Enterprise information security management method, system, equipment and medium

Abstract

The invention relates to an enterprise information security management method, system and device and a medium. The method comprises the following steps: acquiring heterogeneous security data of a physical environment and a network environment, and performing standardized analysis and element extraction on the heterogeneous security data to obtain a physical event and a network event; based on a preset unified event model, carrying out cross-domain association analysis on the physical event and the network event, and calculating space-time proximity and semantic correlation between the physical event and the network event to obtain an association candidate pair set; inputting the associated candidate pair set into a pre-trained causal inference model to obtain the causal intensity of the influence of the physical event on the network event, and identifying the associated candidate pair of which the causal intensity exceeds a preset threshold value from the associated candidate pair set as a cross-domain event pair to obtain a visual attribution map; and triggering an enterprise dual prevention mechanism to perform linkage response based on the visual attribution map. By adopting the method, the overall capability of active defense and risk management and control of an enterprise can be improved.

Description

Technical Field

[0001] This invention belongs to the field of information security technology, and in particular relates to an enterprise information security management method, system, device and medium. Background Technology

[0002] With the development of technologies in the field of digital transformation, enterprise information system technologies covering both physical and cyberspace have emerged. These enterprise information systems have complex architectures and are deeply coupled with physical and cybersecurity.

[0003] In traditional technology, enterprises address their security needs by deploying separate physical security systems and network security systems. This means that video surveillance and access control systems, which are responsible for physical security, and systems such as SIEM and IDS / IPS, which are responsible for network security, operate independently. Security events generated by these two types of systems are stored in different databases and analyzed by different teams using different tools.

[0004] However, the aforementioned security management methods lack a unified anchor point for linking physical security incidents and cybersecurity incidents. The timestamp precision and spatial description dimensions differ, making event alignment difficult. A small number of attack-related events are mixed in with the massive amount of daily events, making it difficult to distinguish logical causality from statistical correlations and to reconstruct a complete cross-domain attack chain. Even if an attack chain is identified, it is difficult to translate it into executable security operation and maintenance instructions, failing to form a closed-loop security management system. Furthermore, existing data fusion research only reaches the level of simple aggregation and parallel display, lacking the ability to automatically and intelligently mine the deep correlations between physical and network heterogeneous data in the temporal, spatial, and semantic dimensions. This makes it difficult for security analysts to effectively contain and trace attacks in their early stages, and to cope with the severe challenges of "physical-network" composite attacks. Summary of the Invention

[0005] Therefore, it is necessary to provide an enterprise information security management method, system, device, and medium that can deeply integrate physical and network security data to drive proactive defense decisions, addressing the aforementioned technical issues.

[0006] Firstly, this application provides a method for enterprise information security management, including:

[0007] Heterogeneous security data from physical and network environments is acquired, and standardized parsing and element extraction are performed on the heterogeneous security data to obtain physical events and network events; the heterogeneous security data includes timestamps, spatial location coordinates, subject identifiers, object identifiers, and behavioral elements;

[0008] Based on a pre-defined unified event model, cross-domain correlation analysis is performed on physical events and network events, and the spatiotemporal proximity and semantic relevance between physical events and network events are calculated to obtain a set of candidate correlation pairs.

[0009] The set of associated candidate pairs is input into a pre-trained causal inference model to obtain the causal strength of the influence of physical events on network events. The associated candidate pairs with causal strength exceeding a preset threshold are identified from the set of associated candidate pairs as cross-domain event pairs, and a visual attribution map is obtained.

[0010] The enterprise's dual prevention mechanism is triggered by the visualization attribution map to carry out a coordinated response; the coordinated response includes converting the risk paths in the visualization attribution map into dynamically adjusted risk levels, and generating hidden danger investigation tasks based on the visualization attribution map.

[0011] In one embodiment, based on a preset unified event model, cross-domain correlation analysis is performed on physical events and network events, and the spatiotemporal proximity and semantic relevance between physical events and network events are calculated to obtain a set of candidate correlation pairs, including:

[0012] In response to the acquisition of newly generated physical events, a forward time window and a backward time window based on a preset time step are set with the timestamp of the newly generated physical event as the center to obtain the correlation analysis time range;

[0013] An initial set of network events is constructed based on all network events that occur within the time frame of the correlation analysis.

[0014] Based on a pre-built enterprise spatial asset knowledge graph, a list of network assets that are connected to the spatial coordinates of newly generated physical events can be obtained by querying.

[0015] From the initial set of network events, network events whose object identifiers or subject identifiers belong to the list of network assets are selected to obtain a subset of spatially associated network events;

[0016] The newly generated physical events are paired with each network event in the spatial association network event subset to obtain a set of association candidate pairs.

[0017] In one embodiment, before inputting a set of associated candidate pairs into a pre-trained causal inference model to obtain the causal strength of the influence of physical events on network events, and identifying associated candidate pairs whose causal strength exceeds a preset threshold as cross-domain event pairs from the set of associated candidate pairs to obtain a visualized attribution map, the method further includes:

[0018] For physical or network events in the set of associated candidate pairs, based on the enterprise spatial asset knowledge graph, a random walk with a fixed step size is performed starting from the entity corresponding to the physical or network event to generate a sequence of entity nodes associated with the event.

[0019] The entity node vector of each entity node is obtained by using a graph embedding algorithm based on the entity node sequence, and the entity node vectors are averaged and aggregated to obtain the spatial context vector of the event.

[0020] For the same physical or network event, the corresponding timestamp is decomposed into a periodic feature vector and fused with behavioral elements to obtain the event's temporal context vector.

[0021] For the same physical or network event, the types corresponding to behavioral elements, subject identifiers, and object identifiers are encoded to obtain the event's ontology vector;

[0022] Spatial context vector, temporal context vector, and ontology vector are concatenated and then dimensionality-reduced and fused using a multilayer perceptron encoder to obtain the final unified vector representation of the corresponding physical or network event.

[0023] In one embodiment, the set of associated candidate pairs is input into a pre-trained causal inference model to obtain the causal strength of the influence of physical events on network events. Then, associated candidate pairs whose causal strength exceeds a preset threshold are identified from the set of associated candidate pairs as cross-domain event pairs, resulting in a visualized attribution map, including:

[0024] Based on the final unified vector representation of each event in the associated candidate pair set, the query vector of the physical event and the key vector sequence and value vector sequence of the network event are obtained;

[0025] Obtain network behavior patterns from historical normal periods that are similar to the spatiotemporal context of physical events, and aggregate them to obtain a vector of control variables;

[0026] Calculate the controlled attention score between physical events and each network event in the set of associated candidate pairs based on the query vector, key vector sequence, value vector sequence, and control variable vector;

[0027] The controlled attention score sequence is normalized to obtain the attention weight distribution;

[0028] The value vector sequence is weighted and summed according to the attention weight distribution to obtain the causal representation. The causal representation is then concatenated with the query vector and input into a pre-trained classifier to obtain the overall causal probability of physical events causing network event anomalies.

[0029] Based on the network event with the largest attention weight distribution, if the corresponding overall causal probability exceeds a preset threshold, the physical event and the network event with the largest attention weight distribution are determined to constitute a cross-domain event pair.

[0030] A visual attribution map is constructed based on each cross-domain event pair.

[0031] In one embodiment, a visual attribution map is constructed based on each cross-domain event pair, including:

[0032] Key security entities in cross-domain event pairs are added as nodes to the attribution graph; key security entities include the subject and object identifiers of physical events, as well as the subject and object identifiers of network events.

[0033] Based on the behavioral logic of cross-domain event pairs, directed edges are created from the key entity nodes of physical events to the key entity nodes of network events, and edge attributes are set for the directed edges; the edge attributes include the source event identifier, the target event identifier, and the overall causal probability;

[0034] Query the enterprise asset knowledge graph to obtain the set of key asset nodes that have direct access or data storage relationships with each node;

[0035] The set of key asset nodes is considered as potential attack targets and added to the attribution graph as dashed edges to obtain potential paths of the attack chain, and the comprehensive risk value of each potential path is calculated.

