Log intent recognition method and system based on semantic fusion and cross-view self-supervision

Abstract

The application discloses a log intent recognition method and system based on semantic fusion and cross-view self-supervision, relates to the field of power internet of things safety monitoring, and comprises the following steps: inputting multi-source heterogeneous log data into a neural network model in the form of key-value pair sequences and training the neural network model; according to the causal correlation between sequence fields, performing masking on the result end field; driving the field name in the masked sequence to be soft-aligned to a semantic prototype; assigning a weight to the cross-view sequence and comparing the weight with a preset noise threshold to determine a noise suppression coefficient; using the soft alignment result and the noise suppression coefficient to construct a weighted sum loss and update the neural network model parameters; and inputting to-be-detected log data into the trained neural network model for intent recognition, thereby significantly improving the accuracy of log intent recognition.

Description

Technical Field

[0001] This invention relates to the field of power Internet of Things (IoT) security monitoring, and in particular to a log intent recognition method and system based on semantic fusion and cross-view self-supervision. Background Technology

[0002] Existing log analysis technologies rely on manual maintenance of complex field mapping rules, which is costly and lacks cross-view adaptive alignment mechanisms. They cannot understand the same business meaning of heterogeneous fields, leading to frequent data silos and semantic fragmentation problems. This makes it difficult to meet the need for accurate identification of log intent of multi-source heterogeneous security devices in the multi-source heterogeneous environment of the power Internet of Things.

[0003] Therefore, how to effectively identify the intent of power logs and improve the stability of power grid operation has become a technical problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0004] This invention provides a log intent recognition method and system based on semantic fusion and cross-view self-supervised learning, in order to solve the problem of how to improve the accuracy of log intent recognition by adaptively fusing heterogeneous field semantics and cross-view self-supervised learning.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide a log intent recognition method based on semantic fusion and cross-view self-supervision, comprising: Each log entry in the multi-source heterogeneous log data is converted into a key-value pair sequence and input into a neural network model for training; During training, based on the causal relationships between fields in the key-value pair sequence, the result field corresponding to the key-value pair sequence is masked to generate a mask sequence; Using a preset semantic prototype library as the alignment benchmark, the first field name in the mask sequence is subjected to a first soft alignment to generate a field vector representation; Extract the cross-view sequence from the key-value pair sequence, determine the weight based on the cross-view sequence, and determine the noise suppression coefficient by comparing the weight with a preset noise threshold. The field vector representation and the noise suppression coefficient are used to construct a weighted sum loss to update the neural network model parameters, thereby obtaining a trained neural network model. The trained neural network model is used to perform intent recognition on the input log data to be detected.

[0006] Furthermore, the step of masking the result field corresponding to the key-value pair sequence based on the causal relationship between fields in the key-value pair sequence to generate a mask sequence includes: Extract the field combinations that have causal relationships in the key-value pair sequence, and identify the result-end field in the field combination; Construct a strategy mask based on the index of the result field; The target field position is located in the key-value pair sequence using the strategy mask and then replaced to obtain the mask sequence.

[0007] Furthermore, the step of performing a first soft alignment on the first field name in the mask sequence using a preset semantic prototype library as the alignment benchmark includes: Map the first field name to an initial vector, and calculate the first semantic distance between each semantic prototype vector in the semantic prototype library and the initial vector; The semantic prototype vector corresponding to the minimum first semantic distance is used as the adsorption target; An adsorption loss function is defined with the objective of minimizing the second semantic distance between the adsorption target and the initial vector; The second semantic distance is iteratively optimized using the adsorption loss function until the initial vector converges to the adsorption target.

[0008] Further, the step of extracting cross-view sequences from the key-value pair sequence, determining weights based on the cross-view sequences, and determining a noise suppression coefficient using a comparison between the weights and a preset noise threshold includes: Drive the second field name in the cross-view sequence to perform a second soft alignment with the semantic prototype library to generate alarm view features and traffic view features; Calculate the attention weight of each traffic view feature relative to the alarm view feature, and compare and analyze the attention weight with the noise threshold; Based on the comparative analysis results, the noise suppression coefficient was determined.

[0009] Furthermore, the construction of the weighted sum loss using the field vector representation and the noise suppression coefficients includes: Obtain the context features represented by the field vector, and construct a mask field modeling loss based on the context features; Using the cross-view sequence, construct positive and negative samples; A cross-view contrast loss is established with the goal of optimizing the view feature distribution in the positive and negative samples, and the cross-view contrast loss is weighted by the noise suppression coefficient; The loss modeling the mask field and the cross-view comparison loss are weighted and summed.

