A method, medium, and system for network threat assessment based on dynamic Bayesian networks

Abstract

This invention provides a network threat assessment method, medium, and system based on dynamic Bayesian networks, belonging to the field of network security technology. The invention uses a parameter adaptive learning unit with a sliding time window mechanism and a Bayesian online change point detection algorithm to update the conditional probability table parameters. It inputs the topology and parameters into a threat temporal inference model that integrates a liquid neuron layer and a hypergraph matching layer, receives real-time security event evidence, and outputs the posterior probability distribution of nodes. Based on the posterior probability distribution, it calculates the neuron activation regulation function value and dynamically adjusts the liquid neuron parameters. When the posterior probability of a threat node exceeds a preset threat threshold, it executes an iterative belief propagation algorithm through a hierarchical distributed inference collaboration module to generate an attack path probability graph and output the network security assessment result. This solves the technical problem of not being able to simultaneously and accurately model the causal dependencies and high-order collaborative modes of network threat events.

Description

Technical Field

[0001] This invention belongs to the field of network security technology, and specifically relates to a network threat assessment method, medium, and system based on dynamic Bayesian networks. Background Technology

[0002] In cybersecurity protection of critical infrastructure such as power monitoring systems, threat assessment techniques typically employ rule-based expert systems or shallow machine learning models for anomaly detection. Traditional methods rely on manually defined attack signature databases and fixed detection rules, judging threat presence by analyzing the statistical characteristics of single security events. Some advanced solutions introduce Bayesian networks to model the probabilistic dependencies between security events, but these can only express pairwise causal relationships between variables. In existing technologies, advanced persistent threats (APS) often manifest as the synergistic effect of multiple security events within a certain time sequence. The binary edge structure of traditional graph models cannot directly characterize the joint occurrence patterns of three or more variables, resulting in a lack of effective identification capabilities for attack chains that require multiple preconditions to be met simultaneously. Furthermore, discrete-time dynamic Bayesian networks struggle to handle asynchronously arriving security event streams, and the fixed time granularity of sliding windows leads to information loss regarding the impact of historical events. In other words, existing technologies suffer from the technical problem of simultaneously and accurately modeling the causal dependencies and high-order synergistic patterns of network threat events. Summary of the Invention

[0003] In view of this, the present invention provides a network threat assessment method, medium and system based on dynamic Bayesian networks, which can solve the technical problem in the prior art that it is impossible to simultaneously and accurately model the causal dependencies and high-order cooperative modes of network threat events.

[0004] The present invention is implemented as follows: The first aspect of the present invention provides a network threat assessment method based on dynamic Bayesian networks, comprising the following steps: The standardized multidimensional security feature vector output by the data aggregation engine includes login behavior anomaly score, network traffic deviation degree, and file operation suspicious index. The multidimensional security feature vector is input into the causal structure learning unit, which identifies the real causal relationship between security event variables through a constraint-based independence test framework and intervention analysis, constructs a dynamic Bayesian network topology, and uses a sliding time window mechanism and Bayesian online change point detection algorithm through the parameter adaptive learning unit to identify the moment of distribution change and update the conditional probability table parameters. The Yesian network topology and conditional probability table parameters are input into the threat temporal inference model. The threat temporal inference model receives real-time security event evidence and outputs the posterior probability distribution of nodes in the current time slice. The posterior probability distribution is used to calculate the neuron activation regulation function value, and the leakage rate parameter and activation threshold parameter of the liquid neuron in the threat time-series inference model are dynamically adjusted according to the interval to which the neuron activation regulation function value belongs. When the posterior probability of any threat node in the posterior probability distribution exceeds the preset threat threshold, the posterior probabilities of the local sub-network are asynchronously exchanged through the hierarchical distributed inference collaboration module and the iterative belief propagation algorithm is executed to converge to a globally consistent state, generating an attack path probability map. The security assessment results are sent to the downstream decision engine. The cybersecurity assessment results include comprehensive threat confidence, key threat node status and attack path probability graph. The comprehensive threat confidence is a quantitative probability value ranging from 0% to 100%.

[0005] A second aspect of the present invention provides a computer-readable storage medium storing program instructions that, when executed in a computer, perform the aforementioned network threat assessment method based on a dynamic Bayesian network.

[0006] A third aspect of the present invention provides a network threat assessment system based on dynamic Bayesian networks, comprising the aforementioned computer-readable storage medium, wherein the system is a computer, the computer-readable storage medium is disposed within the system, and the system is provided with a microprocessor for executing program instructions stored in the computer-readable storage medium.

