Network security monitoring analysis method and system

Abstract

The invention discloses a network security monitoring analysis method and system, and relates to the technical field of network security monitoring analysis, and the method comprises the steps: deploying distributed monitoring agents at different levels of a network infrastructure, capturing real-time service flows and meta-information flows, and converging the real-time service flows and meta-information flows into network environment mirror image data; and carrying out layer-by-layer progressive association deconstruction on the mirror image data, and extracting a topological connection track, a session fingerprint track and a load fragment track. And drawing a dynamic graph of the threat intention based on the tracks to generate an initial threat intention dynamic graph. And introducing a network resource occupation baseline, and performing environmental interference suppression on the attack behavior mark points in the atlas to obtain a threat intention dynamic atlas for eliminating resource environmental noise. And targeted defense treatment guidance is automatically derived and formed according to the atlas. According to the method, accurate description of the cross-layer attack chain is realized, and false alarms caused by environmental noise are effectively reduced.

Description

Technical Field

[0001] This invention belongs to the field of network security monitoring and analysis technology, specifically a network security monitoring and analysis method and system. Background Technology

[0002] Current network security monitoring primarily relies on the analysis of discrete data sources. Feature-based methods focus on detecting known malicious code fragments in the payload. Traffic statistical analysis methods focus on abnormal thresholds for protocols, ports, and connection frequencies. Log aggregation methods attempt to establish simple time-series correlations between various system events. All these techniques examine network activity from a specific perspective.

[0003] Single-dimensional detection results in isolated alerts that fail to reflect multi-layered attack steps across network structure, user behavior, and data content. A large number of low-correlation alerts overwhelm the actual attack chain. Meanwhile, periodic or sudden changes in the operational status of the network infrastructure itself, such as fluctuations in service load, often trigger anomaly detection mechanisms based on fixed thresholds, generating high-frequency environmental noise alerts that severely interfere with the identification of effective threats.

[0004] There is a need for a technical solution that can automatically construct cross-level behavioral correlations from raw network traffic and distinguish malicious activities from normal resource fluctuations. This requires the method not only to deconstruct and connect activity trajectories at different levels, but also to have a dynamic reference mechanism to calibrate the true risk of abnormal behavior. Summary of the Invention

[0005] This invention aims to solve at least one of the technical problems existing in the prior art;

[0006] Therefore, this invention proposes a network security monitoring and analysis method, including:

[0007] Distributed listening agents are deployed at different levels of the network infrastructure. These agents capture real-time service flows and metadata flows passing through their respective nodes and aggregate the captured real-time service flows and metadata flows into network environment mirror data.

[0008] The network environment mirror data is deconstructed layer by layer to extract the topology connection trajectory reflecting the network structure characteristics, the session fingerprint trajectory reflecting the user interaction pattern, and the load segment trajectory reflecting the data exchange characteristics.

[0009] Based on the topology connection trajectory, the session fingerprint trajectory, and the payload fragment trajectory, a dynamic threat intent graph is drawn to generate an initial dynamic threat intent graph containing potential attack behavior markers.

[0010] By introducing a resource occupancy baseline that characterizes the network's own operating status, environmental interference suppression is applied to the attack behavior markers in the initial threat intent dynamic map, resulting in a threat intent dynamic map that eliminates resource and environmental noise.

[0011] Based on the dynamic map of threat intent that has eliminated resource and environmental noise, targeted defense and response guidelines are automatically derived and formed.

[0012] Preferably, the step of progressively deconstructing the network environment mirror data to extract topological connection trajectories reflecting network structural characteristics, session fingerprint trajectories reflecting user interaction patterns, and payload segment trajectories reflecting data exchange characteristics includes:

[0013] The device communication record stream and control protocol signaling stream are separated from the network environment mirror data;

[0014] Based on the device communication record stream, a time-series change graph of the interaction relationship between network nodes is constructed; the time-series change graph is traversed to record the connection establishment event sequence, connection persistence event sequence, and connection termination event sequence generated by a specific network node at different time points, and the connection establishment event sequence, the connection persistence event sequence, and the connection termination event sequence are combined to form the topology connection trajectory;

[0015] Based on the control protocol signaling flow, construct the state transition path within the session lifecycle;

[0016] Analyze the state transition path and extract the authentication credential sequence, interaction action sequence and state transition sequence generated by the user or process during the session. The session fingerprint trajectory is formed by combining the authentication credential sequence, the interaction action sequence and the state transition sequence.

[0017] Simultaneously, an application layer payload block containing valid data units is extracted from the real-time service stream;

[0018] The application layer payload block is subjected to format recognition and semantic segmentation to form a sequence of data content fragments;

[0019] Statistical measurements are performed on the data content segment sequence to obtain a load size distribution sequence, a load type distribution sequence, and a load entropy value distribution sequence. The load segment trajectory is formed by combining the load size distribution sequence, the load type distribution sequence, and the load entropy value distribution sequence.

[0020] Preferably, the step of dynamically mapping the threat intent based on the topology connection trajectory, the session fingerprint trajectory, and the payload fragment trajectory to generate an initial dynamic threat intent map containing markers of potential attack behaviors includes:

[0021] A spatiotemporal coordinate system is established for fusing different types of trajectory data. The spatiotemporal coordinate system includes a network topology dimension, a time process dimension, and a behavior intensity dimension.

[0022] The network topology dimension and time process dimension of the topological connection trajectory are mapped to the spatiotemporal coordinate system to generate a spatiotemporal distribution cloud of the connection relationship between nodes;

[0023] The session fingerprint trajectory is mapped to the time process dimension and behavior intensity dimension of the spatiotemporal coordinate system to generate an intensity change surface of the user behavior pattern;

[0024] The trajectory of the load segment is mapped to the time process dimension of the spatiotemporal coordinate system to generate a cluster of fluctuation curves for load characteristic parameters;

[0025] Using trajectory association mining rules, we simultaneously analyze the abnormal clustering and dispersing patterns of connectivity in the spatiotemporal distribution cloud, the abrupt inflection points of behavioral patterns in the intensity change surface, and the outlier fluctuation ranges of characteristic parameters in the fluctuation curve cluster.

[0026] When the abnormal aggregation and dispersion pattern, the mutation inflection point, and the outlier fluctuation interval intersect in the same spatiotemporal neighborhood in the spatiotemporal coordinate system, an attack behavior marker point is marked at the center of the spatiotemporal neighborhood where the abnormal aggregation and dispersion pattern, the mutation inflection point, and the outlier fluctuation interval intersect.

[0027] All attack behavior markers and their corresponding spatiotemporal neighborhoods, marked in the spatiotemporal coordinate system, are integrated to form the initial dynamic threat intent map.

[0028] Preferably, the step of introducing a resource occupancy baseline characterizing the network's own operating state and suppressing environmental interference on the attack behavior markers in the initial threat intent dynamic map to obtain a threat intent dynamic map with eliminated resource and environmental noise includes:

[0029] Periodically collect the CPU utilization curve, memory usage curve, and network interface bandwidth usage curve of key devices in the network infrastructure to synthesize the resource usage baseline; align and match the spatiotemporal neighborhood corresponding to each attack behavior marker in the initial threat intent dynamic map with the resource usage data of the resource usage baseline in the same time period.