[0010] Furthermore, obtaining the contextual features represented by the field vector and constructing a mask field modeling loss based on the contextual features includes: The field vector representation is input into the encoder of the neural network model for processing, and the context feature representation is output. Extract the mask feature representation corresponding to the target field position in the context feature representation, and input the mask feature representation into the fully connected decoding layer to obtain the predicted probability distribution; Based on the difference between the predicted probability distribution and the true value, a mask field modeling loss is constructed.

[0011] Furthermore, the process of generating the field vector representation also includes: The field values ​​in the mask sequence are semantically encoded to obtain the content embedding vector; The positional order information of each field in the mask sequence is mapped to obtain the position embedding vector; The field name embedding vector, the content embedding vector, and the position embedding vector generated by the first soft alignment are integrated to obtain the field vector representation.

[0012] Furthermore, the intent recognition of the input log data to be detected includes: The log data to be detected is used to generate a sequence of features to be detected and input into a multi-head attention layer to calculate the contribution weight of each field. The global intent vector is obtained by weighted summation of the contribution weights of all fields. Based on the global intent vector, the intent category probability distribution is obtained to determine the intent category recognition result.

[0013] Furthermore, obtaining the intent category probability distribution based on the global intent vector includes: The global intent vector is input into the classifier, and the classifier parameters are fine-tuned using pre-built labeled samples; The fine-tuned classifier output is injected into the Softmax function layer to output the probability distribution of the intent category.

[0014] Another embodiment of the present invention provides a log intent recognition system based on semantic fusion and cross-view self-supervision, comprising: The data preprocessing module is used to convert each log entry in the multi-source heterogeneous log data into a key-value pair sequence and input it into the neural network model for training; The masking module is used to mask the result field corresponding to the key-value pair sequence during training based on the causal relationship between fields in the key-value pair sequence, and generate a masked sequence. The soft alignment snapping module is used to perform a first soft alignment on the first field name in the mask sequence using a preset semantic prototype library as the alignment reference, and generate a field vector representation. The noise suppression module is used to extract the cross-view sequence in the key-value pair sequence, determine the weight based on the cross-view sequence, and determine the noise suppression coefficient by comparing the weight with a preset noise threshold. The intent recognition module is used to construct a weighted sum loss using the field vector representation and the noise suppression coefficient to update the neural network model parameters and obtain a trained neural network model, wherein the trained neural network model is used to perform intent recognition on the input log data to be detected.

[0015] Compared with the prior art, the beneficial effects of the embodiments of the present invention are at least one of the following: This invention designs a soft alignment mechanism constructed from a loss function to guide heterogeneous field name embedding vectors to converge toward their most similar semantic prototype, fundamentally solving the feature alignment problem caused by vendor-specific definitions. Furthermore, it constructs a cross-view alignment mechanism that works in conjunction with the soft alignment mechanism. By identifying causal relationships between fields in a log sequence and constructing a mask replacement operation using result segment fields as indexes, it masks key fields in the log, improving the model's ability to learn causal logic in power safety business. Further, it performs weight analysis and noise comparison on the cross-view sequences to construct a noise suppression coefficient, achieving dynamic suppression of underlying traffic noise and improving the accuracy of cross-view evidence chain alignment. Based on the execution results of this dual-stream mechanism, a weighted sum loss is constructed to update model parameters during training, significantly improving the model's accuracy and robustness in intent detection under high-noise environments. Attached Figure Description

[0016] Figure 1 This is a schematic diagram of the log intent recognition method based on semantic fusion and cross-view self-supervision in one embodiment of the present invention; Figure 2 This is a diagram of the dual-stream self-supervised pre-training mechanism architecture in one embodiment of the present invention; Figure 3 This is a diagram of the soft alignment mechanism architecture in one embodiment of the present invention; Figure 4 This is a schematic diagram of the log intent recognition system structure based on semantic fusion and cross-view self-supervision in one embodiment of the present invention. Detailed Implementation

[0017] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The purpose of providing these embodiments is to make the disclosure of the present invention more thorough and comprehensive. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0018] In the description of this application, the terms "first," "second," "third," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Therefore, a feature defined with "first," "second," "third," etc., may explicitly or implicitly include one or more of that feature. In the description of this application, unless otherwise stated, "a plurality of" means two or more.

[0019] In the description of this application, it should be noted that, unless otherwise expressly specified and limited, the terms "installation," "connection," and "linking" should be interpreted broadly. For example, they can refer to fixed connections, detachable connections, or integral connections; they can refer to mechanical connections or electrical connections; they can refer to direct connections or indirect connections through an intermediate medium; and they can refer to the internal communication between two components. The terms "vertical," "horizontal," "left," "right," "upper," "lower," and similar expressions used herein are for illustrative purposes only and do not indicate or imply that the device or component referred to must have a specific orientation, or be constructed and operated in a specific orientation, and therefore should not be construed as limiting the invention. The term "and / or" as used herein includes any and all combinations of one or more of the associated listed items. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0020] In the description of this application, it should be noted that, unless otherwise defined, all technical and scientific terms used in this invention have the same meaning as commonly understood by one of ordinary skill in the art. The terminology used in this specification is for the purpose of describing specific embodiments only and is not intended to limit the invention. Those skilled in the art can understand the specific meaning of the above terms in this application based on the specific circumstances.