[0007] This invention constructs a three-layer threat assessment architecture integrating dynamic Bayesian networks, liquid neuron temporal reasoning, and hypergraph matching. At the bottom layer, it utilizes a constraint-based independence testing framework and intervention analysis using causal structure learning units to identify genuine causal relationships between security event variables, avoiding spurious dependencies caused by traditional correlation analysis. In the middle layer, liquid neurons with leakage integral characteristics are introduced to expand discrete node states into continuous membrane potential variables. A pulse-driven mechanism enables real-time processing of asynchronous security event streams, and a high-dimensional dynamic state space using a reservoir computing framework captures attack temporal patterns. At the top layer, a hypergraph matching layer is superimposed to explicitly model the synergistic effects of multiple security events through hyperedge structures, overcoming the limitations of binary relations and employing an approximate reasoning operator based on tensor contraction to control the computational complexity of high-order relation reasoning. The liquid neuron leakage mechanism of this invention enables adaptive forgetting of the impact of historical events, and the hypergraph community discovery function automatically clusters semantically related security events into attack pattern clusters. The synergy of these two features gives the threat assessment model both sensitivity to single-point anomalies and global insight into coordinated attacks. In summary, this invention solves the technical problem mentioned in the background art of the inability to simultaneously and accurately model the causal dependencies and high-order synergistic modes of network threat events. Attached Figure Description

[0008] Figure 1This is a flowchart of the method of the present invention.

[0009] Figure 2 This is a timing analysis diagram for sliding window variable point detection.

[0010] Figure 3 The graph shows the F1 score change during the training process of the threat temporal reasoning model.

[0011] Figure 4 This is a diagram illustrating the convergence process of distributed reasoning iterative belief propagation.

[0012] Figure 5 This is a tree-like visualization of attack path probabilities. Detailed Implementation

[0013] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings.

[0014] like Figure 1 The diagram shown is a flowchart of a network threat assessment method based on dynamic Bayesian networks provided by the first aspect of this invention. This method includes the following steps: S01. Receive a standardized multidimensional security feature vector output from the data aggregation engine. The standardized multidimensional security feature vector includes login behavior anomaly score, network traffic deviation degree, and file operation suspicious index. S02. Input the standardized multidimensional security feature vector into the causal structure learning unit, identify the real causal relationship between security event variables through a constraint-based independence test framework and intervention analysis, construct a dynamic Bayesian network topology, and use a sliding time window mechanism and Bayesian online change point detection algorithm through a parameter adaptive learning unit to identify the distribution change moment and update the conditional probability table parameters. S03. Input the dynamic Bayesian network topology and the conditional probability table parameters into the threat time-series inference model. The threat time-series inference model receives real-time security event evidence and outputs the posterior probability distribution of nodes in the current time slice. S04. Calculate the neuron activation regulation function value based on the node posterior probability distribution, and dynamically adjust the leakage rate parameter and activation threshold parameter of the liquid neuron in the threat time-series inference model according to the interval to which the neuron activation regulation function value belongs. S05. When the posterior probability of any threat node in the node posterior probability distribution exceeds the preset threat threshold, the posterior probabilities of the local sub-network are asynchronously exchanged through the hierarchical distributed inference collaboration module and the iterative belief propagation algorithm is executed to converge to a globally consistent state, generating an attack path probability map. S06. Output the network security assessment results to the downstream decision engine. The network security assessment results include the comprehensive threat confidence level, the status of key threat nodes, and the attack path probability map. The comprehensive threat confidence level is a quantitative probability value from 0% to 100%.

[0015] The processing steps of the causal structure learning unit are as follows: First, conditional independence tests are performed on the variable pairs in the historical security data samples. The chi-square test statistic is used to determine whether the two security event variables are independent under the given third-party variable. When the test p-value is less than 0.05, the independence hypothesis is rejected. Then, the Do-calculus theory is introduced to simulate intervention experiments on variable pairs with causal relationships. The true causal direction is identified by comparing the KL divergence between the observation distribution and the intervention distribution. When the KL divergence is greater than 0.15, causal dependence is determined. Finally, combined with the causal prior constraint set provided by domain experts, variable pairs without causal relationships are removed from the candidate edge set. The optimal network structure is searched using a hill-climbing algorithm based on scoring. The scoring function uses the BIC criterion to balance the model fit and complexity.

[0016] The parameter adaptive learning unit processes the following steps: A sliding time window of 1000 time slices is used to extract training samples from the historical data stream. A Bayesian online change point detection algorithm is executed on the data within the window. This algorithm identifies moments of significant change in data distribution by recursively calculating the posterior probability ratio. A change point alarm is triggered when the posterior probability ratio of five consecutive time slices is greater than 3.0. Once a change point is detected, the relearning process of the conditional probability table parameters is immediately initiated. The maximum likelihood estimation method is used to recalculate the conditional probabilities of each node under different combinations of parent node states based on the data within the window. To avoid the negative impact of outdated data on the current model, a forgetting factor weight is assigned to the samples within the window. The forgetting factor is set to 0.98, and the weight of samples farther from the current time decays exponentially. When calculating the decay weight, the sample weight is equal to the forgetting factor raised to the power of the sample time distance.

