Financial network intrusion detection method and system based on multi-source information fusion

Abstract

The application discloses a financial network intrusion detection method and system based on multi-source information fusion, and relates to the technical field of network security. The method comprises the following steps: collecting multi-source threat information, reporting after screening and desensitization; processing and correlation analysis of the information, constructing an information correlation network and dynamically updating a fusion information database; differentiating screening and weight distribution of the fusion information according to the financial business scene, business priority and sensitive data characteristics, generating a scene detection rule; collecting and preprocessing detection data; feature matching detection based on the scene detection rule, abnormal behavior detection based on a deep learning model, and intrusion judgment by using a priority weighted decision fusion rule; issuing a defense instruction according to the intrusion level; collecting data by combining the timing with the event driving, dynamically optimizing the information fusion rule and the detection model; and recording the whole-process log for compliance verification. The application improves the intrusion detection precision and the business continuity guarantee capability.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically, to a method and system for detecting financial network intrusions based on multi-source intelligence fusion. Background Technology

[0002] Existing financial network intrusion detection technologies primarily identify intrusion behaviors by collecting network traffic, system logs, and business data, combined with preset rules or machine learning models. Rule-based detection methods rely on manual rule updates, making them ill-equipped to handle novel and unknown attacks. Machine learning-based methods often depend on a single data source, making their accuracy susceptible to data quality issues and limiting their generalization capabilities. At the threat intelligence application level, existing technologies mostly employ single-source threat intelligence, failing to effectively integrate multi-source intelligence. This results in intelligence redundancy, high false positive rates, and an inability to promptly acquire information on emerging external threats, leading to delays in detecting unknown intrusions. Furthermore, existing technologies generally fail to consider the core characteristics of financial networks: conflicts between detection and business continuity, lack of compliance audit compatibility, and a disconnect between detection results and defense systems, making it difficult to form a closed-loop system of "intelligence fusion - intrusion detection - defense linkage."

[0003] To address the aforementioned issues, some improved solutions have been proposed in existing technologies. These solutions construct a "decision tree-convolutional neural network-decision tree" model, aiming to solve the problems of low training efficiency and difficulty in meeting real-time detection requirements of deep neural networks. The core of this approach lies in using a first decision tree to offline filter a large amount of normal data, retaining abnormal and suspected abnormal data to accelerate data processing. Then, an improved convolutional neural network is used to extract features, and finally, a second decision tree performs classification. While this solution improves detection efficiency and accuracy to some extent through model structure improvements, its technical approach primarily focuses on optimizing the model architecture for general network intrusion detection and is not designed specifically for the needs of financial networks.

[0004] Specifically, the existing technical solutions have the following technical problems: 1) Lack of fusion and scenario-based adaptation of multi-source threat intelligence: This solution relies solely on the network traffic data to be detected, without incorporating any external threat intelligence. This results in its detection model being able to make judgments based only on the collected traffic characteristics, unable to utilize multi-source data such as third-party commercial intelligence and industry-shared intelligence to gain prior knowledge of new attack methods, malicious IPs, etc. This makes the model inherently deficient in its ability to detect unknown attacks, and it cannot achieve deep adaptation of intelligence to financial business scenarios (such as core trading areas and customer information areas).

[0005] 2) Intrusion detection is disconnected from financial operations and defense systems: The detection process of this solution mainly ends at the output of classification results, failing to establish a linkage with financial business continuity assurance (such as business compensation mechanisms) and existing defense systems (such as firewalls and IPS). Its detection results cannot automatically trigger targeted defense strategies, and it is difficult to ensure business continuity when attacks targeting core businesses are detected, which is inconsistent with the actual needs of the financial industry to "emphasize both security and business".

[0006] 3) Lack of adaptive optimization and compliance auditing capabilities for detection systems: Existing technologies generally lack a closed-loop mechanism for dynamically optimizing models and rules based on detection results, and the detection process lacks fully traceable audit logs, making it difficult to meet the financial industry's dual requirements for continuous system evolution and compliance verification. Although the solutions disclosed in the comparative documents achieve a certain degree of adaptability through model training, their optimization mechanisms mainly rely on updates to training data and do not construct a fully closed-loop optimization system from intelligence gathering, fusion, detection, and defense response. Furthermore, they cannot meet the financial industry's compliance verification requirements for a fully traceable and auditable intrusion detection process. Summary of the Invention

[0007] The purpose of this invention is to overcome the above-mentioned problems in the prior art and provide a financial network intrusion detection method and system based on multi-source intelligence fusion, and to build an integrated system of multi-source threat intelligence fusion, financial business adaptation, accurate intrusion detection, defense linkage, compliance audit and closed-loop optimization.

[0008] To achieve the above objectives, the present invention provides the following technical solution: This application provides a financial network intrusion detection method based on multi-source intelligence fusion, including the following steps: Step S1: System Initialization and Multi-Source Threat Intelligence Acquisition Deploy the system architecture and configure basic parameters, including intelligence collection sources, intelligence fusion rules, detection model parameters, business adaptation benchmarks, sensitive data protection rules, and compliance configurations; collect threat intelligence from at least two sources, including at least two of third-party commercial threat intelligence, financial industry shared intelligence, local threat intelligence, and open-source threat intelligence; perform preliminary screening on the collected raw threat intelligence, remove invalid and expired intelligence, and de-identify intelligence containing sensitive information, then encrypt and report the processed intelligence.

[0009] Step S2: Multi-source threat intelligence fusion processing The system receives reported intelligence, standardizes it to unify the format of intelligence from different sources, uses a cosine similarity algorithm to identify and remove duplicate intelligence, employs an isolated forest algorithm to remove invalid and interfering intelligence, and uses the Apriori algorithm to perform multi-dimensional correlation analysis on the deduplicated and denoised intelligence. It then constructs an intelligence correlation network with intelligence entities as nodes and correlation relationships as edges using a graph database. The system stores the accurate intelligence after correlation analysis in a fused intelligence database and establishes a dynamic update mechanism to update newly collected intelligence in real time and periodically clean up expired intelligence.

[0010] Step S3: Adaptation of Financial Transactions and Sensitive Data The system acquires business scenario classification and business priority information of the financial network, as well as sensitive data identification rules; based on the business scenarios and business priorities, it uses a rule engine to perform differentiated filtering of intelligence in the fused intelligence database, and uses the hierarchical analysis method to assign corresponding weights to the filtered intelligence to generate scenario-based intelligence; it associates sensitive data features and marks intrusion intelligence targeting sensitive data; based on the scenario-based intelligence, business priorities, and sensitive data adaptation results, it generates differentiated scenario-based detection rules.

[0011] Step S4: Financial Network Detection Data Acquisition and Preprocessing The system collects detection data from the financial network, including network traffic data, system log data, and business data. It then preprocesses the collected detection data, including deduplication and noise reduction, sensitive data anonymization, data standardization, and feature extraction, to obtain preprocessed feature data.

[0012] Step S5: Precise Intrusion Detection and Result Determination Based on the scenario-based detection rules and intrusion features in the fused intelligence database, feature matching detection is performed on the preprocessed feature data to identify known intrusion behaviors. Simultaneously, an abnormal behavior detection is performed on data that does not match known intrusion features, based on a hybrid deep learning detection model combining CNN and LSTM, to identify unknown intrusion behaviors. A priority-weighted decision fusion rule is used to fuse and determine the feature matching detection results and abnormal behavior detection results. When a feature matching detection hits, it is directly determined as an intrusion; when a feature matching detection misses, the abnormality score of the abnormal behavior detection is used as the determination basis, and the determination threshold of the abnormality score is dynamically adjusted according to the business scenario. If the fused determination result is an intrusion, the intrusion parameters are determined, including intrusion type, intrusion level, intrusion location, and intrusion impact range. If it is determined to be normal business behavior, the process returns to step S4 to continuously collect detection data. If the detection result is manually verified as a misjudgment, the misjudged data is fed back for subsequent optimization.

[0013] Step S6: Collaborative and Joint Response Based on the determined intrusion level, corresponding defense commands are issued to the defense system. These commands include interception, rate limiting, or blocking commands. Commands are issued using advanced policy names and parameter configurations. For older defense devices that do not support standard protocols, protocol conversion is performed using a pre-set adapter. When the intrusion level is classified as severe, a service compensation mechanism is activated, automatically switching core service traffic to a pre-established hot standby channel. This hot standby channel operates in parallel with the main channel, using an incremental synchronization mechanism to synchronize service data in real time. Simultaneously, information from the entire process of intelligence gathering, fusion, detection, and handling is synchronized to the compliance audit module, and operation logs are recorded. The handling results are received from the defense system.

[0014] Step S7: Closed-loop optimization The system employs a combination of timed triggering and event-driven triggering to collect detection results, defense response results, false positive data, and business update data. Event-driven triggering conditions include false positive rate exceeding a preset threshold, false negative rate exceeding a preset threshold, defense response failure rate exceeding a preset threshold, or the amount of newly collected valid threat intelligence exceeding a preset threshold. Based on the collected data, the intelligence fusion rules are optimized using adaptive parameter adjustment, the detection model is optimized using incremental training, and the scenario-based detection rules are adjusted. The optimized rules and models are synchronized to steps S2, S3, and S5 for subsequent intelligence fusion, business adaptation, and intrusion detection.

[0015] Step S8: Compliance Verification and Anomaly Handling Based on the full-process logs stored in the compliance audit module, it provides multi-dimensional log query and export functions, and supports automatic generation of compliance verification reports; it monitors the operating status of each link of the system in real time, triggers hierarchical alarms when an anomaly occurs, starts backup plans to perform anomaly handling, and records anomaly handling logs.