[0030] For each attack behavior marker, the following environmental interference suppression operations are performed: The rate of change of network activity characteristics within the spatiotemporal neighborhood corresponding to the attack behavior marker is calculated; simultaneously, the rates of change of the CPU utilization curve, the memory utilization curve, and the network interface bandwidth utilization curve within the same time period are extracted from the resource usage baseline; and the rates of change of the network activity characteristics are compared with the rates of change of the CPU utilization curve, the memory utilization curve, and the network interface bandwidth utilization curve, respectively, through correlation analysis.

[0031] If the rate of change of the network activity characteristics shows a positive correlation with the rate of change of any resource curve exceeding a predetermined threshold, it is determined that the attack behavior marker has been significantly disturbed by the corresponding resource environment fluctuation, and the attack behavior marker is removed from the initial threat intent dynamic map.

[0032] After the removal operation, the remaining attack behavior markers and their spatiotemporal neighborhoods in the initial threat intent dynamic map are recombined into the threat intent dynamic map that has eliminated resource and environmental noise.

[0033] Preferably, the step of automatically deriving and forming targeted defense and response guidelines based on the dynamic map of threat intent after eliminating resource and environmental noise includes:

[0034] The dynamic threat intent map, which eliminates resource and environmental noise, is analyzed to identify threat clusters formed by all attack behavior markers in the map, as well as the associated paths between threat clusters.

[0035] For each identified threat cluster, the spatiotemporal distribution density of attack behavior markers within the threat cluster, the set of attack behavior types represented by the attack behavior markers, and the logical distance between the threat cluster and the network critical asset area are analyzed.

[0036] Based on the spatiotemporal distribution density, determine the urgency level of the defense response; based on the set of attack behavior types, determine the types of defense capabilities that need to be invoked; based on the logical distance, determine the deployment scope and intensity of the defense measures.

[0037] For each identified associated path, the starting and ending threat clusters of the associated path are analyzed to infer the possible path direction of the attack evolution;

[0038] By taking into account the urgency level of the defense response, the type of defense capabilities to be invoked, the deployment scope and intensity of the defense measures, and the possible evolution path of the attack, specific action sequences and configuration parameters are generated for each threat cluster and each associated path, forming a structured defense response guide.

[0039] Preferably, the analysis of the spatiotemporal distribution density of attack behavior markers within the threat cluster, the set of attack behavior types represented by the attack behavior markers, and the logical distance between the threat cluster and the network critical asset area includes:

[0040] Calculate the volume occupied by the threat cluster in the spatiotemporal coordinate system, and count the total number of attack behavior markers contained in the volume; divide the total number of attack behavior markers by the volume to obtain the spatiotemporal distribution density;

[0041] Extract the trajectory association mining rules associated with each attack behavior marker point within the threat cluster when it is generated, and deduplicate and summarize the attack behavior classification labels mapped by the trajectory association mining rules to form the attack behavior type set.

[0042] On the network topology dimension of the spatiotemporal coordinate system, locate the coordinates of the geometric center point of the threat cluster and locate the coordinate range corresponding to the predefined network critical asset region; calculate the nearest Euclidean distance from the coordinates of the geometric center point to the boundary of the coordinate range of the network critical asset region, and use the nearest Euclidean distance as the logical distance.

[0043] Preferably, the step of performing format recognition and semantic segmentation on the application layer payload block to form a data content fragment sequence includes:

[0044] Read the start byte of the application layer payload block, match it with a predefined protocol identifier library, and determine the application layer protocol format followed by the application layer payload block;

[0045] Based on the determined application layer protocol format, the corresponding syntax parsing template is invoked to perform structured parsing on the application layer payload block, separating the protocol header field set and the payload data body;

[0046] The payload data body is subjected to primary segmentation based on content type, and continuous data content of the same type is divided into a content block to obtain multiple content blocks;

[0047] For each content block, a semantic boundary detection method is applied. The semantic boundary detection method identifies the potential semantic boundary positions inside the content block based on the character conversion pattern under a specific encoding rule, or based on the lexical unit boundary features in natural language processing, or based on the opcode rules of binary instruction sequences.

[0048] Based on all identified semantic boundary locations, the payload data body is segmented into multiple semantically independent data content fragments, which are then arranged in the order of segmentation to form a sequence of data content fragments.

[0049] Preferably, calculating the rate of change of network activity characteristics within the spatiotemporal neighborhood corresponding to the attack behavior marker includes:

[0050] Obtain the time-series values ​​of connection establishment rate of all network nodes on the topology connection trajectory, the time-series values ​​of interaction frequency of all users on the session fingerprint trajectory, and the time-series values ​​of entropy change of all data exchanges on the payload segment trajectory within the spatiotemporal neighborhood corresponding to the attack behavior marker point.

[0051] Time series differentiation operations are performed on the connection establishment rate time series value, the interaction action frequency time series value, and the entropy change time series value to obtain the connection establishment acceleration sequence, the interaction action acceleration sequence, and the entropy change gradient sequence.

[0052] Calculate the average absolute value of the connection establishment acceleration sequence, the average absolute value of the interaction action acceleration sequence, and the average absolute value of the entropy change gradient sequence within the time span of the spatiotemporal neighborhood, respectively.

[0053] The average value of the connection establishment acceleration sequence, the average value of the interaction action acceleration sequence, and the average value of the entropy change gradient sequence are weighted and summed, and the result is used as the rate of change of the network activity feature.

[0054] Preferred options also include:

[0055] Establish an execution effect feedback loop for the defense response guidance, which is used to optimize the dynamic mapping process of the threat intent;

[0056] Specifically, after applying the aforementioned defense handling guidelines, the subsequent service flows and metadata flows of the network infrastructure are recaptured to generate subsequent network environment mirror data;

[0057] The subsequent network environment mirror data is subjected to the progressive association deconstruction to extract the subsequent topology connection trajectory, subsequent session fingerprint trajectory, and subsequent payload fragment trajectory.

[0058] Compare the deviation of the subsequent topology connection trajectory from the historical topology connection trajectory, compare the deviation of the subsequent session fingerprint trajectory from the historical session fingerprint trajectory, and compare the deviation of the subsequent payload fragment trajectory from the historical payload fragment trajectory;

[0059] If the deviation is lower than a predetermined threshold, the confidence level of the trajectory association mining rule used to generate the defense response guidance will be increased by one level; if the deviation is higher than the predetermined threshold, the confidence level of the trajectory association mining rule used to generate the defense response guidance will be decreased by one level.

[0060] In the subsequent dynamic mapping of the threat intent, the decision weight of the trajectory association mining rule when marking attack behavior markers is adjusted based on the confidence level of the updated trajectory association mining rule.

[0061] Preferably, the present invention also includes a network security monitoring and analysis system, the system including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein when the processor executes the computer program, it implements the steps of the network security monitoring and analysis method described above.