[0017] The do-calculus theory is a mathematical framework used in causal reasoning to quantify the effects of intervention. It uses the do operator to represent active intervention operations on variables, which is different from passive observation. The intervention distribution is the probability distribution of the system after artificial control is applied to a certain variable, while the observation distribution is the natural probability distribution of the system when no intervention is applied.

[0018] The KL divergence is an asymmetric measure of the degree of difference between two probability distributions. The larger the value, the more significant the difference between the distributions, and it is used to judge the strength of causal relationships.

[0019] The BIC criterion, short for Bayesian Information Criterion, avoids overfitting by penalizing model complexity; a smaller BIC value indicates higher model quality.

[0020] The threat temporal reasoning model has the following structure: The bottom layer is a dynamic Bayesian network layer containing 50 to 200 security event nodes. These nodes are connected by directed edges to form a temporally unfolded network structure, with security event nodes in adjacent time slices linked by transition edges. A liquid neuron layer is superimposed on top of this dynamic Bayesian network layer. Each security event node is mapped to a liquid neuron structure in the GPU memory. This liquid neuron structure contains three fields: membrane potential state variable, leakage rate parameter, and excitation threshold parameter. The connections between liquid neurons within the liquid neuron layer are implemented using a parallel pulse propagation mechanism based on a multi-layer grid in CUDA. GPU thread blocks are organized into a two-dimensional grid corresponding to the topology of the dynamic Bayesian network layer. Each thread is responsible for updating the state of one liquid neuron, and shared memory is used to achieve the same thread... Fast communication within the liquid neurons layer; a hypergraph matching layer is constructed on top of the liquid neuron layer, which extends the traditional binary edge relationship into a hyperedge representation. A single hyperedge stores the indices of all security event nodes it connects through an integer array, and the weight of the hyperedge is stored as the mutual information value associated with the hyperedge. The hypergraph matching layer uses a tensor contraction-based inference operator to represent the high-order dependencies between security event nodes as a third-order tensor. The three dimensions of the third-order tensor correspond to the time slice index, the security event node index, and the state enumeration, respectively. The third-order tensor is approximated as the product of three low-rank factor matrices through Tucker decomposition, reducing storage overhead and computational complexity. The top layer of the model is the readout layer, which extracts threat situation features from the dynamic state space of the liquid neuron layer through ridge regression. The dimension of the regression coefficient matrix is ​​the number of threat categories multiplied by the number of liquid neurons.

[0021] The steps for establishing the training dataset for the threat time-series inference model are as follows: Extract time-series samples containing normal operation and known attack events from the historical security logs of the power monitoring system. Each time-series sample contains a sequence of security events across 100 consecutive time slices. Encode the security events in each time slice by normalizing the login behavior anomaly score to the 0-1 range, standardizing the network traffic deviation by dividing by the historical maximum deviation, and mapping the file operation suspicion index to the 0-1 range using the sigmoid function. Label each time-series sample with a threat tag, which includes a binary identifier indicating the presence of a threat, a multi-class identifier indicating the threat type, and a continuous value identifier indicating the severity of the threat. Divide the dataset into a training set, a validation set, and a test set in an 8:1:1 ratio to ensure a consistent distribution of attack types across the three subsets. Perform data augmentation on the training set by randomly pruning the time dimension, adding Gaussian noise to the feature dimension, and oversampling minority class samples to balance the number of samples for each threat type.

[0022] The training steps of the threat temporal inference model are as follows: First, fix the topology of the dynamic Bayesian network layer and the parameters of the conditional probability table, and train only the parameters of the liquid neuron layer and the readout layer. Use the temporal backpropagation algorithm to minimize the cross-entropy loss between the predicted threat label and the actual threat label. Set the learning rate to 0.001, the batch size to 32, and train for 200 iterations. Then, fix the parameters of the liquid neuron layer and the readout layer, optimize the hyperedge configuration of the hypergraph matching layer using a reinforcement learning algorithm, model the addition and deletion of hyperedges as an action space, and train the threat detection F-values ​​of the threat temporal inference model on the validation set. A score is used as the reward signal, and the parameters of the hyperedge selection policy are updated using the policy gradient method, with 100 training iterations. Finally, the entire threat temporal inference model is jointly fine-tuned end-to-end. A multi-task learning framework is used to simultaneously optimize both threat detection accuracy and inference latency. A composite loss function is constructed by weighted summation, with the threat detection loss weight set to 0.7 and the inference latency loss weight set to 0.3. The Adam optimizer is used for 50 rounds of fine-tuning. During training, the performance of the threat temporal inference model is evaluated on the validation set every 10 rounds. If the F1 score does not improve after 3 consecutive evaluations, training is terminated early and the historical best model parameters are loaded.