[0036] The attribution map and the combined risk value of each potential path are rendered using a visualization engine to obtain a visualized attribution map.

[0037] In one embodiment, a coordinated response is triggered by the enterprise's dual prevention mechanism based on a visualized attribution map, including:

[0038] A list of assets associated with potential paths in an attack chain is determined based on a visualized attribution graph.

[0039] For each asset in the asset list, a dynamic risk value is obtained by overlaying a dynamic risk increment introduced by the attack chain on the comprehensive risk value.

[0040] The risk level of an asset is determined based on dynamic risk values, and enhanced control measures corresponding to the risk level are automatically triggered. These measures include logically isolating the asset through a network policy controller or upgrading the access approval level of the area where the asset is located through a physical security system.

[0041] A structured investigation work order is generated based on the edge attributes in the visualized attribution graph. The investigation work order includes the physical location, time and specific inspection items of the corresponding physical event node, as well as the target IP address, scanning command and verification command of the corresponding network event node.

[0042] Secondly, this application also provides an enterprise information security management system, including:

[0043] The system environment module is used to acquire heterogeneous security data from the physical and network environments, and to perform standardized parsing and element extraction on the heterogeneous security data to obtain physical events and network events; the heterogeneous security data includes timestamps, spatial location coordinates, subject identifiers, object identifiers, and behavioral elements.

[0044] The association candidate module is used to perform cross-domain association analysis on the physical event and the network event based on a preset unified event model, and to calculate the spatiotemporal proximity and semantic relevance between the physical event and the network event to obtain a set of association candidate pairs.

[0045] The causal inference module is used to input the set of associated candidate pairs into a pre-trained causal inference model to obtain the causal strength of the influence of the physical event on the network event, and to identify the associated candidate pairs whose causal strength exceeds a preset threshold as cross-domain event pairs from the set of associated candidate pairs to obtain a visual attribution map.

[0046] The safety management module is used to trigger the enterprise's dual prevention mechanism for a coordinated response based on the visualized attribution map; wherein, the coordinated response includes converting the risk paths in the visualized attribution map into dynamically adjusted risk levels, and generating hazard investigation tasks based on the visualized attribution map.

[0047] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of any of the above-described enterprise information security management methods.

[0048] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of any of the above-described enterprise information security management methods.

[0049] The aforementioned enterprise information security management methods, systems, equipment, and media standardize and extract elements from heterogeneous security data collected from physical and network environments, generating uniformly formatted physical and network events to lay a data foundation for cross-domain analysis. Based on a unified event model, by calculating the spatiotemporal proximity and semantic relevance between events, a set of candidate pairs of associations between physical and network events is automatically generated, thus initially bridging the two security domains. A pre-trained causal inference model is used to conduct in-depth analysis of the candidate pair set, quantifying the causal influence of physical events on network events, and accurately selecting association pairs with causal strength exceeding a threshold as real cross-domain attack event pairs. This constructs a clear and visualized attribution graph, intuitively displaying the attack chain. Based on this attribution graph, the enterprise's dual prevention mechanism is automatically triggered to dynamically transform risk paths in the graph into executable risk level adjustment instructions and precise hidden danger investigation tasks. This achieves automated discovery, visualized tracing, and intelligent response to "physical-network" cross-domain composite attack chains, effectively solving the problems of data fragmentation and delayed analysis between physical and network security, and improving the overall capabilities of enterprise proactive defense and risk management. Attached Figure Description

[0050] To more clearly illustrate the technical solutions in the embodiments or related technologies of this application, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is a flowchart illustrating the enterprise information security management method of the present invention;

[0052] Figure 2 This is a structural diagram of the enterprise information security management system of the present invention. Detailed Implementation

[0053] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0054] In one embodiment, such as Figure 1 As shown, an enterprise information security management method is provided. This embodiment illustrates the method applied to a terminal, but it is understood that the method can also be applied to a server, and further to a system including both a terminal and a server, and is implemented through the interaction between the terminal and the server. In this embodiment, the method includes the following steps:

[0055] S101. Obtain heterogeneous security data from the physical and network environments, and perform standardized analysis and element extraction on the heterogeneous security data to obtain physical events and network events; the heterogeneous security data includes timestamps, spatial location coordinates, subject identifiers, object identifiers, and behavioral elements.

[0056] The acquisition of heterogeneous security data covers all relevant data sources in both physical and network environments. Physical environment heterogeneous security data originates from operational and monitoring data generated by access control systems, video analytics platforms, and environmental sensors. Network environment heterogeneous security data originates from log data, traffic data, and alarm data generated by servers, network devices, and security protection equipment. As an illustration, the data acquisition process employs standardized access methods adapted to various data sources to ensure the integrity and real-time nature of data collection. For different types of data sources, corresponding data transmission protocols and interface specifications are used to achieve stable data access, avoiding data loss or transmission delays. The standardized parsing of heterogeneous security data is based on preset multi-source data parsing rules, performing unified format conversion and syntax verification on raw data of different formats and structures to eliminate parsing obstacles caused by data format differences. The element extraction process is based on a predefined element recognition model. It accurately extracts timestamps, spatial coordinates, subject identifiers, object identifiers, and behavioral elements from the standardized and parsed heterogeneous security data. The timestamp represents the specific time when the data was generated, the spatial coordinates represent the physical or logical location where the data was generated, the subject identifier represents the identity information of the entity that triggered the generation of the data, the object identifier represents the entity information that was affected during the generation of the data, and the behavioral elements represent the specific operational behavior performed by the subject on the object. Through this extraction process, the original heterogeneous security data is transformed into structured physical events and network events.

[0057] S102. Based on the preset unified event model, perform cross-domain correlation analysis on physical events and network events, and calculate the spatiotemporal proximity and semantic relevance between physical events and network events to obtain a set of candidate correlation pairs.

[0058] Furthermore, a pre-defined unified event model provides a unified descriptive framework and data structure specification for physical and network events. This model defines the core attributes and representation methods of events, enabling physical and network events to have the basic conditions for correlation analysis. The core of cross-domain correlation analysis is to break down the domain barriers between physical and network events and achieve effective correlation between the two types of events by constructing a unified correlation analysis dimension. The calculation of spatiotemporal proximity is carried out from the time dimension and the spatial dimension respectively. The temporal dimension proximity is based on the timestamp of the event occurrence to determine the sequential relationship and time interval characteristics of physical and network events in the time series. The spatial dimension proximity is based on the spatial location coordinates of the event to determine the spatial relationship and distance characteristics of physical and network events. The calculation of semantic relevance is based on the subject identifier, object identifier, and behavioral elements of the event. The semantic matching algorithm analyzes the semantic fit of the two types of events in entity correlation and behavioral correlation, and explores the implicit semantic correlation logic behind the events. The generation of the candidate pair set is based on the comprehensive judgment results of spatiotemporal proximity and semantic relevance. Physical events and network events that meet the preset association conditions are paired and combined to form a candidate pair set for further causal analysis. The selection process of this set balances association coverage and analysis efficiency, ensuring that no potential cross-domain association events are missed, while effectively reducing the dataset size for subsequent causal analysis.

[0059] S103. Input the set of associated candidate pairs into the pre-trained causal inference model to obtain the causal strength of the influence of physical events on network events, and identify the associated candidate pairs whose causal strength exceeds the preset threshold as cross-domain event pairs from the set of associated candidate pairs to obtain a visualized attribution map.