[0062] Compared with the prior art, the beneficial effects of the present invention are:

[0063] By deploying distributed eavesdropping agents at different layers of the network infrastructure and implementing progressively layered deconstruction, topology connection trajectories, session fingerprint trajectories, and payload fragment trajectories can be extracted from the original business flow and metadata flow. These three trajectories provide a structured representation of network activity with temporal characteristics from three orthogonal dimensions: network structure, user interaction, and data exchange. This method overcomes the attack chain fragmentation problem caused by traditional single-dimensional analysis, allowing cross-layer attack steps that were originally hidden in mixed traffic to be presented as clear and coherent trajectory sequences. Threat mapping based on these multimodal trajectories can more accurately depict the attacker's lateral movement paths, tactical intentions, and the propagation process of tool data, achieving high-fidelity reconstruction and intent reasoning of complex attack chains.

[0064] After generating the initial dynamic threat intent map, a resource usage baseline representing the network's own operational status is introduced to suppress environmental interference at attack behavior markers. This step dynamically compares the anomaly indicators of attack behavior with historical normal resource data such as CPU, memory, and bandwidth at the same time and node. If a suspected attack behavior is accompanied by a peak in resource usage, its threat weight is suppressed; conversely, the same behavior during resource idle periods is amplified. This mechanism quantifies the network environment state as a dynamic noise filter, changing the single mode of traditional detection that relies solely on behavioral thresholds. It can effectively distinguish between apparent anomalies caused by legitimate business peaks and covert attacks carried out under normal load, significantly filtering out false alarms caused by environmental noise, making the final generated threat intent map more purely focused on genuine malicious activities. Attached Figure Description

[0065] Figure 1 This is a flowchart illustrating the steps of the network security monitoring and analysis method described in this invention.

[0066] Figure 2 A flowchart for creating a dynamic map of threat intent;

[0067] Figure 3 A flowchart for environmental interference suppression;

[0068] Figure 4 A bar chart comparing the spatiotemporal distribution density of threat clusters;

[0069] Figure 5 A bar chart comparing the confidence levels of trajectory association mining rules. Detailed Implementation

[0070] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0071] See Figure 1 This invention provides a network security monitoring and analysis method, the overall implementation of which is as follows: Distributed monitoring agents are deployed at different layers of the network infrastructure, such as the access layer, aggregation layer, core layer, or specific host nodes. These distributed monitoring agents capture real-time service flows and metadata flows passing through their respective network nodes, and aggregate the captured real-time service flows and metadata flows to form network environment mirror data. The network environment mirror data is progressively deconstructed layer by layer, and topology connection trajectories reflecting network structure characteristics, session fingerprint trajectories reflecting user interaction patterns, and payload fragment trajectories reflecting data exchange characteristics are extracted from the data. Based on the topology connection trajectories, session fingerprint trajectories, and payload fragment trajectories, a dynamic threat intent graph is drawn, generating an initial dynamic threat intent graph containing potential attack behavior markers. A resource occupancy baseline representing the network's own operating state is introduced. This baseline reflects the network's resource consumption pattern under normal or expected load. Environmental interference suppression is applied to the attack behavior markers in the initial dynamic threat intent graph. By removing markers significantly affected by resource environment fluctuations, a dynamic threat intent graph with eliminated resource environment noise is obtained. Based on the dynamic map of threat intent that has eliminated resource and environmental noise, targeted defense and response guidelines are automatically derived and generated, which include specific action sequences and configuration parameters.

[0072] In one embodiment of the present invention, the implementation begins after the network environment mirror data is aggregated. The network environment mirror data is a unified data set formed by fusing real-time service streams and metadata streams captured by a distributed monitoring agent. The progressive deconstruction of this data set layer by layer is the basis for extracting key trajectory information. The network environment mirror data contains various intertwined data components. The first step is to separate the device communication record stream and the control protocol signaling stream from the network environment mirror data. The device communication record stream records the source address, destination address, port, and timestamp information of communication between network nodes, while the control protocol signaling stream contains protocol interaction instructions used to establish, maintain, and terminate sessions.

[0073] In practical implementation, based on the separated device communication record stream, a time-series graph is constructed with network nodes as vertices and communication relationships as edges, each edge having a timestamp attribute. Traversing this time-series graph, the system records connection establishment events, connection persistence events, and connection termination events triggered by specific network nodes at different times. These events are arranged in chronological order to form connection establishment event sequences, connection persistence event sequences, and connection termination event sequences, respectively. The connection establishment event sequence describes the active moments when nodes initiate connections, the connection persistence event sequence reflects the duration and stability of connection existence, and the connection termination event sequence records the connection closing behavior. The connection establishment event sequence, connection persistence event sequence, and connection termination event sequence together constitute the topological connection trajectory reflecting the dynamic evolution of the network structure.

[0074] In some embodiments, based on the separated control protocol signaling flow, the system reconstructs the complete lifecycle of a session and depicts its state transition path. The state transition path clearly shows all protocol state transitions experienced by a session from initial negotiation, authentication establishment, data exchange to final termination. Analyzing this state transition path allows for the extraction of the authentication credential sequence used by the user or process throughout the session, the sequence of interactive actions performed, and the sequence of state transitions triggered. The authentication credential sequence may contain information such as username, password hash, or token; the interactive action sequence records operations such as command execution, file upload and download; and the state transition sequence reflects the progression of the session phases. The combination of the authentication credential sequence, interactive action sequence, and state transition sequence constitutes a session fingerprint trajectory that uniquely represents the interaction patterns of the user or process.

[0075] In practical implementation, parallel to the trajectory extraction process described above, the system extracts application layer payload blocks containing actual transmitted data from the original real-time service stream. Processing of the application layer payload block begins with format recognition and semantic segmentation. The starting byte of the application layer payload block is read and matched against a predefined protocol identifier library. This library stores the identification features of various application layer protocols; a successful match determines the application layer protocol format followed by the application layer payload block. Based on the determined application layer protocol format, the corresponding syntax parsing template is invoked. This template defines the protocol's field structure and separation rules. The application layer payload block is then structured and parsed using this template, separating the protocol header field set and the payload data body.

[0076] In some embodiments, the payload data body undergoes primary segmentation based on content type. This primary segmentation divides continuously stored text, image encoded data, compressed data, or encrypted data blocks of the same type into independent content blocks based on the encoding characteristics or format markers of the data content. For each segmented content block, a semantic boundary detection method is applied to further identify its internal structure. This method identifies encoding unit boundaries based on character conversion patterns under specific encoding rules, word and sentence boundaries based on lexical unit boundary features in natural language processing, or instruction boundaries based on opcode patterns in binary instruction sequences. Based on all identified semantic boundary locations, the entire payload data body is finely segmented into multiple semantically relatively independent data content fragments. These data content fragments are arranged in the order they were segmented, forming a data content fragment sequence.

[0077] Understandably, after constructing the data content segment sequence, the system performs statistical measurements on it to generate payload segment trajectories. These measurements include calculating the size of each data content segment in the sequence, forming a payload size distribution sequence arranged chronologically; identifying the type of each data content segment, forming a payload type distribution sequence; and calculating the entropy value of each data content segment to measure its randomness or disorder, forming a payload entropy value distribution sequence. The calculation of the payload entropy value distribution sequence involves the information entropy formula:

[0078]

[0079] Where: symbol The information entropy of a data content fragment is represented by the symbol. This represents the total number of different symbols or byte values ​​that may appear in the data content segment. Indicates the first A symbol or byte value, symbol Symbols The probability of appearing in this data content segment. The load segment trajectory, which is ultimately composed of the load size distribution sequence, the load type distribution sequence, and the load entropy value distribution sequence, reflects the complexity and characteristics of data exchange.