[0023] The principle of the liquid neuron temporal reasoning algorithm is as follows: Inspired by the continuous evolution of the membrane potential of biological neurons over time, the discrete node states in the dynamic Bayesian network are extended into continuous membrane potential variables with leakage integral characteristics. The dynamic change process of the membrane potential variable is described by a first-order differential equation. The right side of the equation contains a leakage term and an input driving term. The leakage term causes the membrane potential variable to decay towards the resting potential at an exponential rate. The input driving term modulates the growth rate of the membrane potential variable according to the received security event pulse sequence. When the accumulated membrane potential variable exceeds the excitation threshold parameter, the liquid neuron outputs an output pulse and transmits it to downstream liquid neurons. When the membrane potential variable is reset to the resting potential, the output pulse driving mechanism is naturally adapted to the asynchronously arriving security event stream, and can perform real-time processing without waiting for all security events to be synchronized. The liquid neuron temporal reasoning algorithm adopts a reservoir computing framework, which maps the input high-dimensional temporal security features to the dynamic state space through a sparsely randomly connected liquid neuron network. The cyclic connections inside the network generate rich transient dynamic behaviors. The transient dynamic behaviors have short-term memory capabilities to retain the impact of recent security events, while the leakage mechanism ensures that the impact of old security events decays naturally over time, avoiding the state saturation problem caused by long-term accumulation.

[0024] In the implementation of the threat time-series inference model, the posterior probability of each security event node is no longer a statically calculated result, but rather the normalized membrane potential state variable value of the corresponding liquid neuron at the current moment. The membrane potential state variables of all liquid neurons are updated at fixed time steps by a differential equation solver. The differential equation solver uses the fourth-order Runge-Kutta method to ensure numerical stability. The state update operations of all liquid neurons are executed in parallel on the GPU, and efficient synchronization of pulse propagation between liquid neurons is achieved by using CUDA warp-level primitives.

[0025] The principle of the attack pattern recognition algorithm guided by embedded hypergraph matching is as follows: Traditional dynamic Bayesian networks can only express pairwise dependencies between variables, and cannot directly model high-order statistical correlations involving three or more variables. Network attacks often manifest as the synergistic effect of multiple security events, and simply analyzing the correlation between pairs of security events is insufficient to capture the global attack pattern. Hypergraphs overcome the limitations of binary relationships through hyperedge structures. A single hyperedge connects any number of security event nodes simultaneously, used to characterize the joint occurrence pattern of multiple security events. The hyperedge weight is defined as the KL divergence of the product of the joint distribution and the edge distribution of the connected security event nodes. The KL divergence quantifies the high-order mutual information between security event nodes, reflecting the strength of the synergistic effect. The algorithm for identifying attack patterns guided by embedding hypergraph matching uses spectral segmentation to perform community detection on the hypergraph, clustering closely related security events into attack pattern clusters. The spectral segmentation is based on the eigenvector decomposition of the hypergraph's Laplacian matrix, selecting the eigenvectors corresponding to the k smallest non-zero eigenvalues ​​as the embedding representation of the security event nodes. In the embedding space, k-means clustering is applied to identify the attack pattern clusters. To address the high computational complexity of hypergraph inference, an approximate inference operator based on tensor contraction is designed. The higher-order conditional probabilities corresponding to the hyperedges are represented as tensor elements. The tensor multiplication order in the inference process is described by a tensor network graph, and a greedy strategy is used to determine the optimal contraction path to minimize the storage overhead of intermediate tensors.

[0026] In the implementation of the threat temporal inference model, a hypergraph structure is superimposed on the liquid neuron layer. The connection configuration of the hyperedges is automatically generated based on the frequently co-occurring security event combinations in the training data. Initially, candidate hyperedges are created for each triplet and quadruple security event. During training, redundant hyperedges with weights below a threshold are removed using a pruning strategy, while retaining high-order dependencies that significantly contribute to threat detection. During hypergraph inference, observational evidence is first constructed based on the current membrane potential state variables of the liquid neurons. Then, the joint posterior probability of each hyperedge connecting security event nodes is calculated. The joint posterior probability tensor is decomposed into the product of a core tensor and a factor matrix using Tucker decomposition. The tensor multiplication operation is accelerated by using the low-rank representation of the factor matrix. Finally, the hyperedge inference results are weighted and fused with the conventional dynamic Bayesian network inference results to obtain the final threat assessment output.