[0060] Optionally, the pre-trained causal inference model is trained based on historical cross-domain security incident data. By learning the causal association patterns of physical and network events in historical data, the model gains the ability to determine the causal relationship of new candidate pairs. The model input consists of event pairs from the candidate pair set. Through feature extraction, association calculation, and causal inference processes within the model, it outputs the causal strength of the physical event's impact on the network event. This causal strength is a quantitative indicator characterizing the degree of causal association between physical and network events, with a value ranging from [0,1]. A higher value indicates a greater impact of the physical event on the network event. The calculation of causal strength follows... ,in, Indicates the strength of causality. Represents the physical events in the candidate pairs of associations. This represents the network events in the associated candidate pairs. This represents the set of model parameters for a causal inference model. The mapping function represents the causal inference model. This function calculates the causal strength value by fusing the characteristics of physical and network events. The preset threshold is determined based on statistical analysis of historical attack event samples and false positive rate control requirements. It is used to distinguish event pairs with genuine causal relationships from those with accidental relationships. The process of identifying cross-domain event pairs involves comparing the causal strength of each candidate pair with the preset threshold. When the causal strength exceeds the preset threshold, the candidate pair is determined to have a genuine causal relationship and is identified as a cross-domain event pair. The construction of the visual attribution graph is centered on cross-domain event pairs. Key entities in the event are used as graph nodes, and the causal relationships between entities are used as graph edges. A graph-based presentation visually displays the cross-domain attack chain from physical events to network events, while integrating core event information and causal strength data to provide intuitive visual support for security analysis and decision-making.

[0061] S104. Trigger the enterprise's dual prevention mechanism for coordinated response based on the visualized attribution map; wherein, the coordinated response includes converting the risk paths in the visualized attribution map into dynamically adjusted risk levels, and generating hidden danger investigation tasks based on the visualized attribution map.

[0062] Specifically, the enterprise's dual prevention mechanism includes a risk classification and control mechanism and a hidden danger investigation and management mechanism. The coordinated response process is based on the cross-domain attack links and risk information presented by the visualized attribution graph, enabling the synergistic operation of the two mechanisms. The dynamic risk level adjustment process is based on the risk paths in the visualized attribution graph. The risk path represents the propagation path from the initial physical event to the final cybersecurity risk. By extracting risk characteristics such as the correlation strength, the importance of the assets involved, and the potential scope of impact on the risk path, these are transformed into quantifiable risk assessment indicators. Combined with the inherent risk level of the assets, a dynamic risk calculation model is used to achieve real-time adjustment of the risk level, ensuring that the risk level accurately reflects the current security risk status brought about by cross-domain attacks. The generation of hidden danger investigation tasks is based on the cross-domain correlation weaknesses and risk sources exposed in the visualized attribution graph. Targeting the key nodes of the physical and network environments involved in the graph, and combining information such as the location of the event, the entities involved, and behavioral characteristics, structured hidden danger investigation tasks with clear investigation objectives, scope, and content are generated. This provides security operations personnel with precise investigation guidance, enabling targeted management of cross-domain attack risks.

[0063] The aforementioned enterprise information security management method addresses the problem of fragmented physical and network security data and the difficulty in cross-domain correlation analysis. It acquires heterogeneous security data from both physical and network environments, performs standardized analysis and element extraction to obtain structured physical and network events, and conducts cross-domain correlation analysis on these two types of events based on a pre-set unified event model. The spatiotemporal proximity and semantic relevance of these events are calculated to form a set of candidate correlation pairs. This set is input into a pre-trained causal inference model to identify cross-domain event pairs with causal strength exceeding a preset threshold and construct a visual attribution graph. Based on this graph, the enterprise's dual prevention mechanism is triggered, transforming risk paths into dynamically adjusted risk levels and generating a coherent means of hidden danger investigation tasks. This breaks down data silos between the physical and network security domains, achieves unified perception of cross-domain security posture, improves the accuracy and efficiency of threat discovery and tracing, and achieves dynamic control and proactive prevention of security risks, effectively addressing the security challenges posed by "physical-network" composite attacks.

[0064] In one embodiment, such as Figure 2 As shown, based on a pre-defined unified event model, cross-domain correlation analysis is performed on physical events and network events, and the spatiotemporal proximity and semantic relevance between physical events and network events are calculated to obtain a set of candidate correlation pairs, including:

[0065] S11. In response to the acquisition of a newly generated physical event, a forward time window and a backward time window based on a preset time step are set with the timestamp of the newly generated physical event as the center to obtain the correlation analysis time range.

[0066] In illustration, a newly generated physical event refers to a physical event that, after standardized parsing and element extraction, enters the cross-domain correlation analysis process for the first time. The event's generation status is captured in real-time by an event flow monitoring mechanism, triggering the initiation of the correlation analysis process. The timestamp, as the core representation of the physical event's occurrence time, becomes the benchmark anchor for setting the time window. The preset time step is determined based on the temporal evolution of cross-domain attack behavior and historical event correlation statistics; its essence is a reasonable definition of the time range within which a physical event may trigger network events. The forward time window corresponds to the preset time interval before the physical event occurs, used to capture network events that may have a prior association with the physical event, such as probing operations performed by attackers through the network before a physical intrusion. The backward time window corresponds to the preset time interval after the physical event occurs, used to capture network attack behaviors that may be triggered in the short term after the physical event. The correlation analysis time range is obtained by integrating the forward and backward time windows, and its time boundary is calculated as follows: ,in, Indicates the time range for the association analysis. The timestamp representing the newly generated physical event. Indicates the length of the forward time window. This indicates the length of the backward time window. Setting this time range ensures comprehensive coverage of potential time-related events while avoiding redundant invalid data caused by an excessively large time range through the constraint of preset time steps.

[0067] S12. Based on all network events that occur within the time frame of the correlation analysis, construct an initial network event set.

[0068] Specifically, the initial network event set is constructed using the association analysis time range as the filtering condition. A range query interface of the time-series event database is used to retrieve all network events whose timestamps fall within this range. The timestamp verification of network events employs an exact matching mechanism, ensuring that only network events whose occurrence time falls entirely within the association analysis time range are included in the initial network event set. To ensure the efficiency and accuracy of subsequent analysis, the initial network event set undergoes deduplication, removing duplicate reports or records. Simultaneously, the events are sorted in ascending order by their timestamps, forming an ordered event set. This set fully preserves all structured elements of each network event, including timestamp, spatial coordinates, subject identifier, object identifier, and behavioral elements, providing a complete data foundation for subsequent spatial association filtering.

[0069] S13. Based on the pre-built enterprise spatial asset knowledge graph, query the list of network assets that are connected to the spatial coordinates of the newly generated physical events.

[0070] For example, a pre-constructed enterprise spatial asset knowledge graph is a structured representation of an enterprise's physical assets and network assets and their relationships. Its nodes include physical asset nodes, such as data centers, server racks, and access control equipment, and network asset nodes, such as servers, network devices, and IP address ranges. Edges represent the relationships between assets, such as ownership, connection, and access permissions. The spatial coordinates of newly generated physical events serve as query keywords, and the graph query algorithm locates the corresponding physical asset node in the knowledge graph. The query process is based on a graph traversal algorithm, starting from the physical asset node and traversing all directly or indirectly connected network asset nodes. The network assets corresponding to each network asset node constitute a list of network assets connected to the spatial coordinates of the physical event. The network asset list is generated by excluding invalid or offline network assets and recording the association type and strength between each network asset and the physical asset node.

[0071] S14. From the initial set of network events, filter out network events whose object identifiers or subject identifiers belong to the list of network assets to obtain a subset of spatially associated network events.

[0072] In a schematic manner, the selection of spatially associated network event subsets is based on the network asset list. For each network event in the initial network event set, its object identifier and subject identifier are extracted and matched against the network asset identifiers in the network asset list. The matching process combines exact matching and association matching. Exact matching is suitable for scenarios where identifiers have unique correspondences, while association matching is suitable for scenarios where identifiers have hierarchical relationships. When either the object identifier or the subject identifier of a network event meets any matching condition, it indicates that the network event has a spatial association with the newly generated physical event, and it is included in the spatially associated network event subset. During the selection process, the matching type and matching result of each network event are recorded to ensure the traceability of the selection results. Simultaneously, the spatially associated network event subsets are sorted in descending order of association strength.

[0073] S15. Pair the newly generated physical events with each network event in the spatial association network event subset to obtain a set of association candidate pairs.

