtering threat pattern feature templates, each column of the similarity matching matrix is ​​traversed, and the value of each element is compared with a preset matching threshold. If the value of an element exceeds the preset matching threshold, the threat pattern feature template corresponding to that column is considered to have successfully matched the standardized threat feature vector. Then, the threat type identifier corresponding to the threat pattern feature template is extracted for subsequent threat assessment and processing.

[0066] Step S250: Perform correlation verification on the original feature fields corresponding to the selected threat type identifiers, verify the logical consistency between feature fields and the degree of feature matching between layers, and generate feature verification results.

[0067] The correlation verification checks the original feature fields corresponding to the selected threat type identifiers to ensure that there are reasonable logical relationships between these feature fields and that features from different layers can match each other. Logical consistency means that the values ​​and meanings of the feature fields conform to normal logical rules; for example, in the network and transport layers, the combination of IP address and port number should be reasonable. Inter-layer feature matching degree refers to whether the correlation between feature fields in the network, transport, and application layers meets expectations; for example, whether the port number in the transport layer matches the protocol type in the application layer. The feature verification result is information that records and summarizes the results of the correlation verification. It can be a Boolean value (indicating whether the verification passed) or a detailed verification report containing problems and anomalies found during the verification process.

[0068] During the correlation verification process, the corresponding original feature fields are first extracted from the multi-level original feature set based on the selected threat type identifiers. Then, logical analysis and inter-layer correlation checks are performed on these feature fields. For the degree of inter-layer feature matching, the information in the inter-layer feature correlation table is used to check whether the feature fields of different layers match each other. If logical contradictions or mismatches between feature fields are found, the verification is considered to have failed, and the relevant issues and anomalies are recorded. Finally, feature verification results are generated for subsequent decision-making and processing.

[0069] Step S260: Associate and encapsulate the verified threat type identifier with the corresponding similarity value to generate a threat assessment vector containing a threat type identifier field and a matching degree value field. The field order of the threat assessment vector is consistent with the arrangement order of threat types in the preset threat pattern library.

[0070] Association encapsulation combines verified threat type identifiers with their corresponding similarity values ​​into a unified data structure. The threat type identifier field stores the threat type information, and the similarity value field stores the similarity scores. The threat assessment vector is a vector containing both the threat type identifier and the similarity value field, visually representing the matching status of a traffic data unit with various threat types. Maintaining the field order of the threat assessment vector consistent with the order of threat types in the preset threat pattern library facilitates subsequent comparison and analysis.

[0071] During the association and encapsulation process, the verified threat type identifiers and their corresponding similarity values ​​are first paired. Then, according to the order of threat types in the preset threat pattern library, all verified threat type identifiers and their corresponding similarity values ​​are sequentially filled into the corresponding positions of the threat assessment vector. If a threat type fails to match, a default value, such as 0, is entered into the corresponding position of the threat assessment vector. Finally, a threat assessment vector containing both a threat type identifier field and a matching score field is generated.

[0072] Step S300: Based on the threat assessment vector of continuous time window, calculate the threat feature correlation degree between adjacent traffic data units, and construct a threat evolution trajectory map with time dimension correlation through the threat feature correlation degree.

[0073] Threat assessment vectors for continuous time windows are threat assessment vectors generated for each traffic data unit within multiple consecutive time windows. These vectors record the threat situation of network traffic at different points in time. Threat feature correlation is the degree of similarity and correlation strength of threat features between adjacent traffic data units, reflecting the continuity and changing trend of network threats over time. A threat evolution trajectory map with time-dimensional correlation is a graphical data structure used to display the evolution process of network threats over time. Nodes in the map represent traffic data units, the edges connecting nodes represent the threat feature correlation between adjacent traffic data units, and the weights of the edges represent the magnitude of the correlation.

[0074] For example, step S300 may specifically include the following steps S310 to S360:

[0075] Step S310: Extract the threat assessment vector sequence corresponding to the continuous time window, arrange them in the order of timestamps to form a threat assessment vector time series, and each vector element in the threat assessment vector time series corresponds to the threat assessment result of a traffic data unit.

[0076] A threat assessment vector sequence corresponding to a continuous time window is a collection of threat assessment vectors generated within multiple consecutive time windows. A timestamp is information used to mark the generation time of each traffic data unit; it can be a specific date and time or a relative time number. Arranging by timestamp order sorts the vectors in the threat assessment vector sequence according to their corresponding timestamps in ascending order. The threat assessment vector time series is an ordered vector sequence where each vector element corresponds to the threat assessment result of a traffic data unit, clearly demonstrating the changes in network threats over time.

[0077] When extracting the threat assessment vector sequence corresponding to a continuous time window, the threat assessment vectors within the continuous time window are selected based on the time window division and the generated threat assessment vectors. Then, these vectors are sorted according to their corresponding timestamp information. For example, sorting algorithms such as quicksort or mergesort can be used to sort the threat assessment vectors in ascending order of timestamps. This ultimately forms a threat assessment vector time series, providing a foundation for subsequent calculations of the threat feature correlation between adjacent traffic data units.

[0078] Step S320: Perform vector differencing on the threat assessment vector time series, calculate the characteristic changes between threat assessment vectors in adjacent time windows, and generate a vector change sequence. The length of the vector change sequence is one unit less than the length of the threat assessment vector time series.

[0079] Vector differencing involves subtracting adjacent vectors in a threat assessment vector time series to calculate the feature changes between them. The feature changes are the differences between two adjacent threat assessment vectors in each dimension, reflecting how the network threat changes between adjacent time windows. The vector change sequence is a sequence of vectors consisting of feature changes, and its length is one unit shorter than the threat assessment vector time series because, during differencing, the last vector has no subsequent vector to subtract from it.

[0080] Step S330: Based on the vector change sequence and time window correlation parameters, calculate the threat feature correlation degree between adjacent traffic data units. The time window correlation parameters are dynamically adjusted according to the time interval between adjacent time windows and historical correlation records.

[0081] The vector change sequence records the changes in threat characteristics between adjacent traffic data units and is an important basis for calculating the correlation degree of threat characteristics. The time window correlation parameter is used to adjust the calculation results of the threat characteristic correlation degree, taking into account the time interval between adjacent time windows and historical correlation records. The time interval between adjacent time windows is the difference between the start times of two adjacent time windows, which can reflect the temporal variation pattern of network traffic. Historical correlation records are the correlation information between adjacent traffic data units recorded in previous calculations and can be used to predict future correlations. The threat characteristic correlation degree is the similarity and correlation strength of threat characteristics between adjacent traffic data units, comprehensively considering both the vector change sequence and the time window correlation parameter.

[0082] For example, step S330 may specifically include the following steps S331 to S336:

[0083] Step S331: Extract the timestamp information of adjacent traffic data units in the threat assessment vector time series, calculate the actual time interval between adjacent timestamps, and record it as the window interval value.

[0084] Timestamp information represents the generation time of the traffic data unit corresponding to each vector in the threat assessment vector time series. The actual time interval between adjacent timestamps is the difference between the timestamps of two adjacent traffic data units, reflecting the continuity and variation pattern of network traffic over time. The window interval value records the actual time interval between adjacent timestamps and is an important basis for subsequent calculation of time window correlation parameters.

[0085] When extracting timestamp information of adjacent traffic data units in the threat assessment vector time series, the timestamp corresponding to each vector is obtained from the threat assessment vector time series. Then, the difference between adjacent timestamps is calculated sequentially.

[0086] Step S332: Query historical threat handling records, calculate the average time interval between adjacent traffic data units under the same protocol type, use it as the standard window interval, and calculate the deviation between the current window interval value and the standard window interval.

[0087] Historical threat handling records are a database storing relevant information from previous network threat handling processes, including time intervals between adjacent traffic data units, threat types, and handling results. "Same protocol type" means the network protocol type used by the currently processed traffic data unit is the same as that used by traffic data units in the historical records. "Average time interval" is the average time interval between adjacent traffic data units under the same protocol type, reflecting the normal time variation pattern of network traffic under that protocol type. "Standard window interval" is the statistically obtained average time interval between adjacent traffic data units under the same protocol type. "Deviation degree" is the ratio of the absolute value of the difference between the current window interval and the standard window interval to the standard window interval, reflecting the degree of deviation of the current network traffic time interval from normal conditions.

[0088] Step S333: Determine the initial value of the time window correlation parameter based on the degree of deviation. When the degree of deviation is positive, the time window correlation parameter decreases linearly as the degree of deviation increases. When the degree of deviation is negative, the time window correlation parameter maintains the baseline value.

[0089] The deviation level refers to the degree of deviation between the current window interval and the standard window interval, reflecting anomalies in network traffic over time. The time window correlation parameter is used to adjust the calculation results of threat characteristic correlation between adjacent traffic data units. The baseline value is a pre-set default value representing the value of the time window correlation parameter under normal circumstances. When the deviation level is positive, it indicates that the current window interval is greater than the standard window interval, and the time interval of network traffic has abnormally increased. In this case, the time window correlation parameter decreases linearly as the deviation level increases to reduce the impact of anomalies on the threat characteristic correlation calculation results. When the deviation level is negative, it indicates that the current window interval is less than the standard window interval, and the time interval of network traffic is within the normal range. In this case, the time window correlation parameter maintains the baseline value.

