Multi-task dynamic collaborative advanced persistent threat detection method and device

Abstract

The invention discloses a multi-task dynamic collaborative advanced persistent threat detection method, and relates to the technical field of network security. The method comprises the following steps: firstly, cleaning security texts such as security logs and threat intelligence, and creating a domain dictionary for standardized mapping; then, a RoBERTa-based multi-task learning framework is constructed, three task heads of maliciousness analysis, tactical-association extraction and threat index detection are deployed in parallel on the basis of a shared encoder, and attack intention, attack elements and threat index high-order feature vectors are extracted respectively; and finally, the core is to introduce a bidirectional dynamic cooperation module, the module realizes vector splicing and weighting of high-order feature vectors in the three tasks through a gating fusion mechanism, generates a joint feature vector fused with multi-party semantic information, feeds back the joint feature vector to each task head, realizes information cooperation and decision mutual identification among the tasks, and finally outputs a threat report. According to the method, hidden threat information can be deeply identified, and the detection accuracy of complex attacks such as advanced persistent threats and the like is remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to an advanced persistent threat detection method and apparatus with multi-task dynamic collaboration. Background Technology

[0002] With the rapid development of the internet and digitalization, cybersecurity attacks are becoming increasingly sophisticated, covert, and persistent. In particular, complex attack patterns such as advanced persistent threats (APTs) pose a serious threat to existing cybersecurity defenses. Against this backdrop, leveraging new technologies such as artificial intelligence to build a new cybersecurity defense system has become a crucial task in the field of cybersecurity.

[0003] Currently, feature matching and rule definition detection methods serve as fundamental technologies for network security defense, playing a crucial role in addressing known basic threats. These methods, through pre-defined attack signature databases and security rules, can quickly identify attack behaviors that match the signatures, offering advantages such as low deployment costs and relatively controllable false positive rates. Meanwhile, some research has also introduced technologies such as deep learning to effectively identify unknown threats and mutated attacks, significantly improving the accuracy and real-time performance of threat detection.

[0004] However, existing technical solutions still have significant shortcomings when facing advanced persistent threats, mainly in the following two aspects: First, traditional static detection methods based on feature matching and rule definition, while efficient in identifying known threats, suffer from rigid detection logic and lagging updates, making them ill-equipped to handle complex strategies common in advanced persistent threats, such as multi-stage penetration, covert communication channels, social engineering, and long-term lurking and lateral movement. These methods cannot dynamically depict the contextual relationships and deep semantics of attack behavior, exhibiting significant shortcomings in dealing with complex and covert attacks, resulting in severely insufficient detection capabilities.

[0005] Second, current intelligent detection solutions based on deep learning, especially those incorporating large language models, while improving automation and accuracy, are generally limited to single-dimensional tasks, such as malicious intent assessment, entity extraction, or indicator recognition. Even research employing multi-task learning frameworks often only reaches the level of simple parameter sharing or task parallelism, lacking deep, dynamic information interaction and collaborative mechanisms between tasks. This task isolation leads to information silos in each detection stage, making it impossible to comprehensively assess complex threats through contextual information enhancement and cross-verification of decision results. Consequently, it is difficult to achieve deep perception and accurate identification of advanced persistent threats, thus limiting overall detection efficiency.

[0006] In summary, existing technologies urgently need a detection method that can deeply integrate multi-dimensional threat information and achieve dynamic collaboration and mutual verification between tasks in order to effectively address the increasingly severe challenges of advanced persistent threats.

[0007] The information disclosed in this background section is intended only to enhance the understanding of the overall background of the invention and should not be construed as an admission or in any way implying that the information constitutes prior art known to those skilled in the art. Summary of the Invention

[0008] To address the aforementioned technical problems, embodiments of the present invention provide an advanced persistent threat detection method with multi-task dynamic collaboration, thereby resolving the issues raised in the background section.

