Active network security defense method, device and equipment

Abstract

The invention discloses an active network security defense method, device and equipment, and the method comprises the steps: collecting multi-mode security metadata, and carrying out the preprocessing of the multi-mode security metadata, and obtaining standardized data; constructing a heterogeneous relation graph based on the standardized data; inputting the heterogeneous relation graph into a space-time fusion model for space correlation analysis and time sequence analysis to obtain a dynamic threat probability of a corresponding target security entity; determining a risk level according to the dynamic threat probability, and selecting a target security policy from a preset policy template library based on the risk level; and issuing the target security policy to a corresponding network device or terminal device for execution, collecting feedback information after the execution of the target security policy, and performing adaptive optimization on the detection threshold and policy parameters of the space-time fusion model according to the feedback information. According to the invention, active detection of network threats can be realized, the risk of false alarm and missing alarm is effectively reduced, and the accuracy of defense actions is improved.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a proactive network security defense method, apparatus, and device. Background Technology

[0002] With the rapid development of information technology, network attack methods are becoming increasingly complex and covert, posing numerous challenges to traditional defense methods. New attack patterns such as Advanced Persistent Threats (APTs), penetration through encrypted channels, lateral movement across systems, and credential abuse are constantly emerging, posing a severe challenge to traditional passive defense systems based on static signature and rule matching. Existing mainstream security solutions, such as Intrusion Detection / Prevention Systems (IDS / IPS), Security Information and Event Management (SIEM) combined with Security Orchestration and Automated Response (SOAR), User and Entity Behavior Analysis (UEBA), and Endpoint Detection and Response (EDR / XDR), have revealed several common bottlenecks in practice. These solutions are either limited to a single data dimension (such as focusing only on network traffic or terminal logs), lacking unified correlation analysis and contextual understanding of multi-source heterogeneous data; or rely on predefined static rules and thresholds, making it difficult to adapt to the dynamic evolution of unknown threats and slow attack behavior patterns, resulting in both false negatives and false negatives; or although they have a certain degree of automated response capabilities, their strategy formulation often lags behind the progress of the attack, and after execution, they lack a closed-loop feedback and adaptive optimization mechanism based on the actual protection effect and business impact, which can easily lead to excessively long response windows or excessive defense affecting normal business, and thus fail to form a comprehensive closed-loop defense. Summary of the Invention

[0003] In view of this, the purpose of this invention is to propose a proactive network security defense method, apparatus, and device, which aims to solve problems such as missed detections, delayed response, data fragmentation, and insufficient policy loop in existing network security defenses.

[0004] To achieve the above objectives, the present invention provides a proactive network security defense method, the method comprising: Collect multimodal security metadata from the network side, terminal side, identity side, and service side, and preprocess the multimodal security metadata to obtain standardized data; A heterogeneous relationship graph is constructed based on the standardized data, wherein the nodes in the heterogeneous relationship graph include different types of security entities, and the edges in the heterogeneous relationship graph represent semantic associations between security entities. The heterogeneous relationship graph is input into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity; The risk level is determined based on the dynamic threat probability, and a target security policy is selected from a preset policy template library based on the risk level. The target security policy is distributed to the corresponding network device or terminal device for execution, and feedback information after the execution of the target security policy is collected. Based on the feedback information, the detection threshold and policy parameters of the spatiotemporal fusion model are adaptively optimized.

[0005] Preferably, the preprocessing of the multimodal security metadata to obtain standardized data includes: The multimodal security metadata is subjected to basic processing including time alignment, numerical normalization, and category encoding to obtain basic processed data; The encrypted network traffic in the basic processing data is fingerprinted using the JA3 or JA3S algorithm to obtain encrypted traffic feature vectors. eBPF technology is used to associate and encode the process identifier and network connection session in the basic processing data to obtain the association data between the process and the session, and the basic processing data, the association data, and the encrypted traffic feature vector are used as the standardized data.

[0006] Preferably, the heterogeneous relationship graph constructed based on the standardized data includes nodes of different types of security entities, and edges in the heterogeneous relationship graph represent semantic associations between security entities, including: Based on the basic processing data, the correlation data, and the encrypted traffic feature vector, nodes and edges in the heterogeneous relationship graph are defined, and dynamic weights are assigned to each edge; wherein... The dynamic weight is calculated based on the interaction frequency, port sensitivity, traffic fingerprint similarity, and traffic direction anomaly. The traffic fingerprint similarity feature is calculated based on the encrypted traffic feature vector. The security entities include user accounts, terminal devices, server hosts, business applications, sensitive files, processes, and network sessions; the relationships include execution edges representing startup relationships, access edges representing access relationships, and belonging edges representing subordinate relationships.

[0007] Preferably, the dynamic weight is calculated based on interaction frequency, port sensitivity, traffic fingerprint similarity, and traffic direction anomaly, including: The dynamic weights are calculated using the formula w = α·freq + β·port_score + γ·ja3_sim + δ·dir, where freq represents the feature value of interaction frequency, port_score represents the feature value of port sensitivity, ja3_sim represents the feature value of traffic fingerprint similarity, dir represents the feature value of traffic direction anomaly, and α, β, γ, and δ represent the corresponding weight coefficients.

[0008] Preferably, the heterogeneous relationship diagram further includes: according to The dynamic weights are decayed and updated to obtain the updated weights, where w new This indicates updating the weights, where w represents the current dynamic weights, λ represents the time decay factor, and t represents the time decay factor. now t represents the current time for calculating and updating the weights. last Indicates the time of the last weight update; When the updated weight is determined to be less than the preset aging threshold, the corresponding edge is deleted from the heterogeneous relationship graph.

[0009] Preferably, the spatiotemporal fusion model includes a graph neural network layer and a time series model layer; the step of inputting the heterogeneous relationship graph into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity includes: The heterogeneous relationship graph is input into the graph neural network layer for spatial correlation analysis, which includes multi-layer message passing and feature aggregation, to obtain spatial features that characterize the abnormal connection topology of nodes. The spatial features are generated into a feature sequence in chronological order, and the feature sequence is input into the time series model layer for time series analysis to output the dynamic threat probability. The time series analysis process includes capturing the degree of deviation of the target security entity's behavior pattern on the time axis.