[0016] Furthermore, in step S1, when initially screening the original threat intelligence, a combination of rule engine and decision tree model is used to screen based on the criteria for determining invalid and expired intelligence.

[0017] Furthermore, in step S3, the weight value is used to influence the alarm threshold of intrusion detection, the scanning frequency of the detection engine, and the priority of threat situation analysis in step S5. The weight value is negatively correlated with the alarm threshold.

[0018] Furthermore, in step S5, the input feature vector is 512-dimensional, including the first 150 dimensions of network traffic features, the middle 120 dimensions of service features, and the last 242 dimensions of fused threat intelligence features.

[0019] On the other hand, this application also provides a financial network intrusion detection system based on multi-source intelligence fusion to implement the above method, the system comprising: The multi-source intelligence gathering module is used to collect threat intelligence from at least two sources, perform preliminary screening and de-identification processing on the collected raw threat intelligence, and report the processed intelligence. The intelligence fusion processing module is connected to the multi-source intelligence collection module. It is used to receive reported intelligence, standardize the intelligence, remove duplicates using the cosine similarity algorithm, reduce noise using the isolated forest algorithm, perform association analysis using the Apriori algorithm, generate a fused intelligence database, and establish a dynamic update mechanism. The business adaptation module is connected to the intelligence fusion processing module. It is used to obtain the business scenario classification, business priority information and sensitive data identification rules of the financial network, use the rule engine to perform differentiated screening of intelligence in the fusion intelligence database, use the hierarchical analysis method to allocate weights, and generate scenario-based intelligence and scenario-based detection rules. The data acquisition and preprocessing module is used to collect detection data from the financial network and perform deduplication and noise reduction, sensitive data anonymization, data standardization and feature extraction on the collected detection data to obtain preprocessed feature data. The intrusion detection module is connected to the business adaptation module and the data acquisition and preprocessing module respectively. It is used to perform feature matching detection based on the scenario-based detection rules and intrusion features in the fusion intelligence database, and to perform abnormal behavior detection based on a hybrid deep learning detection model combining CNN and LSTM. It uses a priority weighted decision fusion rule to fuse and determine the detection results and determine the intrusion parameters. The collaborative linkage module, connected to the intrusion detection module, is used to issue defense instructions to the defense system according to the intrusion level, activate the service compensation mechanism to switch core service traffic to the hot standby channel when the intrusion level is a severe intrusion, and receive the handling results fed back by the defense system. The compliance audit module, connected to the collaborative module, is used to record information throughout the entire process, provide log query and export functions, and support the automatic generation of compliance verification reports; The closed-loop optimization module is connected to the intrusion detection module, the collaborative linkage module, the intelligence fusion processing module, the business adaptation module, and the intrusion detection module, respectively. It is used to collect detection results, defense handling results, misjudgment data, and business update data by combining timed triggering and event-driven triggering, optimize intelligence fusion rules by adopting parameter adaptive adjustment, optimize detection models by incremental training, and adjust scenario-based detection rules. The optimized rules and models are then synchronized to the intelligence fusion processing module, the business adaptation module, and the intrusion detection module. The data support layer is connected to the multi-source intelligence collection module, the intelligence fusion processing module, the business adaptation module, the data collection and preprocessing module, the intrusion detection module, the collaborative linkage module, the compliance audit module, and the closed-loop optimization module. It is used to store intelligence data, detection data, and log data in an encrypted storage manner, and to provide data storage and query services for each module.

[0020] Furthermore, the multi-source intelligence gathering module includes: The third-party intelligence gathering unit, connected to the preliminary screening unit, is used to collect third-party commercial threat intelligence via HTTPS / RESTful interface calls. An industry intelligence collection unit, connected to the preliminary screening unit, is used to collect shared intelligence in the financial industry via an IPsec VPN encrypted connection. A local intelligence gathering unit, connected to the preliminary screening unit, is used to gather local threat intelligence through the ELK suite and regular expression parsing. An open-source intelligence gathering unit, connected to the preliminary screening unit, is used to crawl and collect open-source threat intelligence using the Scrapy framework. The initial screening unit, connected to the desensitization processing unit, is used to remove invalid and outdated information by combining a rule engine with a decision tree model. The desensitization processing unit, whose output terminal serves as the output terminal of the multi-source intelligence collection module, is used to desensitize intelligence containing sensitive information.

[0021] Furthermore, the intelligence fusion processing module includes: The standardized processing unit, whose input end serves as the input end of the intelligence fusion processing module, is used to unify the format of threat intelligence from different sources; The deduplication unit, connected to the standardization processing unit, is used to identify and remove duplicate information using a cosine similarity algorithm. The noise reduction unit, connected to the deduplication unit, is used to remove invalid and interfering information using the isolated forest algorithm. The association analysis unit, connected to the noise reduction unit, is used to perform multi-dimensional association analysis on intelligence using the Apriori algorithm and to construct an intelligence association network through a graph database. The integrated intelligence database unit is connected to the correlation analysis unit to store processed and accurate intelligence and to establish a dynamic update mechanism. Its output end serves as the output end of the intelligence fusion processing module.

[0022] Furthermore, the service adaptation module includes: The scenario information acquisition unit is used to acquire business scenario classification, business priority information, and sensitive data identification rules of the financial network. A differentiated filtering unit is connected to the intelligence fusion processing module and the scene information acquisition unit, respectively, and is used to perform differentiated filtering on the fused intelligence using a rule engine; The weight allocation unit is connected to the differential filtering unit and the scene information acquisition unit respectively. It is used to assign weights to the filtered intelligence using the analytic hierarchy process to generate scene-based intelligence. The weight values ​​are used to affect the alarm threshold of intrusion detection, the scanning frequency of the detection engine, and the priority of threat situation analysis. The rule generation unit is connected to the weight allocation unit and the scene information acquisition unit respectively, and is used to generate scene-based detection rules based on scene-based intelligence, business priority and sensitive data adaptation results. Its output end serves as the output end of the business adaptation module.

[0023] Furthermore, the intrusion detection module includes: The feature matching and detection unit is connected to the business adaptation module and the data acquisition and preprocessing module respectively, and is used to perform feature matching and detection based on scenario-based detection rules and intrusion features in the fusion intelligence database. An abnormal behavior detection unit, connected to the data acquisition and preprocessing module, is used to detect abnormal behavior in data that does not match known intrusion features based on a hybrid deep learning detection model combining CNN and LSTM. The input feature vector of the detection model is 512-dimensional, including the first 150 dimensions of network traffic features, the middle 120 dimensions of business features, and the last 242 dimensions of fused threat intelligence features. A fusion decision unit is connected to the feature matching detection unit and the abnormal behavior detection unit respectively, and is used to fuse and determine the feature matching detection results and the abnormal behavior detection results using a priority weighted decision fusion rule; The intrusion parameter determination unit, connected to the fusion decision unit, is used to determine the intrusion type, intrusion level, intrusion location, and intrusion impact range when the fusion determination result is an intrusion. Its output terminal serves as the output terminal of the intrusion detection module.

[0024] Furthermore, the collaborative linkage module includes: The defense command issuing unit is connected to the intrusion detection module and is used to issue interception commands, flow limiting commands, or blocking commands to the defense system according to the intrusion level. The commands are issued in the form of advanced policy names plus parameter configuration. The device adaptation unit is connected to the defense command issuing unit and is used to perform protocol conversion for older defense devices that do not support standard protocols through a preset adapter. The service compensation unit is connected to the defense instruction issuing unit and is used to automatically switch core service traffic to a pre-established hot standby channel when the intrusion level is a severe intrusion. The hot standby channel runs in parallel with the main channel and uses an incremental synchronization mechanism to synchronize service data in real time. The result receiving unit is connected to the defense system and is used to receive the processing results fed back by the defense system. The log recording unit is connected to the defense instruction issuing unit, the business compensation unit, and the result receiving unit, respectively. Its output end serves as the output end of the collaborative linkage module, used to synchronize the entire process information to the compliance audit module.

[0025] Furthermore, the closed-loop optimization module includes: The data acquisition unit is connected to the intrusion detection module and the collaborative linkage module respectively. It is used to collect detection results, defense and handling results, false alarm data and business update data in a combination of timed triggering and event-driven triggering. The conditions for event-driven triggering include false alarm rate exceeding a preset threshold, false alarm rate exceeding a preset threshold, defense and linkage handling failure rate exceeding a preset threshold, or newly collected effective threat intelligence exceeding a preset threshold. An optimized execution unit is connected to the data acquisition unit and is used to optimize the intelligence fusion rules by adopting an adaptive parameter adjustment method, optimize the detection model by adopting an incremental training method, and adjust the scenario-based detection rules. The synchronization update unit is connected to the optimization execution unit, and is also connected to the intelligence fusion processing module, the business adaptation module, and the intrusion detection module, respectively, for synchronizing the optimized rules and models to the relevant modules.

[0026] Compared with the prior art, the present invention has the following beneficial effects: I. A multi-source threat intelligence fusion processing mechanism is constructed to achieve deep integration and precise utilization of intelligence, solving the problems of single intelligence source, high redundancy, and low accuracy in existing technologies. Existing technologies rely solely on the network traffic data to be detected, without incorporating any external threat intelligence. Their detection models can only make judgments based on the collected traffic characteristics. While it is generally known in this field that there are technical means to incorporate third-party threat intelligence, these are mostly simple overlays, lacking deep integration and adaptation mechanisms.