[0021] Power grid companies often face cross-domain penetration of advanced persistent threats (APTs). The massive amounts of structured alarm logs generated by these heterogeneous devices often form "data silos" due to inconsistent field naming conventions, such as heterogeneous field names, ambiguous attribute definitions, and IT / OT semantic separation. This makes it difficult to effectively identify cross-device attack chains and true intentions from a single perspective, affecting the overall security posture of the power grid.

[0022] Based on this, one embodiment of the present invention provides a log intent recognition method based on semantic fusion and cross-view self-supervision. For details, please refer to [link to relevant documentation]. Figure 1 , Figure 1 The diagram shown illustrates a log intent recognition method based on semantic fusion and cross-view self-supervision in one embodiment of the present invention, including the following steps: S1. Convert each log entry in the multi-source heterogeneous log data into a key-value pair sequence and input it into the neural network model for training.

[0023] In this embodiment, a deep neural network model based on the Transformer architecture is preferably used to identify log intent. Preferably, the model uses the BERT model as the feature extractor for text fields, a one-dimensional convolutional neural network (1D-CNN) as the feature extractor for numerical and IP fields, and a multi-layer Transformer encoder as the core backbone network for learning contextual semantic features.

[0024] First, multi-source heterogeneous log data from the power information network is collected to train a neural network model (hereinafter referred to as the model). The data can be in the format of JSON objects, key-value pairs, or database records. This data includes high-level semantic logs (such as structured alerts from WAF (Web Application Firewall) / IDS (Intrusion Detection System)) and low-level traffic logs (such as payload records from a full traffic analysis system).

[0025] This step first requires a unified sequence transformation of this data. During this process, the original text format of field names (Keys) and field values ​​(Values) is preserved without manual normalization, retaining vendor-specific naming characteristics. For example, this embodiment defines multi-source heterogeneous log data. Each log It consists of a series of heterogeneous key-value pairs. The maximum number of input fields for the model is set to L.

[0026] Each log Expand into a sequence of key-value pairs = For logs with more than L fields, the first L key fields are truncated; for logs with fewer than L fields, empty key-value pairs (PAD, PAD) are used to fill the gaps. These refer to the field name and the field value, respectively.

[0027] After obtaining these key-value pair sequences, they are fed into the model to perform the subsequent training process.

[0028] S2. During the training process, based on the causal relationship between fields in the key-value pair sequence, the result field corresponding to the key-value pair sequence is masked to generate a mask sequence.

[0029] In this embodiment, a dual-stream self-supervised pre-training mechanism for parallel business logic-aware flow and asymmetric cross-view aligned flow is designed to jointly train and update model parameters. For the specific architecture, please refer to [reference needed]. Figure 2 As shown.

[0030] This step aims to implement a strategy masking mechanism for business logic awareness flow. Understandably, in order to train the model to grasp the inherent causal logic within the power business protocol, this embodiment forces the model to infer missing content based on the remaining fields by randomly masking key field values ​​(such as attack type) in the logs.

[0031] Based on a predefined power protocol rule base, the system scans key-value pair sequences to extract causally related field combinations, such as <remote control selection, remote control execution> and <parameter setting request, parameter setting confirmation>.

[0032] For each field combination, identify its result field and construct a strategy mask based on the index of the result field in the key-value pair sequence, denoted as . For example, "remote execution" is the result of "remote selection".

[0033] Using a strategy mask, the target field is located in a sequence of key-value pairs and replaced, i.e., the original field value is... Replace with the special [MASK] flag while keeping the field names unchanged. Thus, the mask sequence is obtained. .

[0034] For example, suppose the original log sequence contains a complete remote control operation, and its key field sequence is: Sequence = [ ..., (Operation: Remote Control Selection), (Object: Switch 01), (Operation: Remote Control Execution), (Object: Switch 01), ... ]. Here, <Remote Control Selection, Remote Control Execution> constitute a pair of business logic operations with a strong causal relationship. Based on predefined rules, it is identified that "Remote Control Execution" is a necessary result (result end) of "Remote Control Selection". At this point, "Remote Control Execution" is forcibly replaced with the [MASK] flag, and the input sequence becomes: Input = [ ..., (Operation: Remote Control Selection), (Object: Switch 01), (Operation: [MASK]), (Object: Switch 01), ... ].