[0010] Preferably, the step of determining the risk level based on the dynamic threat probability and selecting a target security policy from a preset policy template library based on the risk level includes: If the probability of the dynamic threat is less than the first threshold, the risk level is determined to be normal. If the probability of the dynamic threat is determined to be greater than or equal to a first threshold and less than a second threshold, then the risk level is determined to be the observation level. If the probability of the dynamic threat is greater than or equal to the second threshold, then the risk level is determined to be an execution level. When the risk level is the execution level, according to R = P(t)×W b + C calculates the comprehensive risk value, and selects a matching target security policy from the policy template library based on the comprehensive risk value, where P(t) represents the dynamic threat probability, and W b C represents the context factor; the security policies in the policy template library include micro-segmentation policy, access degradation policy, mandatory multi-factor authentication policy, decoy traffic redirection policy, session termination policy, packet capture policy, and evidence collection policy.

[0011] Preferably, the step of adaptively optimizing the detection threshold and policy parameters of the spatiotemporal fusion model based on the feedback information includes: The detection threshold is dynamically adjusted based on the false alarms and missed alarms in the feedback information, wherein the detection threshold includes a first threshold and a second threshold; The policy parameters are dynamically adjusted based on the policy execution effect and user complaint information in the feedback information, wherein the policy parameters include the security policy timeout parameter and / or execution priority parameter; The high-confidence data in the feedback information is used as training samples to incrementally learn or fine-tune the spatiotemporal fusion model.

[0012] To achieve the above objectives, the present invention also provides an active network security defense device, the device comprising: The data acquisition unit is used to collect multimodal security metadata, including network side, terminal side, identity side and service side, and preprocess the multimodal security metadata to obtain standardized data; The graph construction unit is used to construct a heterogeneous relationship graph based on the standardized data, wherein the nodes in the heterogeneous relationship graph include different types of security entities, and the edges in the heterogeneous relationship graph represent semantic associations between security entities. The model analysis unit is used to input the heterogeneous relationship graph into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity. The strategy selection unit is used to determine the risk level based on the dynamic threat probability, and select a target security strategy from a preset strategy template library based on the risk level. The optimization unit is used to distribute the target security policy to the corresponding network device or terminal device for execution, collect feedback information after the target security policy is executed, and adaptively optimize the detection threshold and policy parameters of the spatiotemporal fusion model based on the feedback information.

[0013] To achieve the above objectives, the present invention also proposes an active network security defense device, including a processor, a memory, and a computer program stored in the memory, wherein the computer program is executed by the processor to implement the steps of an active network security defense method as described in the above embodiments.

[0014] To achieve the above objectives, the present invention also proposes a computer-readable storage medium storing a computer program that is executed by a processor to implement the steps of an active network security defense method as described in the above embodiments.

[0015] Beneficial effects: The above solution constructs a complete proactive defense closed loop encompassing perception, cognition, decision-making, action, and learning. By collecting multimodal security metadata and constructing a heterogeneous relationship graph, combined with a spatiotemporal fusion model for dynamic threat probability calculation, it enables correlation analysis and dynamic prediction of network threats, achieving proactive and accurate detection. Risk-level-based strategy selection and adaptive optimization mechanisms form a closed-loop defense from detection to response, improving the automation and intelligence of security responses, effectively reducing false positives and false negatives, and achieving precise and systematic defense actions. Simultaneously, through feedback loops, it continuously optimizes the defense effect, achieving self-evolution capabilities, significantly shortening the attack exposure window, and improving the overall intelligence and adaptability of the defense.

[0016] By extracting feature vectors from encrypted traffic using the JA3 / JA3S algorithm, effective behavioral characterization and tracking can be achieved even in the face of encrypted communication. Furthermore, by utilizing eBPF technology to implement strong correlation encoding between processes and network sessions, the key context of "who (process) accessed where (network) when" in the attack chain can be accurately reconstructed. This effectively penetrates the data barrier between network logs and terminal logs, providing core correlation evidence for constructing accurate heterogeneous relationship graphs, enhancing the ability to identify encrypted traffic and complex process relationships, and laying a reliable data foundation for threat detection.

[0017] A semantic relationship graph that dynamically and quantitatively reflects the complex interactions between security entities was constructed. By abstracting users, devices, applications, processes, and sessions as nodes, and abstracting their relationships (such as initiation, access, and ownership) as edges with clear semantics, a visualized and structured model of complex network environments and attack behaviors was achieved. By assigning dynamic weights to edges (calculated based on interaction frequency, port sensitivity, fingerprint similarity, and directional features) and introducing a time decay mechanism, this relationship graph can not only quantitatively assess the risk of a single interaction but also dynamically track the state changes and historical trends of entity relationships. This enables the system to effectively identify low-frequency, slow lateral movement behaviors and uses traffic fingerprint similarity features to assist in identifying abnormal traffic, thereby enhancing the ability to detect covert threats (such as APTs). Simultaneously, the weight decay mechanism avoids data redundancy and improves computational efficiency.

[0018] Employing a cascaded architecture comprising a graph neural network layer and a temporal model layer, this approach achieves deep fusion analysis of threats across both spatial correlation and temporal dimensions. The graph neural network layer learns spatial correlation patterns between entities from the topological structure of a heterogeneous graph, effectively capturing anomalous connection paths and community structures. The temporal model layer focuses on analyzing the sequential characteristics of entity behavior over time, identifying anomalous deviations in behavioral rhythm and long-term latency patterns. This spatiotemporal fusion analysis enables the model to simultaneously capture spatial anomalies in the topological structure and the evolutionary patterns of behavioral temporal sequences, thereby achieving dynamic assessment and trend prediction of the threat landscape. This results in the output of dynamically evolving threat probabilities, achieving true threat prediction rather than simple post-event detection.