[0027] This invention achieves deep integration of multi-source threat intelligence by constructing a full-process fusion mechanism of "collection-standardization-deduplication and noise reduction-correlation analysis-dynamic update". Specifically: First, the collection scope covers four core sources: third-party commercial intelligence, financial industry shared intelligence, local intelligence, and open-source intelligence, ensuring the comprehensiveness and timeliness of the intelligence; Second, the cosine similarity algorithm is used for deduplication, and the isolated forest algorithm is used for noise reduction, effectively solving the problems of intelligence redundancy and high proportion of invalid intelligence; Third, the Apriori algorithm is used for multi-dimensional correlation analysis, and an intelligence correlation network is constructed through a graph database to achieve multi-dimensional correlation of intelligence internally, externally (with financial business, sensitive data), and historically, significantly improving the accuracy of the intelligence; Fourth, a dynamic update and expiration cleanup mechanism is established to ensure the timeliness of the intelligence.

[0028] The synergistic effect of the aforementioned technical features enables this invention to achieve a leap from "single source, simple superposition" to "multi-source fusion, deep correlation" at the intelligence level, providing comprehensive and accurate data support for subsequent intrusion detection.

[0029] Second, a dual adaptation mechanism for financial business and sensitive data was established to achieve deep coupling between intelligence and business scenarios, solving the problems of detection being disconnected from business and high false alarm rates in existing technologies. Existing technologies employ uniform detection rules, failing to consider the differentiated needs of various business scenarios, and their detection results lack correlation with ensuring the continuity of financial services. While the concept of business priority exists in common knowledge in this field, it is not deeply coupled with threat intelligence screening and the generation of detection rules.

[0030] This invention innovatively constructs a dual-adaptation mechanism for financial business and sensitive data: First, based on the business scenario classification of the financial network (core transaction area, customer information area, office area, etc.) and business priority (level 1 to level 4), the fused intelligence is differentiated and weighted using the analytic hierarchy process (AHP); Second, the weight values ​​directly affect the alarm threshold of intrusion detection, the scanning frequency of the detection engine, and the priority of threat situation analysis. The weights are negatively correlated with the alarm thresholds, enabling dynamic adjustment of detection sensitivity; Third, sensitive data features are associated, intrusion intelligence targeting sensitive data is labeled, and specific detection rules are set.

[0031] The synergistic effect of the above-mentioned technical features enables the present invention to dynamically adjust the detection strategy according to the importance of the business and the sensitivity of the data. High-intensity and high-sensitivity detection is used for core business, while lightweight detection is used for non-core business. This ensures high security protection for core business while taking into account the operational efficiency of non-core business, fundamentally solving the problems of detection being disconnected from business and high false alarm rate in the prior art.

[0032] Third, a collaborative mechanism for detection, defense, and compliance auditing is established to achieve a closed-loop process for intrusion handling, solving the problems of disconnect between detection and defense, insufficient business continuity assurance, and poor compliance adaptation in existing technologies. Existing detection processes primarily terminate at the output of classification results, without establishing a linkage with defense systems and compliance audit systems. While it is generally accepted in this field that defense actions are triggered by detection results, these are mostly simple interceptions, lacking targeted tiered handling and business continuity assurance mechanisms.

[0033] This invention constructs a three-in-one collaborative mechanism of "detection-defense-compliance audit": First, differentiated defense instructions are issued according to the intrusion level (minor, moderate, severe). Minor intrusions are intercepted, moderate intrusions are rate-limited and intercepted, and severe intrusions are blocked and a business compensation mechanism is activated. Second, the business compensation mechanism uses a pre-established hot standby channel that runs in parallel with the main channel and uses an incremental synchronization mechanism to synchronize business data in real time, with a switching time of no more than 1 second, ensuring that core business is not interrupted. Third, for older defense devices that do not support standard protocols, protocol conversion is performed through a preset adapter to ensure system compatibility. Fourth, while handling defense, the entire process of intelligence collection, fusion, detection, and handling is synchronized to the compliance audit module, and a complete operation log is recorded to ensure that the entire process is auditable and traceable.

[0034] The synergistic effect of the above-mentioned technical features enables the present invention to achieve rapid linkage from "detection to defense" (response time not exceeding 500 milliseconds), and ensures the continuity of core business through a business compensation mechanism. At the same time, it meets the compliance verification requirements of the financial industry for full-process traceability, and solves the problems of disconnect between detection and defense, insufficient business continuity guarantee, and poor compliance adaptation in the existing technology.

[0035] Fourth, a closed-loop optimization mechanism is constructed to achieve adaptive iteration and continuous evolution of the system, solving the problems of the inability of the system to adaptively iterate and the decline in accuracy over long-term use in existing technologies. Existing optimization mechanisms primarily rely on updating training data, lacking the ability to dynamically optimize based on real-time detection results. While technical means for model updates exist, they are mostly full retraining, which is inefficient and lacks a complete closed-loop system.

[0036] This invention constructs a closed-loop optimization mechanism encompassing "data collection-analysis-optimization-synchronization-iteration": First, it employs a combination of timed triggering and event-driven triggering. Event-driven triggering conditions include a false positive rate exceeding 0.5%, a false negative rate exceeding 0.2%, a defense linkage failure rate exceeding 1%, or a daily increase of over 500 newly collected valid threat intelligence entries, ensuring the timeliness and necessity of optimization triggering. Second, the optimization content covers three dimensions: intelligence fusion rules (using parameter adaptive adjustment), detection models (using incremental training, freezing the underlying feature extraction layer, and only fine-tuning the parameters of the top fully connected layer), and scenario-based detection rules, achieving multi-level system optimization. Third, a version management mechanism is established, retaining nearly 10 valid versions and supporting one-click rollback to the optimal version. Fourth, before a new model goes live, it undergoes full-scale performance testing in a simulation testing environment, requiring each indicator to be at least 5% better than the current online model. After verification through gray-scale deployment, a full replacement is performed, ensuring the reliability of the optimization effect.

[0037] The synergistic effect of the above-mentioned technical features enables the present invention to achieve adaptive iteration of the detection system, reduce the false alarm rate by 0.05% per month, and adapt to new intrusion methods within 24 hours, thus solving the problems of existing systems being unable to adaptively iterate and experiencing a decline in accuracy over long-term use.

[0038] In summary, this invention, through the integration and synergy of the above technical solutions, constructs an integrated system of "multi-source threat intelligence fusion - financial business adaptation - precise intrusion detection - defense linkage - compliance audit - closed-loop optimization". The various technical features support and synergize with each other, realizing a closed-loop process from intelligence collection to detection and handling to optimization iteration. This significantly improves the accuracy, adaptability, real-time performance, and adaptability of financial network intrusion detection, and effectively solves many technical problems existing in the prior art. Attached Figure Description

[0039] Figure 1 This is a flowchart of the method described in Embodiment 1 of the present invention; Figure 2 This is a sub-flowchart of step S1 in Embodiment 1 of the present invention; Figure 3 This is a sub-flowchart of step S2 in Embodiment 1 of the present invention; Figure 4 This is a sub-flowchart of step S3 in Embodiment 1 of the present invention; Figure 5 This is a sub-flowchart of step S5 in Embodiment 1 of the present invention; Figure 6 This is a sub-flowchart of step S6 in Embodiment 1 of the present invention; Figure 7 This is a sub-flowchart of step S7 in Embodiment 1 of the present invention; Figure 8 This is an architecture diagram of the system described in Embodiment 2 of the present invention. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be described in further detail below with reference to the accompanying drawings and specific embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in this application can be combined with each other.

[0041] First, some of the terms used in this invention will be explained to facilitate understanding: Threat intelligence refers to actionable knowledge about cybersecurity threats, including but not limited to malicious IP addresses, malicious domains, vulnerability information, attack methods, and attack indicators, which can be used to identify and prevent cyberattacks.

[0042] Multi-source threat intelligence fusion refers to the process of collecting, standardizing, deduplicating, reducing noise, and performing correlation analysis on threat intelligence from different sources (such as third-party commercial intelligence, industry-shared intelligence, locally collected intelligence, and open-source intelligence) to form a unified, accurate, and usable intelligence set.

[0043] Financial business scenarios refer to different areas or logical units in the network environment of financial institutions, divided according to business functions, including but not limited to the core transaction area (carrying key businesses such as real-time payment and fund transfer), customer information area (storing and processing sensitive customer data), office area (carrying daily office business), and bank-enterprise direct connection area (connecting enterprise and bank systems).

[0044] Business Priority: This refers to the classification of financial services based on their importance and the requirements for business continuity. Level 1 services (such as real-time payments and fund transfers) require zero missed reports and high availability, while Level 4 services (such as office-related services) prioritize ensuring smooth business operations.

[0045] Contextualized intelligence refers to threat intelligence generated by differentiating and weighting intelligence from the integrated intelligence database based on financial business scenarios and priorities, and adapted to specific business scenarios.

[0046] Hot standby channel: refers to a backup channel that runs in parallel with the main business channel. It uses an incremental synchronization mechanism to synchronize business data in real time and can quickly switch over when the main channel fails, ensuring business continuity.

[0047] Incremental training: refers to a training method that uses newly added sample data to fine-tune the model based on the existing trained model, without retraining the entire model, which can significantly shorten the training time.

[0048] Example 1: A Financial Network Intrusion Detection Method Based on Multi-Source Intelligence Fusion This embodiment provides a financial network intrusion detection method based on multi-source intelligence fusion. This method constructs an integrated process of "multi-source threat intelligence collection - intelligence fusion processing - financial business adaptation - detection data collection - accurate intrusion detection - collaborative response - closed-loop optimization - compliance verification and anomaly handling," achieving high-precision, low-false-positive, and traceable real-time detection and handling of financial network intrusion activities. See also... Figure 1 The following is a detailed explanation of the specific steps.

[0049] Step S1: System Initialization and Multi-Source Threat Intelligence Acquisition See Figure 2 The specific implementation is as follows: In the financial network environment, build the overall system architecture and configure basic intelligence collection sources, intelligence fusion rules, detection model parameters, business adaptation benchmarks, sensitive data protection rules and compliance configurations.