[0009] This invention provides the following technical solution: an advanced persistent threat detection method with multi-task dynamic collaboration, comprising the following steps: Step 1: Analyze the network security text dataset D raw Data cleaning and deduplication are performed based on dictionary W. domain Complete the standardization mapping of threat terms and generate dataset D. std As the entire input; Step 2: Construct a multi-task learning framework based on RoBERTa. This framework deploys three task heads in parallel on top of a shared encoder: maliciousness analysis, tactical-association extraction, and threat indicator detection. While performing deep semantic encoding on the text, it generates a set of high-order feature vectors V for subsequent collaboration. high ; Step 3: Extract the high-order feature vectors V from the three tasks. high By using a gating fusion mechanism to perform vector concatenation and weighting, a joint feature vector set V that integrates semantic information from multiple sources is generated. join ; Step 4: The joint feature vector containing semantic information from multiple parties is dynamically fed back to each task head. The task heads then fuse the joint feature vector to achieve information collaboration and mutual verification of decisions among the tasks, and finally output a threat report.

[0010] In this embodiment, the specific method of step 1 is as follows: Step 1.1: Define T raw For a single piece of cybersecurity text to be processed, it satisfies relation T raw ={id,Content}, where id is the unique identifier of the text and Content is the security text obtained from security logs, threat intelligence, etc.; Step 1.2: Define D raw Given a text dataset in the cybersecurity domain to be processed, satisfying relation D raw ={T raw1,T raw2 ,…,T rawa ,…,T rawL(Draw)}, where T rawa Let L(D) be the a-th text to be processed in the dataset. raw ) represents the length of the dataset, and variable a∈[1,L(D) raw )]; Step 1.3: For D raw Data cleaning is performed, including removing null values, filtering out garbled characters and other irrelevant characters, and deduplicating sentences, resulting in the cleaned dataset D. clean ={T clean1 ,T clean2 ,…,T cleana1 ,…,T cleanL(Dclean)}, where T cleana1 For the a1-th cleaned text in the dataset, L(D) clean ) represents the length of the dataset, and variable a1∈[1,L(D) clean )]; Step 1.4: Construct a professional dictionary for the cybersecurity field, W, by integrating standard terminology and its variations from publicly available threat intelligence databases. domain This establishes a mapping relationship between terms and standard names, i.e., W domain ={term i →standard_term i}, where i represents the i-th mapping relationship; Step 1.5: For each text T cleana1 Iterate through the terms it contains, based on dictionary W. domain For dataset D clean Perform standardized mapping of threat terms to obtain the standardized dataset D. std ={T std1 ,T std2 ,…,T stda2 ,…,T stdL(Dstd)}, where T stda2 For the a2th text in the standardized dataset, L(D std )=L(D clean ), variable a2∈[1,L(D std )).

[0011] In this embodiment, the specific method of step 2 is as follows: Step 2.1: Construct the multi-task learning framework RoBERTa, and use the dataset D std As input to the entire model; Step 2.2: Load the RoBERTa model for word segmentation and generate word embedding vector sequence E1; Step 2.3: Generate the location embedding vector E2 based on the location information of the dataset; Step 2.4: Add the two vectors to obtain the final input E of the embedding layer, E = E1 + E2; Step 2.5: Define a loop variable i and initialize it to 1. If i ≤ len(D std If the condition is met, proceed to step 2.6; otherwise, proceed to step 2.20. Step 2.6: Obtain the final input vector E of the i-th text in the embedding layer. i ; Step 2.7: Define the Transformer layer index j, initialize it to 1, and set the total number of model layers L=12; Step 2.8: If the layer index j ≤ L, then execute step 2.9; otherwise, jump to step 2.12. Step 2.9: Extract and transform features using the Transformer of the j-th layer. After self-attention calculation, feedforward neural network, residual connection, and layer normalization, output the hidden state H of this layer. j ; Step 2.10: Update layer index j, j = j + 1; Step 2.11: Return to Step 2.8 and proceed to the next level of calculation; Step 2.12: End the loop and take the output vector h of the last Transformer at the [CLS] marker. i As the global feature vector, the output H of the entire sequence i As a sequence feature vector; Step 2.13: Construct a malicious analysis task, and use the global vector h i The input is given to the malicious analysis task header, which is a classifier with two fully connected layers, calculated using the following formula: Where W1 and b1 are the weights and biases of the first fully connected layer, W2 and b2 are the weights and biases of the second fully connected layer, and GELU is the activation function. Let be the probability distribution of the maliciousness category of the i-th text; Step 2.14: Construct a tactical-association extraction task, extracting the sequence feature vector H i The input is fed into the tactical-association extraction task header. This task uses the BiLSTM-CRF model to extract attack entities. The vector is calculated using the BiLSTM formula. ,in This represents the hidden state of the forward LSTM. Represents the hidden state of the inverse LSTM. This represents the concatenated bidirectional feature matrix. Input the CRF layer to identify entities such as attack tools and target assets, and output the entity relation set R of the i-th text. i ; Step 2.15: Construct a threat indicator detection task, and use the global vector h i The input is fed into the threat indicator detection task header, which is a multi-label classifier. The calculation formula is as follows: Where W and b are the weights and biases of the fully connected layer. It is the Sigmoid activation function. Let be the probability of the threat indicator corresponding to the i-th text; Step 2.16: Extract high-order feature vectors from before the GELU activation function in the malicious analysis task header. ; Step 2.17: After extracting the task header BiLSTM output layer from the tactical-associative model, ... Perform mean pooling to extract higher-order vectors. ; Step 2.18: Extract high-order feature vectors from before the Sigmoid activation function in the threat indicator detection task header. ; Step 2.19: Store the three higher-order feature vectors of the current text i into set V. high , Update the text index i = i + 1, and return to step 2.6; Step 2.20: End the loop and output the set of high-order feature vectors V of all text. high As input for subsequent modules.