[0027] The technical effects of the two algorithms mentioned above on the threat temporal reasoning model and the overall scheme are as follows: The liquid neuron temporal reasoning algorithm solves the problem that traditional discrete-time dynamic Bayesian networks cannot effectively handle asynchronous security event streams by introducing a continuous-time dynamic model; the leakage mechanism of membrane potential state variables realizes adaptive forgetting of the impact of historical security events, avoiding information loss caused by manually set time granularity of sliding time windows; the pulse-driven security event processing method significantly reduces computational resource consumption, triggering liquid neuron updates only when a security event arrives instead of continuous polling; the high-dimensional dynamic state space provided by the reservoir computing framework enhances the threat temporal reasoning model's ability to represent attack temporal patterns, enabling the threat temporal reasoning model to distinguish between normal behavior and attack behavior with similar sets of security events but different temporal sequences; and embedding hypergraph matching. The guided attack pattern recognition algorithm overcomes the limitation of traditional graph models that can only express binary dependencies. By explicitly modeling the collaborative patterns of multiple security events through hyperedge structures, it can identify advanced persistent threat attack chains that require multiple preconditions to be met simultaneously. The community discovery function of the hypergraph automatically clusters semantically related security events into attack pattern clusters, reducing the reliance on expert knowledge in manually defined attack scenarios. The approximate inference operator based on tensor contraction maintains the expressive power of high-order relations while controlling computational complexity through low-rank decomposition, keeping the inference latency of large-scale networks containing hundreds of security event nodes and dozens of hyperedges within an acceptable range. The synergy of the two algorithms enables the threat temporal inference model to have both sensitivity to single-point anomalies and global insight into collaborative attacks, exhibiting stronger generalization ability and robustness when facing unknown threats.

[0028] The calculation process of the neuron excitation regulation function value is as follows: First, the average membrane potential state variable value of all liquid neurons within the current time window is recorded as the average membrane potential value. The standard deviation of the membrane potential state variables of all liquid neurons is calculated and recorded as the membrane potential volatility. The proportion of liquid neurons that emit output pulses to the total number of liquid neurons is recorded as the excitation sparsity rate. Then, the neuron excitation regulation function value is calculated. The neuron excitation regulation function value is equal to the product of the average membrane potential value divided by the membrane potential volatility and the excitation sparsity rate. All parameters are normalized by dividing by their respective historical maximum values ​​to remove dimensions before calculation. The parameters of the threat time series inference model are adjusted according to the interval to which the neuron excitation regulation function value belongs. When the neuron excitation regulation function value belongs to [0, 0.3), the network is determined to be in a state of [0, 0.3]. In a low-activity state, the leakage rate parameter of all liquid neurons is reduced by 20% to prolong memory duration, while the activation threshold parameter is reduced by 15% to improve the sensitivity of liquid neurons. When the neuron activation regulation function value is within [0.3, 0.7), the network is determined to be in a normal active state, and the current leakage rate parameter and activation threshold parameter remain unchanged. When the neuron activation regulation function value is within [0.7, 1.0], the network is determined to be in a high-activity state, and the leakage rate parameter of all liquid neurons is increased by 20% to accelerate the decay of old information, while the activation threshold parameter is increased by 15% to suppress noise interference. When the neuron activation regulation function value is greater than 1.0, the network is determined to be in an over-excited state, and the leakage rate parameter is increased by 50% and the activation threshold parameter is increased by 30% to quickly restore the network to a stable state.

[0029] The hierarchical distributed inference collaboration module processes as follows: First, based on the physical topology and logical partitioning of the power monitoring system, the global dynamic Bayesian network is decomposed into multiple local sub-networks. Each local sub-network is assigned to an edge computing node in its corresponding region. These local sub-networks are connected through boundary nodes, where each boundary node belongs to two adjacent local sub-networks simultaneously. Each edge computing node independently executes inference computation for its local sub-network, obtaining the posterior probability of the local sub-network for each local node. This posterior probability is then asynchronously sent to adjacent edge computing nodes via a message passing interface protocol. Upon receiving the message from the adjacent edge computing node, the edge computing node uses the posterior probability of the local sub-network of the external boundary node as new observation evidence and re-executes the inference computation. The local subnetwork posterior probability of internal nodes is updated through local inference. The iterative process continues until a convergence condition is met, defined as the maximum change in the local subnetwork posterior probability of all boundary nodes in two consecutive iterations being less than 0.01. To accelerate the convergence process, a damping factor is used to smooth message updates. The new message is equal to the weighted average of the current message and the previous message, and the damping factor is set to 0.6. When the posterior probability of a threat node in the local subnetwork exceeds the preset threat threshold, the corresponding edge computing node immediately sends an alarm message to the central coordination node. After collecting all alarm messages, the central coordination node triggers global inference collaboration, which accelerates the achievement of the global consistency state by increasing the message transmission frequency and lowering the convergence threshold.