[0074] Furthermore, the generation of the candidate association pair set adopts a one-to-one pairing mode, treating newly generated physical events as fixed association subjects and forming independent candidate association pairs with each network event in the subset of spatially related network events. Each candidate association pair contains complete structured data of the physical event, complete structured data of the network event, and their spatiotemporal association characteristics, namely the time interval and spatial association type, which together constitute the basic data unit for subsequent causal inference analysis. The pairing process ensures that each network event forms only one candidate association pair with that physical event, avoiding analytical redundancy caused by repeated pairings. The candidate association pair set is stored in the form of a structured data list, where each element corresponds to a candidate association pair. A unique identifier is assigned to each candidate association pair to facilitate the mapping of subsequent causal inference results to that candidate pair.

[0075] In one embodiment, before inputting a set of associated candidate pairs into a pre-trained causal inference model to obtain the causal strength of the influence of physical events on network events, and identifying associated candidate pairs whose causal strength exceeds a preset threshold as cross-domain event pairs from the set of associated candidate pairs to obtain a visualized attribution map, the method further includes:

[0076] S21. For physical events or network events in the set of associated candidate pairs, based on the enterprise spatial asset knowledge graph, perform a random walk with a fixed step size starting from the entity corresponding to the physical event or network event to generate a sequence of entity nodes associated with the event.

[0077] In illustration, the entity corresponding to a physical or network event in the set of associated candidate pairs refers to the specific asset entity pointed to by the subject or object identifier in the event element, and this entity has a unique corresponding node mapping in the enterprise spatial asset knowledge graph. The fixed step size is set based on the average path length of the enterprise spatial asset knowledge graph and the statistical results of historical cross-domain association paths. Its purpose is to ensure that the random walk process can fully capture the spatial association environment information around the event entity, while avoiding the introduction of irrelevant nodes due to an excessively long step size or the loss of association information due to an excessively short step size. The random walk process starts from the entity node corresponding to the event and traverses nodes in the knowledge graph according to a preset walk strategy. Each step starts from the current node, and randomly selects an adjacent node as the next hop node based on the association weight of the edges. The weight allocation is determined based on the actual connection strength and access frequency between assets. When the number of traversals reaches the fixed step size, the walk stops and all nodes traversed during the traversal are recorded, forming a sequence of entity nodes associated with the event. The order of nodes in the sequence strictly follows the access sequence during the walk, ensuring that the sequence reflects the spatial association path characteristics between entities.

[0078] S22. Obtain the entity node vector of each entity node according to the entity node sequence through the graph embedding algorithm, and perform average aggregation on the entity node vectors to obtain the spatial context vector of the event.

[0079] Specifically, graph embedding algorithms are used to transform discrete entity nodes in a knowledge graph into low-dimensional, dense vector representations, enabling spatial relationships between nodes to be characterized by distances in the vector space. The algorithm's training process is based on all node and edge data of the enterprise spatial asset knowledge graph. By minimizing the conditional probability loss function between nodes, it learns the vector representation of nodes, ensuring that nodes with direct or indirect relationships are in neighboring positions in the vector space. The entity node sequence serves as input to the graph embedding algorithm. The algorithm learns the co-occurrence relationships and transition probabilities of nodes in the sequence, outputting an entity node vector corresponding to each entity node. The dimension of this vector is preset according to the node size and feature complexity of the knowledge graph, ensuring it can fully carry the node's relational information. The spatial context vector of an event is obtained by averaging all entity node vectors in the entity node sequence. The aggregation process follows... ,in, The spatial context vector representing the event, This represents the number of nodes in the entity node sequence. Represents the first in the sequence of entity nodes The entity node vectors corresponding to each node. This aggregation method can comprehensively reflect the overall spatial relationship environment around the event entity, transforming discrete node relationships into a unified vector representation.

[0080] S23. For the same physical event or network event, decompose the corresponding timestamp into a periodic feature vector, and fuse it with behavioral elements to obtain the event's time context vector.

[0081] For example, the periodic feature decomposition of timestamps is based on the natural periodicity of time, transforming timestamps into periodic numerical feature vectors through mathematical transformations. Periodic features include intraday time-segment features and intraweekly date features, each mapped to a continuous vector value using trigonometric functions, ensuring that periodic features at different time points can reflect similarities and differences in the vector space. The fusion process of behavioral elements involves converting the type identifier corresponding to the behavioral element into numerical features, concatenating it with the periodic feature vector to form an initial time feature vector, and then using a linear transformation layer to adjust the dimensions and fuse features of the initial time feature vector to obtain the event's temporal context vector, i.e. ,in, Represents the temporal context vector of an event. This represents the weight matrix of the linear transformation layer. This represents the periodic eigenvector obtained from timestamp decomposition. This represents the numerical feature vector after the behavioral elements have been transformed. This represents the bias vector of the linear transformation layer. This process combines temporal periodicity with event behavior characteristics, enabling the temporal context vector to simultaneously carry information about the temporal regularity and behavioral correlation of events.

[0082] S24. For the same physical event or network event, encode the types corresponding to the behavioral elements, subject identifiers, and object identifiers respectively to obtain the event's ontology vector.

[0083] Specifically, the classification of behavioral elements, subject identifiers, and object identifiers is determined based on the business scenarios and asset classification standards of enterprise security incidents. Behavioral element types include pre-defined categories such as physical access, network login, and port scanning. Subject and object identifier types include asset categories such as personnel, servers, network devices, and access control devices. The encoding process employs an embedding method suitable for categorical data. A pre-trained encoding model maps each category identifier to a dense vector of fixed dimensions. The training data for the encoding model comes from the element type statistics of historical security incidents within the enterprise, ensuring that the encoding results accurately reflect the semantic relationships between different types. The ontology vector is obtained by concatenating the encoded vectors corresponding to behavioral elements, subject identifiers, and object identifiers in a pre-defined order. ,in, The ontology vector representing the event. The encoding vector representing the type of behavioral element. The encoding vector representing the subject identifier type, This is an encoding vector representing the object identifier type. This vector fully carries the core semantic features of the event, providing a foundation for subsequent semantic relevance analysis of cross-domain events.

[0084] S25. The spatial context vector, temporal context vector, and ontology vector are concatenated and then dimensionality-reduced and fused using a multilayer perceptron encoder to obtain the final unified vector representation of the corresponding physical event or network event.

[0085] Furthermore, the spatial context vector, temporal context vector, and ontology vector are concatenated according to a preset feature priority order. The dimension of the concatenated vector is the sum of the dimensions of the three input vectors. This concatenation process fully preserves the three core features of the event: spatial, temporal, and semantic. The multilayer perceptron encoder consists of an input layer, several hidden layers, and an output layer. The dimension of the input layer is consistent with the dimension of the concatenated vector, and the dimension of the output layer is a preset unified vector dimension. The number of hidden layers and neurons is determined through iterative optimization based on feature complexity and model training performance. The encoder training process learns to reduce the dimensionality of the high-dimensional concatenated vector and fuse features by minimizing the feature reconstruction loss function, ultimately outputting a unified vector representation with unified dimensions and condensed features. ,in, The final unified vector representation of an event, The mapping function represents the encoder of a multilayer perceptron. Represents the spatial context vector, Represents the time context vector. This represents the ontology vector. This final unified vector can comprehensively represent the spatiotemporal and semantic features of an event, providing standardized input data for subsequent causal inference models.

[0086] In one embodiment, the set of associated candidate pairs is input into a pre-trained causal inference model to obtain the causal strength of the influence of physical events on network events. Then, associated candidate pairs whose causal strength exceeds a preset threshold are identified from the set of associated candidate pairs as cross-domain event pairs, resulting in a visualized attribution map, including:

[0087] S31. Based on the final unified vector representation of each event in the associated candidate pair set, obtain the query vector of the physical event and the key vector sequence and value vector sequence of the network event.