[0012] In this embodiment, the specific method of step 3 is as follows: Step 3.1: Construct a bidirectional dynamic collaborative module to integrate the high-order feature vector set V high As input, , where i represents the i-th text; Step 3.2: Define a loop variable p and assign it the value 1; Step 3.3: If p≤ If so, proceed to step 3.4; otherwise, proceed to step 3.9. Step 3.4: Obtain the higher-order feature vector corresponding to the p-th text, and concatenate them along the feature dimension to generate a concatenated vector. , , where [;] indicates splicing; Step 3.5: Connect the concatenated vectors Input the gating network and calculate the weight ratio of the three tasks using the following formula: Where W and b are the weight matrix and bias, This represents the weights of the three tasks on text p; Step 3.6: Perform weighted fusion on the concatenated high-order feature vectors to generate the joint feature vector of text p. The calculation formula is: + + ; Step 3.7: Combine the joint feature vectors Store in the joint feature vector set ; Step 3.8: Update the loop variable p, p = p + 1, then jump to step 3.3 to continue execution; Step 3.9: End the loop and output the set of joint feature vectors for all text. .

[0013] In this embodiment, the specific method of step 4 is as follows: Step 4.1: Define a loop variable k and initialize it to 1; Step 4.2: If k≤ If so, proceed to step 4.3; otherwise, proceed to step 4.9. Step 4.3: Obtain the joint feature vector of the k-th text. ; Step 4.4: Perform malicious analysis task feature enhancement, and combine the joint feature vectors. With the original higher-order vector By fusing, a vector is obtained. Then input it into the fully connected layer defined in step 2.13 to output the final maliciousness analysis result. ; Step 4.5: Perform tactical-association extraction task feature enhancement, and combine the joint feature vectors. and Vector concatenation yields a vector The validation module of the fully connected layer extracts data with a confidence level greater than a defined threshold. Entity Relationship Set ; Step 4.6: Perform threat indicator detection task feature enhancement, and combine the joint feature vectors. With the original higher-order vector By fusing, a vector is obtained. Then input it into the fully connected layer defined in step 2.15 to output the final threat indicator detection result. ; Step 4.7: Integrate the final outputs of the three tasks to generate the threat report for the k-th text. k ; Step 4.8: Update index k, k = k + 1, then return to step 4.2 to continue execution; Step 4.9: Output the complete structured threat report .

[0014] An advanced persistent threat detection device with multi-task dynamic collaboration is provided, wherein the computer program, when loaded into a processor, implements the aforementioned advanced persistent threat detection method with multi-task dynamic collaboration.

[0015] This embodiment also includes a memory, a processor, and a computer program stored in the memory and executable on the processor.