[0050] Specifically, the intelligence-related configuration includes: pre-setting multiple intelligence collection sources, including third-party commercial intelligence interfaces (connecting to the threat intelligence platforms of mainstream network security vendors), financial industry shared intelligence platforms (connecting to financial industry threat intelligence sharing platforms), local attack log databases (parsing logs from devices such as firewalls and IPS), and open-source threat intelligence databases (crawled from open-source threat intelligence platforms); configuring the intelligence collection frequency to no more than 100 milliseconds / time; pre-setting intelligence fusion rules, including deduplication, noise reduction, and correlation analysis algorithm parameters; and establishing standardized intelligence format specifications, following the STIX 2.1 standard.

[0051] Business adaptation configuration includes: preset financial business scenario classification, including core transaction area, customer information area, office area, and bank-enterprise direct connection area; preset business priorities, with first-level businesses including real-time payment and fund transfer, second-level businesses including risk control inquiry and batch clearing, third-level businesses including customer inquiry and business processing, and fourth-level businesses including office-related businesses; preset sensitive data identification rules, including identification features of sensitive fields such as customer ID number, fund password, and account information.

[0052] The detection configuration includes: building an intrusion detection model, using a hybrid deep learning model combining CNN and LSTM. The CNN network structure has 3 convolutional layers: the first convolutional layer has 64 3×3 convolutional kernels, the second convolutional layer has 128 3×3 convolutional kernels, and the third convolutional layer has 256 3×3 convolutional kernels. 2×2 max pooling is used, and ReLU is selected as the activation function. The LSTM network structure has 2 layers: the first layer has 256 hidden units, and the second layer has 128 hidden units. The dropout ratio is set to 0.3. Preset detection rules include detection thresholds for different scenarios and different priority services. The detection frequency is configured to not exceed 50 milliseconds / time. The intrusion level is divided into three levels: mild, moderate, and severe.

[0053] Sensitive data protection configuration includes: configuring data anonymization rules, using AES-256 encryption and masking for sensitive fields; specifying the scope of data collection for detection, prohibiting the collection of plaintext sensitive data; and configuring data access permissions to restrict access to sensitive data.

[0054] The compliance configuration includes: importing financial industry compliance rules, including the relevant requirements of the "Administrative Measures for Cybersecurity of Commercial Banks" and the "Personal Financial Information Protection Law"; configuring the scope of log recording, including the entire process of intelligence collection, integration, detection, linkage, and optimization; configuring the log storage period to be no less than one year; and building a compliance query and export interface to support multi-dimensional queries and report generation.

[0055] After completing the above configuration, perform system integration and self-test: complete the integration of each functional module and test the effectiveness of intelligence collection, fusion, detection, and linkage functions; complete the integration with the defense system and compliance audit system and test the smoothness of data interaction; simulate different types of intrusion behavior to verify detection accuracy and linkage effect; test the sensitive data collection and desensitization process to ensure data security; adjust the basic configuration parameters to ensure normal system operation.

[0056] After the system initialization and deployment are completed, four types of core threat intelligence are collected in real time through methods such as interface calls, log parsing, and web crawling.

[0057] Third-party commercial threat intelligence collection: Threat intelligence platforms of mainstream cybersecurity vendors are accessed via HTTPS / RESTful interfaces, with HTTP / 2 protocol compatibility and JSON data exchange conforming to the STIX 2.1 standard. Authentication uses API keys, IP whitelists, and timestamp signatures. The maximum concurrent API throughput is no less than 100 QPS, with a single response time not exceeding 50 milliseconds, and batch requests are supported (no more than 1000 requests per request). Collected content includes malicious IP databases, malicious domain databases, vulnerability intelligence (CVE vulnerabilities, financial industry-specific vulnerabilities), and attack method intelligence.

[0058] Financial industry shared intelligence collection: Encrypted connections are established via IPsec VPN, and data transmission uses AES-256-GCM tunnel encryption and RSA-2048 end-to-end encryption, with SHA-256 verification for integrity; a two-way synchronization mechanism is adopted, with real-time push (delay not exceeding 100 milliseconds) and hourly incremental retrieval; the collected content includes intrusion intelligence across banks and financial institutions (such as targeted attacks against financial systems and new types of fraud attacks) and compliance-related intelligence.

[0059] Local threat intelligence gathering: Analyzes six core log types, including firewall, IPS, and server logs, using the ELK suite and regular expressions; extracts structured threat intelligence from massive logs through a three-level logic of "filtering-extracting-correlation"; the collected content includes local intrusion characteristics, malicious behavior records, and internal violation intelligence.

[0060] Open source threat intelligence gathering: The Scrapy framework is used, employing a targeted and deep crawling strategy; core platforms are monitored in real time (update delay not exceeding 5 minutes), and non-core platforms are crawled every 2 hours; anti-crawler mechanisms are countered through dynamic User-Agent and IP proxy pools; the collected content includes new attack scripts and vulnerability exploitation methods.

[0061] After collection, the raw intelligence undergoes initial screening using a method that primarily employs the Drools rule engine, supplemented by a lightweight decision tree model. The response time is no more than 10 milliseconds, and the accuracy rate is no less than 98%. Invalid intelligence is judged based on vague descriptions, missing attack sources, credibility scores below 60, irrelevance to financial scenarios, duplication, or incorrect formatting. Expired intelligence is judged based on exceeding its marked expiration time, vulnerability patching exceeding 72 hours, attack methods with no cases in the past 30 days, or no updates for more than 90 days. Intelligence containing sensitive information is anonymized to prevent leakage of sensitive data. The pre-screened intelligence is encrypted and reported to the intelligence fusion processing layer at a frequency not exceeding 100 milliseconds per report. Intelligence collection logs are recorded, including collection time, source, and intelligence type, for compliance auditing and subsequent traceability.

[0062] Step S2: Multi-source threat intelligence fusion processing See Figure 3 The specific implementation is as follows: After receiving the reported intelligence, it is first standardized. The pre-set standardized format specifications are used to uniformly format intelligence from different sources and in different formats, and to unify the description format and field definition of malicious IP and vulnerability intelligence, so as to solve the problem of inconsistent formats of multi-source intelligence.

[0063] After standardization, deduplication is performed: using the cosine similarity algorithm, feature vectors are constructed by extracting core intelligence features (attack IP, threat type, etc.), and vector similarity is calculated. When the similarity is not less than 95%, it is judged as duplicate intelligence and removed to ensure the uniqueness of the integrated intelligence database. The deduplication accuracy is not less than 99.8%.

[0064] After deduplication, noise reduction is performed: the Isolation Forest algorithm is adopted, which is implemented based on the Python sklearn framework. The training data comes from historical valid intelligence, labeled noise data and publicly available industry noise samples; the noise feature library is updated by a combination of manual annotation and automatic learning, and is optimized and updated daily based on the screening results; invalid and interfering intelligence is removed, and the proportion of valid intelligence after noise reduction is not less than 95%.

[0065] After noise reduction, correlation analysis is performed: The Apriori algorithm is used to conduct multi-dimensional correlation analysis on the standardized, deduplicated, and noise-reduced intelligence, mining correlation rules between intelligence features (such as the correlation between malicious IPs and attack methods and vulnerability types), mining frequent itemsets, and generating correlation rules. A graph database is used to implement the intelligence correlation network, with intelligence entities as nodes and correlation relationships as edges. Nodes contain attributes such as intelligence identifiers and features, and edges are labeled with correlation types (such as causal and accompanying), enabling visualization and rapid retrieval of intelligence correlations. Correlation analysis includes internal correlation (correlating intelligence related to the same attack behavior), external correlation (correlating intelligence with financial business scenarios and sensitive data features), and historical correlation (correlating current intelligence with local historical intelligence and historical intrusion data to analyze attack trend changes).

[0066] Accurate intelligence obtained from correlation analysis is stored in the integrated intelligence database and managed according to intelligence type (malicious IP, vulnerability, attack method); a dynamic intelligence update mechanism is established to receive newly collected intelligence in real time and update the integrated intelligence database synchronously, and expired intelligence (such as invalid malicious IP and patched vulnerability) is cleaned up daily to ensure the timeliness of intelligence; the update process is logged for compliance auditing.

[0067] Step S3: Adaptation of Financial Transactions and Sensitive Data See Figure 4 The specific implementation is as follows: After obtaining information on the business scenario classification and business priority of the financial network, as well as the rules for identifying sensitive data, differentiated adaptation is carried out by combining intelligence from the integrated intelligence database.

[0068] Business Scenario Adaptation: The fused intelligence is selectively filtered based on different business scenarios. For the core transaction area, the focus is on filtering attack intelligence targeting real-time payments and fund transfers (such as malicious payment instructions and fund theft attack methods). A rule engine is used to match intelligence features (such as database vulnerabilities and fund theft) with the scenario features of the core transaction area (core database and sensitive transaction data storage). Intelligence highly correlated with the core transaction area is retained and assigned the highest weight (weight value 8-10) using the analytic hierarchy process (AHP), and marked as "core risk intelligence." For the customer information area, the focus is on filtering intelligence targeting customer information theft and tampering (such as malicious web crawlers and data leakage attack intelligence). Sensitive data features are correlated, and the AHP is used to assign a medium-to-high weight (weight value 6-7). For the office area and non-core areas, routine intrusion intelligence is filtered and assigned a lower weight (weight value 2-3) using the AHP. Lightweight detection rules are employed to avoid impacting office and non-core business efficiency.