[0080] Optionally, during the construction of topology connection trajectories and session fingerprint trajectories, the analysis of time-series change diagrams and state transition paths can be performed using an incremental update approach. Whenever new device communication record streams or control protocol signaling streams are injected, the system dynamically updates the corresponding trajectory sequence, ensuring that the trajectory information reflects the latest state of the network environment in real time. The extraction and processing of application layer payload blocks can be selectively performed on specific network nodes or for specific protocols according to pre-configured strategies, balancing processing overhead and analysis depth. It can be understood that topology connection trajectories, session fingerprint trajectories, and payload fragment trajectories together constitute a multi-layered, multi-perspective description of network activity. The extraction processes of these three trajectories are independent yet proceed in parallel, providing a structured input data foundation for subsequent threat intent mapping. The entire implementation process of this embodiment is based entirely on the automated parsing and calculation of network environment mirror data, without relying on predefined attack signatures.

[0081] In one embodiment of the present invention, see [reference] Figure 2 The implementation method is executed after obtaining the topology connection trajectory, session fingerprint trajectory, and payload fragment trajectory. Its core lies in establishing a multi-dimensional fusion analysis framework to draw an initial dynamic map of threat intent. Establishing a spatiotemporal coordinate system for fusing different types of trajectory data is the first step. The spatiotemporal coordinate system is a virtual mathematical construction that includes network topology dimension, time process dimension, and behavior intensity dimension. The network topology dimension is used to characterize the logical or physical location relationship of network nodes, the time process dimension is used to characterize the temporal sequence and duration of events, and the behavior intensity dimension is used to quantify the activity level or intensity value of user or process interaction behavior.

[0082] In practical implementation, the topology connection trajectory is mapped to the network topology dimension and time process dimension of the spatiotemporal coordinate system. The mapping process, based on the network node identifiers and event timestamps recorded in the topology connection trajectory, transforms each connection establishment, continuation, or termination event into a point or line segment in the spatiotemporal coordinate system. The projection and distribution of these points and line segments on the plane formed by the network topology dimension and the time process dimension collectively generate a spatiotemporal distribution cloud of the connection relationships between nodes. Similarly, the session fingerprint trajectory is mapped to the time process dimension and behavior intensity dimension of the spatiotemporal coordinate system. The mapping process, based on the interaction action sequence and state transition sequence in the session fingerprint trajectory, assigns an intensity value to each interaction calculated based on action type, frequency, or resource consumption, forming a surface on the plane formed by the time process dimension and the behavior intensity dimension, thus generating an intensity change surface of the user behavior pattern.

[0083] In some embodiments, the load fragment trajectory is mapped to the time process dimension of a spatiotemporal coordinate system. The mapping process calculates corresponding load characteristic parameters for each sampling time point based on the load entropy distribution sequence and load magnitude distribution sequence in the load fragment trajectory. The load characteristic parameters can be a composite index combining entropy and magnitude. The trajectories of these parameter values ​​changing over time form a cluster of fluctuation curves. Trajectory association mining rules are used to simultaneously analyze anomalous clustering and dispersing patterns of connectivity in the spatiotemporal distribution cloud, abrupt inflection points of behavioral patterns in the intensity change surface, and outlier fluctuation ranges of characteristic parameters in the cluster of fluctuation curves. The trajectory association mining rules are a set of predefined logical judgments and statistical algorithms used to identify patterns exceeding the normal baseline.

[0084] In practical implementation, abnormal aggregation and dispersion patterns may manifest as a large number of connection events concentrating on a few previously inactive network nodes within a short period of time in a spatiotemporal distribution cloud. Abrupt inflection points, in the intensity change surface, are characterized by unexpected step changes in behavioral intensity values ​​at consecutive time points. Outlier fluctuation intervals, in the fluctuation curve cluster, are characterized by load characteristic parameter values ​​consistently exceeding or falling below the normal range threshold obtained from historical data statistics. When the system, through trajectory association mining rule analysis, determines that an abnormal aggregation and dispersion pattern, an abrupt inflection point, and an outlier fluctuation interval intersect in the same spatiotemporal neighborhood in the spatiotemporal coordinate system, this spatiotemporal neighborhood is a multidimensional spatial region jointly defined by the network topology coordinate range, the time interval range, and the behavioral intensity value range.

[0085] Understandably, after determining that the intersection has occurred, the system will mark an attack behavior marker at the center of the spatiotemporal neighborhood where the abnormal aggregation and dispersion pattern, the mutation inflection point, and the outlier fluctuation interval intersect. This attack behavior marker is a data object containing spatiotemporal coordinate information, associated anomaly type, and confidence score. Integrating all attack behavior markers marked in the spatiotemporal coordinate system and their corresponding spatiotemporal neighborhoods, each attack behavior marker is associated with its spatiotemporal neighborhood, forming an initial dynamic threat intent map reflecting the distribution and association of potential threats in the spatiotemporal dimension. Optionally, the determination of outlier fluctuation intervals in the trajectory association mining rules can adopt a statistical distribution-based method. For example, calculating the mean and standard deviation of the load characteristic parameter sequence in the fluctuation curve cluster, and identifying the continuous time interval to which data points exceeding a certain number of standard deviations above and below the mean belong as outlier fluctuation intervals. Calculating the information entropy of the load characteristic parameter sequence can be used to quantify its volatility. The formula for calculating information entropy is:

[0086]

[0087] Where: symbol Represents the load characteristic parameter sequence Information entropy, symbol This represents the total number of different intervals that can occur after discretizing the load characteristic parameter values, with the symbol... Represents a sequence The parameter value falls into the first A range, symbol This indicates that the parameter value falls within the range. The frequency. Higher. The value may indicate a complex pattern of fluctuations in the sequence, helping to identify anomalies.

[0088] In some embodiments, the size of the spatiotemporal neighborhood can be configured using predefined parameters, such as setting a hop radius in the network topology dimension, a time window length in the time process dimension, and a range of intensity values ​​in the behavior intensity dimension. The confidence score of attack behavior markers can be calculated comprehensively based on the number of intersecting anomalous patterns, the degree of deviation of each anomalous pattern, and the historical rule hit accuracy. It can be understood that the initial threat intent dynamic map is a dynamically updated data model. As new trajectory data is continuously mapped and analyzed, new attack behavior markers may be added, and the existing spatiotemporal neighborhood may be merged or expanded. The drawing process relies entirely on the correlation analysis of the three types of trajectory data in multidimensional space, and does not rely on direct matching of known attack features.

[0089] In one embodiment of the present invention, see [reference] Figure 3 The implementation method is executed after generating the initial dynamic threat intent map. The purpose is to improve the accuracy of threat identification by suppressing resource environment noise. The CPU utilization curve, memory usage curve, and network interface bandwidth usage curve of key devices in the network infrastructure are periodically collected. The collection period can be configured according to the characteristics of network activities, such as at intervals of seconds or minutes. The collected resource utilization curves are aligned and integrated according to time to synthesize a resource usage baseline that can characterize the normal fluctuation of the network's own operating status in the time dimension.