[0019] By establishing a three-tiered risk level classification mechanism (e.g., normal, observation, and execution) and calculating a comprehensive risk value, continuous threat probabilities are transformed into actionable discrete risk levels. Based on dynamic threat probabilities, and by introducing business weights and context factors, multi-dimensional risk assessment based on asset importance (business weights) and real-time environment (real-time context information) is achieved. Response strategies are automatically selected from a template library containing policies such as micro-segmentation, access degradation, and mandatory authentication based on the comprehensive risk value, ensuring a risk-driven, tiered response defense effect. Furthermore, detection thresholds and strategy parameters are dynamically optimized through feedback information, and incremental learning is combined to continuously improve model performance, forming an adaptive closed-loop optimization mechanism. This effectively reduces the impact of false alarms, minimizing interference with normal business operations while ensuring security. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an embodiment of the proactive network security defense method provided by the present invention.

[0022] Figure 2 This is a schematic diagram of the overall process of proactive network security defense provided in an embodiment of the present invention.

[0023] Figure 3 This is a schematic diagram of the structure of an active network security defense device provided in an embodiment of the present invention.

[0024] The realization of the invention's objective, its functional characteristics, and advantages will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. Detailed Implementation

[0025] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only a part of the embodiments of the present invention, not all of them. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Therefore, the following detailed description of the embodiments of the present invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to represent selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0026] The present invention will be described in detail below with reference to the embodiments.

[0027] Reference Figure 1 The diagram shown is a flowchart of a proactive network security defense method provided in an embodiment of the present invention.

[0028] In this embodiment, the method includes: S11, collect multimodal security metadata including network side, terminal side, identity side and service side, and preprocess the multimodal security metadata to obtain standardized data.

[0029] The collection of multimodal security metadata, including network-side, terminal-side, identity-side, and service-side metadata, includes: Collect network traffic logs and session connection data from the network side; Collect process behavior logs and file operation records from the terminal side; Collect user login information and permission change records from the identity side; Collect application access logs and API call sequences from the business side.

[0030] Furthermore, the preprocessing of the multimodal security metadata to obtain standardized data includes: The multimodal security metadata is subjected to basic processing including time alignment, numerical normalization, and category encoding to obtain basic processed data; The encrypted network traffic in the basic processing data is fingerprinted using the JA3 or JA3S algorithm to obtain encrypted traffic feature vectors. eBPF technology is used to associate and encode the process identifier and network connection session in the basic processing data to obtain the association data between the process and the session, and the basic processing data, the association data, and the encrypted traffic feature vector are used as the standardized data.

[0031] Reference Figure 2 As shown. In this embodiment, raw multimodal security metadata is collected synchronously from multiple dimensions through distributed deployment of collection probes or agents. Specifically, full traffic mirror data, VPC flow logs, and network session metadata are collected from the network side; from the terminal side, kernel-level process creation and exit, file read / write operations, and external network connection behavior event logs are collected using embedded eBPF probes; from the identity side, user successful / failed login logs, multi-factor authentication (MFA) events, and account permission change records are collected through integration with identity providers (IdP) or directory services; from the business side, access logs and API call sequences and their parameters of business functions are collected by parsing application server logs or listening to API gateways. These logs and data from different sources and in different formats constitute the raw input for subsequent analysis.

[0032] The collected multimodal security metadata undergoes deep preprocessing to generate standardized data. This preprocessing includes basic processing, such as time alignment of all input metadata (ensuring a unified clock reference), normalization of numerical fields to eliminate the influence of units, and standardization operations such as one-hot encoding of categorical fields like protocol type and operating system version. This results in standardized basic processing data with a unified structure that can be directly used for computation. Based on this, key advanced feature extraction is performed, including: for encrypted network traffic (such as TLS / SSL communication) in the basic processing data, using the JA3 or JA3S algorithm to extract features of the handshake phase and generate fixed-dimensional fingerprint vectors, thus obtaining encrypted traffic feature vectors that can be used to identify and track specific client or server tools; for terminal process events and network connection events in the basic processing data, using eBPF technology to capture process identifiers (such as PID, process hash) and network 5-tuple (source IP, source port, destination IP, destination port, protocol) information for precise association encoding, thereby solidifying the key relationship of "which process initiated which network connection," obtaining process-session association data. Ultimately, the basic processing data, encrypted traffic feature vectors, and process-session relationship data are integrated to form a standardized data set with a good format, rich features, and clear relationships, providing a direct and high-quality data foundation for the subsequent construction of heterogeneous relationship graphs.

[0033] S12, construct a heterogeneous relationship graph based on the standardized data, wherein the nodes in the heterogeneous relationship graph include different types of security entities, and the edges in the heterogeneous relationship graph represent semantic associations between security entities.

[0034] Furthermore, the heterogeneous relationship graph constructed based on the standardized data includes nodes of different types of security entities, and edges in the heterogeneous relationship graph represent semantic associations between security entities, including: Based on the basic processing data, the correlation data, and the encrypted traffic feature vector, nodes and edges in the heterogeneous relationship graph are defined, and dynamic weights are assigned to each edge; wherein... The dynamic weight is calculated based on the interaction frequency, port sensitivity, traffic fingerprint similarity, and traffic direction anomaly. The traffic fingerprint similarity feature is calculated based on the encrypted traffic feature vector. The security entities include user accounts, terminal devices, server hosts, business applications, sensitive files, processes, and network sessions; the relationships include execution edges representing startup relationships, access edges representing access relationships, and belonging edges representing subordinate relationships.

[0035] Furthermore, the dynamic weights are calculated based on interaction frequency, port sensitivity, traffic fingerprint similarity, and traffic direction anomaly, including: The dynamic weights are calculated using the formula w = α·freq + β·port_score + γ·ja3_sim + δ·dir, where freq represents the feature value of interaction frequency, port_score represents the feature value of port sensitivity, ja3_sim represents the feature value of traffic fingerprint similarity, dir represents the feature value of traffic direction anomaly, and α, β, γ, and δ represent the corresponding weight coefficients.