[0088] Specifically, the final unified vector representation of each event in the candidate association pair set is a structured dataset storing the final unified vector representations of all physical and network events. Each event's final unified vector is mapped one-to-one with its unique identifier, ensuring the accuracy of vector retrieval. The query vector for a physical event directly uses its corresponding final unified vector, serving as a baseline feature for causal association matching and guiding the relevance screening of network events. The key vector sequence and value vector sequence for network events are obtained by performing two independent linear transformations on the final unified vector of each network event. The weight matrix of the linear transformation is a learnable parameter of the pre-trained causal inference model. Through iterative optimization during model training, the key vector is adapted to the matching dimension of the query vector, while the value vector retains the core features related to causal association between the network event and the query vector. The construction of the key vector sequence and value vector sequence follows the order of network events in the candidate association pair set, ensuring a one-to-one correspondence between the key vector and value vector for each network event. , ,in, Indicates the first The key vector of a network event. The weight matrix represents the linear transformation of the key vectors. Indicates the first The final unified vector of a network event, Indicates the first A vector of values ​​for network events, The weight matrix represents the linear transformation of the value vector.

[0089] S32. Obtain network behavior patterns during historical normal periods that are similar to the spatiotemporal context of physical events, and aggregate them to obtain a vector of control variables.

[0090] This illustration illustrates the filtering of historical normal time periods similar to the spatiotemporal context of physical events. Based on the spatial and temporal context vectors of physical events, it calculates the similarity between the spatiotemporal vectors of physical events within historical time periods and the spatiotemporal vector of the current physical event, filtering out historical time periods that meet preset similarity criteria. Historical normal time periods must meet the following conditions: no confirmed abnormal physical events occurred within the period, and network behavior within the period was determined to be normal operation by security audits, with no attack characteristics or abnormal correlations. Obtaining network behavior patterns involves extracting the final unified vector of all network events within these historical normal time periods. Feature fusion is then performed using a vector aggregation algorithm to obtain a control variable vector that can characterize the baseline of normal network behavior in this type of spatiotemporal scenario. The aggregation process employs an average aggregation strategy to ensure that the control variable vector reflects the overall characteristics of normal network behavior. ,in, Represents the control variable vector. This indicates the number of network events within a normal historical period. Indicates the first [number]th ... The final unified vector of network events.

[0091] S33. Calculate the controlled attention score between physical events and each network event in the set of associated candidate pairs based on the query vector, key vector sequence, value vector sequence, and control variable vector.

[0092] Furthermore, the controlled attention score calculation aims to eliminate the interference of normal network behavior background on causal association determination. By fusing features from query vectors, key vector sequences, value vector sequences, and control variable vectors, it achieves accurate capture of true causal associations. The calculation process obtains the original similarity between the query vector and each key vector through dot product operation, and then obtains the normal background similarity between the query vector and the control variable vector through dot product operation. A weighted parameter is introduced to adjust the two types of similarity, ultimately yielding the controlled attention score for each network event. ,in, Indicates the first Controlled attention score for a network event A query vector representing a physical event. Indicates the first Transpose of a network event key vector This represents the dimension of the key vector. This represents a tradeoff parameter used to adjust the degree to which normal background similarity affects the score. This represents the transpose of the control variable vector.

[0093] S34. Normalize the controlled attention score sequence to obtain the attention weight distribution.

[0094] Optionally, the normalization of the controlled attention score sequence can be achieved using the softmax function. This function maps the controlled attention scores of all network events to the interval [0,1], and the sum of all scores is 1, forming a probabilistic attention weight distribution. The normalization process suppresses the weight proportion of low-scoring network events and highlights the relevance of high-scoring network events, allowing the weight distribution to directly reflect the probability of a causal relationship between each network event and the physical event. ,in, Indicates the first Attention weights for individual network events Represents the natural constant. Indicates the first Controlled attention score for a network event This represents the total number of network events in the set of candidate association pairs. Indicates the first Controlled attention score for each network event.

[0095] S35. The value vector sequence is weighted and summed according to the attention weight distribution to obtain the causal representation. The causal representation is then concatenated with the query vector and input into a pre-trained classifier to obtain the overall causal probability of physical events causing network event anomalies.

[0096] Specifically, the calculation of causal representation is achieved by weighting and summing the value vector sequence through an attention weight distribution. The higher the weight of a network event, the greater its contribution to the causal representation, enabling the causal representation to reflect the characteristics of network events that are strongly correlated with physical events. ,in, Indicates causal representation, Indicates the first Attention weights for individual network events This represents the total number of network events in the set of candidate association pairs. Indicates the first The causal representation and query vector are concatenated using a feature dimension expansion method. The two types of vectors are sequentially combined to form a higher-dimensional fused feature vector, which simultaneously carries the baseline features of the physical event and the correlation features of the network event. The pre-trained classifier is a binary classification neural network model, trained on samples using historical cross-domain events. It can perform non-linear mapping on the fused feature vector, outputting the overall causal probability of a physical event causing an anomaly in the network event. ,in, Represents the overall causal probability. This represents the mapping function of the pre-trained binary classifier. Indicates causal representation, A query vector representing a physical event. This indicates a vector concatenation operation.

[0097] S36. Based on the network event with the largest attention weight distribution, if the corresponding overall causal probability exceeds a preset threshold, then the physical event and the network event with the largest attention weight distribution constitute a cross-domain event pair.

[0098] For example, the network event with the largest attention weight distribution refers to the network event corresponding to the weight with the highest value in the attention weight distribution. This network event is judged as the candidate event with the highest probability of causal association with the physical event. The preset threshold is determined based on the analysis of the receiver operating characteristic curve during model training. Its value balances the accuracy and recall of causal association judgment, ensuring that true causal associations are effectively captured while minimizing the probability of false positives. When the overall causal probability exceeds the preset threshold, it indicates that the association between the physical event and the network event is not a coincidence, but a real logical causal relationship. Therefore, the two are judged to constitute a cross-domain event pair. This judgment result records the overall causal probability and attention weight as the basis for the association strength.

[0099] S37. A visual attribution map is constructed based on each cross-domain event pair.

[0100] Optionally, the construction of the visual attribution graph uses cross-domain event pairs as the core data unit. Key entities of physical and network events in each cross-domain event pair are extracted, including the asset entities corresponding to the subject and object identifiers. These entities are used as nodes in the graph, with node attributes including entity type, identifier information, and associated event identifiers. Based on the causal relationship logic of the cross-domain event pairs, directed edges are constructed from key entities of physical events to key entities of network events. Edge attributes include overall causal probability, attention weight, and event occurrence time intervals. During graph construction, a graph structure optimization algorithm is used to eliminate redundant nodes and edges, ensuring the graph's simplicity and readability. A hierarchical layout strategy is adopted, dividing node distribution areas according to physical and network domains, making the cross-domain causal relationship path intuitively identifiable. Ultimately, a visual attribution graph that clearly displays the causal chain from physical events to network events is formed.

[0101] In one embodiment, a visual attribution map is constructed based on each cross-domain event pair, including:

[0102] S41. Add the key security entities in the cross-domain event pair as nodes to the attribution graph; key security entities include the subject and object identifiers of physical events, as well as the subject and object identifiers of network events.

[0103] Indicatively, key security entities in cross-domain event pairs are the core carriers of causal relationships between events. Their extraction process is based on the structured elements of the events, precisely locating the actual asset entities corresponding to the subject identifier, object identifier, subject identifier, and object identifier of the network event. Each key security entity corresponds to a unique node in the attribution graph. Node creation follows the principle of entity uniqueness; that is, regardless of how many cross-domain event pairs the same asset entity appears in, only one node is created in the graph, avoiding node redundancy. Node attribute settings comprehensively cover the core information of the entity, including entity type (such as personnel, access control devices, servers, IP addresses, etc.), as well as globally unique identifiers, a list of associated cross-domain event pair identifiers, and the entity's current security status. These attributes provide basic data support for subsequent graph analysis and risk assessment, ensuring the completeness and traceability of information for each node.

[0104] S42. Based on the behavioral logic of cross-domain event pairs, create directed edges from the key entity nodes of physical events to the key entity nodes of network events, and set edge attributes for the directed edges; the edge attributes include source event identifier, target event identifier, and overall causal probability.