[0090] In practical implementation, the spatiotemporal neighborhood corresponding to each attack behavior marker in the initial threat intent dynamic map is aligned and matched with the resource usage data of the resource occupancy baseline within the same time period. The alignment and matching process extracts CPU utilization curve segments, memory occupancy curve segments, and network interface bandwidth utilization curve segments within the exact same time interval from the resource occupancy baseline based on the time process dimension coordinates of the attack behavior marker in the spatiotemporal coordinate system. For each attack behavior marker in the initial threat intent dynamic map, the system sequentially performs environmental interference suppression operations, which include calculating the rate of change of network activity characteristics and performing correlation analysis with the resource change rate.

[0091] In some embodiments, the rate of change of network activity characteristics within the spatiotemporal neighborhood corresponding to the attack behavior marker is calculated. This process requires obtaining the time-series values ​​of connection establishment rate of all network nodes on the topology connection trajectory, the time-series values ​​of interaction frequency of all users on the session fingerprint trajectory, and the time-series values ​​of entropy change of all data exchanges on the payload segment trajectory. Time series differentiation operations are then performed on the connection establishment rate time-series values, interaction frequency time-series values, and entropy change time-series values, respectively. The time series differentiation operation calculates the difference between values ​​at adjacent time points to obtain the connection establishment acceleration sequence, interaction acceleration sequence, and entropy change gradient sequence.

[0092] It can be understood that the average absolute values ​​of the connection establishment acceleration sequence, the average absolute values ​​of the interaction acceleration sequence, and the average absolute values ​​of the entropy change gradient sequence are calculated within the spatiotemporal neighborhood time span, respectively. These average values ​​are denoted as follows: , and .because , and Because they have different physical dimensions, they need to be converted into dimensionless relative values ​​for comprehensive calculations. , and The standard deviations for their respective historical baseline periods are denoted as follows: , and ,Will , and Divide each of these values ​​by their corresponding historical baseline standard deviation to obtain the normalized relative values. , and The formula is , , The normalized relative values ​​of the acceleration sequence establishing the connection, the normalized relative values ​​of the acceleration sequence of interactive actions, and the normalized relative values ​​of the gradient sequence of entropy changes are weighted and summed. The weight coefficients used for the weighted summation can be preset based on experience or obtained through training. The result is used as the rate of change of network activity features characterizing the intensity of overall network activity fluctuations in the spatiotemporal neighborhood. Rate of change of network activity characteristics Calculated using the following formula:

[0093]

[0094] Where: symbol The rate of change of network activity characteristics, symbol , , These represent the weight coefficients for connection establishment acceleration, interaction acceleration, and entropy change gradient, respectively, and their sum is 1. (Symbols are missing from the original text.) This represents the relative value of the average absolute value of the established acceleration sequence after normalization to the historical baseline standard deviation, with the symbol [symbol missing]. This represents the relative value of the average absolute value of the interaction acceleration sequence after normalization to the historical baseline standard deviation, with the sign... It represents the relative value of the average absolute value of the entropy change gradient sequence after normalization to the standard deviation of the historical baseline.

[0095] In practice, the rate of change of CPU utilization curve, memory utilization curve, and network interface bandwidth utilization curve within the same time period are extracted from the resource utilization baseline. The rate of change of the resource curve can be obtained by calculating the average of the curve slope or the average of the absolute values ​​of the sequence differences within that time period, and then normalized to its historical baseline standard deviation to convert it into a dimensionless relative rate of change. The rate of change of network activity characteristics is then compared with the normalized relative rates of change of CPU utilization curve, memory utilization curve, and network interface bandwidth utilization curve to perform correlation analysis. The correlation analysis can be calculated using Pearson correlation coefficient or Spearman rank correlation coefficient to quantify the degree of linear correlation.

[0096] Optionally, if calculations show that the rate of change of network activity characteristics exhibits a positive correlation exceeding a predetermined threshold with the normalized relative rate of change of the CPU utilization curve, or the normalized relative rate of change of the memory occupancy curve, or the normalized relative rate of change of the network interface bandwidth utilization curve, such that the predetermined threshold is set to 0.7, then it is determined that the abnormal network activity pattern represented by the attack behavior marker has been significantly interfered with by fluctuations in the corresponding resource environment. This interference may originate from legitimate business peaks or system maintenance tasks. The system will remove the attack behavior markers that have been significantly interfered with from the initial threat intent dynamic map. The removal operation means removing the attack behavior marker and its associated spatiotemporal neighborhood data.

[0097] In some embodiments, the remaining attack behavior markers and their spatiotemporal neighborhoods in the initial threat intent dynamic map after the removal operation are recombined. These remaining attack behavior markers are considered to be indicators of potential threats less affected by resource and environmental noise. These remaining attack behavior markers and their spatiotemporal neighborhoods constitute a threat intent dynamic map that has eliminated resource and environmental noise. It can be understood that the introduction of a resource occupancy baseline, the execution of environmental interference suppression operations, and the comprehensive calculation ensuring dimensional consistency through normalization processing make the threat intent dynamic map focus more on revealing malicious attack intentions rather than superficial anomalies caused by normal network load fluctuations, thereby reducing the possibility of false alarms.

[0098] In one embodiment of the present invention, execution occurs after obtaining a dynamic threat intent map with resource and environmental noise eliminated. The core of this process is to transform the abstract markers in the map into actionable defense strategies. The dynamic threat intent map with resource and environmental noise eliminated is analyzed to identify threat clusters composed of all attack behavior markers in the map, as well as the associated paths between these clusters. A threat cluster is a set of attack behavior markers that are spatially adjacent and have similar behavioral characteristics in a spatiotemporal coordinate system. The associated paths are dashed lines or vectors connecting different threat clusters, reflecting the lateral movement or phased evolution of potential attacks. In a specific implementation, for each identified threat cluster, the system performs parallel analysis of three key attributes: the spatiotemporal distribution density of attack behavior markers within the threat cluster, the set of attack behavior types represented by the attack behavior markers, and the logical distance between the threat cluster and critical network asset areas. The volume occupied by the threat cluster in the spatiotemporal coordinate system is calculated. The volume is estimated by multiplying the difference between the extreme values ​​of the coordinates of the threat cluster in all dimensions (network topology dimension, time process dimension, and behavior intensity dimension). The total number of attack behavior markers contained in the volume is counted. The total number of attack behavior markers is divided by the volume to obtain the spatiotemporal distribution density that characterizes the degree of concentration of threat activity space.