[0030] The method for determining the preset threat threshold is as follows: Collect historically labeled threat event samples and normal event samples; input the threat event samples and normal event samples into a trained threat temporal inference model to obtain the posterior probability distribution of nodes; extract the posterior probability values ​​of threat nodes to form a threat sample probability set and a normal sample probability set; plot the receiver operating characteristic (ROC) curves under different thresholds, with the horizontal axis representing the false positive rate and the vertical axis representing the true positive rate. The false positive rate is defined as the proportion of probability values ​​in the normal sample probability set exceeding the threshold, and the true positive rate is defined as the proportion of probability values ​​in the threat sample probability set exceeding the threshold; calculate the area under the ROC curve and select the threshold that maximizes the ROC curve area as the preset threat threshold. If multiple thresholds correspond to the same maximum ROC curve area, select the threshold that minimizes the difference between the false positive rate and the true negative rate; fine-tune the preset threat threshold according to the actual operation and maintenance requirements of the power monitoring system. For critical core equipment, lower the preset threat threshold to improve detection sensitivity; for peripheral non-critical equipment, increase the preset threat threshold to reduce false alarm interference.

[0031] The method for generating the attack path probability graph is as follows: Extract all directed paths from the initial normal state node to the final threat state node from the temporal unfolding structure of the dynamic Bayesian network layer; each directed path represents an attack sequence; calculate the joint probability of each directed path, where the joint probability is equal to the product of the transition probabilities of all security event nodes on the directed path, and the security event node transition probabilities are obtained from the parameters of the conditional probability table; sort all directed paths in descending order of their joint probabilities, and select the top few directed paths whose sum of joint probabilities reaches 95% of the total probability. As a set of high-probability attack paths, the set of high-probability attack paths is visualized as a tree diagram, with the root node being the initial normal state node, the leaf nodes being the final threat state node, the middle nodes being the critical event nodes in the attack process, and the transition probability values ​​of the security event nodes being marked on the edges. For directed paths containing hyperedges, hyperedge nodes are inserted at the corresponding positions to represent the synergistic effect points of multiple security events. The hyperedge nodes are marked with different colors to distinguish them from ordinary critical event nodes, and the hyperedge weight value is displayed as the hyperedge node label.

[0032] The method for calculating the comprehensive threat confidence is as follows: extract the posterior probability values ​​of all threat nodes in the posterior probability distribution of the nodes, and perform a weighted summation of the posterior probability values ​​of the threat nodes to obtain the initial threat confidence. The weights are determined according to the criticality of each threat node in the attack chain, with higher criticality resulting in higher weights. The initial threat confidence is multiplied by the highest joint probability in the attack path probability graph to obtain the path modulation threat confidence. The path modulation threat confidence is linearly combined with the neuron activation regulation function value to obtain the comprehensive threat confidence, with linear combination coefficients of 0.7 and 0.3, respectively. Finally, the comprehensive threat confidence is normalized to the range of 0% to 100%.

[0033] The critical threat node status is the threat status identifier corresponding to the security event node with the highest probability value in the posterior probability distribution of the nodes. The threat status identifier includes five types: data leakage in progress, privilege escalation completed, lateral movement in progress, persistence mechanism established, and command control channel activated. The network security assessment results are used by the downstream decision engine to formulate security response strategies. When the overall threat confidence exceeds 80%, an automatic isolation response is triggered; when the overall threat confidence is between 50% and 80%, a manual review process is triggered; and when the overall threat confidence is below 50%, only logs are recorded without triggering a response. The reserve pool calculation framework is a recurrent neural network calculation paradigm. It maps the input signal to a high-dimensional state space through a fixed, randomly connected sparse network, training only the output layer weights while keeping the internal connections of the network unchanged. It utilizes the network's dynamic characteristics to achieve nonlinear transformation and short-term memory of time-series signals. The Tucker decomposition is one of the high-order tensor decomposition methods, decomposing an n-order tensor into a multilinear product of a core tensor and n factor matrices. Data compression is achieved by controlling the rank of the core tensor and factor matrices, while preserving the main structural information of the tensor. The ridge regression is a linear regression method with L2 regularization. It prevents overfitting by adding a penalty term of the sum of squared weight coefficients to the loss function, and the regularization coefficient controls the balance between model complexity and fitting accuracy. The F1 score is a performance evaluation metric for classification models, defined as the harmonic mean of precision and recall, comprehensively considering both precision and recall. Its value ranges from 0 to 1, with higher values ​​indicating better model performance. The policy gradient method is an algorithm category in reinforcement learning that directly optimizes the policy function. It updates parameters by calculating the gradient of the policy function parameters with respect to the expected reward, achieving policy improvement without explicitly learning the value function. The Adam optimizer is an adaptive learning rate optimization algorithm that combines the advantages of the momentum method and the RMSProp algorithm. It maintains an independent adaptive learning rate for each parameter dimension, accelerating training convergence and improving robustness. The spectral segmentation method is a graph-based clustering algorithm. It maps graph nodes to a low-dimensional space by calculating the eigenvalues ​​and eigenvectors of the graph Laplacian matrix, and then applies traditional clustering algorithms to achieve graph segmentation in the low-dimensional space. The k-means clustering is a classic unsupervised learning algorithm that divides data points into k clusters by iteratively optimizing the within-cluster squared error and minimizing the objective. Each cluster is represented by its centroid. The warp-level primitives are low-level synchronization primitives for warp execution units in the CUDA programming model. A warp is an execution group of 32 threads on a GPU. Threads within a warp execute instructions in a lockstep manner. Efficient data exchange and synchronization between threads are achieved through warp-level primitives. The mutual information value is an information theory quantity that measures the degree of interdependence between two random variables. It is defined as the KL divergence of the product of the joint distribution and the marginal distributions of the two variables. A mutual information value of zero indicates that the two variables are statistically independent, while a larger mutual information value indicates a stronger correlation.The true negative rate is one of the performance indicators of the classification model, defined as the proportion of the number of samples correctly identified as negative to the total number of actual negative samples, reflecting the model's ability to identify negative classes.