[0105] Specifically, the behavioral logic of cross-domain event pairs refers to the inherent correlation logic of the key entities in physical events affecting the key entities in network events. For example, the main entity in a physical event, "unauthorized personnel entering the computer room," triggers "abnormal data upload" in a network event by operating a server in the computer room. Its behavioral logic manifests as the main entity actively operating on the object entity. Based on this, the direction of the directed edge is determined to be from the key entity node of the physical event to the key entity node of the network event. The creation of directed edges corresponds one-to-one with cross-domain event pairs, with each directed edge uniquely mapping the causal relationship of a cross-domain event pair. Edge attributes are set to accurately reflect the correlation characteristics. The source event identifier is the globally unique ID of the physical event in the cross-domain event pair, used to locate the starting event of the causal relationship; the target event identifier is the globally unique ID of the network event in the cross-domain event pair, used to locate the result event of the causal relationship; the overall causal probability is the causal strength value calculated by the causal inference model for the cross-domain event pair, used to quantify the credibility of the causal relationship represented by the edge. All edge attributes are associated with the original event data in real time to ensure the accuracy and dynamic updating capability of the attribute information.

[0106] S43. Query the enterprise asset knowledge graph to obtain the set of key asset nodes that have direct access or data storage relationships with each node.

[0107] For example, the enterprise asset knowledge graph contains complete relationship data of all physical and network assets of the enterprise. The stored relationship types cover direct access relationships and data storage relationships. Direct access relationships refer to legitimate access paths or operational permissions between asset entities, such as communication links between servers and network devices, or employee account access permissions to databases. Data storage relationships refer to the association between an asset entity as a data storage carrier and other asset entities, such as the application system to which business data stored on a server belongs, or the business module corresponding to sensitive information stored in a database. The query process uses a graph traversal algorithm, starting from each existing node in the attribution graph, traversing all nodes in the enterprise asset knowledge graph that have direct access or data storage relationships with the starting node, and filtering out nodes belonging to the category of key assets to form a key asset node set. The criteria for determining key assets are preset standards such as the importance level of the asset in the enterprise's business architecture and the sensitivity of the data it carries, ensuring that the nodes in the set are all core assets that may be affected by attacks.

[0108] S44. The set of key asset nodes is taken as a potential target of attack and added to the attribution graph as a dashed edge to obtain the potential path of the attack chain, and the comprehensive risk value of each potential path is calculated.

[0109] Furthermore, the set of critical asset nodes, as potential attack targets, is not considered a causal relationship with existing nodes in the attribution graph. Instead, it represents a possible attack path inferred from asset association logic. Therefore, dashed edges are used for differentiation. The visual characteristics of dashed edges clearly distinguish them from solid edges representing actual causal relationships, facilitating rapid path identification by security analysts. The potential attack chain consists of a sequence of directed edges: "physical event critical entity node → network event critical entity node → potential critical asset node," with each potential path corresponding to a complete inferred attack chain. The comprehensive risk value is calculated by integrating the risk characteristics of each link in the path and using a weighted product model for quantitative assessment. ,in, This represents the overall risk value of a potential path. This indicates the importance coefficient of the critical asset node at the end of the path, which can be set according to the asset's importance level. Indicates the potential path currently being computed. Indicates the first path The severity level coefficient of the vulnerability of the asset or event associated with the stripe. This represents the maximum value among all vulnerability severity coefficients corresponding to all edges on the path. Indicates the first path The overall causal probability corresponding to each edge. This formula represents the product of the overall causal probabilities of all edges on the path. By integrating asset importance, vulnerability risk, and causal credibility, it achieves precise quantification of potential path risks.

[0110] S45. Render the attribution map and the combined risk value of each potential path using a visualization engine to obtain a visualized attribution map.

[0111] Optionally, the visualization engine possesses core functions such as graph structure rendering, risk value visualization, and interactive querying. Its rendering process optimizes the topological structure of the attribution graph using a combination of hierarchical and force-directed layout strategies. Physical domain nodes, network domain nodes, and potential critical asset nodes are divided into different levels according to their domains. Simultaneously, a force-directed algorithm adjusts node spacing to avoid edge overlap, ensuring a clear and readable graph structure. For the comprehensive risk value of each potential path, a visualization method combining color coding and numerical labeling is used. Risk values ​​are mapped to preset color gradient ranges, with higher risk values ​​corresponding to more prominent colors. Specific risk values ​​are also labeled at the endpoint of each potential path or next to the path itself, intuitively presenting the risk differences between paths. The rendering process also supports node and edge interaction. Clicking a node displays details of the corresponding entity, a list of associated events, and records of security status changes. Clicking an edge displays complete edge attribute information and a summary of the causal inference process. Ultimately, it generates a visually appealing attribution graph that combines intuitiveness, information completeness, and interactivity, providing clear visual support for security decision-making.

[0112] In one embodiment, a coordinated response is triggered by the enterprise's dual prevention mechanism based on a visualized attribution map, including:

[0113] S51. Determine a list of assets with potential path associations in the attack chain based on a visualized attribution graph.

[0114] The illustrative, visualized attribution graph comprehensively records the topology and node relationships of potential attack chain paths. The list of assets associated with each potential path is determined by traversing all nodes along each path and extracting the corresponding asset entity information. The traversal process employs a depth-first search algorithm, starting from the starting node of each potential path and sequentially traversing key network event entity nodes and potential key asset nodes along the path, collecting core information such as the globally unique identifier of the asset, asset type, and the business domain to which the asset belongs for each node. The asset list is generated following a deduplication principle; if the same asset entity is associated with multiple potential paths, only one record is retained in the list to avoid duplicate counting. The list also records the potential path identifier associated with each asset, its role in the path (starting node, intermediate node, ending node, etc.), providing a basis for subsequent dynamic risk value calculations and ensuring that the asset list comprehensively and accurately reflects the scope of all assets potentially affected by the attack chain.

[0115] S52. For each asset in the asset list, based on the comprehensive risk value, the dynamic risk increment introduced by the attack chain is added to obtain the dynamic risk value of each asset.

[0116] Specifically, the static risk value of each asset in the asset list is a basic risk quantification indicator based on factors such as the asset's own attributes, historical security event records, and inherent vulnerabilities. Its value reflects the inherent security risk level of the asset when there is no external attack chain. The comprehensive risk value is the risk quantification result of the potential path in which the asset is located, directly reflecting the potential threat level posed by the attack chain to the asset. The dynamic risk increment is an additional risk quantification value derived from the comprehensive risk value and the correlation strength of the asset in the potential path. The correlation strength is determined by the product of the asset's role in the path and the causal probability of the path. The dynamic risk value is calculated by weighting and superimposing the static risk value and the dynamic risk increment. ,in, This represents the dynamic risk value of an asset. This represents the static risk value of an asset. This represents the adjustment factor, used to balance the weighting of static risk and dynamic risk increments. This represents the dynamic risk increment introduced by the attack chain.

[0117] S53. Determine the risk level of an asset based on dynamic risk values ​​and automatically trigger enhanced control measures corresponding to the risk level; measures include logically isolating the asset through a network policy controller or upgrading the access approval level of the area where the asset is located through a physical security system.

[0118] Furthermore, the risk level is determined based on the range of dynamic risk values, with multiple consecutive risk value intervals preset. Each interval corresponds to a unique risk level, such as low risk, medium risk, high risk, and extremely high risk. The interval division criteria are determined based on the enterprise's security management standards and risk tolerance capabilities, ensuring that the risk level can accurately distinguish the risk differences of different assets. When the dynamic risk value falls into a certain risk value interval, the risk level of the corresponding interval for that asset is automatically determined. Enhanced control measures and risk levels adopt a preset mapping relationship. The mapping rules are formulated based on the threat severity and impact scope corresponding to the risk level, ensuring the measures are targeted and effective. The network policy controller, upon receiving risk level trigger commands, calls its own API interface to generate and issue logical isolation policies, restricting communication links between the asset and unnecessary network nodes, blocking the network propagation path of the attack chain. Upon receiving the command, the physical security system automatically adjusts the access approval process of the physical area where the asset is located, enhances the access permission verification level, increases the frequency of access records and audit strength, and curbs the further spread of the attack chain from a physical perspective.