[0016] The advanced persistent threat detection method with multi-task dynamic collaboration provided in this invention has the following beneficial effects: (1) This invention first cleans security texts such as security logs and threat intelligence, and creates a domain dictionary to complete the standardized mapping of threat terms. Subsequently, a multi-task learning framework based on RoBERTa is constructed. This framework deploys three task heads in parallel on the basis of a shared encoder: maliciousness analysis, tactical-correlation extraction, and threat indicator detection. These three task heads are used to extract high-order feature vectors of attack intent, attack elements, and threat indicators, respectively.

[0017] (2) The core of this scheme lies in the introduction of a bidirectional dynamic collaboration module. This module uses a gating fusion mechanism to concatenate and weight high-order feature vectors from three tasks, thereby generating a joint feature vector that integrates semantic information from multiple parties. This joint feature vector is then dynamically fed back to the heads of each task, enabling information collaboration and mutual verification of decisions between tasks, ultimately outputting a structured threat report. This method, by constructing a multi-task dynamic collaboration mechanism, achieves deep interaction and enhancement of semantic information, enabling deep identification of hidden attack traces, metaphorical expressions, and industry jargon, thus significantly improving the detection accuracy of complex attacks such as advanced persistent threats.

[0018] (3) Multi-task dynamic collaboration mechanism plays an important role and significance in the detection of advanced persistent threats. In the field of network security threat detection, although the static detection method that traditionally relies on feature matching and rule definition has improved the ability to identify known threats to a certain extent, its detection mechanism is rigid and has limited scalability, making it difficult to effectively deal with multi-stage, complex and highly covert network attacks. In particular, its detection capability is significantly insufficient in the scenario of advanced persistent threats.

[0019] (4) On the other hand, the detection scheme that introduces a large language model has improved the intelligence level of detection to some extent. However, existing methods mostly focus on the detection of single-dimensional tasks. Even when extended to multi-task scenarios, there are still common problems such as insufficient information coordination between tasks and weak dynamic interaction capabilities. This leads to the isolated execution of each task, making it impossible to identify potential related threat features through deep information fusion and contextual reasoning, thereby weakening the overall perception depth and detection accuracy of advanced threats.

[0020] (5) Therefore, in order to effectively improve the detection capability of advanced persistent threats, the multi-task dynamic collaboration proposed in this invention provides a new technical approach. This scheme adopts a shared model encoder, deploys multiple task heads in parallel, and constructs a bidirectional dynamic collaboration module. By extracting the high-order feature vectors of each task head and performing weighted fusion, and then feeding the fusion result back to each task head to enhance its feature representation, it effectively promotes information collaboration and overall perception among tasks, thereby significantly improving the detection accuracy of complex attacks such as advanced persistent threats. Attached Figure Description

[0021] Figure 1 This is the overall flowchart of the present invention; Figure 2 This is an overall network structure diagram according to one embodiment of the present invention. Detailed Implementation

[0022] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0023] To address the problems mentioned in the background section, this invention provides an advanced persistent threat detection method with multi-task dynamic collaboration to solve the aforementioned technical problems. The technical solution is as follows: Step 1: Analyze the network security text dataset D raw Data cleaning and deduplication are performed, and a domain-specific dictionary W is built based on an authoritative knowledge framework. domain Complete the standardization mapping of threat terms and generate dataset D. std As the entire input; Step 1.1: Define T raw For a single piece of cybersecurity text to be processed, it satisfies relation T raw ={id,Content}, where id is the unique identifier of the text and Content is the security text obtained from security logs, threat intelligence, etc.; Step 1.2: Define D raw Given a text dataset in the cybersecurity domain to be processed, satisfying relation D raw ={T raw1 ,T raw2 ,…,T rawa ,…,T rawL(Draw)}, where T rawa Let L(D) be the a-th text to be processed in the dataset. raw ) represents the length of the dataset, and variable a∈[1,L(D) raw )]; Step 1.3: For D raw Data cleaning is performed, including removing null values, filtering out garbled characters and other irrelevant characters, and deduplicating sentences, resulting in the cleaned dataset D. clean ={T clean1 ,T clean2 ,…,T cleana1 ,…,T cleanL(Dclean)}, where T cleana1 For the a1-th cleaned text in the dataset, L(D) clean ) represents the length of the dataset, and variable a1∈[1,L(D) clean )]; Step 1.4: Construct a professional dictionary for the cybersecurity field, W, by integrating standard terminology and its variations from publicly available threat intelligence databases. domain This establishes a mapping relationship between terms and standard names, i.e., W domain ={term i →standard_term i}, where i represents the i-th mapping relationship; Step 1.5: For each text T cleana1 Iterate through the terms it contains, based on dictionary W. domain For dataset D clean Perform standardized mapping of threat terms to obtain the standardized dataset D. std ={T std1 ,T std2 ,…,T stda2 ,…,T stdL(Dstd)}, where T stda2 For the a2th text in the standardized dataset, L(D std )=L(D clean ), variable a2∈[1,L(D std )).