[0036] Furthermore, the heterogeneous relationship diagram also includes: according to The dynamic weights are decayed and updated to obtain the updated weights, where w new This indicates updating the weights, where w represents the current dynamic weights, λ represents the time decay factor, and t represents the time decay factor. now t represents the current time for calculating and updating the weights. last Indicates the time of the last weight update; When the updated weight is determined to be less than the preset aging threshold, the corresponding edge is deleted from the heterogeneous relationship graph.

[0037] In this embodiment, based on the standardized data obtained in step S11, a heterogeneous relationship graph capable of depicting complex interactions between security entities is dynamically constructed and maintained. The construction of this graph begins with the extraction and mapping of key elements from the standardized data. First, fields such as user ID, device ID, server IP, application ID, and file path are parsed from the basic processing data and defined as graph nodes representing subjects (user accounts, terminal devices), objects (server hosts, business applications, sensitive files), and intermediate entities (processes, network sessions). These nodes carry rich attribute features; for example, user and terminal nodes can be associated with geolocation information, process nodes can be tagged with eBPF kernel event labels (such as file tampering, sensitive system calls), and network session nodes are associated with their JA3 / JA3S traffic fingerprint vectors. Simultaneously, using the process-session association data, precise links are established between process nodes and the network session nodes they initiate.

[0038] The definition of edges gives the relationship graph rich semantics, mainly establishing the following types of edges to characterize the behavioral chain: execution edges are used to connect user nodes and the process nodes they start (user node → process node), indicating "who executed what"; access edges are used to connect process nodes and the network targets (IP / host) or file nodes they access (process node → network address / process node → file node), indicating "what the process accessed"; belonging edges are used to connect IP addresses and host nodes, or process nodes and their respective user nodes (IP → host / process node → user node), indicating "subordination relationship". Each edge is assigned a dynamic weight w to quantify the real-time risk or anomaly level of the interaction. This dynamic weight is calculated using the formula w = α·freq + β·port_score + γ·ja3_sim + δ·dir. In this formula, freq (Interaction Frequency) represents the number of interactions between the nodes at both ends of the edge within the current time window; port_score (Port / Service Sensitivity) represents a pre-defined risk coefficient based on the target port number (e.g., accessing management ports like 22 / 3389 scores higher); ja3_sim (Fingerprint Similarity) calculates similarity by comparing the encrypted traffic feature vector associated with the current session node with the historical fingerprint baseline of the target node, effectively identifying spoofed traffic using the same tools but with a different source address; and dir (Directional Entropy) represents the entropy value of analyzing the directionality of traffic (e.g., abnormal outbound connections) and load distribution. The weight coefficients α, β, γ, and δ are adjustable parameters that can be preset based on experience or optimized through model learning. Contextual attributes such as geographical location can be used as contextual factors in subsequent risk assessments (such as abnormal login locations).

[0039] Furthermore, to ensure the graph reflects real-time risk conditions and focuses on recent activities, the system introduces a time-domain maintenance mechanism (time decay factor). The weight of each edge decays over time, according to... The update is performed, where λ is the time decay factor, and Δt = t now -t last This represents the time interval since the last update. When the weight of an edge decays below a preset aging threshold ε, the edge will be automatically removed from the graph. In this way, the constructed heterogeneous relationship graph becomes a dynamic, sparse, and semantically rich real-time knowledge graph. It integrates entities and relationships from multiple sources and, through quantized dynamic weights and time-series decay mechanisms, provides a core data structure foundation for subsequent accurate identification of abnormal topological associations (such as lateral movement) and slow attacks.

[0040] S13, input the heterogeneous relationship graph into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity.

[0041] Furthermore, the spatiotemporal fusion model includes a graph neural network layer and a time series model layer; the step of inputting the heterogeneous relationship graph into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity includes: The heterogeneous relationship graph is input into the graph neural network layer for spatial correlation analysis, which includes multi-layer message passing and feature aggregation, to obtain spatial features that characterize the abnormal connection topology of nodes. The spatial features are generated into a feature sequence in chronological order, and the feature sequence is input into the time series model layer for time series analysis to output the dynamic threat probability. The time series analysis process includes capturing the degree of deviation of the target security entity's behavior pattern on the time axis.

[0042] In this embodiment, the constructed dynamic heterogeneous relation graph is input into a spatiotemporal fusion model for deep analysis. This model employs a cascaded "space-time" dual-dimensional fusion architecture, including a Graph Neural Network (GNN) layer and a temporal model layer (such as a Transformer or Temporal Convolutional Network (TCN)). A contrastive learning optimization strategy is introduced during the training phase. First, spatial relational analysis is performed by the GNN layer, which receives the input heterogeneous relation graph. Through multi-layer message passing and feature aggregation mechanisms, each node in the graph (such as a user account or a server process) receives and integrates information from its neighboring nodes and connecting edges (especially edges considering dynamic weights w). After multiple iterations, each node ultimately generates a high-order spatial feature vector. This spatial feature vector not only encodes the node's own attributes (such as account permissions and process signatures), but more importantly, it captures the node's context and connection patterns within the overall network topology. For example, if the spatial characteristics of an internal user account node show that it has established strong connections with multiple core business nodes and highly sensitive resource nodes that are usually unrelated, the GNN layer can identify such abnormal access paths from the graph topology.

[0043] Furthermore, time series analysis is performed by the time series model layer. The system arranges the spatial feature vectors of each target security entity (such as a specific user, host, or process) output by the GNN layer according to the timestamps in which they were generated, forming a time feature sequence. This sequence is then input into the time series model layer. The time series model (using Transformer as an example) utilizes its self-attention mechanism to calculate long-distance dependencies between the behavioral features of the same entity at different points in time. By analyzing this time series, the model can capture subtle deviations in the entity's behavioral patterns along the timeline. For example, for a service account, the time series model can identify that its authentication behavior becomes more concentrated during inactive periods, or that the temporal pattern of its initiated internal access sequences deviates significantly from the historical baseline, thus capturing signs of slow penetration.