[0090] Step S334: Extract the vector change amount of the corresponding adjacent traffic data units from the vector change sequence, and calculate the inverse index of the vector change amount as the basic correlation degree. The smaller the vector change amount, the higher the basic correlation degree.

[0091] The vector change sequence, generated in step S320, records the characteristic changes between threat assessment vectors in adjacent time windows. The vector change corresponding to adjacent traffic data units represents the change in threat characteristics between two adjacent traffic data units, as indicated by each element in the vector change sequence. The inverse index is an index obtained by taking the reciprocal of the vector change, which can convert the vector change into an index positively correlated with the correlation. The basic correlation is the initial correlation between adjacent traffic data units calculated based on the inverse index of the vector change. The smaller the vector change, the smaller the change in threat characteristics between adjacent traffic data units, and the higher the correlation.

[0092] When extracting the vector changes of adjacent traffic data units from the vector change sequence, each element is directly obtained from the sequence. Then, the inverse index of the vector change is calculated. For example, assuming the vector change is [2,3,1,4], its inverse index is [1 / 2,1 / 3,1,1 / 4]. These inverse indices are used as the basic correlation; the smaller the vector change, the higher the basic correlation. By calculating the basic correlation, the threat characteristic association between adjacent traffic data units can be preliminarily assessed.

[0093] Step S335: Multiply the basic correlation degree with the time window correlation parameter to obtain the preliminary threat feature correlation degree, and then combine it with the average correlation degree of the same type of traffic in history for weighted adjustment to generate the final threat feature correlation degree.

[0094] The basic correlation degree is the initial correlation degree between adjacent traffic data units calculated based on the inverse index of vector change, reflecting the similarity of threat characteristics between adjacent traffic data units. The time window correlation parameter is a dynamically adjusted parameter based on the time interval between adjacent time windows and historical correlation records, taking into account the changes in network traffic over time. The preliminary threat characteristic correlation degree is the result of multiplying the basic correlation degree and the time window correlation parameter, comprehensively considering threat characteristic changes and time factors. The average correlation degree of historical traffic of the same type is the average correlation degree between adjacent traffic data units of the same type in historical records, reflecting the normal correlation of this type of traffic. The weighted adjustment is a weighted average of the preliminary threat characteristic correlation degree and the average correlation degree of historical traffic of the same type to generate the final threat characteristic correlation degree, making the calculation results more accurate and stable.

[0095] Step S336: Record the calculation process and parameter values ​​of the threat feature correlation degree as a historical correlation record for subsequent dynamic adjustment of the correlation parameters within the time window.

[0096] The calculation process for threat feature correlation includes steps such as calculating vector change, calculating basic correlation, determining time window correlation parameters, calculating preliminary threat feature correlation, and weighted adjustment of final threat feature correlation. Parameter values ​​refer to various parameters used in the calculation process, such as time window correlation parameters, weighting coefficients, and historical correlation averages. The historical correlation record is a database storing previous threat feature correlation calculation processes and parameter values, providing a reference for subsequent dynamic adjustments to time window correlation parameters.

[0097] Step S340: Using each traffic data unit as a graph node, the node attributes include the corresponding threat assessment vector and timestamp information. The threat feature correlation between adjacent traffic data units is used as the weight value of the node connection edge to construct the initial threat evolution trajectory chain.

[0098] Graph nodes are elements representing each traffic data unit in a threat evolution trajectory graph. They can be graphical nodes or data objects. Node attributes are additional information associated with the graph node, including the corresponding threat assessment vector and timestamp information. The threat assessment vector records the threat assessment result of the traffic data unit, and the timestamp records the generation time of the traffic data unit. Node connection edges are lines in the threat evolution trajectory graph that connect adjacent graph nodes, representing the association between adjacent traffic data units. Threat feature correlation is the degree of similarity and correlation strength of threat features between adjacent traffic data units. It is used as the weight value of node connection edges, which can intuitively show the tightness of the association between adjacent traffic data units. The initial threat evolution trajectory chain is a linear structure composed of graph nodes and node connection edges, which can initially show the evolution process of network threats over time.

[0099] Step S350: Perform path integrity detection on the initial threat evolution trajectory chain, identify broken nodes and abnormal connection edges in the trajectory chain, supplement missing connections or correct abnormal connections based on threat feature correlation, and obtain the complete trajectory path.

[0100] Path integrity detection examines the initial threat evolution trajectory chain to ensure that the nodes and connecting edges in the trajectory chain form a complete and continuous path, accurately reflecting the evolution process of network threats. Broken nodes are nodes in the initial threat evolution trajectory chain that have no connecting edges with the nodes before and after them, or whose connecting edges have extremely low correlation, potentially indicating an interruption or data loss during the network threat evolution process. Abnormal connecting edges are connecting edges whose threat feature correlation is significantly higher or lower than normal, potentially indicating anomalies in the network threat evolution process. Adding missing connections involves adding connecting edges between broken nodes and the nodes before and after them to restore the continuity of the trajectory chain. Correcting abnormal connections involves adjusting the weight values ​​of abnormal connecting edges to better match normal threat feature correlation. A complete trajectory path is a continuous trajectory chain without broken nodes or abnormal connecting edges obtained after path integrity detection and processing.

[0101] For example, step S350 may specifically include the following steps S351 to S356:

[0102] Step S351: Traverse all nodes in the initial threat evolution trajectory chain, record the incoming edge connection information and outgoing edge connection information of each node, and construct a node connection relationship graph, wherein the incoming edge connection information includes the source node identifier and correlation degree, and the outgoing edge connection information includes the target node identifier and correlation degree.

[0103] Incoming edge connection information refers to information about edges connecting to a specific node, including the source node identifier and its correlation degree. The source node identifier is a symbol or number used to uniquely identify the starting node of the connecting edge, and the correlation degree is the threat characteristic of the connecting edge. Outgoing edge connection information refers to information about edges originating from a specific node, including the target node identifier and its correlation degree. The target node identifier is a symbol or number used to uniquely identify the ending node of the connecting edge. A node connection graph is a graphical data structure used to record the connection relationships between nodes, clearly showing the connection status and correlation strength between each node and other nodes.

[0104] When traversing all nodes in the initial threat evolution trajectory chain, each node is visited sequentially, starting from the first node in the trajectory chain. For each node, its incoming edge connection information and outgoing edge connection information are recorded. For example, suppose node A has two incoming edges, from nodes B and C respectively, with associativity degrees rBA and rCA; and one outgoing edge, pointing to node D with associativity degree rAD. Then the incoming edge connection information of node A is recorded as [(B,rBA),(C,rCA)], and the outgoing edge connection information is recorded as [(D,rAD)].

[0105] Step S352: Based on the node connection relationship graph, perform path traversal on the initial threat evolution trajectory chain, check the continuity of the timestamps of the node sequence, and mark the node as a broken node when the timestamp interval between adjacent nodes exceeds the preset maximum allowable interval.

[0106] Timestamp continuity means that the timestamps of adjacent nodes in a node sequence should increase sequentially in chronological order, and the time interval should be within a reasonable range. The preset maximum allowable interval is a pre-defined time interval value used to determine if the timestamp interval between adjacent nodes is too large. A broken node is a node whose timestamp interval between adjacent nodes exceeds the preset maximum allowable interval, which may indicate an interruption or data loss during the evolution of network threats.

[0107] Step S353: Perform correlation detection on the connecting edges in the trajectory chain, compare the correlation of the threat features of the connecting edges with the preset correlation benchmark value, and mark the connecting edges as abnormal when the correlation is lower than the benchmark value. At the same time, record the source node and target node of the abnormal connecting edges.

[0108] Correlation detection is the process of evaluating the threat feature correlation of each connecting edge in a trajectory chain. The preset correlation benchmark is a pre-defined threshold used to measure whether the correlation of connecting edges is normal. It is derived from statistical analysis of a large amount of historical data and represents a reasonable lower limit for the threat feature correlation between adjacent traffic data units under normal circumstances. An abnormal connecting edge is one whose threat feature correlation is lower than the preset correlation benchmark. Such connecting edges may indicate anomalies in the evolution of network threats, such as abnormal data transmission or sudden changes in threat features.

[0109] During correlation detection, all connecting edges in the trajectory chain are traversed. For each connecting edge, its threat feature correlation value is obtained and compared with a preset correlation benchmark value. For example, suppose the preset correlation benchmark value is R. base The threat feature correlation degree of a certain connecting edge is R. edge If R edge <R base If an edge is found to be abnormal, it is marked as an abnormal edge. Simultaneously, the source node identifier and target node identifier of this abnormal edge are recorded. For example, a dictionary can be used to store this information, with the key being the edge identifier and the value being a tuple containing the source and target node identifiers. In this way, abnormal edges with abnormal correlation in the trajectory chain can be identified, providing a basis for subsequent correction of abnormal connections.