[0024] Step 2: Construct a multi-task learning framework based on RoBERTa. This framework deploys three task heads in parallel on top of a shared encoder: maliciousness analysis, tactical-association extraction, and threat indicator detection. While performing deep semantic encoding on the text, it generates a set of high-order feature vectors V for subsequent collaboration. high ; Step 2.1: Construct the multi-task learning framework RoBERTa, and use the dataset D std As input to the entire model; Step 2.2: Load the RoBERTa model for word segmentation and generate word embedding vector sequence E1; Step 2.3: Generate the location embedding vector E2 based on the location information of the dataset; Step 2.4: Add the two vectors to obtain the final input E of the embedding layer, E = E1 + E2; Step 2.5: Define a loop variable i and initialize it to 1. If i ≤ len(D std If the condition is met, proceed to step 2.6; otherwise, proceed to step 2.20. Step 2.6: Obtain the final input vector E of the i-th text in the embedding layer. i ; Step 2.7: Define the Transformer layer index j, initialize it to 1, and set the total number of model layers L=12; Step 2.8: If the layer index j ≤ L, then execute step 2.9; otherwise, jump to step 2.12. Step 2.9: Extract and transform features using the Transformer of the j-th layer. After self-attention calculation, feedforward neural network, residual connection, and layer normalization, output the hidden state H of this layer. j ; Step 2.10: Update layer index j, j = j + 1; Step 2.11: Return to Step 2.8 and proceed to the next level of calculation; Step 2.12: End the loop and take the output vector h of the last Transformer at the [CLS] marker. i As the global feature vector, the output H of the entire sequence i As a sequence feature vector; Step 2.13: Construct a malicious analysis task, and use the global vector h i The input is given to the malicious analysis task header, which is a classifier with two fully connected layers, calculated using the following formula: Where W1 and b1 are the weights and biases of the first fully connected layer, W2 and b2 are the weights and biases of the second fully connected layer, and GELU is the activation function. Let be the probability distribution of the maliciousness category of the i-th text; Step 2.14: Construct a tactical-association extraction task, extracting the sequence feature vector H i The input is fed into the tactical-association extraction task header. This task uses the BiLSTM-CRF model to extract attack entities. The vector is calculated using the BiLSTM formula. ,in This represents the hidden state of the forward LSTM. Represents the hidden state of the inverse LSTM. This represents the concatenated bidirectional feature matrix. Input the CRF layer to identify entities such as attack tools and target assets, and output the entity relation set R of the i-th text. i ; Step 2.15: Construct a threat indicator detection task, and use the global vector h i The input is fed into the threat indicator detection task header, which is a multi-label classifier. The calculation formula is as follows: Where W and b are the weights and biases of the fully connected layer. It is the Sigmoid activation function. Let be the probability of the threat indicator corresponding to the i-th text; Step 2.16: Extract high-order feature vectors from before the GELU activation function in the malicious analysis task header. ; Step 2.17: After extracting the task header BiLSTM output layer from the tactical-associative model, ... Perform mean pooling to extract higher-order vectors. ; Step 2.18: Extract high-order feature vectors from before the Sigmoid activation function in the threat indicator detection task header. ; Step 2.19: Store the three higher-order feature vectors of the current text i into set V. high , Update the text index i = i + 1, and return to step 2.6; Step 2.20: End the loop and output the set of high-order feature vectors V of all text. high As input for subsequent modules.