[0044] Model training and optimization are crucial for ensuring its detection performance. During the model training phase, a contrastive learning loss function (Margin Ranking Loss based on triples) was employed. The core design goal of this function is to explicitly increase the distance between the feature vectors of anomalous attack samples and those of normal business samples in the latent feature space learned by the model (i.e., the feature representation space formed by the combined action of GNN and the temporal model), while simultaneously decreasing the distance between samples of the same type. Through this optimization, the model's ability to distinguish subtle anomalous features is significantly enhanced, enabling it to more accurately identify covert attacks, such as slow lateral movement, where individual actions are weak but the overall pattern is abnormal, effectively reducing the false negative rate for such threats.

[0045] The spatiotemporal fusion model integrates spatial topological anomaly information from the GNN layer and temporal behavioral deviation information from the temporal model layer. Through a classification output layer, it calculates and outputs the dynamic threat probability P(t) of the corresponding target security entity. This probability value P(t) is a continuous variable between 0 and 1, reflecting in real time the likelihood that the entity poses a security threat within the current and recent time window. During the training phase, the entire model employs a contrastive learning loss function, improving discriminative power by increasing the distance between anomalous and normal samples in the feature space. It also supports incremental fine-tuning using high-confidence samples from the feedback loop, updating only the output layer and classification threshold parameters, thus continuously adapting to new threat patterns while maintaining the stability of the model backbone. High-confidence samples are those identified as "false positives" or "false negatives" by security operations personnel, or those explicitly matched by a deterministic rule engine (such as feature signature-based rules).

[0046] S14. Determine the risk level based on the dynamic threat probability, and select a target security policy from the preset policy template library based on the risk level.

[0047] Furthermore, the step of determining the risk level based on the dynamic threat probability and selecting a target security policy from a preset policy template library based on the risk level includes: If the probability of the dynamic threat is less than the first threshold, the risk level is determined to be normal. If the probability of the dynamic threat is determined to be greater than or equal to a first threshold and less than a second threshold, then the risk level is determined to be the observation level. If the probability of the dynamic threat is greater than or equal to the second threshold, then the risk level is determined to be an execution level. When the risk level is the execution level, according to R = P(t)×W b + C calculates the comprehensive risk value, and selects a matching target security policy from the policy template library based on the comprehensive risk value, where P(t) represents the dynamic threat probability, and W b C represents the context factor; the security policies in the policy template library include micro-segmentation policy, access degradation policy, mandatory multi-factor authentication policy, decoy traffic redirection policy, session termination policy, packet capture policy, and evidence collection policy.

[0048] In this embodiment, the dynamic threat probability P(t) output by the spatiotemporal fusion model is received, and an automated risk level determination is performed based on a preset first threshold θ1 and a second threshold θ2 (where θ2>θ1). The determination logic is as follows: if P(t)<θ1, it is marked as normal level, and the system only logs and does not trigger a response; if θ1≤P(t)<θ2, it is marked as observation level, and the system will implement enhanced monitoring, such as full logging of all sessions associated with the entity or imposing soft access rate limits, but without disconnecting existing connections; if P(t)≥θ2, it is marked as execution level, and this level will immediately trigger an automated response process.

[0049] For entities classified as enforcement-critical, the system will initiate refined policy orchestration. First, a comprehensive risk value R is calculated using the formula R = P(t) × W. b + C, where W bBusiness weight is a static coefficient preset based on the criticality of the assets or business involved in the target entity, used to ensure stronger protection of core assets; C is the context factor, a dynamically calculated comprehensive value that integrates real-time information, such as: time factor (whether the current period is a business downturn or maintenance window), geographic / network factor (whether the login source IP comes from a familiar office location or an unfamiliar region / VPN), device factor (whether the device fingerprint initiating the request is a new device or an uncommon browser), and business environment factor (whether the account is in the process of leaving the company, whether the target server is under planned maintenance). This is achieved by weighted fusion of P(t) and W. b The C and R values ​​yield a final risk assessment that reflects both the urgency of the threat and the asset value and operational context.

[0050] Subsequently, based on the numerical range of the calculated comprehensive risk value R, the system automatically matches and selects one or more most suitable target security policies from a pre-set policy template library. This template library pre-configures various standardized, executable response actions, mainly including: Micro-segmentation strategy: By calling the application programming interface (API) of the software-defined networking (SDN) controller or next-generation firewall (NGFW), access control lists (ACLs) are dynamically issued to immediately block all unnecessary communication between the target entity (IP, MAC or security group) and other critical areas within the network; Access Degradation / Forced Multi-Factor Authentication (MFA) Policy: Temporarily increase the session security requirements of the account through the identity provider's (IdP) interface, such as forcibly triggering an MFA challenge on the next login or access to sensitive applications, or directly reducing its privileges to the minimum. Decoy redirection strategy: Utilizing network orchestration techniques (such as SDN flow table modification or policy routing), subsequent probe and scanning traffic destined for or originating from the high-risk entity is transparently redirected to an isolated, highly simulated honeypot environment. This allows for the observation of attacker behavior and the collection of intelligence without interrupting the connection. Thus, the real production system is protected while attacker behavior is continuously observed in a controlled environment, and in-depth intelligence such as attack tools, intentions, and methods is collected. Session termination and evidence collection strategy: Immediately terminate all active TCP / UDP session connections of the entity, and coordinate with the Endpoint Detection and Response (EDR) module to capture memory snapshots, retain full packets (packet capture), and collect evidence from key files and the registry on the host where the entity is located, so as to preserve evidence for event tracing and analysis.

[0051] The above strategies can be automatically combined based on the R-value. For example, for extremely high-risk lateral movement, "micro-isolation" and "evidence gathering" may be executed simultaneously; for suspected account abuse, "mandatory MFA" and "enhanced monitoring" may be selected. After strategy selection, a conflict resolution phase (subsequent steps) will be entered before formal implementation to ensure consistency between actions. Through this process, the system achieves a key leap from "risk perception" to "precise, tiered, and automated response."