[0110] Step S354: For the marked broken node, query the threat assessment vectors of its preceding and following adjacent nodes, calculate the threat feature correlation degree between the broken node and the preceding and following nodes, and add connecting edges to supplement the missing connections when the correlation degree meets the supplementation condition.

[0111] For marked broken nodes, further analysis of their relationship with adjacent nodes before and after them is needed to determine whether additional connecting edges are required to restore the continuity of the trajectory chain. Adjacent nodes are those located before and after the broken node in the trajectory chain. The threat assessment vector contains the threat assessment result for each traffic data unit. By comparing the threat assessment vectors of the broken node with those of its adjacent nodes, the correlation degree of threat characteristics between them can be calculated.

[0112] The threat feature correlation can be calculated using a method similar to that in step S330, such as using vector similarity calculation methods, like cosine similarity. The supplementary condition is a pre-defined rule used to determine whether a connection edge should be added. For example, the supplementary condition could be set to a threat feature correlation greater than a certain threshold R. add When the calculated threat feature correlation between the fracture node and its preceding and following nodes meets the supplementary conditions, connecting edges are added between the fracture node and its preceding and following nodes. When adding connecting edges, the attributes of the connecting edges need to be set, including the source node identifier, the target node identifier, and the threat feature correlation.

[0113] Step S355: For the marked abnormal connection edges, extract the average historical threat feature correlation between the source node and the target node. When the current correlation deviation from the average exceeds the preset deviation range, correct the correlation value of the current connection edge based on the average.

[0114] For marked abnormal connection edges, their correlation needs to be adjusted to better reflect normal threat feature correlation. The historical average threat feature correlation between the source and target nodes is the average value of the threat feature correlation between the source and target nodes in historical records. This can be achieved by querying the historical correlation record database, filtering out all correlation data between the source and target nodes, and calculating their average value.

[0115] The preset deviation range is a pre-defined range used to determine whether the current correlation is abnormal. For example, it can be set to ±k% of the mean (where k is a pre-defined percentage). When the deviation between the current correlation and the mean exceeds the preset deviation range, it indicates that the current correlation is abnormal and needs to be corrected. Correction methods could include adjusting the current correlation to the mean of historical threat feature correlations.

[0116] Step S356: Perform path integrity check on the supplemented and corrected trajectory chain again, repeat the above steps until there are no broken nodes or abnormal connection edges, and obtain a complete trajectory path with continuous timestamps and reasonable correlation.

[0117] After completing the connection supplementation of broken nodes and the correlation correction of abnormal connection edges, the trajectory chain is checked again for path integrity to ensure that the processed trajectory chain has no new broken nodes or abnormal connection edges. The process of checking the path integrity again is similar to steps S352 and S353, that is, checking the continuity of the timestamps of the node sequence and the correlation of the connection edges.

[0118] If broken nodes or abnormal connecting edges are still found during the re-detection process, steps S354 and S355 are repeated to address these issues. This process is repeated until there are no more broken nodes or abnormal connecting edges in the trajectory chain. Through this iterative approach, the trajectory chain can be gradually improved, ultimately resulting in a complete trajectory path with continuous timestamps and reasonable correlation.

[0119] Step S360: The nodes and connecting edges in the complete trajectory path are encapsulated in a structured manner to generate a threat evolution trajectory map containing a set of nodes, a set of edges, and an edge weight matrix. The nodes in the threat evolution trajectory map are continuously associated according to the timestamp order.

[0120] The node set is the collection of all nodes in the complete trajectory path. Each node contains its corresponding threat assessment vector, timestamp information, and a unique node identifier. The edge set is the collection of all connecting edges in the complete trajectory path. Each connecting edge contains its source node identifier, target node identifier, threat feature correlation degree, and a unique edge identifier. The edge weight matrix is ​​a two-dimensional matrix used to represent the threat feature correlation degree of the connecting edges between nodes. The row index of the matrix corresponds to the source node identifier, and the column index corresponds to the target node identifier.

[0121] For example, step S360 involves structurally encapsulating the nodes and connecting edges in the complete trajectory path to generate a threat evolution trajectory map containing a set of nodes, a set of edges, and an edge weight matrix. Specifically, this may include the following steps S361-S366:

[0122] Step S361: Extract all nodes in the complete trajectory path, assign a unique node identifier to each node, record the timestamp, threat assessment vector, and protocol type of the traffic data unit corresponding to the node, and generate a node attribute table. The node attribute table includes node identifier, timestamp, threat assessment vector field, and protocol type field.

[0123] In the complete trajectory path, each node represents a traffic data unit. For ease of management and analysis, each node needs to be assigned a unique node identifier. Incrementing integers can be used as node identifiers, starting from 1 and assigned sequentially to each node. The timestamp records the time when the traffic data unit was generated, providing precise point-in-time information; for example, it can use the ISO8601 format. The threat assessment vector, generated in step S260, includes the threat type identifier of the traffic data unit and its corresponding match degree. The protocol type is the network protocol used by the traffic data unit, such as HTTP, FTP, etc.

[0124] A node attribute table is a data structure used to store information about nodes, and it can be in tabular form. Each row represents a node, and each column corresponds to an attribute field, namely, node identifier, timestamp, threat assessment vector, and protocol type. When generating the node attribute table, all nodes in the complete trajectory path are traversed, and the relevant information for each node is obtained and filled into the corresponding row of the node attribute table.

[0125] Step S362: Extract all connecting edges in the complete trajectory path, assign a unique edge identifier to each connecting edge, record the source node identifier, target node identifier, threat feature correlation degree, and connection time interval of the connecting edge, and generate an edge attribute table containing the edge identifier, source node identifier, target node identifier, correlation degree, and time interval fields.

[0126] The connecting edges in the complete trajectory path represent the threat characteristic associations between adjacent traffic data units. To accurately record and manage these connecting edges, a unique edge identifier needs to be assigned to each edge. Incrementing integers can also be used as edge identifiers, starting from 1 and assigned sequentially to each connecting edge. The source node identifier and the destination node identifier are the identifiers of the starting and ending nodes of the connecting edge, respectively; these two identifiers determine the position of the connecting edge within the node set.

[0127] The threat feature correlation degree, calculated in step S335, reflects the similarity and correlation strength of threat features between adjacent traffic data units. The connection time interval is the time range within which the association represented by the connection edge exists, which can be determined by the timestamps of the source and target nodes. The edge attribute table is a data structure used to store information related to connection edges, also in tabular form. Each row represents a connection edge, and each column corresponds to an attribute field, namely, edge identifier, source node identifier, target node identifier, correlation degree, and time interval fields. When generating the edge attribute table, all connection edges in the complete trajectory path are traversed, and the relevant information of each connection edge is obtained sequentially and filled into the corresponding row of the edge attribute table.

[0128] Step S363: Construct an edge weight matrix. The row index of the matrix corresponds to the source node identifier, the column index corresponds to the target node identifier, and the matrix element value is the threat feature correlation degree of the corresponding connected edge. When there is no connected edge between the source node and the target node, the matrix element value is a preset null value.

[0129] The edge weight matrix is ​​a two-dimensional matrix used to represent the threat characteristic correlation of edges connecting nodes. It has an n×n size, where n is the number of nodes in the complete trajectory path. The row and column indices of the matrix correspond to the node identifiers, allowing direct location of the connecting edges between the corresponding source and target nodes using the matrix element positions.

[0130] When constructing the edge weight matrix, an n×n matrix is ​​first initialized, with all elements set to preset null values. These preset null values ​​can be set according to specific circumstances; for example, they can be set to 0 or a special marker value to indicate that there is no connecting edge between the source and target nodes. Then, the edge attribute table is traversed. For each connecting edge, its position in the matrix is ​​determined based on its source and target node identifiers, and the threat characteristic correlation of that connecting edge is filled into the corresponding element of the matrix.

[0131] Step S364: Add a time window attribution field to the node attribute table to record the time window number to which the traffic data unit corresponding to the node belongs and its sequential position within the time window.

[0132] The time window attribution field is added to facilitate the analysis of nodes along the time dimension. In step S100, the raw traffic data is discretized into segments according to preset time windows, with each traffic data unit belonging to a specific time window. The time window number is a unique identifier for each time window and can be assigned using an incrementing integer. The sequential position within the time window records the order of the traffic data unit within its respective time window, such as the 1st, 2nd, etc.

[0133] When adding a time window affiliation field to the node attribute table, the first step is to determine the time window number to which the node belongs based on the timestamp information of the traffic data unit corresponding to that node. This can be done by comparing the timestamp with the start and end times of each time window. Then, within that time window, the traffic data units are sorted by timestamp to determine the node's sequential position within the time window. Finally, the time window number and sequential position are combined into a new field value and added to each row of the node attribute table.