[0025] Step 3: Extract the high-order feature vectors V from the three tasks. high By using a gating fusion mechanism to perform vector concatenation and weighting, a joint feature vector set V that integrates semantic information from multiple sources is generated. join ; Step 3.1: Construct a bidirectional dynamic collaborative module to integrate the high-order feature vector set V high As input, , where i represents the i-th text; Step 3.2: Define a loop variable p and assign it the value 1; Step 3.3: If p≤ If so, proceed to step 3.4; otherwise, proceed to step 3.9. Step 3.4: Obtain the higher-order feature vector corresponding to the p-th text, and concatenate them along the feature dimension to generate a concatenated vector. , , where [;] indicates splicing; Step 3.5: Connect the concatenated vectors Input the gating network and calculate the weight ratio of the three tasks using the following formula: Where W and b are the weight matrix and bias, This represents the weights of the three tasks on text p; Step 3.6: Perform weighted fusion on the concatenated high-order feature vectors to generate the joint feature vector of text p. The calculation formula is: + + ; Step 3.7: Combine the joint feature vectors Store in the joint feature vector set ; Step 3.8: Update the loop variable p, p = p + 1, then jump to step 3.3 to continue execution; Step 3.9: End the loop and output the set of joint feature vectors for all text. .

[0026] Step 4: Dynamically feed the joint feature vector containing semantic information from multiple parties to each task head. The task heads then fuse the joint feature vector to achieve information collaboration and mutual verification of decisions among the tasks, and finally output a threat report. Step 4.1: Define a loop variable k and initialize it to 1; Step 4.2: If k≤ If so, proceed to step 4.3; otherwise, proceed to step 4.9. Step 4.3: Obtain the joint feature vector of the k-th text. ; Step 4.4: Perform malicious analysis task feature enhancement, and combine the joint feature vectors. With the original higher-order vector By fusing, a vector is obtained. Then input it into the fully connected layer defined in step 2.13 to output the final maliciousness analysis result. ; Step 4.5: Perform tactical-association extraction task feature enhancement, and combine the joint feature vectors. and Vector concatenation yields a vector The validation module of the fully connected layer extracts data with a confidence level greater than a defined threshold. Entity Relationship Set ; Step 4.6: Perform threat indicator detection task feature enhancement, and combine the joint feature vectors. With the original higher-order vector By fusing, a vector is obtained. Then input it into the fully connected layer defined in step 2.15 to output the final threat indicator detection result. ; Step 4.7: Integrate the final outputs of the three tasks to generate the threat report for the k-th text. k ; Step 4.8: Update index k, k = k + 1, then return to step 4.2 to continue execution; Step 4.9: Output the complete structured threat report .

[0027] It should be noted that Table 1 below provides a detailed description of all variables involved in the above steps, to facilitate understanding of the logical connections and calculation basis of each step: Table 1 Variable Description Table The present invention also provides an advanced persistent threat detection device with multi-task dynamic collaboration, including a memory, a processor, and a computer program stored in the memory and executable on the processor. The computer program, when loaded onto the processor, implements the aforementioned advanced persistent threat detection method with multi-task dynamic collaboration.

[0028] This method effectively utilizes the feature information of network text. Through information sharing and collaborative perception among multiple tasks, it deeply integrates independently performed detection tasks. This not only allows the three tasks of malicious analysis, tactical correlation extraction, and threat indicator detection to be processed in parallel and share the same semantic encoding basis to improve efficiency, but also constructs a bidirectional dynamic collaborative module to establish a dialogue mechanism between tasks in deep features. This enhances the overall perception capability and detection accuracy of hidden semantics, attack context, and potential correlations in advanced persistent threats.

[0029] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.

Claims

1. A multi-task dynamic collaborative advanced persistent threat detection method, characterized in that, Includes the following steps: Step 1: Analyze the network security text dataset D raw Data cleaning and deduplication are performed based on dictionary W. domain Complete the standardization mapping of threat terms and generate dataset D. std As the entire input; Step 2: Construct a multi-task learning framework based on RoBERTa. This framework deploys three task heads in parallel on top of a shared encoder: maliciousness analysis, tactical-association extraction, and threat indicator detection. While performing deep semantic encoding on the text, it generates a set of high-order feature vectors V for subsequent collaboration. high ; Step 3: Extract the high-order feature vectors V from the three tasks. high By using a gating fusion mechanism to perform vector concatenation and weighting, a joint feature vector set V that integrates semantic information from multiple sources is generated. join ; Step 4: Dynamically feed the joint feature vector containing semantic information from multiple parties back to each task head. The task heads then fuse the joint feature vector to achieve information collaboration and mutual verification of decisions among the tasks, and finally output a threat report.