[0052] S15, the target security policy is sent to the corresponding network device or terminal device for execution, and feedback information after the execution of the target security policy is collected. The detection threshold and policy parameters of the spatiotemporal fusion model are adaptively optimized based on the feedback information.

[0053] Furthermore, the adaptive optimization of the detection threshold and policy parameters of the spatiotemporal fusion model based on the feedback information includes: The detection threshold is dynamically adjusted based on the false alarms and missed alarms in the feedback information, wherein the detection threshold includes a first threshold and a second threshold; The policy parameters are dynamically adjusted based on the policy execution effect and user complaint information in the feedback information, wherein the policy parameters include the security policy timeout parameter and / or execution priority parameter; The high-confidence data in the feedback information is used as training samples to incrementally learn or fine-tune the spatiotemporal fusion model.

[0054] In this embodiment, once a target security policy is selected, the system does not immediately issue it. To ensure the consistency and effectiveness of defensive actions, it first enters the policy conflict resolution phase. The system maintains a predefined mutual exclusion matrix, whose horizontal and vertical axes list various defensive actions (such as blocking, diverting traffic, downgrading, and forensics). Matrix cells define whether any two actions are "mutually exclusive," "compatible," or "inclusive." The orchestration engine queries this matrix. If it finds that the policy to be issued is mutually exclusive with a currently effective policy (e.g., "complete blocking" and "traffic monitoring" are mutually exclusive), it automatically makes a decision based on priority ranking rules. The priority rules comprehensively consider asset importance (policies protecting core assets take precedence) and defensive effectiveness (active blocking policies take precedence over passive monitoring policies). Ultimately, higher-priority policies will override or suspend lower-priority policies, thereby resolving conflicts.

[0055] Furthermore, the mutual exclusion matrix is ​​constructed based on strict system resource constraints and business logic conflicts, and the specific construction steps are as follows: Step 1: Constructing a Complete Set of Defense Actions The system first iterates through all atomic defense capabilities supported by the security orchestration engine, establishing a standard "defense action index table." This index table assigns a unique identifier to each defense action (such as IP blocking, bandwidth limiting, full traffic mirroring, CAPTCHA verification, TCP reset, etc.), thereby determining the row and column dimensions of the mutual exclusion matrix.

[0056] Step 2: Establishing the relationship between any two actions (mutual exclusion, compatibility, inclusion) in the cell relationship determination dimension matrix is ​​based on logical deduction and assignment according to the following two core dimensions: 1) Resource-level conflict determination: Check whether two actions exclusively occupy the same underlying system resource. For example, if "network card promiscuous mode packet capture" and "network card offloading acceleration" both require exclusive use of the hardware queue, they are determined to be mutually exclusive physical resources.

[0057] 2) Conflict determination at the logical level: Check whether the two actions are contradictory in terms of business semantics. For example, "blocking the connection" and "deep load detection" are logically mutually exclusive because once the connection is blocked, the subsequent data flow will not exist, and the detection action will lose its basis for execution.

[0058] Step 3: Matrix Initialization and Assignment. Based on the above-mentioned decision dimensions, the system fills the matrix cells according to the following logic: 1) If action A and action B do not conflict in terms of resources and logic, and can produce a superimposed defense effect, then fill in the "compatibility" mark at the corresponding coordinates in the matrix. 2) If the execution of action A will cause action B to fail, become ineffective, or generate a system error, then fill in the "mutual exclusion" flag; 3) If the execution scope of action A completely covers action B in the mathematical set (e.g., "block all ports" covers "block port 80"), then fill in the "contains" flag.

[0059] Step 4: Persistent Storage of the Matrix. The completed logical relationships are serialized and stored as a static configuration file or in-memory data structure for the system. When a new defense component is added to the system, the matrix's row and column dimensions only need to be expanded, and the relationship values ​​between the new action and other old actions need to be added according to the above logic to complete the incremental update of the matrix.

[0060] After conflict resolution, the final policy, as determined, is automatically distributed to the corresponding execution endpoints via standard Application Programming Interface (API) or Command Line Interface (CLI). For example, micro-segmentation instructions are distributed to switches or firewalls via the Software Defined Networking (SDN) controller; mandatory multi-factor authentication (MFA) instructions are configured through the Identity Management Platform (IdP) interface; and forensic instructions are distributed to the Endpoint Detection and Response (EDR) agent on the target host. The moment the policy takes effect, the system starts a countdown timer, configures an initial timeout parameter for the policy, and records a complete execution log. This design aims to achieve automatic rollback upon timeout, avoiding persistent impact on business operations. Rollback will be automatically triggered when any of the following conditions are met: the system continuously monitors that the probability of dynamic threats has fallen below the security threshold; a manually confirmed false alarm appeal is received; or the pre-set countdown for the policy's effectiveness ends and no new risk signals appear during the period.

[0061] After the policy is issued, the system enters monitoring mode, continuously collecting feedback information after policy execution, including: the blocking effect reported by security devices (e.g., whether subsequent malicious sessions were successfully blocked), residual risk activities detected by the system (e.g., whether attackers changed paths to continue penetration), user complaints from business departments (e.g., legitimate operations were mistakenly blocked), and false positives and false negatives obtained through retrospective analysis of historical alerts. This multi-source feedback forms the data foundation for the system's adaptive optimization. Based on the collected feedback information, the system performs closed-loop self-optimization at the following levels, including: (1) Dynamically adjust detection thresholds: The system periodically analyzes the false alarm rate and false negative rate in the feedback information. If the false alarm rate increases significantly, the system will automatically raise the first threshold θ1 and / or the second threshold θ2 used for risk classification to make the judgment more stringent; conversely, if a false negative is found, the threshold will be appropriately lowered to improve the detection sensitivity.