[0134] Step S365: Add an association type field to the edge attribute table. Based on whether the threat type identifiers in the threat assessment vectors of the source node and the target node are consistent, the association types are divided into same-type associations and different-type associations. Different-type associations need to additionally record the type conversion direction.

[0135] The association type field further describes the association nature represented by the connecting edge. Based on whether the threat type identifiers in the threat assessment vectors of the source and target nodes are consistent, association types can be divided into same-type associations and dissimilar-type associations. Same-type associations indicate that the source and target nodes face the same type of threat. For example, if the threat type identifier in the threat assessment vectors of both the source and target nodes is "DDoS_01", then the association type of this connecting edge is same-type. Dissimilar-type associations indicate that the source and target nodes face different types of threats. For example, if the threat type identifier of the source node is "DDoS_01" and the threat type identifier of the target node is "SQL_02".

[0136] For heterogeneous associations, the type conversion direction needs to be additionally recorded. The type conversion direction can be represented by an ordered pair, for example, ("DDoS_01", "SQL_02") representing a conversion from a DDoS type threat to an SQL injection type threat. When adding an association type field to the edge attribute table, each connection edge in the table is traversed, and the threat assessment vectors of its source and target nodes are obtained. The threat type identifiers are compared. If they are the same, the association type is marked as a same-type association; if they are different, it is marked as a heterogeneous association, and the type conversion direction is recorded.

[0137] Step S366: Integrate the node attribute table, edge attribute table, and edge weight matrix in a structured manner to generate a threat evolution trajectory graph containing graph metadata, including graph construction time, total number of nodes, total number of edges, and average correlation degree.

[0138] Structured integration combines the node attribute table, edge attribute table, and edge weight matrix into a unified data structure, forming a complete threat evolution trajectory map. Map metadata contains basic information about the threat evolution trajectory map, helping users quickly understand the overall picture.

[0139] The map construction time refers to the specific time when the threat evolution trajectory map was generated, and can be recorded in ISO 8601 format. The total number of nodes is the number of nodes in the complete trajectory path, which can be determined by the number of rows in the node attribute table. The total number of edges is the number of connecting edges in the complete trajectory path, which can be obtained by the number of rows in the edge attribute table. The average correlation is the average threat feature correlation of all connecting edges, which can be calculated by summing the correlation fields in the edge attribute table and dividing by the total number of edges.

[0140] When performing structured integration, a dictionary can be used to store this data. The keys of the dictionary can be "node attribute table", "edge attribute table", "edge weight matrix" and "graph metadata", and the corresponding values ​​are the node attribute table, edge attribute table, edge weight matrix and the dictionary containing graph metadata, respectively.

[0141] Step S400: Input the threat evolution trajectory map into the preset generative adversarial network model, call the discriminator in it to optimize the feature boundary of the threat evolution trajectory map, and generate a threat determination matrix containing the threat probability distribution.

[0142] Generative Adversarial Networks (GANs) consist of a generator and a discriminator. In this step, the pre-trained GAN model is used to process the threat evolution trajectory map. The discriminator's main role is to distinguish between genuine threat evolution trajectory maps and fake trajectory maps generated by the generator, and to optimize the feature boundaries of the genuine threat evolution trajectory map. Feature boundary optimization involves adjusting the features of the map to make the boundaries between genuine threat features and non-threat features clearer, facilitating subsequent threat determination.

[0143] The threat determination matrix is ​​a two-dimensional matrix. Its rows correspond to nodes in the trajectory map, and its columns correspond to threat types in the preset threat pattern library. The matrix element values ​​are the probabilities of a node belonging to the corresponding threat type, reflecting the probability distribution of each node under different threat types.

[0144] For example, step S400 may specifically include the following steps S410-S460:

[0145] Step S410: Perform graph vectorization transformation on the threat evolution trajectory map, arrange the threat assessment vectors in the node attribute table in timestamp order to generate a node feature matrix, and use the edge weight matrix as the adjacency matrix to construct the graph structure data representation of the map.

[0146] Graph vectorization transforms the graphical data structure of threat evolution trajectory maps into a vector form suitable for processing by generative adversarial network (GAN) models. The node feature matrix is ​​a two-dimensional matrix, where each row corresponds to a node's threat assessment vector. This matrix is ​​obtained by arranging the threat assessment vectors from the node attribute table in timestamp order. This arrangement preserves the temporal sequence information of the nodes, helping the model capture the evolutionary trends of network threats.

[0147] An adjacency matrix is ​​a matrix used to represent the connection relationships between nodes in a graph. In this step, the edge weight matrix is ​​directly used as the adjacency matrix. The element values ​​of the edge weight matrix represent the threat characteristic correlation degree of the connecting edges between nodes. Therefore, the adjacency matrix not only reflects the connection relationship between nodes, but also reflects the strength of the connection.

[0148] For example, step S410 may specifically include the following steps S411-S416:

[0149] Step S411: Extract the threat assessment vectors of all nodes from the node attribute table of the threat evolution trajectory map, and generate an initial node feature matrix by arranging the nodes in ascending order of their timestamps. The number of rows in the initial node feature matrix is ​​the total number of nodes, and the number of columns is the dimension of the threat assessment vectors.

[0150] Sort the nodes in ascending order of timestamps to ensure that the row order in the initial node feature matrix matches the node order in the time dimension. Sorting algorithms, such as quicksort or mergesort, can be used to sort the threat assessment vectors based on the timestamp information in the node attribute table. The initial node feature matrix is ​​a two-dimensional matrix with the number of rows equal to the total number of nodes and the number of columns equal to the dimension of the threat assessment vectors. Each threat assessment vector is represented as a row in the matrix, thus integrating the threat assessment information of all nodes into a single matrix for easier subsequent processing.

[0151] Step S412: Perform row normalization on the initial node feature matrix by dividing the threat assessment vector element value of each row by the square root of the sum of squares of the elements in that row, to obtain a normalized node feature matrix with unit vector properties.

[0152] Step S413: Extract the edge weight matrix from the threat evolution trajectory map, and replace the preset null values ​​in the edge weight matrix with preset minimum values.

[0153] The edge weight matrix, constructed in step S363, represents the threat characteristic correlation degree of the connecting edges between nodes. The preset null value is a value set when there is no connecting edge between the source and target nodes during the construction of the edge weight matrix. The preset minimum value is a very small positive number used to replace the preset null value, aiming to avoid division by zero or other numerical instability in subsequent calculations.

[0154] After extracting the edge weight matrix, iterate through each element of the matrix and check if it is a preset null value. If so, replace it with a preset minimum value. For example, suppose the preset null value is 0 and the preset minimum value is 10. -6 .

[0155] Step S414: Convert the format of the processed edge weight matrix and store the row index, column index and corresponding correlation value of the non-zero elements in the coordinate triple format to generate a sparse adjacency matrix to reduce storage space usage.

[0156] The edge weight matrix is, for example, a sparse matrix, meaning that most of its elements are zero. To save storage space and improve computational efficiency, the processed edge weight matrix needs to be formatted using coordinate triples to store the non-zero elements. Coordinate triples are a method for representing sparse matrices, recording only the non-zero elements and their positions. Each triple consists of three values: row index, column index, and element value.

[0157] During format conversion, the processed edge weight matrix is ​​traversed, all non-zero elements are identified, and their row indices, column indices, and corresponding correlation values ​​are recorded, forming a list of coordinate triples. This list is the representation of the sparse adjacency matrix. This method significantly reduces storage space usage.

[0158] Step S415: Perform a dimension consistency check on the standardized node feature matrix and the sparse adjacency matrix to ensure that the number of rows in the standardized node feature matrix is ​​equal to the number of rows and columns in the sparse adjacency matrix. If there is a dimension mismatch, return to re-extract node and edge information.

[0159] Dimensionality consistency verification is a crucial step in ensuring that the normalized node feature matrix and the sparse adjacency matrix match in dimensions. The number of rows in the normalized node feature matrix represents the number of nodes, and the number of rows and columns in the sparse adjacency matrix should also match the number of nodes, as it represents the connection relationships between nodes.

[0160] During dimensional consistency verification, the number of rows in the standardized node feature matrix is ​​compared with the number of rows and columns in the sparse adjacency matrix. If the three are equal, it indicates dimensional matching, and subsequent processing can continue; if they are not equal, it indicates an error occurred during node and edge information extraction or matrix processing, requiring a return to re-extract node and edge information and repeat the previous steps for matrix generation and processing.

[0161] Step S416: Encapsulate the standardized node feature matrix, sparse adjacency matrix, and node count information to generate a graph structure data representation containing feature matrix fields, adjacency matrix fields, and node count fields. The graph structure data representation conforms to the input format requirements of the generative adversarial network model.

[0162] Encapsulation involves combining the standardized node feature matrix, sparse adjacency matrix, and node count information into a unified data structure for input into the generative adversarial network model. The graph structure data representation is this unified data structure, containing three fields: feature matrix field, adjacency matrix field, and node count field.