[0099] In some embodiments, the trajectory association mining rules associated with each attack behavior marker point within a threat cluster are extracted at the time of generation. Each trajectory association mining rule is pre-mapped to one or more classification labels describing attack techniques and tactics. The classification labels associated with all attack behavior marker points within the threat cluster are deduplicated and summarized to form a set of attack behavior types describing the range of attack methods covered by the threat cluster. On the network topology dimension of the spatiotemporal coordinate system, the coordinates of the geometric center point of the threat cluster are located. The coordinates of the geometric center point are determined by the arithmetic mean of the coordinates of all attack behavior marker points within the cluster in the network topology dimension. The coordinate range corresponding to a predefined network critical asset area is also located. The nearest Euclidean distance from the geometric center point coordinates to the boundary of the network critical asset area coordinate range is calculated, and this nearest Euclidean distance is used as the logical distance reflecting the degree of proximity of the threat to the critical target. The calculation can be expressed as:

[0100]

[0101] Where: symbol Represents logical distance, symbol and The coordinates of the geometric center of the threat cluster on the two-dimensional plane of the network topology are represented by the symbol. and Indicates the first The coordinates of a point located on the boundary of the coordinate range of a network critical asset area, function This indicates that the minimum value is taken after traversing all boundary points. It can be understood that, based on the calculated spatiotemporal distribution density, the system determines the urgency level of the defense response by querying a pre-defined mapping table; for example, high density corresponds to a high urgency level. Based on the set of attack behavior types, the system determines the specific type of defense capability to be invoked by matching it against a defense capability knowledge base; for example, enabling anti-scanning rules of the intrusion prevention system for scanning behavior, and enabling account locking policies for brute-force attacks. Based on logical distance, the deployment scope and strength of defense measures are determined through a predefined strategy model; the closer the logical distance, the more focused the deployment scope is on the vicinity of critical assets, and the higher the defense strength.

[0102] In practical implementation, for each identified associated path, the system analyzes the starting and ending threat clusters. The starting threat cluster is the source of the path, and the ending threat cluster is the direction the path leads. By comparing the attack behavior types and time sequence of the two threat clusters, the possible evolution path direction of the attack is inferred. Combining the urgency level of the defense response, the type of defense capabilities to be invoked, the deployment scope and strength of defense measures obtained from the analysis of each threat cluster, and the inferred possible evolution path direction of the attack for each path, the system generates specific action sequences and configuration parameters for each threat cluster and each associated path. The action sequence is a series of ordered defense operation instructions, and the configuration parameters specify the detailed settings of these operations, ultimately forming a structured defense handling guide. Refer to Table 1; the structured output of the defense handling guide can be seen in the following threat cluster analysis results table.

[0103] Table 1: Threat Cluster Analysis Results

[0104] Threat Cluster Identifier Spatiotemporal distribution density (number of points / unit volume) Set of attack behavior types Logical distance (units) Urgency level Recommended defensive capabilities Deployment in key areas TC-101 8.7 Port scanning, service detection 12.5 middle Network layer access control lists, intrusion detection system scanning suppression Subnet A boundary TC-102 15.2 {Brute-force attack, abnormal login} 3.1 high Enhanced multi-factor authentication, monitoring and locking of abnormal account logins Core server area boundary TC-103 4.1 {Data transmission via high-entropy encrypted communication} 8.9 middle Data loss prevention strategies, external connection channel monitoring and auditing Database server area

[0105] Optionally, the aggregation of attack behavior types can be done using tag clouds or weight vectors to reflect the frequency of different attack types within a threat cluster. Logical distance calculation can incorporate hop count as a supplementary metric, rather than solely relying on geometric Euclidean distance. When generating a sequence of actions, the system can invoke predefined defense scripts, which automatically combine and instantiate specific command-line, configuration script, or application programming interface (API) call parameters based on the input threat attributes.

[0106] In some embodiments, the inference of associated paths can be based on the timestamp order of attack behavior markers and connectivity in the network topology dimension. If the markers in two threat clusters have a temporal order and their network nodes have reachable paths in the network topology graph, then an associated path can be established between them. The structured defense response guidelines can ultimately be output in a machine-readable format, such as JSON or XML, or converted into an instruction set that can be directly used by a ticketing system to create tasks, thereby driving the automated security operations platform to execute responses. It can be understood that the implementation process of this embodiment achieves automated derivation from threat graphs to specific defense actions, directly converting analysis results into executable security operation instructions, shortening the cycle from threat detection to response and handling.

[0107] See Figure 4 This is a bar chart comparing the spatiotemporal distribution density of threat clusters. It visually displays the spatiotemporal distribution density of five different threat clusters, reflecting the spatial concentration of attack behavior markers within each cluster. In network security monitoring and analysis, this chart can directly support subsequent defense decisions. The high density of TC-102 and TC-105 corresponds to a high urgency level and requires priority handling. Highly active threat clusters (such as TC-102) should be allocated more defense resources and have more stringent protection measures deployed. Comparing density changes at different points in time can assess the effectiveness of defense measures or discover new attack evolution directions. It transforms abstract threat activities into quantifiable density indicators, helping security teams quickly identify high-priority threats. Through bars of different colors and heights, it visually displays the current threat distribution pattern in the network.

[0108] In one embodiment of the present invention, a closed-loop optimization mechanism is established within the entire network security monitoring and analysis method framework. This mechanism is a feedback loop for the execution effect of defense and response guidance, which optimizes the dynamic graph drawing process of threat intent. After applying the defense and response guidance generated based on the dynamic graph of threat intent with resource and environmental noise eliminated, the system reactivates the distributed monitoring agents deployed at each level of the network infrastructure. This recaptures subsequent service flows and metadata flows of the network infrastructure, covering a configurable observation period after the execution of the defense and response guidance. The recaptured subsequent service flows and metadata flows are then aggregated to generate subsequent network environment mirror data.

[0109] In specific implementation, the subsequent network environment mirror data undergoes the same progressive association and deconstruction process as in the previous embodiment. This process separates the subsequent device communication record stream and the subsequent control protocol signaling stream from the subsequent network environment mirror data, and extracts the subsequent application layer payload block from the subsequent real-time service stream. Based on the subsequent device communication record stream, a subsequent time-series change graph is constructed, and the subsequent connection establishment event sequence, subsequent connection persistence event sequence, and subsequent connection termination event sequence are extracted, combining them to form the subsequent topology connection trajectory. Based on the subsequent control protocol signaling stream, a subsequent state transition path is constructed, and the subsequent authentication credential sequence, subsequent interaction action sequence, and subsequent state jump sequence are extracted, combining them to form the subsequent session fingerprint trajectory. The subsequent application layer payload block is subjected to format recognition, semantic segmentation, and statistical measurement to form a subsequent data content fragment sequence, thereby obtaining the subsequent payload size distribution sequence, subsequent payload type distribution sequence, and subsequent payload entropy value distribution sequence, which are combined to form the subsequent payload fragment trajectory.

[0110] In some embodiments, the system performs comparison operations, comparing the deviation of subsequent topology connection trajectories from historical topology connection trajectories, comparing the deviation of subsequent session fingerprint trajectories from historical session fingerprint trajectories, and comparing the deviation of subsequent payload fragment trajectories from historical payload fragment trajectories. Historical topology connection trajectories, historical session fingerprint trajectories, and historical payload fragment trajectories refer to the trajectory data used to draw the dynamic threat intent map, which has eliminated resource environment noise, before generating the current defense response guidance. Deviation is a quantified scalar value used to measure the degree of difference between two trajectories within the same time interval or the same network node range.

[0111] It is understandable that deviation calculation can be performed on the feature sequence of each trajectory, such as calculating the difference between the connection establishment rate sequence in subsequent topological connection trajectories and the corresponding sequence in historical topological connection trajectories. A specific deviation... The calculation formula is as follows:

[0112]

[0113] Where: symbol This represents the deviation calculated for a specific trajectory (such as a topological connection trajectory), with the symbol... Represents the total number of sequence data points within the comparison time window, with the sign... Indicates the subsequent trajectory at the th The characteristic parameter values ​​(such as connection establishment rate) of each sampling point, symbol Indicates the historical trajectory at the 1st The system needs to calculate the deviation of each of the three trajectories, based on the corresponding feature parameter values ​​for each sampling point. , and .