[0062] (2) Dynamically optimize strategy parameters: The system dynamically adjusts the key parameters in the strategy template based on the actual effect of strategy execution and user complaints. For example, if a certain "micro-isolation" strategy frequently causes false blocking, the system will automatically extend its "timeout parameter" to make it roll back faster, and may reduce its "execution priority parameter" to make it easier to be overridden when conflicts are resolved.

[0063] (3) Incremental learning and fine-tuning of dynamic models: The system labels high-confidence data (such as confirmed attack or false alarm samples) in the feedback information to form a new training sample library. Subsequently, the system starts the model fine-tuning task. This process adopts incremental learning technology: freeze the weights of the backbone layer of the spatiotemporal fusion model, and only use new samples to fine-tune the output layer (classifier) ​​and risk probability threshold, so that the model can continuously evolve to adapt to new threats and business models, while minimizing the impact on online inference performance.

[0064] Through this closed loop, continuous self-optimization is possible in the ever-changing network threat and business environment, improving overall protection accuracy and efficiency. By integrating conflict resolution, timeout rollback, and multi-layered feedback optimization, a complete proactive defense closed loop is achieved, from intelligent decision-making and precise collaborative execution to continuous self-improvement.

[0065] Reference Figure 3 The diagram shown is a structural schematic of an active network security defense device provided in an embodiment of the present invention.

[0066] In this embodiment, the device 20 includes: The data acquisition unit 21 is used to collect multimodal security metadata including network side, terminal side, identity side and service side, and preprocess the multimodal security metadata to obtain standardized data; Graph construction unit 22 is used to construct a heterogeneous relationship graph based on the standardized data, wherein the nodes in the heterogeneous relationship graph include different types of security entities, and the edges in the heterogeneous relationship graph represent semantic associations between security entities; The model analysis unit 23 is used to input the heterogeneous relationship graph into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity; The strategy selection unit 24 is used to determine the risk level based on the dynamic threat probability, and select a target security strategy from a preset strategy template library based on the risk level. The optimization unit 25 is used to distribute the target security policy to the corresponding network device or terminal device for execution, collect feedback information after the target security policy is executed, and adaptively optimize the detection threshold and policy parameters of the spatiotemporal fusion model based on the feedback information.

[0067] Each unit module of the device 20 can execute the corresponding steps in the above method embodiment, so the details of each unit module will not be elaborated here. Please refer to the description of the corresponding steps above for details.

[0068] This invention also provides a proactive network security defense device, which includes the proactive network security defense apparatus described above, wherein the proactive network security defense apparatus can employ... Figure 3 The structure of the embodiment, correspondingly, can be executed Figure 1 The technical solutions of the method embodiments shown are similar in implementation principle and technical effect. For details, please refer to the relevant records in the above embodiments, which will not be repeated here.

[0069] The device includes: a mobile phone, digital camera, or tablet computer, or other device with a camera function; or a device with an image processing function; or a device with an image display function. The device may include components such as a memory, processor, input unit, display unit, and power supply.

[0070] The memory can be used to store software programs and modules. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory can mainly include a program storage area and a data storage area. The program storage area can store the operating system, applications required for at least one function, etc.; the data storage area can store data created according to the use of the device, etc. In addition, the memory can include high-speed random access memory, and can also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. Accordingly, the memory can also include a memory controller to provide access to the memory for the processor and input units.

[0071] The input unit can be used to receive input numerical, character, or image information, and to generate keyboard, mouse, joystick, optical, or trackball signal inputs related to user settings and function control. Specifically, in addition to a camera, the input unit of this embodiment may also include a touch-sensitive surface (e.g., a touch screen) and other input devices.

[0072] The display unit can be used to display information input by the user or information provided to the user, as well as various graphical user interfaces of the device. These graphical user interfaces can be composed of graphics, text, icons, video, and any combination thereof. The display unit may include a display panel, optionally configured as an LCD (Liquid Crystal Display), OLED (Organic Light-Emitting Diode), or other similar display panel. Furthermore, a touch-sensitive surface may cover the display panel. When the touch-sensitive surface detects a touch operation on or near it, it transmits the information to the processor to determine the type of touch event. Subsequently, the processor provides corresponding visual output on the display panel based on the type of touch event.

[0073] This invention also provides a computer-readable storage medium, which may be a computer-readable storage medium included in the memory described in the above embodiments; or it may be a standalone computer-readable storage medium not assembled into a device. The computer-readable storage medium stores at least one instruction, which is loaded and executed by a processor to implement... Figure 1 The method for proactive network security defense is illustrated. The computer-readable storage medium may be a read-only memory, a hard disk, or an optical disk, etc.

[0074] This invention also provides a computer program product, including a computer program / instructions, which are loaded and executed by a processor to implement... Figure 1 This illustrates a proactive network security defense method.

[0075] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the device embodiments, equipment embodiments, and storage medium embodiments, since they are basically similar to the method embodiments, the descriptions are relatively simple, and relevant parts can be referred to the descriptions in the method embodiments.

[0076] Furthermore, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0077] The foregoing description illustrates and describes preferred embodiments of the present invention. It should be understood that the present invention is not limited to the forms disclosed herein and should not be construed as excluding other embodiments. It can be used in various other combinations, modifications, and environments, and can be altered within the scope of the inventive concept by means of the foregoing teachings or techniques or knowledge in related fields. Any modifications and variations made by those skilled in the art that do not depart from the spirit and scope of the present invention should be within the protection scope of the appended claims.

Claims

1. A proactive network security defense method, characterized in that, The method includes: Collect multimodal security metadata from the network side, terminal side, identity side, and service side, and preprocess the multimodal security metadata to obtain standardized data; A heterogeneous relationship graph is constructed based on the standardized data, wherein the nodes in the heterogeneous relationship graph include different types of security entities, and the edges in the heterogeneous relationship graph represent semantic associations between security entities. The heterogeneous relationship graph is input into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity; The risk level is determined based on the dynamic threat probability, and a target security policy is selected from a preset policy template library based on the risk level. The target security policy is distributed to the corresponding network device or terminal device for execution, and feedback information after the execution of the target security policy is collected. Based on the feedback information, the detection threshold and policy parameters of the spatiotemporal fusion model are adaptively optimized.