[0069] Business Priority Adaptation: The focus of intelligence adaptation and detection is adjusted according to business priority. Level 1 business (real-time payment) is adapted to high-precision and high-sensitivity intelligence and detection rules to ensure zero missed detections; Level 2 and 3 business are adapted to conventional intelligence and detection rules, balancing accuracy and efficiency; Level 4 business is adapted to simplified intelligence and detection rules, prioritizing business smoothness.

[0070] Sensitive data adaptation: Associate and integrate intelligence with sensitive data characteristics, mark intrusion intelligence targeting sensitive data (such as data theft and tampering intelligence), set specific detection rules to ensure that such intrusion behaviors can be accurately identified; avoid contact with plaintext sensitive data during the intelligence adaptation process to ensure data security.

[0071] Contextualized detection rule generation: Based on contextualized intelligence, business priorities, and sensitive data adaptation results, differentiated contextualized detection rules are generated using a model of automatic generation followed by manual verification before being issued. These rules are then issued to the intrusion detection layer for subsequent precise intrusion detection. The rule templates are predefined according to financial business scenarios (payment, customer data management, etc.), and the parameters are automatically filled in by the adapted intelligence features. Before taking effect, the validity of the rules is verified through simulated attack scenarios to ensure that there are no false positives or false negatives before formal issuance.

[0072] Step S4: Financial Network Detection Data Acquisition and Preprocessing We collect comprehensive financial network detection data through real-time packet capture, log parsing, and API calls, with a collection frequency not exceeding 50 milliseconds per instance. The collection scope includes: network traffic data (inflow / outflow traffic rates, packet sizes, source IPs, destination IPs, port information, protocol types, and data payloads for various business scenarios), system log data (operation logs, alarm logs, and access logs of devices such as servers, firewalls, and IPS), and business data (business type, business interaction frequency, data format, and business response time; sensitive data in plaintext is not collected).

[0073] The collected detection data undergoes multi-step preprocessing to balance data quality and sensitive data protection. Deduplication and noise reduction remove duplicate and interfering data (such as duplicate traffic packets and invalid logs); sensitive data anonymization involves AES-256 encryption and masking of sensitive fields (such as customer ID numbers and account information); data standardization unifies data from different formats (such as log formats from different devices); and feature extraction extracts core features from the data (such as abnormal traffic characteristics, abnormal data format characteristics, and abnormal access behavior characteristics) as input data for the detection model.

[0074] The preprocessed detection data is encrypted and stored in the data support layer, and data collection and preprocessing logs are recorded for subsequent detection traceability and compliance auditing; the extracted feature data is input into the intrusion detection model in real time.

[0075] Step S5: Precise Intrusion Detection and Result Determination See Figure 5 The specific implementation is as follows: A hybrid deep learning detection model combining CNN and LSTM is launched, which is trained by integrating intelligence features, financial business features, and sensitive data features. The input feature vector is 512-dimensional, including the first 150 dimensions of network traffic features (covering packet size, traffic rate, packet interval, TCP / UDP connection status, port access features, and data transmission direction), the middle 120 dimensions of business features (covering business type, business priority, sensitive data access permissions, business operation frequency, and business operation duration), and the last 242 dimensions of integrated threat intelligence features (covering malicious IP identifier, vulnerability ID, attack method type, threat level, and intelligence credibility). The three types of features are normalized, one-hot encoded, and then concatenated sequentially to form a fixed-length 512-dimensional input feature vector.

[0076] The system employs a dual detection logic, comprising feature matching detection and abnormal behavior detection. Feature matching detection matches the input feature data with the scenario-based detection rules generated in step S3 and the intrusion features in the fused intelligence database generated in step S2, identifying known intrusion behaviors (such as matching malicious IPs or attack commands), with an accuracy rate of at least 99.5%. Abnormal behavior detection analyzes the abnormality of data that does not match known intrusion features using a CNN+LSTM hybrid model (such as deviations from normal business traffic patterns, abnormal access frequency, and abnormal data formats), identifying unknown intrusions and covert intrusions (such as APT attacks disguised as normal business operations), with an accuracy rate of at least 99%.

[0077] The fusion of dual detection logic adopts a priority-weighted decision fusion rule. When the feature matching detection result is "hit intrusion feature", it is directly judged as an intrusion, and the abnormal behavior detection result is used as an auxiliary reference to determine the intrusion level. When the feature matching detection result is "miss", the abnormality score (0-100 points) of the abnormal behavior detection is the core. A score of 70 points or higher is judged as an intrusion, and a score of less than 70 points is judged as normal. The abnormality score is dynamically adjusted with the threshold based on the financial business scenario (60 points for core business and 80 points for non-core business). When the feature matching detection misses but the abnormal behavior score is 65 points, if it occurs in the core business scenario (core transaction area, customer information area), the abnormal behavior score of 65 points is lower than the core business threshold of 70 points, and it is judged as "suspected intrusion", triggering a low-level alarm. The behavior data is included in the closed-loop optimization sample without interrupting business operations. If it occurs in the non-core business scenario (office area, test area), the abnormal behavior score of 65 points is higher than the non-core business threshold of 60 points, and it is judged as "intrusion", triggering a regular alarm and issuing a lightweight interception command.

[0078] If an intrusion is detected, the system automatically determines the intrusion parameters, including the intrusion type (data theft, malicious attack, unauthorized access, vulnerability exploitation, etc.), intrusion level (minor, moderate, severe), intrusion location (specific business scenario, device node), and intrusion impact scope (potentially affected business and data). It then associates the corresponding fused intelligence to identify the intrusion methods and possible attack sources.

[0079] The detection results (normal / intrusion, intrusion parameters, related intelligence) are encrypted and reported to the collaborative layer, and simultaneously stored in the data support layer; detection logs (detection time, detection data, detection results, judgment basis) are recorded for compliance auditing and closed-loop optimization.

[0080] After receiving the detection results, the collaborative layer combines contextual intelligence and business operation status to perform a secondary judgment on the results to avoid misjudgments. If the detection result is determined to be normal business behavior, it is ignored, and the process returns to step S4 to continuously collect detection data for real-time monitoring. If the detection result is determined to be an intrusion, the corresponding collaborative handling process is triggered according to the intrusion level, and the judgment log is recorded to clarify the basis for the judgment.

[0081] Establish a false positive feedback mechanism. If the detection result is manually verified as a false positive (such as normal business traffic being mistakenly identified as an intrusion), the false positive data will be fed back to the closed-loop optimization module for the optimization of the detection model and detection rules, thereby reducing the subsequent false positive rate.

[0082] Step S6: Collaborative and Joint Response See Figure 6 The specific implementation is as follows: Based on the intrusion level determined in step S5, targeted defense instructions are issued to the financial institution's existing defense systems to achieve "detection-defense" linkage, with a response time of no more than 500 milliseconds. For minor intrusions (such as a single invalid or unauthorized access), an interception instruction is issued to block the attack source without affecting normal business operations; for moderate intrusions (such as small-scale malicious scanning or single-node attacks), a rate-limiting and interception instruction is issued to limit attack traffic, block the attack source, and monitor the attack situation to prevent its spread; for severe intrusions (such as large-scale APT attacks, data theft attacks, or cross-node intrusions), a blocking instruction is issued to cut off the attack path, suspend affected non-core business operations, activate a business compensation mechanism to ensure the continuity of core business operations, and simultaneously notify operations and maintenance personnel for manual handling.

[0083] The interface interaction with the defense system adopts a "standard protocol as the primary method, adapter as a secondary method" interaction mode. It prioritizes the use of the RESTful API standard protocol for communication, is compatible with HTTPS, and uses JSON for data exchange. Interface calls employ dual authentication using API keys and IP whitelists to ensure communication security. For a few older defense devices that do not support the RESTful API standard protocol, a pre-set adapter performs protocol conversion, transforming standard system commands into a device-recognizable command format, eliminating the need to write separate core code for each device. Commands are issued in the form of "advanced policy name + parameter configuration" rather than specific command lines. Examples include blocking commands like "block_source_ip" (parameters: attack source IP, blocking duration), interception commands like "intercept_abnormal_flow" (parameters: abnormal traffic characteristics, interception action), and log collection commands like "collect_defense_log" (parameters: log type, collection duration).

[0084] The business compensation mechanism adopts a "pre-established hot standby + automatic switching" model. The backup channel for core businesses (such as payments and fund transfers) is a pre-established hot standby channel that runs in parallel with the primary channel, synchronizing business data in real time (using an incremental synchronization mechanism with a synchronization delay of no more than 100 milliseconds). The hardware and software configuration of the backup channel is consistent with the primary channel. The automatic switching process is as follows: When a severe intrusion is detected (such as the primary channel in the core transaction area being blocked, or the database being compromised and tampered with), a business compensation instruction is immediately triggered, recording the intrusion type and scope of impact; a switching notification is sent to the business layer via a message queue, containing "intrusion event, switching instruction, and switching time." Upon receiving the notification, the business layer automatically suspends primary channel business processing and saves the current business session data; a channel switching instruction is issued, automatically switching core business traffic to the backup channel. The switching process is completed automatically by the system, with a switching time of no more than 1 second, imperceptible to the user; when the primary channel intrusion is cleared and the system returns to normal, the notification is sent again, and the business layer automatically switches business traffic back to the primary channel, synchronizing business data in the backup channel to ensure data consistency. After the switch is completed, the backup channel returns to hot standby status.

[0085] While conducting defense and response, the entire process information (intelligence collection, fusion, detection, judgment, and defense operations) is synchronized to the compliance audit module, and complete logs are recorded according to preset specifications, including operation time, operator, operation content, execution result, related intelligence and detection data, to ensure that the entire process is auditable and traceable.