2. The advanced persistent threat detection method with multi-task dynamic collaboration according to claim 1, characterized in that, The specific method for step 1 is as follows: Step 1.1: Define T raw For a single piece of cybersecurity text to be processed, it satisfies relation T raw ={id,Content}, where id is the unique identifier of the text and Content is the security text obtained from security logs, threat intelligence, etc.; Step 1.2: Define D raw Given a text dataset in the cybersecurity domain to be processed, satisfying relation D raw ={T raw1 ,T raw2 ,…,T rawa ,…,T rawL(Draw) }, where T rawa Let L(D) be the a-th text to be processed in the dataset. raw ) represents the length of the dataset, and variable a∈[1,L(D) raw )]; Step 1.3: For D raw Data cleaning is performed, including removing null values, filtering out garbled characters and other irrelevant characters, and deduplicating sentences, resulting in the cleaned dataset D. clean ={T clean1 ,T clean2 ,…,T cleana1 ,…,T cleanL(Dclean) }, where T cleana1 For the a1-th cleaned text in the dataset, L(D) clean ) represents the length of the dataset, and variable a1∈[1,L(D) clean )]; Step 1.4: Construct a professional dictionary for the cybersecurity field, W, by integrating standard terminology and its variations from publicly available threat intelligence databases. domain This establishes a mapping relationship between terms and standard names, i.e., W domain ={term i →standard_term i }, where i represents the i-th mapping relationship; Step 1.5: For each text T cleana1 Iterate through the terms it contains, based on dictionary W. domain For dataset D clean Perform standardized mapping of threat terms to obtain the standardized dataset D. std ={T std1 ,T std2 ,…,T stda2 ,…,T stdL(Dstd) }, where T stda2 For the a2th text in the standardized dataset, L(D std )=L(D clean ), variable a2∈[1,L(D std )).

3. The advanced persistent threat detection method with multi-task dynamic collaboration according to claim 1, characterized in that, The specific method for step 2 is as follows: Step 2.1: Construct the multi-task learning framework RoBERTa, and use the dataset D std As input to the entire model; Step 2.2: Load the RoBERTa model for word segmentation and generate word embedding vector sequence E1; Step 2.3: Generate the location embedding vector E2 based on the location information of the dataset; Step 2.4: Add the two vectors to obtain the final input E of the embedding layer, E = E1 + E2; Step 2.5: Define a loop variable i and initialize it to 1. If i ≤ len(D std If the condition is met, proceed to step 2.6; otherwise, proceed to step 2.

20. Step 2.6: Obtain the final input vector E of the i-th text in the embedding layer. i ; Step 2.7: Define the Transformer layer index j, initialize it to 1, and set the total number of model layers L=12; Step 2.8: If the layer index j ≤ L, then execute step 2.9; otherwise, jump to step 2.