[0034] The login behavior anomaly score is a numerical indicator that quantifies the degree to which a user's login behavior deviates from the normal pattern. It is calculated by analyzing features such as login time, login location, login device, login frequency, and number of login failures. These features are compared with historical normal login patterns, and the degree of deviation is calculated using the isolated forest algorithm or an anomaly detection method based on statistical distribution. The login behavior anomaly score is normalized to the range of 0 to 1. The larger the value, the more abnormal the login behavior. A value exceeding 0.7 usually indicates the risk of account theft or brute-force attacks.

[0035] The network traffic deviation is a quantitative indicator that measures the degree of difference between the current network traffic characteristics and the normal baseline traffic characteristics. The monitored traffic characteristics include packet size distribution, protocol type distribution, traffic rate, connection duration, and port access pattern. By constructing a statistical baseline model of normal traffic, the Euclidean distance or Mahalanobis distance between the current traffic feature vector and the baseline feature vector is calculated as the network traffic deviation. The network traffic deviation is standardized by dividing by the maximum deviation value observed in history. The larger the standardized value, the higher the degree of traffic abnormality. A sudden increase in deviation often indicates malicious behavior such as data leakage, distributed denial-of-service attacks, or lateral movement.

[0036] The file operation suspiciousness index is a comprehensive score for assessing the abnormality and potential threat of file system operation behavior. The monitored file operation behaviors include file access frequency, file modification type, file deletion behavior, sensitive file access, and batch file operations. The file operation behaviors are evaluated through a predefined set of suspicious behavior rules and an anomaly detection model based on machine learning. The suspiciousness of multiple dimensions is weighted and summarized to obtain the file operation suspiciousness index. The file operation suspiciousness index is mapped to the range of 0 to 1 using the sigmoid function. A value close to 1 indicates that the file operation behavior is highly suspicious, which is usually associated with attack phases such as ransomware encrypting files, data theft, or trace erasure after privilege escalation.

[0037] The specific implementation methods of the above steps are described in detail below.