2. The proactive network security defense method according to claim 1, characterized in that, The preprocessing of the multimodal security metadata to obtain standardized data includes: The multimodal security metadata is subjected to basic processing including time alignment, numerical normalization, and category encoding to obtain basic processed data; The encrypted network traffic in the basic processing data is fingerprinted using the JA3 or JA3S algorithm to obtain encrypted traffic feature vectors. eBPF technology is used to associate and encode the process identifier and network connection session in the basic processing data to obtain the association data between the process and the session, and the basic processing data, the association data, and the encrypted traffic feature vector are used as the standardized data.

3. The proactive network security defense method according to claim 2, characterized in that, The heterogeneous relationship graph is constructed based on the standardized data, wherein the nodes in the heterogeneous relationship graph include different types of security entities, and the edges in the heterogeneous relationship graph represent semantic associations between security entities, including: Based on the basic processing data, the correlation data, and the encrypted traffic feature vector, nodes and edges in the heterogeneous relationship graph are defined, and dynamic weights are assigned to each edge; wherein... The dynamic weight is calculated based on the interaction frequency, port sensitivity, traffic fingerprint similarity, and traffic direction anomaly. The traffic fingerprint similarity feature is calculated based on the encrypted traffic feature vector. The security entities include user accounts, terminal devices, server hosts, business applications, sensitive files, processes, and network sessions; the relationships include execution edges representing startup relationships, access edges representing access relationships, and belonging edges representing subordinate relationships.

4. The proactive network security defense method according to claim 3, characterized in that, The dynamic weights are calculated based on interaction frequency, port sensitivity, traffic fingerprint similarity, and traffic direction anomaly, including: The dynamic weights are calculated using the formula w = α·freq + β·port_score + γ·ja3_sim + δ·dir, where freq represents the feature value of interaction frequency, port_score represents the feature value of port sensitivity, ja3_sim represents the feature value of traffic fingerprint similarity, dir represents the feature value of traffic direction anomaly, and α, β, γ, and δ represent the corresponding weight coefficients.

5. The proactive network security defense method according to claim 3, characterized in that, The heterogeneous relationship diagram also includes: according to The dynamic weights are decayed and updated to obtain the updated weights, where w new This indicates updating the weights, where w represents the current dynamic weights, λ represents the time decay factor, and t represents the time decay factor. now t represents the current time for calculating and updating the weights. last Indicates the time of the last weight update; When the updated weight is determined to be less than the preset aging threshold, the corresponding edge is deleted from the heterogeneous relationship graph.

6. The proactive network security defense method according to claim 1, characterized in that, The spatiotemporal fusion model includes a graph neural network layer and a time series model layer; the step of inputting the heterogeneous relationship graph into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity includes: The heterogeneous relationship graph is input into the graph neural network layer for spatial correlation analysis, which includes multi-layer message passing and feature aggregation, to obtain spatial features that characterize the abnormal connection topology of nodes. The spatial features are generated into a feature sequence in chronological order, and the feature sequence is input into the time series model layer for time series analysis to output the dynamic threat probability. The time series analysis process includes capturing the degree of deviation of the target security entity's behavior pattern on the time axis.

7. The proactive network security defense method according to claim 1, characterized in that, The step of determining the risk level based on the dynamic threat probability and selecting a target security policy from a preset policy template library based on the risk level includes: If the probability of the dynamic threat is less than the first threshold, the risk level is determined to be normal. If the probability of the dynamic threat is determined to be greater than or equal to a first threshold and less than a second threshold, then the risk level is determined to be the observation level. If the probability of the dynamic threat is greater than or equal to the second threshold, then the risk level is determined to be an execution level. When the risk level is the execution level, according to R = P(t)×W b + C calculates the comprehensive risk value, and selects a matching target security policy from the policy template library based on the comprehensive risk value, where P(t) represents the dynamic threat probability, and W b C represents the context factor; the security policies in the policy template library include micro-segmentation policy, access degradation policy, mandatory multi-factor authentication policy, decoy traffic redirection policy, session termination policy, packet capture policy, and evidence collection policy.

8. A proactive network security defense method according to claim 1 or 7, characterized in that, The adaptive optimization of the detection threshold and policy parameters of the spatiotemporal fusion model based on the feedback information includes: The detection threshold is dynamically adjusted based on the false alarms and missed alarms in the feedback information, wherein the detection threshold includes a first threshold and a second threshold; The policy parameters are dynamically adjusted based on the policy execution effect and user complaint information in the feedback information, wherein the policy parameters include the security policy timeout parameter and / or execution priority parameter; The high-confidence data in the feedback information is used as training samples to incrementally learn or fine-tune the spatiotemporal fusion model.

9. A proactive network security defense device, characterized in that, The device includes: The data acquisition unit is used to collect multimodal security metadata, including network side, terminal side, identity side and service side, and preprocess the multimodal security metadata to obtain standardized data; The graph construction unit is used to construct a heterogeneous relationship graph based on the standardized data, wherein the nodes in the heterogeneous relationship graph include different types of security entities, and the edges in the heterogeneous relationship graph represent semantic associations between security entities. The model analysis unit is used to input the heterogeneous relationship graph into the spatiotemporal fusion model for spatial correlation analysis and time series analysis to obtain the dynamic threat probability of the corresponding target security entity. The strategy selection unit is used to determine the risk level based on the dynamic threat probability, and select a target security strategy from a preset strategy template library based on the risk level. The optimization unit is used to distribute the target security policy to the corresponding network device or terminal device for execution, collect feedback information after the target security policy is executed, and adaptively optimize the detection threshold and policy parameters of the spatiotemporal fusion model based on the feedback information.

10. A proactive network security defense device, characterized in that, It includes a processor, a memory, and a computer program stored in the memory, wherein the computer program, when executed by the processor, implements the steps of a proactive network security defense method as described in any one of claims 1 to 8.

Images