[0035] In the model training process of this embodiment, in order to accurately predict that the true value at [MASK] is "remote execution", the model must forcibly pay attention to the preceding "remote selection" field. This means that the model is forced to learn the following business logic rule: "When the 'remote selection' instruction appears, the following action should most likely be 'remote execution'".

[0036] S3. Using a preset semantic prototype library as the alignment benchmark, perform the first soft alignment on the first field name in the mask sequence to generate a field vector representation.

[0037] After the field mask is completed, the soft alignment mechanism designed in this embodiment will be called to move heterogeneous field names (such as c_ip and src_addr) to the semantic prototypes that are most similar to them during the training process, and construct the embedded representation of the mask sequence.

[0038] Prior to this, this step will clarify the specific architecture of the soft alignment mechanism; please refer to [link / reference needed]. Figure 3 As shown. First, a trainable semantic prototype library is initialized, represented in matrix form. ,in The number of preset generic semantic prototypes (such as source IP, destination port, attack payload, etc.). For feature dimensions.

[0039] Next, the field names in the log sequence Mapping to initial vector Then calculate its relationship with the prototype library. The adsorption relationship. To force heterogeneous field names to conform to their semantic prototypes, a semantic prototype adsorption loss is defined. for: In the formula, This represents the semantic prototype adsorption loss value; This indicates the total number of fields contained in a single input log sequence; This indicates the index of the field currently being traversed in the log sequence. ; This indicates the total number of prototypes in the preset global semantic prototype library; This represents the prototype index in the semantic prototype library. ; Indicates the first in the input log The feature vector of each field name (Key) after being mapped by the embedding layer; Indicates the first in the prototype library A general semantic prototype vector; Represents the squared Euclidean distance (L2 norm squared) between vectors, used to measure the semantic distance between the field name vector and the prototype vector; This represents the minimum value operation, which involves dynamically searching the feature space for the value that is closest to the current field vector. The nearest prototype vector is used as the optimization target for the current training step; This represents the regularization hyperparameter (weighting coefficient), used to adjust the proportion of adsorption and separation terms in the total loss; This represents the calculation of the determinant of a matrix.

[0040] Specifically, the first term in the above equation reflects that, in each forward propagation, based on the current model parameter state, the field name embedding vector is selected. semantic prototype with the smallest semantic distance As an adsorption target, the field name embedding parameters and prototype parameters are updated through the backpropagation mechanism, so that the minimum semantic distance gradually decreases in subsequent training iterations, thereby achieving continuous convergence of field semantics to the general prototype space.

[0041] The second point reflects: maximizing the determinant of the prototype matrix ensures that prototypes with different semantics remain orthogonally separated, preventing semantic collapse.

[0042] In this embodiment, the field name optimized by the above soft alignment mechanism is directly defined as the first... The final attribute embedding vector of each field .

[0043] Correspondingly, the business logic-aware flow will directly invoke the aforementioned soft alignment mechanism. Specifically, after mapping the corresponding first field name in the mask sequence to an initial vector, the Euclidean distance between it and each semantic prototype vector in the semantic prototype library is calculated.

[0044] Based on the calculations, the semantic prototype vector with the smallest Euclidean distance is selected as the adsorption target. Substituting it into the formula of the loss function mentioned above, during the training process, the Euclidean distance between the adsorption target and the initial vector is minimized by modifying the parameters related to the field name embedding vector or the semantic prototype embedding vector. The first field name is made to converge toward the adsorption target by maximizing the determinant of the prototype matrix.

[0045] Furthermore, when performing soft alignment of field names to achieve attribute embedding, the content embedding of field values ​​and the position embedding of fields are also performed in parallel. In one implementation of this invention, for the content embedding of field values, if it is a text field: preferably, a BERT pre-trained language model is used to extract its high-dimensional semantic feature vector; if it is a numerical or IP address field: then 1D-CNN is used for character-level feature encoding, and the encoded content embedding vector... Specifically, it is expressed as follows: In the formula: Indicates the first [number]th [item] in the input log sequence. The field values ​​of each field; This represents the embedding matrix of globally trainable field content.

[0046] Accordingly, during the location embedding process, the corresponding integer index sequence is first generated based on the order of the fields in the structured log. ,in For the total number of fields, then, using a learnable positional embedding layer, the above integer indexes are... Mapped to a fixed-dimensional position embedding vector .

[0047] Finally, the attribute embedding vector, content embedding vector, and position embedding vector are added together to obtain the first... Complete feature representation of each field Specifically, it is expressed as follows: Then, facing the business logic-aware flow, the semantic encoding of the above-mentioned categories is performed on the field values ​​in the mask sequence to obtain the corresponding content embedding vector. Similarly, the positional order information of each field in the mask sequence is mapped to obtain the positional embedding vector. These embedding vectors are integrated to generate the corresponding field vector representation, denoted as . .