[0163] The feature matrix field stores the normalized node feature matrix, containing threat assessment information for each node. The adjacency matrix field stores the sparse adjacency matrix, representing the connection relationships and association strength between nodes. The node count field records the total number of nodes in the graph, which is an important piece of metadata that helps the model understand the scale of the graph.

[0164] Step S420: Input the graph structure data representation into the generator of the preset generative adversarial network model. The generator reconstructs the graph structure based on the node feature matrix and the adjacency matrix to generate a fake trajectory graph containing potential threat features. The number of nodes and edges in the fake trajectory graph are consistent with the number of threat evolution trajectory graphs.

[0165] The node feature matrix contains threat assessment information for each node, while the adjacency matrix represents the connectivity and association strength between nodes. The generator uses this information to perform calculations and transformations through a series of neural network layers, attempting to reconstruct a new graph structure. This new graph structure is the fake trajectory map, containing potential threat features generated by the generator through learning and simulating real threat characteristics.

[0166] To ensure the comparability of the forged trajectory map with the threat evolution trajectory map, the number of nodes and edges in the forged trajectory map must be consistent with those in the threat evolution trajectory map. This allows the discriminator to compare and distinguish between the real and forged maps under the same scale and structure. When generating the forged trajectory map, the generator continuously adjusts its parameters to make the generated map as close as possible to the real threat evolution trajectory map, thereby deceiving the discriminator.

[0167] Step S430: Input the threat evolution trajectory map and the fake trajectory map into the discriminator of the generative adversarial network model. The discriminator compares the differences in the graph structure features of the two and extracts the threat feature boundaries unique to the real trajectory map. The threat feature boundaries are used to distinguish real threat features from features faked by the generator.

[0168] The discriminator is a component in a generative adversarial network (GAN) model used to distinguish between real and fake data. In this step, both the real threat evolution trajectory map and the fake trajectory map generated by the generator are simultaneously input into the discriminator. The discriminator performs a detailed analysis and comparison of the graph structure features of these two maps. Graph structure features include the feature information of nodes and the connections between nodes. By comparing the differences between the two, the discriminator can identify unique feature patterns and feature boundaries in the real trajectory map.

[0169] The threat feature boundary is a region partition in the feature space that distinguishes genuine threat features from features fabricated by the generator. The discriminator continuously adjusts its parameters by learning from a large number of real and fabricated maps to accurately find this boundary. Once the threat feature boundary is determined, it can be used to further optimize the real threat evolution trajectory map, making genuine threat features more prominent and non-threat features easier to identify.

[0170] For example, a discriminator can use structures such as convolutional neural networks (CNNs) or graph neural networks (GNNs) to extract features from the graph and identify differences between the feature vectors of the real and fake graphs. Then, based on these differences, a threat feature boundary is determined. This boundary can be represented by a hyperplane or other geometric shape, dividing the feature space into regions of real threat features and regions of fake features.

[0171] Step S440: Call the feature boundary optimization module of the discriminator to adjust the node feature matrix of the threat evolution trajectory map based on the extracted threat feature boundary, strengthen the representation strength of real threat features located inside the boundary, and weaken the representation strength of non-threat features located outside the boundary.

[0172] For example, step S440 may specifically include the following steps S441-S446:

[0173] Step S441: The threat feature boundary extracted by the discriminator is represented as a hyperplane equation. The coefficients of the hyperplane equation are learned by the discriminator during training through the gradient descent algorithm and are used to separate the real threat feature region and the non-threat feature region in the feature space.

[0174] A hyperplane is a geometric concept used to divide regions in high-dimensional space. In this step, the threat feature boundaries extracted by the discriminator are represented as hyperplane equations. During training, the discriminator continuously adjusts the coefficients of the hyperplane equation using a gradient descent algorithm, ensuring that the hyperplane can separate real threat feature regions and non-threat feature regions as accurately as possible.

[0175] During training, the discriminator continuously adjusts the position and orientation of the hyperplane based on the input real threat evolution trajectory map and fake trajectory map, so that the real threat features are located on one side of the hyperplane and the non-threat features are located on the other side.

[0176] Step S442: Calculate the distance from each node feature vector in the standardized node feature matrix to the threat feature boundary represented by the hyperplane equation. A positive distance value indicates that the node feature vector is located inside the real threat feature region, and a negative distance value indicates that it is located outside the non-threat feature region.

[0177] After obtaining the hyperplane equation of the threat feature boundary, the distance from each node feature vector in the normalized node feature matrix to the hyperplane is calculated. When the calculated distance value d > 0, it indicates that the node feature vector is located on one side of the hyperplane, i.e., inside the real threat feature region; when d < 0, it indicates that the node feature vector is located on the other side of the hyperplane, i.e., outside the non-threat feature region.

[0178] Step S443: For node feature vectors with positive distance values, calculate the ratio of their distance value to the preset boundary safety distance, and use it as the feature enhancement coefficient. The larger the ratio, the closer the feature is to the boundary center, and the larger the enhancement coefficient value is, so as to enhance its representation strength.

[0179] The preset boundary safety distance is a pre-defined positive number used to measure the position of a node feature vector relative to the threat feature boundary. A positive distance value indicates that the node feature vector is located inside the actual threat feature region. To enhance the representational strength of these features, the ratio of their distance value to the preset boundary safety distance needs to be calculated.

[0180] Let d be the distance from the node feature vector to the threat feature boundary, and let D be the preset boundary safety distance. safe Then the feature enhancement coefficient α = d / D. The larger the ratio α, the closer the feature vector of the node is to the boundary center, indicating that the feature is more typical and requires stronger enhancement.

[0181] After calculating the feature enhancement coefficient, it is applied to the node feature vector (weighted with the vector elements). In this way, the representational strength of the node feature vector located inside the real threat feature region is enhanced.

[0182] Step S444: For node feature vectors with negative distance values, calculate the ratio of the absolute value of the distance value to the preset boundary safety distance to generate a feature weakening coefficient. The larger the ratio, the farther the feature is from the boundary. The smaller the value of the weakening coefficient, the lower its representation intensity.

[0183] For node feature vectors with negative distance values, it indicates that they are located outside the non-threat feature region. To weaken the representational strength of these features, the ratio of the absolute value of their distance value to the preset boundary safety distance is calculated.

[0184] Step S445: Multiply each element of the feature vector of each node with the corresponding feature enhancement coefficient or feature weakening coefficient to obtain the adjusted node feature vector, ensuring that the representation strength of real threat features is improved and the representation strength of non-threat features is suppressed.

[0185] After obtaining the feature enhancement coefficient or feature weakening coefficient for each node's feature vector, a corresponding product operation is performed on each element of the node's feature vector. For node feature vectors located inside the real threat feature region, the feature enhancement coefficient is used for product operation; for node feature vectors located outside the non-threat feature region, the feature weakening coefficient is used for product operation. Through product operation, the representation strength of real threat features is enhanced because the feature enhancement coefficient is greater than 1; the representation strength of non-threat features is suppressed because the feature weakening coefficient is less than 1. This makes the difference between real threat features and non-threat features more obvious, facilitating subsequent threat determination.

[0186] Step S446: Arrange all the adjusted node feature vectors in their original order to generate an optimized node feature matrix. The distinction between real threat features and non-threat features in the optimized node feature matrix is ​​significantly improved.

[0187] Because feature enhancement or weakening was performed on each node feature vector in step S445, the representation strength of real threat features and non-threat features changed. The representation strength of real threat features was increased, while the representation strength of non-threat features was suppressed. Therefore, the distinguishability between real threat features and non-threat features in the optimized node feature matrix was significantly improved.

[0188] Step S450: Input the optimized node feature matrix into the graph attention layer of the discriminator, calculate the association weights between nodes through the graph attention mechanism, perform weighted aggregation processing on the node features, and obtain a node aggregated feature vector with global association.

[0189] The graph attention layer introduces a graph attention mechanism to process the optimized node feature matrix. Graph attention is an attention mechanism used to process graph-structured data; it can automatically learn the association weights between nodes and perform weighted aggregation of node features based on these weights.

[0190] After the optimized node feature matrix is ​​input into the graph attention layer, the layer calculates the association weights between each node and other nodes. These association weights represent the importance and relevance between nodes. The process of calculating these association weights involves, for example, an attention function that considers both node feature information and graph structural information.

[0191] By performing this weighted aggregation process on all nodes, a node aggregation feature vector with global relevance is obtained. This vector integrates the feature information of all nodes in the graph and the relationships between them, thus better reflecting the characteristics and threat situation of the entire graph.

[0192] Step S460: Call the classification output layer of the discriminator to perform threat probability prediction on the node aggregated feature vector, and generate a threat determination matrix containing the probability values ​​of each threat type. The rows of the threat determination matrix correspond to the nodes in the trajectory map, the columns correspond to the threat types in the preset threat pattern library, and the matrix element values ​​are the probability that the node belongs to the corresponding threat type.