[0114] In practice, the system compares the calculated deviation of each trajectory with a predetermined threshold. This threshold is set independently to define whether the trajectory behavior has returned to the expected or historical baseline. If the deviation is below the predetermined threshold, it indicates that after implementing the defense and response guidance, the corresponding type of network activity trajectory has tended towards the historical normal pattern, and the system increases the confidence level of the trajectory association mining rules used to generate this defense and response guidance by one level. If the deviation is above the predetermined threshold, it indicates that the network activity trajectory has not changed as expected or the deviation has worsened, and the system decreases the confidence level of the trajectory association mining rules used to generate this defense and response guidance by one level.

[0115] Optionally, the confidence level can be a discrete integer level or a continuous confidence score. Increasing or decreasing the confidence level by one level involves a fixed addition or subtraction operation on the score. The initial confidence value of the trajectory association mining rule can be set to an intermediate level and continuously updated with multiple feedback loops. In the subsequent dynamic mapping of threat intent, specifically when using the trajectory association mining rule to analyze the spatiotemporal distribution cloud, intensity change surface, and fluctuation curve cluster to determine whether to mark attack behavior points, the system adjusts the decision weight of the trajectory association mining rule when marking attack behavior points based on the updated confidence level of the trajectory association mining rule.

[0116] In some embodiments, the adjustment of decision weights can manifest as follows: trajectory association mining rules with higher confidence can have more lenient judgment thresholds when judging abnormal clustering patterns, abrupt inflection points, or outlier fluctuation ranges; or their conclusions can be given higher weight when comprehensively judging the intersection of multiple rules. Conversely, trajectory association mining rules with lower confidence may have their judgment thresholds tightened or their conclusion weights reduced. The execution effect feedback loop enables the threat intent dynamic map drawing process to have adaptive capabilities, dynamically adjusting the sensitivity and accuracy of threat detection strategies based on the actual effects of defensive measures. It can be understood that the implementation of the embodiments extends a one-time defensive action into a continuous learning and optimization cycle, refining the core judgment rules on which the threat intent dynamic map drawing process relies through practical feedback.

[0117] See Figure 5 This is a bar chart comparing the confidence levels of trajectory association mining rules. It visually demonstrates the changes in the confidence levels of eight threat detection rules in their initial state and after response feedback, reflecting the self-optimization capability of the network security monitoring system. Through dynamic updates to confidence levels, security teams can automatically eliminate invalid rules (such as rule 2) and strengthen effective rules (such as rule 5), continuously improving the accuracy of threat detection. This chart is the core embodiment of the closed loop of "threat detection → response → effect feedback → rule optimization," enabling the security system to have the ability to self-evolve. Rules with high confidence levels (such as rule 5 and rule 3) can be used as core detection logic, while rules with low confidence levels (such as rule 2) require reduced resource investment to optimize security operation efficiency.

[0118] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A network security monitoring and analysis method, characterized in that, The method includes: Distributed listening agents are deployed at different levels of the network infrastructure. These agents capture real-time service flows and metadata flows passing through their respective nodes and aggregate the captured real-time service flows and metadata flows into network environment mirror data. The network environment mirror data is deconstructed layer by layer to extract the topology connection trajectory reflecting the network structure characteristics, the session fingerprint trajectory reflecting the user interaction pattern, and the load segment trajectory reflecting the data exchange characteristics. Based on the topology connection trajectory, the session fingerprint trajectory, and the payload fragment trajectory, a dynamic threat intent graph is drawn to generate an initial dynamic threat intent graph containing potential attack behavior markers. By introducing a resource occupancy baseline that characterizes the network's own operating state, environmental interference suppression is applied to the attack behavior markers in the initial threat intent dynamic map, resulting in a threat intent dynamic map that eliminates resource and environmental noise. Based on the dynamic map of threat intent that has eliminated resource and environmental noise, targeted defense and response guidelines are automatically derived and formed.

2. The network security monitoring and analysis method according to claim 1, characterized in that, The step-by-step deconstruction of the network environment mirror data to extract topological connection trajectories reflecting network structural characteristics, session fingerprint trajectories reflecting user interaction patterns, and payload segment trajectories reflecting data exchange characteristics includes: The device communication record stream and control protocol signaling stream are separated from the network environment mirror data; Based on the device communication record stream, a time-series change graph of the interaction relationship between network nodes is constructed; the time-series change graph is traversed to record the connection establishment event sequence, connection persistence event sequence, and connection termination event sequence generated by a specific network node at different time points, and the connection establishment event sequence, the connection persistence event sequence, and the connection termination event sequence are combined to form the topology connection trajectory; Based on the control protocol signaling flow, construct the state transition path within the session lifecycle; Analyze the state transition path and extract the authentication credential sequence, interaction action sequence and state transition sequence generated by the user or process during the session. The session fingerprint trajectory is formed by combining the authentication credential sequence, the interaction action sequence and the state transition sequence. Simultaneously, an application layer payload block containing valid data units is extracted from the real-time service stream; The application layer payload block is subjected to format recognition and semantic segmentation to form a sequence of data content fragments; The data content segment sequence is statistically measured to obtain the load size distribution sequence, the load type distribution sequence, and the load entropy value distribution sequence. The load segment trajectory is formed by combining the load size distribution sequence, the load type distribution sequence, and the load entropy value distribution sequence.

3. The network security monitoring and analysis method according to claim 2, characterized in that, The step of dynamically mapping threat intent based on the topology connection trajectory, the session fingerprint trajectory, and the payload fragment trajectory, generating an initial dynamic threat intent map containing markers of potential attack behaviors, includes: A spatiotemporal coordinate system is established for fusing different types of trajectory data. The spatiotemporal coordinate system includes a network topology dimension, a time process dimension, and a behavior intensity dimension. The network topology dimension and time process dimension of the topological connection trajectory are mapped to the spatiotemporal coordinate system to generate a spatiotemporal distribution cloud of the connection relationship between nodes; The session fingerprint trajectory is mapped to the time process dimension and behavior intensity dimension of the spatiotemporal coordinate system to generate an intensity change surface of the user behavior pattern; The trajectory of the load segment is mapped to the time process dimension of the spatiotemporal coordinate system to generate a cluster of fluctuation curves for load characteristic parameters; Using trajectory association mining rules, we simultaneously analyze the abnormal clustering and dispersing patterns of connectivity in the spatiotemporal distribution cloud, the abrupt inflection points of behavioral patterns in the intensity change surface, and the outlier fluctuation ranges of characteristic parameters in the fluctuation curve cluster. When the abnormal aggregation and dispersion pattern, the mutation inflection point, and the outlier fluctuation interval intersect in the same spatiotemporal neighborhood in the spatiotemporal coordinate system, an attack behavior marker point is marked at the center of the spatiotemporal neighborhood where the abnormal aggregation and dispersion pattern, the mutation inflection point, and the outlier fluctuation interval intersect. All attack behavior markers and their corresponding spatiotemporal neighborhoods, marked in the spatiotemporal coordinate system, are integrated to form the initial dynamic threat intent map.