[0119] S54. Generate a structured investigation work order based on the edge attributes in the visualized attribution graph; the investigation work order includes the physical location, time and specific inspection items of the corresponding physical event node, as well as the target IP address, scanning command and verification command of the corresponding network event node.

[0120] Optionally, the edge attributes of the visualized attribution graph include core information such as source event identifier, target event identifier, overall causal probability, and event occurrence time interval. This information provides crucial data support for the generation of structured investigation work orders. The generation of structured investigation work orders follows a fixed template format to ensure the standardization and executability of the work order content. For work order content involving physical event nodes, physical location information is derived from the attribute data of key entity nodes of the physical event, accurately pointing to the specific physical spatial range where the event occurred; time information is extracted from the timestamp of the physical event, clarifying the specific time period during which the event occurred; specific inspection items are generated based on the behavioral logic of cross-domain event pairs and the event characteristics associated with edge attributes, focusing on potential safety hazards caused by physical events, such as the integrity of equipment physical status, the retention of operation traces, and abnormal environmental changes. For work order content related to network event nodes, the target IP address originates from the object identification information of the key entity node of the network event, clearly identifying the specific network asset affected by the network event. Scanning commands are generated based on the behavioral elements and associated vulnerability characteristics of the network event, used to detect whether network assets contain corresponding malicious files, system vulnerabilities, or other security risks. Verification commands target key operations involved in the network event, such as login behavior, data transmission, and configuration changes, used to verify whether there are any anomalies in the network asset's log records, account status, and configuration parameters. Work orders also include structured information such as a work order number, priority determined based on overall causal probability and dynamic risk value, responsible department, completion deadline, and fields for entering verification results, ensuring full-process traceability and closed-loop management of work orders.

[0121] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0122] Based on the same inventive concept, this application also provides an enterprise information security management system for implementing the enterprise information security management method described above. The solution provided by this system is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more enterprise information security management system embodiments provided below can be found in the limitations of the enterprise information security management method described above, and will not be repeated here.

[0123] In one exemplary embodiment, such as Figure 2 As shown, an enterprise information security management system is provided, including:

[0124] The system environment module 201 is used to acquire heterogeneous security data of physical and network environments, and to perform standardized parsing and element extraction on the heterogeneous security data to obtain physical events and network events; the heterogeneous security data includes timestamps, spatial location coordinates, subject identifiers, object identifiers and behavioral elements;

[0125] The association candidate module 202 is used to perform cross-domain association analysis on the physical event and the network event based on a preset unified event model, and calculate the spatiotemporal proximity and semantic relevance between the physical event and the network event to obtain a set of association candidate pairs;

[0126] The causal inference module 203 is used to input the set of associated candidate pairs into a pre-trained causal inference model to obtain the causal strength of the influence of the physical event on the network event, and to identify the associated candidate pairs whose causal strength exceeds a preset threshold from the set of associated candidate pairs as cross-domain event pairs, thereby obtaining a visual attribution map.

[0127] The safety management module 204 is used to trigger the enterprise's dual prevention mechanism for a coordinated response based on the visualized attribution map; wherein, the coordinated response includes converting the risk paths in the visualized attribution map into dynamically adjusted risk levels, and generating a hidden danger investigation task based on the visualized attribution map.

[0128] In one embodiment, the associated candidate module 202 is further configured to:

[0129] In response to the acquisition of newly generated physical events, a forward time window and a backward time window based on a preset time step are set with the timestamp of the newly generated physical event as the center to obtain the correlation analysis time range;

[0130] An initial set of network events is constructed based on all network events that occur within the time frame of the correlation analysis.

[0131] Based on a pre-built enterprise spatial asset knowledge graph, a list of network assets that are connected to the spatial coordinates of newly generated physical events can be obtained by querying.

[0132] From the initial set of network events, network events whose object identifiers or subject identifiers belong to the list of network assets are selected to obtain a subset of spatially associated network events;

[0133] The newly generated physical events are paired with each network event in the spatial association network event subset to obtain a set of association candidate pairs.

[0134] In one embodiment, an event representation vector module is also included for:

[0135] For physical or network events in the set of associated candidate pairs, based on the enterprise spatial asset knowledge graph, a random walk with a fixed step size is performed starting from the entity corresponding to the physical or network event to generate a sequence of entity nodes associated with the event.

[0136] The entity node vector of each entity node is obtained by using a graph embedding algorithm based on the entity node sequence, and the entity node vectors are averaged and aggregated to obtain the spatial context vector of the event.

[0137] For the same physical or network event, the corresponding timestamp is decomposed into a periodic feature vector and fused with behavioral elements to obtain the event's temporal context vector.

[0138] For the same physical or network event, the types corresponding to behavioral elements, subject identifiers, and object identifiers are encoded to obtain the event's ontology vector;

[0139] Spatial context vector, temporal context vector, and ontology vector are concatenated and then dimensionality-reduced and fused using a multilayer perceptron encoder to obtain the final unified vector representation of the corresponding physical or network event.

[0140] In one embodiment, the causal inference module 203 is further configured to:

[0141] Based on the final unified vector representation of each event in the associated candidate pair set, the query vector of the physical event and the key vector sequence and value vector sequence of the network event are obtained;

[0142] Obtain network behavior patterns from historical normal periods that are similar to the spatiotemporal context of physical events, and aggregate them to obtain a vector of control variables;

[0143] Calculate the controlled attention score between physical events and each network event in the set of associated candidate pairs based on the query vector, key vector sequence, value vector sequence, and control variable vector;

[0144] The controlled attention score sequence is normalized to obtain the attention weight distribution;

[0145] The value vector sequence is weighted and summed according to the attention weight distribution to obtain the causal representation. The causal representation is then concatenated with the query vector and input into a pre-trained classifier to obtain the overall causal probability of physical events causing network event anomalies.

[0146] Based on the network event with the largest attention weight distribution, if the corresponding overall causal probability exceeds a preset threshold, the physical event and the network event with the largest attention weight distribution are determined to constitute a cross-domain event pair.

[0147] A visual attribution map is constructed based on each cross-domain event pair.

[0148] In one embodiment, a visualization attribution mapping module is also included, for:

[0149] Key security entities in cross-domain event pairs are added as nodes to the attribution graph; key security entities include the subject and object identifiers of physical events, as well as the subject and object identifiers of network events.

[0150] Based on the behavioral logic of cross-domain event pairs, directed edges are created from the key entity nodes of physical events to the key entity nodes of network events, and edge attributes are set for the directed edges; the edge attributes include the source event identifier, the target event identifier, and the overall causal probability;

[0151] Query the enterprise asset knowledge graph to obtain the set of key asset nodes that have direct access or data storage relationships with each node;

[0152] The set of key asset nodes is considered as potential attack targets and added to the attribution graph as dashed edges to obtain potential paths of the attack chain, and the comprehensive risk value of each potential path is calculated.

[0153] The attribution map and the combined risk value of each potential path are rendered using a visualization engine to obtain a visualized attribution map.

[0154] In one embodiment, the security management module 204 is further configured to:

[0155] A list of assets associated with potential paths in an attack chain is determined based on a visualized attribution graph.

[0156] For each asset in the asset list, a dynamic risk value is obtained by overlaying a dynamic risk increment introduced by the attack chain on the comprehensive risk value.

[0157] The risk level of an asset is determined based on dynamic risk values, and enhanced control measures corresponding to the risk level are automatically triggered. These measures include logically isolating the asset through a network policy controller or upgrading the access approval level of the area where the asset is located through a physical security system.

[0158] A structured investigation work order is generated based on the edge attributes in the visualized attribution graph. The investigation work order includes the physical location, time and specific inspection items of the corresponding physical event node, as well as the target IP address, scanning command and verification command of the corresponding network event node.