[0193] The classification output layer is the last layer of the discriminator. Its main task is to aggregate feature vectors from the input nodes to predict threat probabilities. For example, the classification output layer is a fully connected layer, and its output dimension equals the number of threat types in a pre-defined threat pattern library.

[0194] After receiving the aggregated feature vector of the nodes, the classification output layer maps the input vector into a probability space through a series of linear transformations and activation functions. Each output dimension corresponds to a threat type, and the output value represents the probability that a node belongs to that threat type.

[0195] For each node in the trajectory map, a vector containing the probability values ​​of each threat type is obtained. Arranging these vectors of all nodes in order forms a threat determination matrix. The rows of the threat determination matrix correspond to the nodes in the trajectory map, the columns correspond to the threat types in the preset threat pattern library, and the matrix elements are the probabilities of a node belonging to the corresponding threat type.

[0196] Step S500: Perform protocol semantic parsing on the threat determination matrix, and verify the threat confidence of the threat determination matrix by combining the protocol field associations obtained from the parsing, and generate network intrusion prevention instructions containing defense policy priorities.

[0197] For example, step S500 may specifically include the following steps S510-S560:

[0198] Step S510: Retrieve protocol semantic rules related to the protocol type corresponding to the node in the threat determination matrix from the preset protocol specification database. The protocol semantic rules include protocol field definitions, constraints between fields, and descriptions of normal value ranges.

[0199] The pre-built protocol specification database is a pre-established database that stores detailed specification information for various network protocols. Protocol types are the network protocols used by the nodes in the threat assessment matrix, such as HTTP, FTP, and SMTP. Different protocol types have their own protocol semantic rules, which are crucial for understanding the meaning and relationships of protocol fields.

[0200] Protocol semantic rules include protocol field definitions, which provide detailed descriptions of the name, meaning, and purpose of each protocol field; inter-field constraints, which describe the interdependencies and constraints between different protocol fields, such as how the value of some fields may affect the value of other fields; and descriptions of normal value ranges, which specify the range of values ​​for each protocol field under normal circumstances.

[0201] Step S520: Based on protocol semantic rules, perform protocol field parsing on the traffic data units of the corresponding nodes in the threat evolution trajectory map, extract the actual value, field position and dependency relationship of each protocol field, and generate a protocol field parsing result table.

[0202] After obtaining the protocol semantic rules, it is necessary to perform detailed protocol field parsing on the traffic data units of the corresponding nodes in the threat evolution trajectory map. The traffic data unit is the network traffic data that is obtained and discretized in step S100.

[0203] Based on protocol semantic rules, each traffic data unit is analyzed field by field to extract the actual value of each protocol field. For example, for the HTTP request method field, the actual value might be "GET" or "POST". Simultaneously, the position of each protocol field within the traffic data unit is recorded, which helps determine the order and relationships between fields.

[0204] Furthermore, it is necessary to analyze the dependencies between protocol fields. For example, in some protocols, the value of a certain field may determine the existence or value range of other fields. By analyzing these dependencies, a more comprehensive understanding of the protocol's semantics and data structure can be achieved. The extracted actual values ​​of the protocol fields, their positions, and their dependencies with other fields are compiled into a table, namely the protocol field parsing result table. Each row of this table corresponds to a protocol field, and each column records information such as the field name, actual value, field position, and dependencies.

[0205] Step S530: Based on the constraints between fields in the protocol field parsing result table, construct a protocol field association graph. The nodes in the graph are protocol fields, the edges represent the dependencies or value associations between fields, and the attributes of the edges describe the association strength.

[0206] A protocol field relationship graph is a graph structure used to represent the relationships between protocol fields. Based on the constraints between fields in the protocol field parsing result table, each protocol field is treated as a node in the graph, and the dependencies or value associations between fields are represented by edges. The edge attributes describe the association strength, indicating the tightness of the association between fields. Association strength can be determined based on factors such as the strictness of the constraints between fields and the correlation of their values.

[0207] Step S540: Calculate the product of the threat probability value of each node in the threat determination matrix and the degree of abnormality of the actual value of the corresponding protocol field, and use it as the initial threat confidence. The degree of abnormality is determined according to the degree to which the actual value of the field deviates from the normal value range.

[0208] Each node in the threat determination matrix corresponds to a threat probability vector, where each element represents the probability that the node belongs to a different threat type. The degree of anomalousness of the actual value of the corresponding protocol field is the degree of deviation between the actual value of the protocol field and the normal value range specified in the protocol semantic rules.

[0209] For each protocol field, an anomaly level value can be calculated based on its actual value and its normal value range. For example, if the normal value range of a protocol field is [a, b], and its actual value is x, then the anomaly level can be calculated using... Let p represent the value (greater than 1 when x is outside the range, and less than 1 when x is within the range). For each node in the threat determination matrix, its threat probability value is multiplied element-wise by the anomaly level of the corresponding protocol field. Assume that the threat probability of node i corresponding to threat type j is p. ij The anomaly level of the corresponding protocol field is e. ij Then the initial threat confidence level c ij =p ij ×e ij .

[0210] Step S550: The association strength description in the protocol field association graph is weighted and summed with the initial threat confidence to obtain the comprehensive threat confidence of each node. The higher the association strength of the field relationship, the greater its contribution to the comprehensive threat confidence.

[0211] Fields with stronger correlations carry greater weight in the weighted summation and thus contribute more to the overall threat confidence score. This is because anomalies in closely related fields are more likely to influence each other, thereby increasing the overall threat level. By using a weighted summation method, the overall threat confidence score can more comprehensively consider the correlations between protocol fields and the initial threat confidence, providing a more accurate basis for subsequent defense strategy selection.

[0212] Step S560: Filter nodes whose overall threat confidence exceeds the preset confidence threshold, extract their corresponding threat type identifiers and threat probability distributions, and generate network intrusion prevention instructions containing defense policy priorities based on the threat probability distributions and the preset defense policy library.

[0213] After filtering out nodes whose overall threat confidence exceeds a preset confidence threshold, threat type identifiers and threat probability distributions are extracted from the threat assessment vectors corresponding to these nodes. The threat type identifier clarifies the specific type of potential network threat, such as "DDoS_01" or "SQL_02"; the threat probability distribution provides the probability values ​​of the node under different threat types.

[0214] The default defense strategy library is a pre-built database that stores defense strategies for various known network threat types. Each defense strategy includes a strategy identifier, activation conditions, and countermeasures. Activation conditions include, for example, threat probability requirements and confidence level requirements; the defense strategy will only be applied when the threat situation of a node meets these conditions.

[0215] When generating network intrusion prevention instructions that include defense policy priorities, a comprehensive analysis based on threat probability distribution and a pre-defined defense policy library is required. The specific process is as follows:

[0216] Step S561: Extract the highest threat probability value and the second highest threat probability value corresponding to each node from the threat probability distribution, and calculate the difference between the two. The difference is used to characterize the clarity of the threat type determination.

[0217] For each selected node, its threat probability distribution is a vector containing probability values ​​for multiple threat types. By comparing these probability values, the highest and second-highest threat probability values ​​are determined. The difference between the two is calculated. The larger the difference, the more clearly the primary threat type faced by the node is identified; the smaller the difference, the more ambiguous the threat type determination is, as the node may face multiple threat types simultaneously. For example, if the difference is close to 1, it means the node is almost certainly attacked by a certain type of threat; if the difference is close to 0, it means the node is more evenly likely to be attacked by multiple threat types.

[0218] Step S562: Retrieve the defense strategy corresponding to the selected threat type identifier from the preset defense strategy library. Each defense strategy includes a strategy identifier, activation conditions, and countermeasures. The activation conditions include threat probability requirements and confidence level requirements.

[0219] Based on the threat type identifier of the selected nodes, the corresponding defense strategy is searched in the preset defense strategy library. Each defense strategy in the preset defense strategy library has its corresponding scope of application, and the appropriate strategy can be accurately located by the threat type identifier.

[0220] A policy identifier is a symbol or number used to uniquely identify each defense policy, facilitating policy management and invocation. Activation conditions are the criteria for determining whether a defense policy can be applied. Threat probability requirements specify the minimum threat probability value a node must reach, while confidence requirements require the node's overall threat confidence level to meet a certain threshold. Countermeasures are the specific actions the network security system must perform when a defense policy takes effect, such as blocking network connections, restricting access permissions, and performing intrusion detection.

[0221] Step S563: Compare the highest threat probability value with the threat probability requirement of the defense strategy to generate a probability matching result. If the highest threat probability value meets the threat probability requirement, the probability matching result is passed; otherwise, it is failed.

[0222] The highest threat probability value of each node extracted in step S561 is compared with the threat probability requirement of the defense strategy retrieved in step S562. If the highest threat probability value is greater than or equal to the threat probability requirement of the defense strategy, the node is considered to meet the effective conditions of the defense strategy in terms of threat probability, and the probability matching result is passed; otherwise, if the highest threat probability value is less than the threat probability requirement of the defense strategy, the probability matching result is failed.