[0048] S4. Extract the cross-view sequence from the key-value pair sequence, determine the weight based on the cross-view sequence, and determine the noise suppression coefficient by comparing the weight with the preset noise threshold.

[0049] This step aims to perform asymmetric cross-view alignment for cross-view sequences containing both lower-level full traffic log sequences and higher-level WAF alarm sequences. To address the difficulty of cross-view alignment caused by background noise in the lower-level full traffic log sequences, this embodiment designs a "master-slave interaction mechanism," using the higher-level WAF alarm sequence as navigation to retrieve and locate key evidence in the lower-level full traffic log sequence. Preferably, this embodiment introduces an asymmetric attention interaction mechanism to measure whether the lower-level full traffic log fragment contains attack payload evidence that can support the current alarm.

[0050] Prior to this, a soft alignment mechanism also needs to be invoked to align the corresponding second field names in the underlying full traffic log sequence and the high-level WAF alarm sequence with the semantic prototype library. Specifically, this involves converting the high-level WAF alarm sequence into alarm view features. Transform the underlying full traffic log sequence into traffic view features. In this embodiment, using Indicates the first The feature vector corresponding to each flow segment.

[0051] Then, based on the master-slave asymmetric attention interaction mechanism, Mapped to a query vector, Mapping to key-value pairs (Key), the attention weight of each traffic view feature relative to the alarm view feature is calculated, specifically expressed by the following formula: In the formula, For the first Each traffic segment has a relative original attention weight to the current alert; This represents a trainable linear projection matrix used to map traffic features to the attention space; For feature dimension, This is the scaling factor.

[0052] This embodiment aims to use this attention weight to suppress background noise in the underlying traffic. Specifically, for the j-th traffic segment in the underlying full traffic log sequence, its attention significance weight relative to the current higher-layer alarm is set. The soft threshold function is applied, as expressed by the following formula: In the formula, This is an indicator function; it is 1 if the condition is met, and 0 otherwise. A noise threshold (e.g., 0.1) is set; traffic below this threshold is considered noise. This is a local smoothing term to prevent gradient interruption caused by coefficients being completely zero. This is the noise suppression coefficient.

[0053] As can be seen from the above formula, the soft thresholding function determines the noise suppression coefficient by comparing and analyzing the attention weights with the noise threshold. Specifically, for weights lower than... The flow segment (determined to be background noise), and its corresponding coefficient The noise is significantly attenuated; for high-weight segments (determined to be effective attack payloads), their coefficients are maintained or amplified, meaning that the noise suppression coefficients will be used in subsequent total loss calculations, thereby enabling the model parameters to be updated and iterated.

[0054] S5. Construct a weighted sum loss using field vector representation and noise suppression coefficients to update the neural network model parameters and obtain a trained neural network model.

[0055] This step involves constructing the joint loss to update the model parameters. The joint loss... Modeling loss using mask field Cross-view comparison loss The weighted summation is used to calculate the result. In the formula, and For weights.

[0056] In this embodiment, the loss for modeling mask fields is constructed by extracting contextual features from the business logic-aware flow to generate field vector representations. In one implementation of this invention, the field vector representation... The input neural network model is processed in a Transformer encoder, and the output is a context feature representation. .

[0057] For each masked target field position in the context feature representation Represent its corresponding mask features The input is fed into a fully connected decoding layer to obtain the probability distribution of the predicted true field value at the predicted field location. Based on the difference between the predicted probability distribution and the true value, a mask field modeling loss is constructed. Specifically, it is expressed as follows: In the formula, This represents the total number of masked fields and is used as a normalization factor to ensure that the loss value does not increase linearly with the number of masks. Indicates position index Retrieve the original, true field values; The model represents the known context. Under the condition of predicting the first Each position represents the true value. The conditional probability.

[0058] Furthermore, regarding the cross-view contrast loss, in this embodiment, it is expressed as the noise suppression coefficient. The weighted form of the contrastive learning loss (InfoNCE) is calculated for the weight factors, and is specifically represented as follows: In the formula, Cosine similarity function ; This is a temperature coefficient used to control the smoothness of the distribution; Index of the positive sample set; This is an index for the set of all samples within the current batch.

[0059] As can be seen from the formula, the cross-view contrast loss aims to optimize the distribution of view features in positive and negative samples, thereby bringing alarms closer to "effective traffic" and pushing them further away from "irrelevant traffic" or "other alarms", thus achieving cross-view alignment, that is, alignment between high-level alarms and low-level traffic.