4. The network security monitoring and analysis method according to claim 3, characterized in that, The introduction of a resource occupancy baseline characterizing the network's own operational status, followed by environmental interference suppression of attack behavior markers in the initial threat intent dynamic map, yields a threat intent dynamic map free from resource and environmental noise. This includes: Periodically collect the CPU utilization curve, memory usage curve, and network interface bandwidth usage curve of key devices in the network infrastructure to synthesize the resource usage baseline; align and match the spatiotemporal neighborhood corresponding to each attack behavior marker in the initial threat intent dynamic map with the resource usage data of the resource usage baseline in the same time period. For each attack behavior marker, the following environmental interference suppression operations are performed: The rate of change of network activity characteristics within the spatiotemporal neighborhood corresponding to the attack behavior marker is calculated; simultaneously, the rates of change of the CPU utilization curve, the memory utilization curve, and the network interface bandwidth utilization curve within the same time period are extracted from the resource usage baseline; and the rates of change of the network activity characteristics are compared with the rates of change of the CPU utilization curve, the memory utilization curve, and the network interface bandwidth utilization curve, respectively, through correlation analysis. If the rate of change of the network activity characteristics shows a positive correlation with the rate of change of any resource curve exceeding a predetermined threshold, it is determined that the attack behavior marker has been significantly disturbed by the corresponding resource environment fluctuation, and the attack behavior marker is removed from the initial threat intent dynamic map. After the removal operation, the remaining attack behavior markers and their spatiotemporal neighborhoods in the initial threat intent dynamic map are recombined into the threat intent dynamic map that has eliminated resource and environmental noise.

5. The network security monitoring and analysis method according to claim 4, characterized in that, The automatic derivation and formation of targeted defense and response guidelines based on the dynamic threat intent map that has eliminated resource and environmental noise includes: The dynamic threat intent map, which eliminates resource and environmental noise, is analyzed to identify threat clusters formed by all attack behavior markers in the map, as well as the associated paths between threat clusters. For each identified threat cluster, the spatiotemporal distribution density of attack behavior markers within the threat cluster, the set of attack behavior types represented by the attack behavior markers, and the logical distance between the threat cluster and the network critical asset area are analyzed. Based on the spatiotemporal distribution density, determine the urgency level of the defense response; based on the set of attack behavior types, determine the types of defense capabilities that need to be invoked; based on the logical distance, determine the deployment scope and intensity of the defense measures. For each identified associated path, the starting and ending threat clusters of the associated path are analyzed to infer the possible path direction of the attack evolution; By taking into account the urgency level of the defense response, the type of defense capabilities to be invoked, the deployment scope and intensity of the defense measures, and the possible evolution path of the attack, specific action sequences and configuration parameters are generated for each threat cluster and each associated path, forming a structured defense response guide.

6. The network security monitoring and analysis method according to claim 5, characterized in that, The analysis of the spatiotemporal distribution density of attack behavior markers within the threat cluster, the set of attack behavior types represented by the attack behavior markers, and the logical distance between the threat cluster and network critical asset areas includes: Calculate the volume occupied by the threat cluster in the spatiotemporal coordinate system, and count the total number of attack behavior markers contained in the volume; divide the total number of attack behavior markers by the volume to obtain the spatiotemporal distribution density; Extract the trajectory association mining rules associated with each attack behavior marker point within the threat cluster when it is generated, and deduplicate and summarize the attack behavior classification labels mapped by the trajectory association mining rules to form the attack behavior type set. On the network topology dimension of the spatiotemporal coordinate system, locate the coordinates of the geometric center point of the threat cluster and locate the coordinate range corresponding to the predefined network critical asset region; calculate the nearest Euclidean distance from the coordinates of the geometric center point to the boundary of the coordinate range of the network critical asset region, and use the nearest Euclidean distance as the logical distance.

7. The network security monitoring and analysis method according to claim 2, characterized in that, The process of format recognition and semantic segmentation of the application layer payload block to form a sequence of data content fragments includes: Read the start byte of the application layer payload block, match it with a predefined protocol identifier library, and determine the application layer protocol format followed by the application layer payload block; Based on the determined application layer protocol format, the corresponding syntax parsing template is invoked to perform structured parsing on the application layer payload block, separating the protocol header field set and the payload data body; The payload data body is subjected to primary segmentation based on content type, and continuous data content of the same type is divided into a content block to obtain multiple content blocks; For each content block, a semantic boundary detection method is applied. The semantic boundary detection method identifies the potential semantic boundary positions inside the content block based on the character conversion pattern under a specific encoding rule, or based on the lexical unit boundary features in natural language processing, or based on the opcode rules of binary instruction sequences. Based on all identified semantic boundary locations, the payload data body is segmented into multiple semantically independent data content fragments, which are then arranged in the order of segmentation to form a sequence of data content fragments.

8. The network security monitoring and analysis method according to claim 4, characterized in that, The calculation of the rate of change of network activity characteristics within the spatiotemporal neighborhood corresponding to the attack behavior marker includes: Obtain the time-series values ​​of connection establishment rate of all network nodes on the topology connection trajectory, the time-series values ​​of interaction frequency of all users on the session fingerprint trajectory, and the time-series values ​​of entropy change of all data exchanges on the payload segment trajectory within the spatiotemporal neighborhood corresponding to the attack behavior marker point. Time series differentiation operations are performed on the connection establishment rate time series value, the interaction action frequency time series value, and the entropy change time series value to obtain the connection establishment acceleration sequence, the interaction action acceleration sequence, and the entropy change gradient sequence. Calculate the average absolute value of the connection establishment acceleration sequence, the average absolute value of the interaction action acceleration sequence, and the average absolute value of the entropy change gradient sequence within the time span of the spatiotemporal neighborhood, respectively. The average value of the connection establishment acceleration sequence, the average value of the interaction action acceleration sequence, and the average value of the entropy change gradient sequence are weighted and summed, and the result is used as the rate of change of the network activity feature.

9. The network security monitoring and analysis method according to claim 1, characterized in that, Also includes: Establish an execution effect feedback loop for the defense response guidance, which is used to optimize the dynamic mapping process of the threat intent; Specifically, after applying the aforementioned defense handling guidelines, the subsequent service flows and metadata flows of the network infrastructure are recaptured to generate subsequent network environment mirror data; The subsequent network environment mirror data is subjected to the progressive association deconstruction to extract the subsequent topology connection trajectory, subsequent session fingerprint trajectory, and subsequent payload fragment trajectory. Compare the deviation of the subsequent topology connection trajectory from the historical topology connection trajectory, compare the deviation of the subsequent session fingerprint trajectory from the historical session fingerprint trajectory, and compare the deviation of the subsequent payload fragment trajectory from the historical payload fragment trajectory; If the deviation is lower than a predetermined threshold, the confidence level of the trajectory association mining rule used to generate the defense response guidance will be increased by one level; if the deviation is higher than the predetermined threshold, the confidence level of the trajectory association mining rule used to generate the defense response guidance will be decreased by one level. In the subsequent dynamic mapping of the threat intent, the decision weight of the trajectory association mining rule when marking attack behavior markers is adjusted based on the confidence level of the updated trajectory association mining rule.

10. A network security monitoring and analysis system, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the network security monitoring and analysis method as described in any one of claims 1 to 9.

Images