[0223] Step S564: Compare the overall threat confidence with the confidence requirement of the defense strategy to generate a confidence matching result. If the overall threat confidence meets the confidence requirement, the confidence matching result is passed; otherwise, it is failed.

[0224] Similarly, the overall threat confidence score of each node calculated in step S550 is compared with the confidence score requirement of the defense strategy retrieved in step S562. If the overall threat confidence score is greater than or equal to the confidence score requirement of the defense strategy, the node is considered to meet the conditions for the defense strategy to take effect in terms of confidence score, and the confidence score matching result is passed; otherwise, if the overall threat confidence score is less than the confidence score requirement of the defense strategy, the confidence score matching result is failed.

[0225] Step S565: For defense strategies that pass both probability matching and confidence matching, calculate the applicability of the strategy by combining the difference between the highest threat probability value and the second highest threat probability value. The larger the difference, the clearer the threat type and the higher the applicability of the strategy.

[0226] The strategy applicability is calculated by combining the difference ΔP between the highest and second-highest threat probability values ​​calculated in step S561. A larger difference ΔP indicates a more clearly defined threat type, meaning that adopting the corresponding defense strategy will be more targeted in addressing the threat, and thus the strategy applicability is higher. A linear function can be used to calculate the strategy applicability, for example, strategy applicability S = k × ΔP (where k is a preset coefficient used to adjust the range of values ​​for strategy applicability).

[0227] Step S566: Sort all defense strategies by applicability, generate defense strategy priorities, and arrange strategies with the same applicability according to their preset order in the defense strategy library. Encapsulate the sorted defense strategies, their corresponding threat type identifiers, and their comprehensive threat confidence scores into network intrusion prevention instructions.

[0228] All selected defense strategies are sorted from highest to lowest applicability. If multiple strategies have the same applicability, they are arranged according to their preset order in the pre-defined defense strategy library. The sorted defense strategies, their corresponding threat type identifiers, and overall threat confidence scores are encapsulated into a network intrusion prevention instruction. This instruction can be stored in a structured data format, such as JSON or XML, for easy reading and execution by the network security system. The network security system can then execute appropriate countermeasures according to the priority of the defense strategies, effectively preventing network intrusions.

[0229] It is understood that the various algorithms involved in the above descriptions of the embodiments of the present invention can all be obtained from relevant content in the prior art. To save space, they will not be elaborated on in the embodiments of the present invention. In addition, those skilled in the art can supplement the details based on common knowledge in the art when implementing the solutions of the present invention. For example, they can use normalization to eliminate dimensional conflicts before feature fusion, use interpolation to eliminate dimensional differences, reasonably set thresholds based on historical data, experience or business scenario requirements, train the model based on a general model training method, set the number of layers in the model structure based on actual needs, select activation functions, etc. The present invention will not provide redundant descriptions of overly detailed implementation processes here.

[0230] Please see Figure 2 , Figure 2This is a schematic diagram of a computer system provided in an embodiment of the present invention. The computer system includes at least a processor 101, a communication interface 102, and a memory 103. The processor 101, communication interface 102, and memory 103 can be connected via a bus or other means. The processor 101 (or Central Processing Unit, CPU) is the computing and control core of the computer system, capable of parsing various instructions and processing various data within the computer system. The communication interface 102 may optionally include a standard wired interface or a wireless interface (such as Wi-Fi, mobile communication interface, etc.), and can be used to send and receive data under the control of the processor 101; the communication interface 102 can also be used for data transmission and interaction within the computer system. The memory 103 is a storage device in the computer system used to store programs and data. It is understood that the memory 103 here can include the computer system's built-in memory, or it can include extended memory supported by the computer system. The memory 103 provides storage space, which stores the computer system's operating system; this invention does not limit this storage space.

[0231] In one embodiment, the processor 101 executes the AI-based network intrusion prevention data processing method provided above in the embodiments of the present invention by running a computer program in the memory 103.

Claims

1. An AI-based network intrusion prevention data processing method, characterized by, The method includes: The system acquires raw traffic data generated during network communication, discretizes the raw traffic data into segments according to a preset time window, and generates a set of traffic data units with time series labels. Threat features are identified for each traffic data unit in the traffic data unit set. Based on the degree of matching between the identified threat features and the preset threat pattern library, a threat assessment vector containing threat type identifiers and corresponding matching degrees is generated. Based on threat assessment vectors within continuous time windows, the correlation degree of threat features between adjacent traffic data units is calculated, and a threat evolution trajectory map with temporal correlation is constructed using the threat feature correlation. Specifically, this includes: extracting the threat assessment vector sequence corresponding to the continuous time window, arranging it in timestamp order to form a threat assessment vector time series, where each vector element in the time series corresponds to the threat assessment result of a traffic data unit; performing vector differencing on the time series to calculate the feature changes between threat assessment vectors in adjacent time windows, generating a vector change sequence, the length of which is one unit shorter than the length of the time series; and calculating the correlation between adjacent traffic data units based on the vector change sequence and time window correlation parameters. Threat feature correlation, the time window correlation parameter is dynamically adjusted according to the time interval of adjacent time windows and historical correlation records; each traffic data unit is used as a graph node, the node attributes include the corresponding threat assessment vector and timestamp information, the threat feature correlation between adjacent traffic data units is used as the weight value of the node connection edge, and an initial threat evolution trajectory chain is constructed; the initial threat evolution trajectory chain is subjected to path integrity detection, the broken nodes and abnormal connection edges in the trajectory chain are identified, and the missing connections are supplemented or abnormal connections are corrected based on the threat feature correlation to obtain a complete trajectory path; the nodes and connection edges in the complete trajectory path are structurally encapsulated to generate a threat evolution trajectory graph containing a node set, an edge set and an edge weight matrix, and the nodes in the threat evolution trajectory graph are continuously correlated according to the timestamp order; The threat evolution trajectory map is input into a preset generative adversarial network model, and the discriminator in the model is called to optimize the feature boundaries of the threat evolution trajectory map, generating a threat determination matrix containing the threat probability distribution; The threat determination matrix is ​​parsed using protocol semantics. The threat confidence of the threat determination matrix is ​​verified by combining the parsed protocol field relationships, and a network intrusion prevention instruction containing the priority of the defense strategy is generated.

2. The method of claim 1, wherein, The process involves identifying threat features for each traffic data unit in the traffic data unit set, and generating a threat assessment vector containing a threat type identifier and corresponding matching degree based on the degree of matching between the identified threat features and a preset threat pattern library. The traffic data unit is subjected to network protocol stack layer parsing processing, and the IP header field of the network layer, the port interaction field of the transport layer, and the payload behavior field of the application layer are extracted in sequence to generate a multi-level original feature set containing inter-layer relationships. Based on the preset feature space mapping rules, the feature dimensions of the multi-level original feature set are uniformly processed, and the feature fields of different levels are mapped to the same feature space to obtain a standardized threat feature vector with fixed dimensions. The system calls the threat pattern feature templates stored in the preset threat pattern library, calculates the feature similarity between the standardized threat feature vector and each threat pattern feature template, and generates a similarity matching matrix covering all threat types. Based on the similarity values ​​of each threat pattern feature template in the similarity matching matrix, threat pattern feature templates with similarity exceeding a preset matching threshold are selected, and their corresponding threat type identifiers are extracted. Perform correlation verification on the original feature fields corresponding to the selected threat type identifiers, verify the logical consistency between feature fields and the degree of feature matching between layers, and generate feature verification results; The verified threat type identifier is associated with and encapsulated with the corresponding similarity value to generate a threat assessment vector containing a threat type identifier field and a matching degree value field. The field order of the threat assessment vector is consistent with the arrangement order of threat types in the preset threat pattern library.

3. The method of claim 2, wherein, The process of performing network protocol stack layered parsing on the traffic data unit sequentially extracts the IP header field of the network layer, the port interaction field of the transport layer, and the payload behavior field of the application layer, generating a multi-level original feature set containing inter-layer relationships, including: The data frame structure of the traffic data unit is parsed to identify the frame start identifier and frame end identifier of the data frame, extract the network protocol type field contained in the frame, and determine the basic protocol type to which the data frame belongs. Based on the basic protocol type, the corresponding protocol parsing module is called to parse the network layer header of the data frame, extract the source address field, destination address field, time to live field, and type of service field from the IP header, and record the original value and length of each field. Based on the network layer parsing results, determine the transport layer protocol type, perform transport layer header parsing on the data frame, extract the source port field, destination port field, connection status flag field and window size field of the transport layer, and record the status value and change trend of each field. The application layer protocol is identified by parsing the payload data from the transport layer. The application layer protocol type is determined by matching the feature codes of the payload data. The field length distribution, the location of key fields and abnormal character sequences in the payload data are extracted to obtain the payload behavior description field. Establish an inter-layer feature association table to record the correspondence between network layer fields and transport layer fields, the dependency between transport layer fields and application layer fields, and mark the offset position and extraction order of each layer feature field in the data frame; The network layer's IP header field, the transport layer's port interaction field, the application layer's payload behavior field, and the inter-layer feature association table are structurally integrated to generate a multi-level original feature set containing layer identifiers and relationship descriptions.