[0060] Among them, a positive sample set is constructed by utilizing cross-view sequences. The set of indexes for all candidate traffic segments compared includes (matching alarm-traffic pairs) and the set of negative samples (mismatching alarm-traffic pairs). (This includes both positive and negative samples).

[0061] After constructing the joint loss function Then, the gradient of the loss with respect to the model parameters is calculated using an automatic differentiation mechanism to achieve iterative updates, including the semantic prototype matrix P, the projection matrix, and the Transformer weights.

[0062] Preferably, AdamW is used to update the parameters in the reverse direction of the gradient, specifically as follows: In the formula, The learning rate is used. This process iterates repeatedly until the loss converges, ultimately yielding the set of parameters for the trained model. * contains the converged semantic prototype matrix. and Transformer weights.

[0063] The model training is now complete.

[0064] Finally, the trained neural network model is used to perform intent recognition on the log data to be detected, thereby obtaining the intent category recognition result.

[0065] Similarly, before inputting the log data to be detected, the sequence can be parsed into a key-value pair sequence and a soft alignment mechanism can be invoked to generate the feature sequence to be detected. .

[0066] By inputting H into the multi-head attention layer to capture global dependencies, the model will automatically calculate the contribution weight of each field i to intent recognition. Specifically, it is expressed as follows: In the formula, All are trainable linear projection matrices.

[0067] The contribution weights of all fields are weighted and summed, as shown by the following formula: In the formula, This is the global intent vector; Indicates the first in H The context feature vector corresponding to each field.

[0068] Next, preferably, the global intent vector is input into a fully connected neural network (MLP) classifier to map the latent features to a predefined attack intent category space.

[0069] To address the scarcity of high-value attack samples, this embodiment utilizes pre-constructed labeled samples to fine-tune classifier parameters and some backbone network parameters, enabling the model to quickly transfer and adapt the general latent features learned during the pre-training phase to specific attack detection tasks.

[0070] After fine-tuning, the output of the fine-tuned classifier is injected into the Softmax function layer, which outputs the intent class probability distribution, represented by the following formula: In the formula, Indicates the input log sequence Belongs to the category of attack intent The predicted probability; This represents the weight matrix of the fully connected layer of the classifier; This represents the bias vector of the fully connected layer of the classifier.

[0071] Finally, the category with the highest probability is selected as the final prediction result. If the maximum probability is lower than a preset safety threshold... If the noise is unknown, it is classified as unknown or normal background noise, thus effectively reducing the false alarm rate.

[0072] This invention provides an example to refine the above-described intent recognition process: The scenario is set as follows: A provincial power grid company's security operations center deployed this system to monitor the security status of its internal core database in real time. On September 25, 2025, at 10:00:05, the system captured two log data sets from different sources and with vastly different formats within the same time window. The system needed to determine whether this constituted a coordinated attack and identify its true intent. The agent received two structured log inputs. At this point, the system's "semantic prototype library" had been completed.

[0073] The data use cases are as follows: { "Log_A (WAF)": { "timestamp":"2025-09-25 10:00:05", "vendor":"Vendor_A_WAF", "src_ip":"192.168.10.55", "desc":"SQL injection attack characteristics detected", "action":"Alert" }, "Log_C (Traffic)": { "timestamp":"2025-09-25 10:00:06", "vendor":"Vendor_C_Traffic", "s_addr":"192.168.10.55", "alarm_name":"Malicious Traffic - Database Error", "websec_req_payload":"VW5pb24gU2VsZWN0IDEsdmVyc2lvbigpIC0tLQ==" } } 1. The system performs a soft alignment mechanism on the above fields: The model maps the field name src_ip of Log_A and s_addr of Log_C to semantic embedding vectors of the field names. Although the spellings are different, they are both aligned with the global prototype in the feature space. The Euclidean distance between the standard source IP prototypes is the shortest. Therefore, during training, they are automatically attracted to the same semantic prototype cluster, causing their respective field name embedding vectors to converge in the feature space to the neighborhood of the same general semantic prototype, thus obtaining semantically consistent field attribute embedding representations.

[0074] Encoding fusion is performed: For the desc of Log_A, the system uses a pre-trained language model to extract high-level semantic features related to SQL injection. For the websec_req_payload (Base64) of Log_C, a character-level CNN is used to extract low-level payload features, implicitly identifying the Union Select pattern.

[0075] Then, both Log_A and Log_C are transformed into field-level feature sequence representations formed by the fusion of field attribute embedding, field content embedding, and positional information. and .

[0076] 2. Using the WAF alarm of Log_A as the "guided query," retrieve the underlying traffic segments (key-value). The system calculates the asymmetric attention weights of Log_A and Log_C (as well as background traffic noise) and applies a soft threshold function for filtering. Please refer to Table 1 below for the specific execution results.