[0086] After the defense system completes its operation, it feeds back the results (number of interceptions, blocking effect, and business impact) to the collaborative linkage layer, which then feeds back the results to the closed-loop optimization module for subsequent optimization. The results of handling severe intrusions are manually reviewed to summarize the handling experience.

[0087] Step S7: Closed-loop optimization See Figure 7 The specific implementation is as follows: Summarize detection results, defense and response results, misjudgment data, intrusion situation change data, and business update data to analyze the shortcomings of current intelligence fusion rules, detection models, and detection rules.

[0088] The optimization mechanism employs a dual-mode approach: timed triggering and event-driven triggering. Timed triggering involves a full optimization performed every week at midnight to ensure regular system iteration. Event-driven triggering (threshold triggering) immediately initiates incremental optimization upon meeting any of the following conditions: ① Intrusion detection false positive rate is no less than 0.5%; ② Unknown intrusion false negative rate is no less than 0.2%; ③ Defense response failure rate is no less than 1%; ④ The number of newly collected valid threat intelligence entries is no less than 500 per day. Before triggering, data sampling and quantitative evaluation are performed: Normal / intrusion detection data, defense response data, and false positive / false negative labeled data from the past 7 days are collected at a 1:1 ratio, with a sample size of no less than 10,000 entries. The current performance of the intelligence fusion rules and detection model is evaluated using eight core indicators, including accuracy, false positive rate, and response efficiency, to pinpoint specific optimization dimensions.

[0089] Multi-dimensional optimization is implemented: the intelligence fusion rule optimization adopts an adaptive parameter adjustment and rule addition / reduction approach. Based on newly collected intrusion intelligence and misjudgment data, the algorithm parameters for intelligence deduplication, noise reduction, and correlation analysis are adjusted. The deduplication / noise reduction algorithm parameters are automatically fine-tuned based on feedback from misjudgment data, with the cosine similarity threshold (±0.05) and the isolated forest outlier determination threshold (±0.03) being adjusted. The correlation analysis rules add high-frequency correlation rules based on the new intelligence correlation features and delete invalid rules that have no matching within 30 days. All parameter adjustments are based on a lightweight regression model trained on historical optimization effect data to ensure the rationality of the adjustments.

[0090] The detection model optimization adopts an incremental training approach, using false positive data and novel intrusion data as training samples to retrain the detection model. The new training sample construction integrates pre-triggered sampling data, newly labeled false / missed data, and novel intrusion samples, dividing the training / validation / test sets in a 7:2:1 ratio. When the sample size is insufficient, it is supplemented with publicly available security datasets from the financial industry. The model training retains the original CNN+LSTM network structure, freezing the bottom feature extraction layer and only fine-tuning the parameters of the top fully connected layer. It uses small-batch (batch_size=32) iterative training to shorten training time. A model version library is established, recording parameters, training samples, and evaluation metrics for each version, retaining nearly 10 valid versions, and supporting one-click rollback to the optimal version. Before the new model goes live, it undergoes full-scale metric testing in a simulation testing environment, requiring all metrics (accuracy, false positive rate, etc.) to be at least 5% better than the current online model. Then, a gray-scale deployment is conducted, deploying the new model to non-core business detection nodes, running it for 24 hours without any anomalies, and then fully replacing the online model.

[0091] Detection rule optimization: Adjust scenario-based detection rules and detection thresholds according to business updates and changes in intrusion trends to adapt to new financial businesses and new intrusion methods.

[0092] Intelligence gathering optimization: Adjust the weight of multi-source intelligence gathering based on the effectiveness of the intrusion intelligence sources, increase the collection frequency of efficient intelligence sources, reduce the collection of invalid intelligence, and improve collection efficiency.

[0093] The optimized intelligence fusion rules, detection models, and detection rules are synchronized to steps S2, S3, and S5 to complete the system configuration update; the fusion intelligence database is updated synchronously to ensure the optimization effect is implemented; and optimization logs are recorded, including optimization time, optimization content, optimization reasons, and optimization effects, for compliance auditing and technical review.

[0094] Set a fixed optimization cycle (once a week) to continuously improve the system's detection accuracy, adaptability, and flexibility in light of changes in financial business, new intrusion methods, and updated compliance requirements; conduct a comprehensive optimization review every quarter to evaluate the optimization effect.

[0095] Step S8: Compliance Verification and Anomaly Handling The full-process logs stored in the compliance audit module support multi-dimensional log queries by time, operation type, business scenario, intrusion level, etc.; log export is also supported (format adapted to compliance verification requirements), making it convenient for financial institutions to accept verification by regulatory authorities.

[0096] Perform daily compliance checks on logs, checking their completeness and compliance. If any logs are missing or violations are found (such as failure to record detection results or failure to perform defense operations), an alarm will be triggered immediately to notify operations and maintenance personnel to supplement and correct the logs.

[0097] It supports the automatic generation of compliance verification reports, summarizing detection, defense, and compliance-related data (such as the number of intrusion detections, handling rate, and log integrity) within a certain period, to meet the compliance reporting needs of the financial industry.

[0098] The system monitors the operational status of each stage (intelligence collection, fusion, detection, linkage, and optimization) in real time. Monitoring indicators include intelligence collection success rate, fusion accuracy rate, detection response time, and linkage response time.

[0099] When an anomaly occurs (such as intelligence gathering failure, fusion module failure, detection model anomaly, or failure to issue linkage commands), a tiered alarm will be triggered immediately. Minor anomalies (such as failure to gather intelligence from a single source) will notify operations and maintenance personnel; severe anomalies (such as detection module failure or inability to detect) will notify operations and maintenance personnel and activate backup detection solutions (such as enabling backup detection models or manual detection). The alarm information includes the anomaly type, anomaly location, anomaly time, and scope of impact.

[0100] Execution of anomaly handling: When intelligence-related anomalies occur, intelligence collection fails and switches to a backup intelligence source; when intelligence fusion anomalies occur, a backup fusion rule is activated and the fusion module is repaired. When detection-related anomalies occur, when a detection model anomaly occurs, a backup detection model is activated and the faulty model is retrained; when detection data collection anomalies occur, the collection interface is checked and the collection module is restarted. When linkage-related anomalies occur, if linkage command issuance fails, the command is reissued, the connection links with the defense system and compliance audit system are checked, and manual linkage is initiated if necessary.

[0101] After an anomaly is handled, analyze the cause of the anomaly, summarize the lessons learned, optimize the system operation mechanism, and prevent similar anomalies from recurring; record the anomaly handling log for compliance auditing and system optimization.

[0102] Example 2: Financial Network Intrusion Detection System Based on Multi-Source Intelligence Fusion This embodiment provides a financial network intrusion detection system based on multi-source intelligence fusion, used to implement the method described in Embodiment 1. See also... Figure 8 The system adopts a six-layer architecture, consisting of a multi-source intelligence collection layer, an intelligence fusion and processing layer, a business adaptation layer, an intrusion detection layer, a collaborative linkage layer, and a data support layer, from top to bottom. Each layer interacts with the others through data interfaces and control interfaces to form a complete closed loop for intrusion detection and handling.

[0103] Overall architecture: The multi-source intelligence gathering layer is deployed at the edge nodes of the financial network. It collects third-party commercial threat intelligence, shared intelligence within the financial industry, local threat intelligence, and open-source threat intelligence in real time through API calls, log parsing, and web crawling. This layer consists of multiple collection units and a preliminary filtering unit. Each collection unit works in parallel, with a collection frequency of 100 milliseconds per collection. After the collection results are aggregated, the preliminary filtering unit removes invalid and expired intelligence, and after de-identification processing, the intelligence is reported to the intelligence fusion processing layer.

[0104] The intelligence fusion processing layer is deployed at the core data processing node and connects to the multi-source intelligence gathering layer. Upon receiving reported intelligence, this layer sequentially performs standardization, deduplication, noise reduction, and correlation analysis. The standardization unit unifies the format of intelligence from different sources; the deduplication unit uses a cosine similarity algorithm to remove duplicate intelligence; the noise reduction unit uses an isolated forest algorithm to remove invalid and interfering intelligence; and the correlation analysis unit uses the Apriori algorithm to mine correlation rules between intelligence and constructs an intelligence correlation network through a graph database. The fused intelligence database unit stores the processed, accurate intelligence and establishes a dynamic update mechanism to update newly collected intelligence in real time and periodically clean up expired intelligence.

[0105] The business adaptation layer connects with the intelligence fusion processing layer, responsible for deeply adapting the fused intelligence to financial business scenarios. This layer includes a scenario information acquisition unit, a differentiation filtering unit, a weight allocation unit, and a rule generation unit. The scenario information acquisition unit pre-configures the financial network's business scenario classification, business priority information, and sensitive data identification rules. The differentiation filtering unit uses a rule engine to perform differentiated filtering of the fused intelligence, the weight allocation unit uses the analytic hierarchy process (AHP) to assign weights to the filtered intelligence, and the rule generation unit generates scenario-based detection rules based on the scenario-based intelligence, business priority, and sensitive data adaptation results.

[0106] The intrusion detection layer is connected to both the business adaptation layer and the data acquisition and preprocessing module. This layer includes a feature matching detection unit, an abnormal behavior detection unit, a fusion decision unit, and an intrusion parameter determination unit. The feature matching detection unit performs feature matching detection based on scenario-based detection rules and intrusion features from the fusion intelligence database. The abnormal behavior detection unit performs abnormal behavior detection based on a hybrid deep learning detection model combining CNN and LSTM. The input feature vector of the detection model is 512-dimensional, including the first 150 dimensions of network traffic features, the middle 120 dimensions of business features, and the last 242 dimensions of fused threat intelligence features. The fusion decision unit uses priority-weighted decision fusion rules to fuse and determine the feature matching detection results and abnormal behavior detection results. When the fusion determination result indicates an intrusion, the intrusion parameter determination unit determines the intrusion type, intrusion level, intrusion location, and intrusion impact range.