4. The method of claim 3, wherein, The process involves identifying the application layer protocol in the payload data parsed from the transport layer. This is achieved by matching the payload data's feature codes to determine the application layer protocol type, extracting the field length distribution, key field occurrence positions, and abnormal character sequences from the payload data, and obtaining payload behavior description fields, including: The payload data parsed by the transport layer is filtered for invalid characters to remove consecutive empty character sequences and protocol padding characters, while retaining the valid payload content. The payload content is segmented according to a preset sliding window length to generate multiple consecutive payload segmentation units. The length of each payload segmentation unit is consistent with the length of the feature code in the preset feature code library. Call the preset feature code library, compare each payload fragment unit with the application layer protocol feature code in the feature code library byte by byte, record the number, position and protocol type of the successfully matched feature codes, and generate a feature code matching result table; Based on the proportion of protocol types to which successfully matched feature codes belong in the feature code matching result table, the application layer protocol type corresponding to the payload data is determined. When multiple protocol types match, the protocol type with the highest proportion is selected as the final result. Field boundary detection is performed on the payload data with a determined protocol type. Based on the delimiters and keyword identifiers defined in the protocol specification, the payload data is split into multiple protocol field units, and the start offset and end offset of each field unit are recorded. The length values ​​of each protocol field unit are statistically analyzed, and the distribution range and dispersion of the length values ​​are calculated as the field length distribution. The first occurrence position and subsequent occurrence interval of the key fields defined in the protocol specification in the payload data are recorded as the key field occurrence position. Character sequences in the payload data that do not conform to the protocol character set are scanned, and their starting positions and lengths are recorded as abnormal character sequences. The field length distribution, key field occurrence positions and abnormal character sequences are integrated into the payload behavior description field.

5. The method of claim 1, wherein, The step of calculating the threat characteristic correlation degree between adjacent traffic data units based on the vector change sequence and time window correlation parameters, wherein the time window correlation parameters are dynamically adjusted according to the time interval between adjacent time windows and historical correlation records, includes: Extract the timestamp information of adjacent traffic data units in the time series of the threat assessment vector, calculate the actual time interval between adjacent timestamps, and record it as a window interval value; Query historical threat handling records, calculate the average time interval between adjacent traffic data units under the same protocol type, use it as the standard window interval, and calculate the degree of deviation between the current window interval value and the standard window interval. The initial value of the time window correlation parameter is determined based on the degree of deviation. When the degree of deviation is positive, the time window correlation parameter decreases linearly as the degree of deviation increases. When the degree of deviation is negative, the time window correlation parameter maintains the baseline value. Extract the vector change amount of the corresponding adjacent traffic data unit from the vector change sequence, and calculate the inverse index of the vector change amount as the basic correlation degree. The smaller the vector change amount, the higher the basic correlation degree. The basic correlation degree is multiplied by the time window correlation parameter to obtain the preliminary threat feature correlation degree. Then, the correlation degree of the same type of traffic in history is combined with the average correlation degree for weighted adjustment to generate the final threat feature correlation degree. The calculation process and parameter values ​​of the threat feature correlation are recorded as historical correlation records for subsequent dynamic adjustment of the correlation parameters over time windows.

6. The method of claim 5, wherein, The process of performing path integrity detection on the initial threat evolution trajectory chain, identifying broken nodes and abnormal connection edges in the trajectory chain, and supplementing missing connections or correcting abnormal connections based on threat feature correlation to obtain a complete trajectory path includes: Traverse all nodes in the initial threat evolution trajectory chain, record the incoming edge connection information and outgoing edge connection information of each node, and construct a node connection relationship graph, wherein the incoming edge connection information includes the source node identifier and correlation degree, and the outgoing edge connection information includes the target node identifier and correlation degree. Based on the node connection graph, the initial threat evolution trajectory chain is traversed, and the continuity of the timestamps of the node sequence is checked. When the timestamp interval between adjacent nodes exceeds the preset maximum allowable interval, it is marked as a broken node. The correlation degree of the connecting edges in the trajectory chain is detected. The correlation degree of the threat characteristics of the connecting edges is compared with the preset correlation degree benchmark value. When the correlation degree is lower than the benchmark value, it is marked as an abnormal connecting edge. At the same time, the source node and target node of the abnormal connecting edge are recorded. For a marked fracture node, query the threat assessment vectors of its preceding and following adjacent nodes, calculate the correlation degree of threat features between the fracture node and the preceding and following nodes, and add connecting edges to supplement the missing connections when the correlation degree meets the supplementation conditions. For marked abnormal connection edges, extract the average historical threat feature correlation between the source node and the target node. When the current correlation deviation from the average exceeds a preset deviation range, correct the correlation value of the current connection edge based on the average. The path integrity check is performed again on the supplemented and corrected trajectory chain. The above steps are repeated until there are no broken nodes or abnormal connection edges, resulting in a complete trajectory path with continuous timestamps and reasonable correlation.

7. The method according to claim 6, characterized in that, The process of structurally encapsulating the nodes and connecting edges in the complete trajectory path to generate a threat evolution trajectory map containing a set of nodes, a set of edges, and an edge weight matrix includes: Extract all nodes from the complete trajectory path, assign a unique node identifier to each node, record the timestamp, threat assessment vector, and protocol type of the traffic data unit corresponding to the node, and generate a node attribute table, which includes a node identifier, timestamp, threat assessment vector field, and protocol type field. Extract all connecting edges from the complete trajectory path, assign a unique edge identifier to each connecting edge, record the source node identifier, target node identifier, threat feature correlation degree, and connection time interval of the connecting edge, and generate an edge attribute table, which includes edge identifier, source node identifier, target node identifier, correlation degree, and time interval fields. Construct an edge weight matrix. The row index of the matrix corresponds to the source node identifier, the column index corresponds to the target node identifier, and the matrix element value is the threat feature correlation degree of the corresponding connected edge. When there is no connected edge between the source node and the target node, the matrix element value is a preset null value. Add a time window affiliation field to the node attribute table to record the time window number to which the traffic data unit corresponding to the node belongs and its sequential position within the time window; Add an association type field to the edge attribute table. Based on whether the threat type identifiers in the threat assessment vectors of the source node and the target node are consistent, the association types are divided into same-type associations and different-type associations. Different-type associations need to additionally record the type conversion direction. The node attribute table, edge attribute table, and edge weight matrix are structurally integrated to generate a threat evolution trajectory map containing graph metadata, including graph construction time, total number of nodes, total number of edges, and average correlation degree.

8. The method according to claim 1, characterized in that, The step of inputting the threat evolution trajectory map into a preset generative adversarial network model, and calling the discriminator therein to optimize the feature boundaries of the threat evolution trajectory map to generate a threat determination matrix containing the threat probability distribution includes: The threat evolution trajectory map is transformed into a graph vectorization model. The threat assessment vectors in the node attribute table are arranged in time stamp order to generate a node feature matrix. The edge weight matrix is ​​used as the adjacency matrix to construct a graph structure data representation of the map. The graph structure data representation is input into the generator of the preset generative adversarial network model. The generator reconstructs the graph structure based on the node feature matrix and the adjacency matrix to generate a fake trajectory graph containing potential threat features. The number of nodes and edges in the fake trajectory graph is consistent with the number of threat evolution trajectory graphs. The threat evolution trajectory map and the fake trajectory map are input into the discriminator of the generative adversarial network model. The discriminator compares the differences in the graph structure features of the two and extracts the threat feature boundaries unique to the real trajectory map. The threat feature boundaries are used to distinguish real threat features from features faked by the generator. The discriminator's feature boundary optimization module is invoked to adjust the node feature matrix of the threat evolution trajectory map based on the extracted threat feature boundaries, thereby strengthening the representation strength of real threat features located inside the boundary and weakening the representation strength of non-threat features located outside the boundary. The optimized node feature matrix is ​​input into the graph attention layer of the discriminator. The association weights between nodes are calculated through the graph attention mechanism, and the node features are weighted and aggregated to obtain a node aggregated feature vector with global association. The classification output layer of the discriminator is invoked to perform threat probability prediction on the aggregated feature vector of the node, generating a threat determination matrix containing probability values ​​of each threat type. The rows of the threat determination matrix correspond to the nodes in the trajectory map, the columns correspond to the threat types in the preset threat pattern library, and the matrix element values ​​are the probability that the node belongs to the corresponding threat type.

9. A computer system, characterized in that, include: A memory, wherein a computer program is stored; Processor, configured to load the computer program to implement claim 1 The AI-based network intrusion prevention data processing method described in any one of the 8 claims.

Images