[0159] In one embodiment, a computer device is provided, including a memory and a processor, the memory storing a computer program, the processor executing the computer program to implement the steps in the above method embodiments.

[0160] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps in the above method embodiments.

[0161] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can be referred to in the description of the method embodiments. The device embodiments described above are merely illustrative. The components described as separate parts may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this disclosure according to actual needs. Those skilled in the art can understand and implement this without creative effort.

[0162] The above-described embodiments are merely illustrative of several implementation methods of the embodiments of this application, and their descriptions are relatively specific and detailed. However, they should not be construed as limiting the scope of the patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the embodiments of this application, and these modifications and improvements all fall within the protection scope of the embodiments of this application.

Claims

1. A method for enterprise information security management, characterized in that, The method includes: Heterogeneous security data from physical and network environments is acquired, and the heterogeneous security data is standardized and parsed and its elements are extracted to obtain physical events and network events; the heterogeneous security data includes timestamps, spatial coordinates, subject identifiers, object identifiers, and behavioral elements; Based on a pre-defined unified event model, cross-domain correlation analysis is performed on the physical events and the network events, and the spatiotemporal proximity and semantic relevance between the physical events and the network events are calculated to obtain a set of candidate correlation pairs. The set of associated candidate pairs is input into a pre-trained causal inference model to obtain the causal strength of the influence of the physical event on the network event, and the associated candidate pairs whose causal strength exceeds a preset threshold are identified from the set of associated candidate pairs as cross-domain event pairs to obtain a visual attribution map. The enterprise's dual prevention mechanism is triggered based on the visualized attribution map to carry out a coordinated response; wherein, the coordinated response includes converting the risk paths in the visualized attribution map into dynamically adjusted risk levels, and generating a hidden danger investigation task based on the visualized attribution map.

2. The method according to claim 1, characterized in that, The method involves performing cross-domain correlation analysis on the physical events and network events based on a preset unified event model, and calculating the spatiotemporal proximity and semantic relevance between the physical events and network events to obtain a set of candidate correlation pairs, including: In response to the acquisition of a newly generated physical event, a forward time window and a backward time window based on a preset time step are set with the timestamp of the newly generated physical event as the center to obtain the correlation analysis time range; Based on all the network events that occurred within the time frame of the correlation analysis, an initial set of network events is constructed; Based on a pre-built enterprise spatial asset knowledge graph, a list of network assets connected to the spatial coordinates of the newly generated physical event is obtained by querying. From the initial set of network events, network events whose object identifier or subject identifier belongs to the list of network assets are selected to obtain a subset of spatially associated network events; The newly generated physical event is paired with each of the network events in the spatial association network event subset to obtain the association candidate pair set.

3. The method according to claim 2, characterized in that, Before inputting the set of associated candidate pairs into a pre-trained causal inference model to obtain the causal strength of the influence of the physical event on the network event, and identifying associated candidate pairs whose causal strength exceeds a preset threshold as cross-domain event pairs from the set of associated candidate pairs to obtain a visualized attribution map, the process further includes: For the physical event or the network event in the set of associated candidate pairs, based on the enterprise spatial asset knowledge graph, a random walk with a fixed step size is performed starting from the entity corresponding to the physical event or the network event to generate a sequence of entity nodes associated with the event; The entity node vector of each entity node is obtained by using a graph embedding algorithm based on the entity node sequence, and the entity node vectors are averaged and aggregated to obtain the spatial context vector of the event. For the same physical event or network event, the corresponding timestamp is decomposed into a periodic feature vector and fused with the behavioral elements to obtain the event's temporal context vector. For the same physical event or network event, the types corresponding to the behavioral elements, subject identifiers, and object identifiers are encoded to obtain the event's ontology vector; The spatial context vector, the temporal context vector, and the ontology vector are concatenated and then dimensionality-reduced and fused using a multilayer perceptron encoder to obtain the final unified vector representation corresponding to the physical event or the network event.

4. The method according to claim 3, characterized in that, The process involves inputting the set of associated candidate pairs into a pre-trained causal inference model to obtain the causal strength of the influence of the physical event on the network event, and identifying associated candidate pairs whose causal strength exceeds a preset threshold from the set of associated candidate pairs as cross-domain event pairs, thereby obtaining a visualized attribution map, including: Based on the final unified vector table corresponding to each event in the set of associated candidate pairs, the query vector of the physical event and the key vector sequence and value vector sequence of the network event are obtained; Obtain network behavior patterns from historical normal periods that are similar to the spatiotemporal context of the physical event, and aggregate them to obtain a vector of control variables; The controlled attention score between the physical event and each network event in the set of associated candidate pairs is calculated based on the query vector, the key vector sequence, the value vector sequence, and the control variable vector. The controlled attention score sequence is normalized to obtain the attention weight distribution; The value vector sequence is weighted and summed according to the attention weight distribution to obtain a causal representation. The causal representation is then concatenated with the query vector and input into a pre-trained classifier to obtain the overall causal probability of the physical event causing network event anomalies. Based on the network event with the largest attention weight distribution, if the corresponding overall causal probability exceeds a preset threshold, then the physical event and the network event with the largest attention weight distribution constitute the cross-domain event pair. The visualized attribution map is constructed based on each of the cross-domain event pairs.

5. The method according to claim 4, characterized in that, The process of constructing the visualized attribution map based on each of the cross-domain event pairs includes: The key security entities in the cross-domain event pairs are added as nodes to the attribution graph; the key security entities include the subject identifier and object identifier of physical events, and the subject identifier and object identifier of network events. Based on the behavioral logic of the cross-domain event pair, a directed edge is created from the key entity node of the physical event to the key entity node of the network event, and edge attributes are set for the directed edge; the edge attributes include the source event identifier, the target event identifier, and the overall causal probability; Query the enterprise asset knowledge graph to obtain the set of key asset nodes that have direct access or data storage relationships with each of the aforementioned nodes; The set of key asset nodes is used as a potential target of attack and added to the attribution graph as dashed edges to obtain potential paths of the attack chain, and the comprehensive risk value of each potential path is calculated. The attribution map and the combined risk value of each potential path are rendered using a visualization engine to obtain the visualized attribution map.

6. The method according to claim 5, characterized in that, The triggering of the enterprise's dual prevention mechanism based on the visualized attribution map includes: Based on the visualized attribution graph, a list of assets potentially associated with the attack chain is determined; For each asset in the asset list, based on the comprehensive risk value, the dynamic risk increment introduced by the attack chain is added to obtain the dynamic risk value of each asset. The risk level of an asset is determined based on the dynamic risk value, and enhanced control measures corresponding to the risk level are automatically triggered. These measures include logically isolating the asset through a network policy controller or raising the access approval level of the area where the asset is located through a physical security system. A structured investigation work order is generated based on the edge attributes in the visualized attribution graph; the investigation work order includes the physical location, time and specific inspection items of the corresponding physical event node, as well as the target IP address, scanning command and verification command of the corresponding network event node.

7. An enterprise information security management system, characterized in that, The system includes: The system environment module is used to acquire heterogeneous security data from the physical and network environments, and to perform standardized parsing and element extraction on the heterogeneous security data to obtain physical events and network events; the heterogeneous security data includes timestamps, spatial location coordinates, subject identifiers, object identifiers, and behavioral elements. The association candidate module is used to perform cross-domain association analysis on the physical event and the network event based on a preset unified event model, and to calculate the spatiotemporal proximity and semantic relevance between the physical event and the network event to obtain a set of association candidate pairs. The causal inference module is used to input the set of associated candidate pairs into a pre-trained causal inference model to obtain the causal strength of the influence of the physical event on the network event, and to identify the associated candidate pairs whose causal strength exceeds a preset threshold as cross-domain event pairs from the set of associated candidate pairs to obtain a visual attribution map. The safety management module is used to trigger the enterprise's dual prevention mechanism for a coordinated response based on the visualized attribution map; wherein, the coordinated response includes converting the risk paths in the visualized attribution map into dynamically adjusted risk levels, and generating hazard investigation tasks based on the visualized attribution map.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 6.

Images