[0077] Table 1: Cross-view alignment results As shown in Table 1, although the payload of Log_C is garbled (Base64), the semantics of "SQL injection" in the alarm are implicitly related to the features after the payload is decoded, causing the attention weight to exceed the noise threshold. (Set to 0.1). The model uses a soft threshold function to force the weight of the heartbeat packet to zero, successfully eliminating background traffic interference and accurately binding the high-level WAF alarms to the low-level Base64 payload.

[0078] 3. After confirming the association, the system inputs the fused feature sequence into the intent decoder. To eliminate noise (such as timestamps and device version numbers), a multi-head attention mechanism automatically calculates the contribution weight of each field to intent recognition.

[0079] First, the system dynamically allocates attention weights based on the requirements of the "intent recognition" task. Please refer to Table 2 below for the specific allocation results.

[0080] Table 2: Attention Weight Allocation As shown in Table 2, the model focused 62.43% of its attention on the websec_req_payload field. This indicates that the model successfully "penetrated" the Base64 encoding obfuscation and identified this field as the core basis for determining the attack intent.

[0081] 4. Based on the aggregated global intent vector, the classifier outputs the final judgment result. The final output of the agent is as follows: { "log_id_ref": ["Log_A","Log_C"], "predicted_intent":"Defense Evasion" "mitre_technique":"T1027 - Obfuscated Files or Information", "confidence_score": 0.9685, "reasoning":"Detected SQL Injection attempt (Union Select) hiddenwithin Base64 encoded payload, aligned with WAF alert." } In summary, this embodiment achieves "implicit automatic normalization" of multi-source heterogeneous data by constructing a soft alignment mechanism that adaptively adsorbs heterogeneous fields to semantic prototypes using a loss function as the carrier. It also designs a dual-stream self-supervised pre-training mechanism based on alarm guidance and cross-view asymmetric interaction, enabling the neural network model to more accurately grasp the inherent causal logic in power business protocols and achieve precise alignment between high-level intent and the evidence chain of the underlying payload. Finally, it employs intent decoding based on field-level attention to efficiently and accurately output intent recognition results, making it suitable for unified semantic understanding and complex attack intent analysis of multi-source heterogeneous security device logs in high-noise, low-resource sample environments in the power Internet of Things.

[0082] One embodiment of the present invention provides a log intent recognition system based on semantic fusion and cross-view self-supervision. For details, please refer to [link to documentation]. Figure 4 , Figure 4 The diagram shown illustrates the architecture of a log intent recognition system based on semantic fusion and cross-view self-supervision in one embodiment of the present invention, including: The data preprocessing module M1 is used to convert each log entry in the multi-source heterogeneous log data into a key-value pair sequence and input it into the neural network model for training. The masking module M2 is used to mask the result field corresponding to the key-value pair sequence during the training process based on the causal relationship between the fields in the key-value pair sequence, and generate a mask sequence. The soft alignment snapping module M3 is used to perform a first soft alignment on the first field name in the mask sequence using a preset semantic prototype library as the alignment reference, and generate a field vector representation. The noise suppression module M4 is used to extract the cross-view sequence in the key-value pair sequence, determine the weight based on the cross-view sequence, and determine the noise suppression coefficient by comparing the weight with a preset noise threshold. The intent recognition module M5 is used to construct a weighted sum loss using the field vector representation and the noise suppression coefficient to update the neural network model parameters and obtain a trained neural network model, wherein the trained neural network model is used to perform intent recognition on the input log data to be detected.

[0083] The technical features and effects of the log intent recognition system based on semantic fusion and cross-view self-supervision proposed in this embodiment of the invention are the same as those of the log intent recognition method based on semantic fusion and cross-view self-supervision proposed in this embodiment of the invention, and will not be repeated here.

[0084] The embodiments described above are merely illustrative of several implementations of the present invention, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of the present invention. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of the present invention, and these modifications and improvements all fall within the scope of protection of the present invention. Therefore, the scope of protection of this patent should be determined by the appended claims.

Claims

1. A log intent recognition method based on semantic fusion and cross-view self-supervision, characterized in that, include: Each log entry in the multi-source heterogeneous log data is converted into a key-value pair sequence and input into a neural network model for training. During training, based on the causal relationships between fields in the key-value pair sequence, the result field corresponding to the key-value pair sequence is masked to generate a mask sequence; Using a preset semantic prototype library as the alignment benchmark, the first field name in the mask sequence is subjected to a first soft alignment to generate a field vector representation; Extract the cross-view sequence from the key-value pair sequence, determine the weight based on the cross-view sequence, and determine the noise suppression coefficient by comparing the weight with a preset noise threshold. The field vector representation and the noise suppression coefficient are used to construct a weighted sum loss to update the neural network model parameters, thereby obtaining a trained neural network model. The trained neural network model is used to perform intent recognition on the input log data to be detected.

2. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 1, characterized in that, The step of masking the result field corresponding to the key-value pair sequence based on the causal relationship between fields in the key-value pair sequence to generate a mask sequence includes: Extract the field combinations that have causal relationships in the key-value pair sequence, and identify the result-end field in the field combination; Construct a strategy mask based on the index of the result field; The target field position is located in the key-value pair sequence using the strategy mask and then replaced to obtain the mask sequence.

3. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 1, characterized in that, The first soft alignment of the first field name in the mask sequence, using a preset semantic prototype library as the alignment benchmark, includes: Map the first field name to an initial vector, and calculate the first semantic distance between each semantic prototype vector in the semantic prototype library and the initial vector; The semantic prototype vector corresponding to the minimum first semantic distance is used as the adsorption target; An adsorption loss function is defined with the objective of minimizing the second semantic distance between the adsorption target and the initial vector; The second semantic distance is iteratively optimized using the adsorption loss function until the initial vector converges to the adsorption target.

4. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 1, characterized in that, The step of extracting cross-view sequences from the key-value pair sequence, determining weights based on the cross-view sequences, and determining a noise suppression coefficient using a comparison between the weights and a preset noise threshold includes: Drive the second field name in the cross-view sequence to perform a second soft alignment with the semantic prototype library to generate alarm view features and traffic view features; Calculate the attention weight of each traffic view feature relative to the alarm view feature, and compare and analyze the attention weight with the noise threshold; Based on the comparative analysis results, the noise suppression coefficient was determined.

5. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 2, characterized in that, The construction of the weighted sum loss using the field vector representation and the noise suppression coefficients includes: Obtain the context features represented by the field vector, and construct a mask field modeling loss based on the context features; Using the cross-view sequence, construct positive and negative samples; A cross-view contrast loss is established with the goal of optimizing the view feature distribution in the positive and negative samples, and the cross-view contrast loss is weighted by the noise suppression coefficient; The loss modeling the mask field and the cross-view comparison loss are weighted and summed.

6. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 5, characterized in that, The step of obtaining the context features represented by the field vector and constructing a mask field modeling loss based on the context features includes: The field vector representation is input into the encoder of the neural network model for processing, and the context feature representation is output. Extract the mask feature representation corresponding to the target field position in the context feature representation, and input the mask feature representation into the fully connected decoding layer to obtain the predicted probability distribution; Based on the difference between the predicted probability distribution and the true value, a mask field is constructed to model the loss.

7. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 1, characterized in that, The process of generating the field vector representation also includes: The field values ​​in the mask sequence are semantically encoded to obtain the content embedding vector; The positional order information of each field in the mask sequence is mapped to obtain the position embedding vector; The field name embedding vector, the content embedding vector, and the position embedding vector generated by the first soft alignment are integrated to obtain the field vector representation.

8. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 1, characterized in that, The intent recognition process for the input log data to be detected includes: The log data to be detected is used to generate a sequence of features to be detected and input into a multi-head attention layer to calculate the contribution weight of each field. The global intent vector is obtained by weighted summation of the contribution weights of all fields. Based on the global intent vector, the intent category probability distribution is obtained to determine the intent category recognition result.

9. The log intent recognition method based on semantic fusion and cross-view self-supervision as described in claim 8, characterized in that, The step of obtaining the intent category probability distribution based on the global intent vector includes: The global intent vector is input into the classifier, and the classifier parameters are fine-tuned using pre-built labeled samples; The fine-tuned classifier output is injected into the Softmax function layer to output the probability distribution of the intent category.

10. A log intent recognition system based on semantic fusion and cross-view self-supervision, characterized in that, include: The data preprocessing module is used to convert each log entry in the multi-source heterogeneous log data into a key-value pair sequence and input it into the neural network model for training; The masking module is used to mask the result field corresponding to the key-value pair sequence during training based on the causal relationship between fields in the key-value pair sequence, and generate a masked sequence. The soft alignment snapping module is used to perform a first soft alignment on the first field name in the mask sequence using a preset semantic prototype library as the alignment reference, and generate a field vector representation. The noise suppression module is used to extract the cross-view sequence in the key-value pair sequence, determine the weight based on the cross-view sequence, and determine the noise suppression coefficient by comparing the weight with a preset noise threshold. The intent recognition module is used to construct a weighted sum loss using the field vector representation and the noise suppression coefficient to update the neural network model parameters and obtain a trained neural network model, wherein the trained neural network model is used to perform intent recognition on the input log data to be detected.

Images