[0107] The collaborative layer connects with the intrusion detection layer and is responsible for implementing differentiated defense measures based on the intrusion level. This layer includes a defense command issuance unit, a device adaptation unit, a service compensation unit, a result receiving unit, and a log recording unit. The defense command issuance unit issues interception, rate limiting, or blocking commands to the defense system based on the intrusion level. The commands are in the form of advanced policy names plus parameter configurations. The device adaptation unit performs protocol conversion for older defense devices that do not support standard protocols through pre-set adapters. When the intrusion level is severe, the service compensation unit automatically switches core business traffic to a pre-established hot standby channel. The hot standby channel runs in parallel with the main channel, using an incremental synchronization mechanism to synchronize business data in real time. The result receiving unit receives the handling results from the defense system. The log recording unit synchronizes all process information to the compliance audit module.

[0108] The compliance audit layer is connected to the collaboration layer to record information throughout the entire process, provide log query and export functions, and support the automatic generation of compliance verification reports.

[0109] The data support layer uses encrypted storage and connects with the multi-source intelligence collection module, intelligence fusion processing module, business adaptation module, data collection and preprocessing module, intrusion detection module, collaborative linkage module, compliance audit module, and closed-loop optimization module. It is used to store the fused intelligence database, detection data, log data, etc., and provides data storage and query services for each module. The log storage period is no less than one year.

[0110] Inter-module data flow and control flow: During system operation, the multi-source intelligence collection layer reports the collected and preliminarily processed intelligence to the intelligence fusion processing layer; after completing the fusion processing, the intelligence fusion processing layer pushes the fused intelligence database to the business adaptation layer; the business adaptation layer combines the pre-configured business scenario information to generate scenario-based detection rules and distributes them to the intrusion detection layer.

[0111] Meanwhile, the data acquisition and preprocessing module collects financial network detection data, which is then preprocessed and input into the intrusion detection layer. The intrusion detection layer performs intrusion detection based on scenario-based detection rules and reports the detection results to the collaborative linkage layer. The collaborative linkage layer executes defense linkage according to the intrusion level and synchronizes the entire process information to the compliance audit module.

[0112] The closed-loop optimization module is connected to the intrusion detection layer, collaborative linkage layer, intelligence fusion processing layer, business adaptation layer, and intrusion detection layer respectively. It regularly collects detection results and defense and handling results, analyzes and optimizes intelligence fusion rules, detection models, and detection rules, and synchronizes the optimization results to the relevant processing layers to form a complete closed-loop optimization link.

[0113] Internal structure of each module: The multi-source intelligence gathering module includes: a third-party intelligence gathering unit connected to the preliminary screening unit, used to gather third-party commercial threat intelligence via HTTPS / RESTful interface calls; an industry intelligence gathering unit connected to the preliminary screening unit, used to gather shared intelligence in the financial industry via IPsec VPN encrypted connection; a local intelligence gathering unit connected to the preliminary screening unit, used to gather local threat intelligence via ELK suite and regular expression parsing; an open-source intelligence gathering unit connected to the preliminary screening unit, used to crawl and gather open-source threat intelligence via the Scrapy framework; a preliminary screening unit connected to a de-identification processing unit, used to remove invalid and expired intelligence using a combination of rule engine and decision tree model; and a de-identification processing unit, whose output serves as the output of the multi-source intelligence gathering module, used to de-identify intelligence containing sensitive information.

[0114] The intelligence fusion processing module includes: a standardization processing unit, whose input terminal serves as the input terminal of the intelligence fusion processing module, used to unify the format of threat intelligence from different sources; a deduplication unit, connected to the standardization processing unit, used to identify and remove duplicate intelligence using a cosine similarity algorithm; a noise reduction unit, connected to the deduplication unit, used to remove invalid and interfering intelligence using an isolated forest algorithm; a correlation analysis unit, connected to the noise reduction unit, used to perform multi-dimensional correlation analysis on intelligence using the Apriori algorithm, and construct an intelligence correlation network through a graph database; and a fused intelligence database unit, connected to the correlation analysis unit, used to store the processed accurate intelligence and establish a dynamic update mechanism, whose output terminal serves as the output terminal of the intelligence fusion processing module.

[0115] The business adaptation module includes: a scenario information acquisition unit, used to acquire business scenario classification, business priority information, and sensitive data identification rules of the financial network; a differential filtering unit, connected to the intelligence fusion processing module and the scenario information acquisition unit respectively, used to perform differential filtering on the fused intelligence using a rule engine; a weight allocation unit, connected to the differential filtering unit and the scenario information acquisition unit respectively, used to allocate weights to the filtered intelligence using the analytic hierarchy process (AHP) to generate scenario-based intelligence, where the weight values ​​affect the alarm threshold for intrusion detection, the scanning frequency of the detection engine, and the priority of threat situation analysis; and a rule generation unit, connected to the weight allocation unit and the scenario information acquisition unit respectively, used to generate scenario-based detection rules based on scenario-based intelligence, business priority, and sensitive data adaptation results, with its output serving as the output of the business adaptation module.

[0116] The intrusion detection module includes: a feature matching detection unit, connected to the service adaptation module and the data acquisition and preprocessing module respectively, for performing feature matching detection based on scenario-based detection rules and intrusion features in the fusion intelligence database; an abnormal behavior detection unit, connected to the data acquisition and preprocessing module, for performing abnormal behavior detection on data that does not match known intrusion features based on a hybrid deep learning detection model combining CNN and LSTM, wherein the input feature vector of the detection model is 512-dimensional, including the first 150 dimensions of network traffic features, the middle 120 dimensions of service features, and the last 242 dimensions of fusion threat intelligence features; a fusion decision unit, connected to the feature matching detection unit and the abnormal behavior detection unit respectively, for performing fusion determination on the feature matching detection results and the abnormal behavior detection results using priority weighted decision fusion rules; and an intrusion parameter determination unit, connected to the fusion decision unit, for determining the intrusion type, intrusion level, intrusion location, and intrusion impact range when the fusion determination result is an intrusion, and its output is used as the output of the intrusion detection module.

[0117] The collaborative linkage module includes: a defense instruction issuing unit, connected to the intrusion detection module, for issuing interception instructions, flow limiting instructions, or blocking instructions to the defense system according to the intrusion level. The instructions are issued in the form of advanced policy names plus parameter configurations; a device adaptation unit, connected to the defense instruction issuing unit, for performing protocol conversion on older defense devices that do not support standard protocols through a preset adapter; a service compensation unit, connected to the defense instruction issuing unit, for automatically switching core service traffic to a pre-established hot standby channel when the intrusion level is a severe intrusion. The hot standby channel runs in parallel with the main channel and uses an incremental synchronization mechanism to synchronize service data in real time; a result receiving unit, connected to the defense system, for receiving the processing results fed back by the defense system; and a log recording unit, connected to the defense instruction issuing unit, the service compensation unit, and the result receiving unit respectively. Its output end serves as the output end of the collaborative linkage module, for synchronizing the entire process information to the compliance audit module.

[0118] The closed-loop optimization module includes: a data acquisition unit, connected to the intrusion detection module and the collaborative linkage module, for collecting detection results, defense handling results, false positive data, and business update data using a combination of timed triggering and event-driven triggering. Event-driven triggering conditions include a false positive rate exceeding a preset threshold, a false negative rate exceeding a preset threshold, a defense linkage failure rate exceeding a preset threshold, or a newly collected effective threat intelligence volume exceeding a preset threshold; an optimization execution unit, connected to the data acquisition unit, for optimizing intelligence fusion rules using adaptive parameter adjustment, optimizing the detection model using incremental training, and adjusting scenario-based detection rules; and a synchronization update unit, connected to the optimization execution unit and connected to the intelligence fusion processing module, the business adaptation module, and the intrusion detection module, for synchronizing the optimized rules and models to the relevant modules.

[0119] Example 3: Implementation Case of Intrusion Detection in a Commercial Bank's Core Network This embodiment applies the method described in Embodiment 1 and the system described in Embodiment 2 to the core network of a large commercial bank to specifically illustrate the implementation process and effects of the technical solution of the present invention in a real financial scenario.

[0120] Application scenario description: A major commercial bank's core network comprises a core transaction area (handling real-time payments and fund transfers), a customer information area (storing and processing anonymized customer information and retrieval services), an office area (handling daily office operations), and a bank-enterprise direct connection area (connecting enterprise and bank systems). The core businesses are real-time payments (primary priority) and risk control inquiries (secondary priority). It must be protected against APT attacks, data theft, malicious scanning, and other intrusion attempts, while simultaneously meeting compliance requirements such as the "Commercial Bank Network Security Management Measures" and the "Personal Financial Information Protection Law," ensuring business continuity and the security of sensitive data.

[0121] Initial deployment: Following the method in step S1 of Example 1, a six-layer overall architecture was built, with the collaborative layer connecting to the bank's existing firewall, IPS, and compliance audit system. Multiple intelligence collection sources were configured, including three third-party commercial intelligence vendors, one financial industry shared intelligence platform, a local log repository, and two open-source intelligence platforms, with an intelligence collection frequency set to 100 milliseconds / time. A detection model combining CNN and LSTM was built, with a detection frequency set to 50 milliseconds / time. Sensitive data identification rules were preset, and AES-256 encryption was used for de-identification. The log storage period was set to 1.5 years to meet compliance requirements.