12. Step 2.9: Extract and transform features using the Transformer at layer j. After self-attention calculation, feedforward neural network, residual connection, and layer normalization, output the hidden state H of this layer. j ; Step 2.10: Update layer index j, j = j + 1; Step 2.11: Return to Step 2.8 and proceed to the next level of calculation; Step 2.12: End the loop and take the output vector h of the last Transformer at the [CLS] marker. i As the global feature vector, the output H of the entire sequence i As a sequence feature vector; Step 2.13: Construct a malicious analysis task, and use the global vector h i The input is given to the malicious analysis task header, which is a classifier with two fully connected layers, calculated using the following formula: Where W1 and b1 are the weights and biases of the first fully connected layer, W2 and b2 are the weights and biases of the second fully connected layer, and GELU is the activation function. Let be the probability distribution of the maliciousness category of the i-th text; Step 2.14: Construct a tactical-association extraction task, extracting the sequence feature vector H i The input is fed into the tactical-association extraction task header. This task uses the BiLSTM-CRF model to extract attack entities. The vector is calculated using the BiLSTM formula. ,in This represents the hidden state of the forward LSTM. Represents the hidden state of the inverse LSTM. This represents the concatenated bidirectional feature matrix. Inputting into a CRF layer identifies entities such as attack tools and target assets, and outputs the entity relation set R of the i-th text. i ; Step 2.15: Construct a threat indicator detection task, and use the global vector h i The input is fed into the threat indicator detection task header, which is a multi-label classifier. The calculation formula is as follows: Where W and b are the weights and biases of the fully connected layer. It is the Sigmoid activation function. Let be the probability of the threat indicator corresponding to the i-th text; Step 2.16: Extract high-order feature vectors from before the GELU activation function in the malicious analysis task header. ; Step 2.17: After extracting the task header BiLSTM output layer from the tactical-associative model, ... Perform mean pooling to extract higher-order vectors. ; Step 2.18: Extract high-order feature vectors from before the Sigmoid activation function in the threat indicator detection task header. ; Step 2.19: Store the three higher-order feature vectors of the current text i into set V. high , Update the text index i = i + 1, and return to step 2.6; Step 2.20: End the loop and output the set of high-order feature vectors V of all text. high As input for subsequent modules.

4. The advanced persistent threat detection method with multi-task dynamic collaboration according to claim 1, characterized in that, The specific method for step 3 is as follows: Step 3.1: Construct a bidirectional dynamic collaborative module to integrate the high-order feature vector set V high As input, , where i represents the i-th text; Step 3.2: Define a loop variable p and assign it the value 1; Step 3.3: If p≤ If so, proceed to step 3.4; otherwise, proceed to step 3.

9. Step 3.4: Obtain the higher-order feature vector corresponding to the p-th text, and concatenate them along the feature dimension to generate a concatenated vector. , , where [;] indicates splicing; Step 3.5: Connect the concatenated vectors Input the gating network and calculate the weight ratio of the three tasks using the following formula: Where W and b are the weight matrix and bias, This represents the weights of the three tasks on text p; Step 3.6: Perform weighted fusion on the concatenated high-order feature vectors to generate the joint feature vector of text p. The calculation formula is: + + ; Step 3.7: Combine the joint feature vectors Store in the joint feature vector set ; Step 3.8: Update the loop variable p, p = p + 1, then jump to step 3.3 to continue execution; Step 3.9: End the loop and output the set of joint feature vectors for all text. .

5. The advanced persistent threat detection method with multi-task dynamic collaboration according to claim 1, characterized in that, The specific method for step 4 is as follows: Step 4.1: Define a loop variable k and initialize it to 1; Step 4.2: If k≤ If the result is positive, proceed to step 4.3; otherwise, proceed to step 4.

9. Step 4.3: Obtain the joint feature vector of the k-th text. ; Step 4.4: Perform malicious analysis task feature enhancement, and combine the joint feature vectors. With the original higher-order vector By fusing, a vector is obtained. Then input it into the fully connected layer defined in step 2.13 to output the final maliciousness analysis result. ; Step 4.5: Perform tactical-association extraction task feature enhancement, and combine the joint feature vectors. and Vector concatenation yields a vector The validation module of the fully connected layer extracts data with a confidence level greater than a defined threshold. Entity Relationship Set ; Step 4.6: Perform threat indicator detection task feature enhancement, and combine the joint feature vectors. With the original higher-order vector By fusing, a vector is obtained. Then input it into the fully connected layer defined in step 2.15 to output the final threat indicator detection result. ; Step 4.7: Integrate the final outputs of the three tasks to generate the threat report for the k-th text. k ; Step 4.8: Update index k, k = k + 1, then return to step 4.2 to continue execution; Step 4.9: Output the complete structured threat report .

6. A multi-task dynamic collaborative advanced persistent threat detection device, characterized in that, When the computer program is loaded into the processor, it implements the advanced persistent threat detection method with multi-task dynamic collaboration as described in any one of claims 1-5.

7. The advanced persistent threat detection device with multi-task dynamic collaboration according to claim 6, characterized in that, It also includes memory, processor, and computer programs stored in memory and capable of running on the processor.

Images