[0122] Multi-source intelligence gathering and fusion: Following the methods in steps S1 and S2 of Example 1, four types of intelligence are collected in real time, and after preliminary screening, they are reported to the fusion layer. The fusion layer performs standardization processing, deduplication and noise reduction (deduplication accuracy of 99.9%, effective intelligence rate of 96%), and correlation analysis to build a fused intelligence database, which is updated in real time. During the collection process, a third-party commercial intelligence interface provides a malicious IP database and CVE vulnerability intelligence, a financial industry shared intelligence platform pushes targeted attack intelligence against banking systems, a local log database parses firewall alarm logs to extract internal unauthorized access records, and an open-source intelligence platform crawls new APT attack methods.

[0123] Financial business and sensitive data adaptation: Following the method in step S3 of Example 1, the core transaction area is primarily adapted to real-time payment attack intelligence, using a rule engine to match database vulnerability intelligence, determining it to be highly relevant to the core transaction area, and assigning a weight of 9; the customer information area is primarily adapted to data theft intelligence, assigning a weight of 7; the bank-enterprise direct connection area is adapted to cross-border attack intelligence, assigning a weight of 5; and the office area is adapted to conventional intrusion intelligence, assigning a weight of 2. High-precision detection rules are used for Level 1 business (real-time payment), with a lower alarm threshold; lightweight detection rules are used for Level 4 business (office), with a higher alarm threshold. Sensitive data features are associated, data theft intelligence is marked, and specific detection rules are set.

[0124] Detection and handling: Following the methods in steps S4 to S6 of Example 1, network traffic, system logs, and business data from various regions were collected, and after anonymization and preprocessing, they were input into the detection model. During peak transaction hours on a certain workday, the system detected a large amount of abnormal traffic from an unknown IP in the core transaction area. The source IP address was a server overseas, and the destination IP pointed to the core payment gateway. Feature matching detection matched the APT attack characteristics (CVE vulnerability exploitation behavior associated with the server IP) in the fused intelligence. Abnormal behavior detection showed abnormal traffic rates and data packet payload formats that did not match normal payment instructions. The fusion decision unit determined it to be a severe intrusion (data theft type). The collaborative linkage layer immediately issued a blocking command to block the attack source IP through the firewall and cut off the attack path; at the same time, the business compensation mechanism was activated, automatically switching the real-time payment business traffic to a pre-established hot standby channel. The switching process took 0.8 seconds, was imperceptible to the user, and the payment business was not interrupted. The entire process log was synchronized to the compliance audit module.

[0125] Source tracing and optimization: Following the method in step S7 of Example 1, by combining fused intelligence and detection data, the attack source was traced to an illegal overseas server. The attack method involved covert theft disguised as normal payment traffic, exploiting a vulnerability in a payment protocol to construct malicious commands. This novel APT attack characteristic was added to the fused intelligence database, the detection model was retrained, the parameters of the top-level fully connected layer were fine-tuned, and the detection rules were optimized.

[0126] Compliance verification and anomaly handling: Following the method in step S8 of Example 1, a full-process compliance log is generated, supporting multi-dimensional querying and export by time, business scenario, intrusion level, etc. Compliance verification shows no anomalies, meeting regulatory audit requirements. During system operation, the status of each stage is monitored in real time, and no abnormal events occur.

[0127] Implementation results: Through actual operation and verification, the implementation effect of this embodiment is as follows: the accuracy rate of known intrusion identification is no less than 99.8%, the accuracy rate of unknown intrusion identification is no less than 99.2%, the false alarm rate is no more than 0.3%, and the false negative rate is no more than 0.1%; the intrusion detection response time is no more than 50 milliseconds, and the defense linkage response time is no more than 300 milliseconds; the core business (real-time payment) was not interrupted due to intrusion detection and handling, and the response time was stable at 200 to 300 milliseconds; there was no leakage of sensitive data, the compliance logs were complete, and the requirements of the "Commercial Bank Network Security Management Measures" were fully met; after closed-loop optimization, the false alarm rate decreased by 0.05% per month, and the response time to adapt to new intrusion methods was no more than 24 hours.

[0128] The embodiments described above are merely preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. It should be noted that the technical solution of the present invention covers a complete technical chain from multi-source threat intelligence collection, fusion processing, business adaptation, intrusion detection, collaborative linkage to closed-loop optimization and compliance verification. The various technical features are interconnected and mutually supportive, forming an organic whole. Based on the technical concept disclosed in this invention, those skilled in the art can make various modifications, equivalent substitutions, or improvements to the above embodiments without departing from the spirit and scope of the present invention; however, all such modifications, equivalent substitutions, or improvements should fall within the scope of protection of the present invention.

[0129] Specifically, the technical solutions claimed in this invention are not limited to the specific parameter values ​​recorded in the embodiments (such as a sampling frequency of 100 milliseconds / time, a detection frequency of 50 milliseconds / time, and a switching duration of 1 second). These parameters are optimized values ​​based on specific application scenarios. Those skilled in the art can adaptively adjust the above parameters according to actual application needs (such as network scale, service type, hardware resources, etc.). As long as they do not depart from the technical principles and concepts disclosed in this invention, they should be considered to fall within the protection scope of this invention. In addition, the specific implementation methods of the hybrid deep learning model combining CNN and LSTM, the cosine similarity deduplication algorithm, the isolated forest denoising algorithm, the Apriori association analysis algorithm, and other technical means disclosed in this invention can be optimized and adjusted according to actual application needs. As long as they achieve the same technical function and the same technical effect, they should be considered to fall within the protection scope of this invention.

[0130] The scope of protection claimed by this invention is defined by the appended claims, and the description and drawings are used to interpret the content of the claims. Any modifications or improvements falling within the equivalent scope of the claims are considered to be included within the scope of protection of this invention.

Claims

1. A financial network intrusion detection method based on multi-source intelligence fusion, characterized in that, include: Collect threat intelligence from multiple sources, and report it after screening and de-identification; The intelligence is standardized, deduplicated, noise-reduced, and correlation-analyzed to build and dynamically update a fused intelligence database; Acquire financial business scenarios, priorities, and sensitive data rules; differentiate and assign weights to the integrated intelligence; and generate scenario-based detection rules. Collect and preprocess the detection data; Feature matching detection is performed based on the aforementioned scenario-based detection rules, while abnormal behavior detection is performed based on a deep learning model. Priority weighted decision fusion is used to determine intrusion. If the feature matching is successful, an intrusion is directly determined. If the feature matching is unsuccessful, the anomaly score is used as the standard, and the threshold is dynamically adjusted. Defense commands are issued based on the intrusion level. In the event of a severe intrusion, a business compensation mechanism is activated to switch core business traffic to a hot standby channel. Data is collected using timed and event-driven methods, and intelligence fusion rules and detection models are dynamically optimized. Record the entire process log for compliance verification.

2. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 1, characterized in that, The threat intelligence sources include at least two of the following: third-party commercial intelligence, industry-shared intelligence, local intelligence, and open-source intelligence; the preliminary screening adopts a combination of rule engine and decision tree model.

3. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 1, characterized in that, The deduplication process employs the cosine similarity algorithm, the noise reduction process employs the isolated forest algorithm, and the association analysis process employs the Apriori algorithm. Furthermore, an association network is constructed using a graph database, with intelligence entities as nodes and association relationships as edges.

4. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 1, characterized in that, The differential screening uses a rule engine, and the weight allocation uses the hierarchical analysis method. The weight values ​​are used to influence the alarm threshold and scanning frequency of intrusion detection, and the weight values ​​are negatively correlated with the alarm threshold.

5. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 1, characterized in that, The desensitization process employs encryption and masking.

6. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 1, characterized in that, The deep learning detection model is a hybrid neural network model combining CNN and LSTM, and its input feature vector is composed of business data features and fused threat intelligence features.

7. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 1, characterized in that, The automatic switching of the service compensation mechanism includes: after triggering the service compensation instruction, sending a switching notification to the service layer, suspending the main channel service processing and saving the session data, and switching the core service traffic to the backup channel; automatically switching back after the main channel intrusion is cleared, and synchronizing the backup channel data.

8. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 1, characterized in that, The event-driven triggering conditions include false alarm rate, false negative rate, failure rate of coordinated handling, or new intelligence collection exceeding a preset threshold; the optimized intelligence fusion rules adopt parameter adaptive adjustment, and the optimized detection model adopts incremental training, that is, freezing the bottom feature extraction layer and only fine-tuning the parameters of the top fully connected layer.

9. The financial network intrusion detection method based on multi-source intelligence fusion according to claim 8, characterized in that, The adaptive adjustment of parameters includes: adjusting the similarity threshold and outlier determination threshold based on feedback from misjudged data, adding new association rules based on new association features, and deleting invalid rules.

10. A financial network intrusion detection system based on multi-source intelligence fusion, characterized in that, The system for implementing the method according to any one of claims 1 to 9, the system comprising: The multi-source intelligence gathering module is used to collect and report processed threat intelligence. The intelligence fusion processing module is used to standardize, deduplicatize, reduce noise, and perform correlation analysis on intelligence, and to build and dynamically update the fused intelligence database. The business adaptation module is used to differentiate and assign weights to the fused intelligence based on business scenarios, priorities, and sensitive data rules, and generate scenario-based detection rules. The data acquisition and preprocessing module is used to acquire and preprocess the detection data. The intrusion detection module is used for feature matching detection based on contextualized detection rules, abnormal behavior detection based on deep learning models, and intrusion determination by priority weighted decision fusion. The collaborative linkage module is used to issue defense instructions based on the intrusion level and to activate the business compensation mechanism in the event of a severe intrusion. The compliance audit module is used to record information throughout the entire process and provide log queries; The closed-loop optimization module is used to collect detection and processing results, optimize intelligence fusion rules, detection models and detection rules, and synchronize them to the corresponding modules. The data support layer provides encrypted storage and data services for each module.

Images