[0038] The specific implementation of step S01 is as follows: The data aggregation engine first collects raw security logs from multiple data sources of the power monitoring system. These data sources include firewall logs, intrusion detection system alarms, host audit logs, and network traffic mirroring data. The collected raw security logs are then timestamped to unify the time base to Coordinated Universal Time (UTC) format, eliminating timing discrepancies caused by clock deviations between different devices. Subsequently, data cleaning is performed, filtering out duplicate records, incorrectly formatted records, and invalid records with missing key fields. Text fields are standardized, and device names, IP addresses, and usernames are uniformly converted to a predefined encoding format. Next, login behavior features are extracted. Login time, login source IP address, login target account, and login result status are parsed from the host audit log. The login frequency and number of failed logins for each account in the last 24 hours are calculated. The login frequency is compared with the average login frequency of the past 30 days to obtain the frequency deviation ratio. The Isolation Forest algorithm is used to calculate the login behavior anomaly score by using the frequency deviation ratio, number of failed logins, and login identifiers during abnormal periods as input features. The Isolation Forest algorithm constructs an isolation tree by randomly selecting features and split points. Abnormal samples have a shorter average path length because they are easy to isolate. The login behavior anomaly score is the reciprocal of the normalized average path length. When extracting network traffic features, the total number of data packets, average packet size, protocol type distribution, and destination port distribution within each time window are statistically analyzed from the network traffic mirror data. A multi-dimensional feature baseline vector of normal traffic is constructed. The baseline vector is obtained by calculating the mean and standard deviation of the normal operation data over the past 7 days. The Mahalanobis distance between the feature vector of the current time window and the baseline vector is calculated as the network traffic deviation. The Mahalanobis distance takes into account the correlation between features. The distance is weighted by the inverse of the covariance matrix so that features with strong correlation will not be counted twice. The network traffic deviation is standardized by dividing by the maximum historically observed Mahalanobis distance. When extracting file operation features, file creation, modification, deletion, and access operations are identified from the host audit logs. The number of file operations and the distribution of file types involved for each process in the most recent hour are counted. Operations involving sensitive directories or system files are assigned higher suspicion weights. Batch behaviors involving a large number of file operations in a short period of time are marked. The number of file operations, sensitive file access identifiers, and batch operation identifiers are input into a pre-trained random forest classifier. The random forest classifier is trained using historically labeled normal and malicious file operation samples. The output malicious probability between 0 and 1 is used as the raw value of the file operation suspicion index. The sigmoid function is used to map the raw value to the 0-1 interval to enhance the discriminative power of the value.Finally, the login behavior anomaly score, the network traffic deviation degree, and the file operation suspicious index are combined into a standardized multidimensional security feature vector and output to the causal structure learning unit. The standardized multidimensional security feature vector is a three-dimensional vector, and the value of each dimension is in the range of 0 to 1.

[0039] The specific implementation of step S02 is as follows: After receiving the standardized multidimensional security feature vector, the causal structure learning unit first extracts a training dataset containing at least 10,000 samples from the historical security database. The training dataset covers time-series records of normal operation and known attack event states, with each sample containing observations of 20 to 50 security event variables. When performing the conditional independence test, all variable pairs are iterated. For any two security event variables X and Y, a third-party variable Z is enumerated as a condition variable. A three-dimensional contingency table is constructed to statistically analyze the joint frequency distribution of X and Y under different values ​​of Z. The chi-square test statistic is calculated by dividing the sum of the squared differences between the observed frequencies and the expected frequencies by the expected frequencies. The chi-square test statistic is compared with the critical value of the chi-square distribution corresponding to the degrees of freedom. When the p-value is less than 0.05, the null hypothesis that X and Y are independent under the given Z condition is rejected, and the variable pair X and Y is marked as conditionally related. Intervention analysis is performed on variable pairs labeled as conditionally related. An intervention model is constructed using Do-calculus theory. This model simulates external intervention by fixing the values ​​of variable X. Based on the observed distribution in the training dataset, a propensity score matching method is used to estimate the intervention distribution. This method predicts the probability of each sample receiving the intervention using a logistic regression model. Samples receiving and not receiving the intervention are paired according to their propensity scores to eliminate confounding factors. The KL divergence between the observed and intervention distributions is calculated. This KL divergence is obtained by weighted summation of the logarithmic ratios of the probability density functions of the observed and intervention distributions. When the KL divergence is greater than 0.15, X is considered to have a causal influence on Y, and the direction of the causal edge is determined to be from X to Y. A set of causal prior constraints provided by domain experts is introduced. This set contains explicitly prohibited causal pairs. Variable pairs from this set are removed from the candidate edge set to avoid constructing causal relationships that violate physical laws or business logic. A hill-climbing algorithm based on a score is used to search for the optimal network structure. The hill-climbing algorithm starts from an empty network or a randomly initialized network. In each iteration, it attempts to add, delete, or flip an edge and calculates the BIC score after the structural change. The BIC score consists of the model log-likelihood and a model complexity penalty term. The model complexity penalty term is proportional to the logarithm of the number of network parameters and the sample size. The structural change operation that maximizes the improvement of the BIC score is selected to perform the network update. The iteration is repeated until no further operation that can improve the BIC score can be found, resulting in a dynamic Bayesian network topology.The parameter adaptive learning unit uses a sliding time window of 1000 time slices to extract samples from the real-time data stream. The sliding time window moves 100 time slices at a time for incremental updates. A Bayesian online change point detection algorithm is executed on the samples within the window. The Bayesian online change point detection algorithm maintains the posterior probability estimate of the data distribution and calculates the posterior probability of each time point being a change point through the recursive Bayes formula. The posterior probability reflects the possibility of a sudden change in the data distribution at that time point. The posterior probability ratio of consecutive time windows is calculated. When the posterior probability ratio of 5 consecutive time slices is greater than 3.0, a change point alarm is triggered. The posterior probability ratio threshold of 3.0 is determined based on the balance point of historical false alarm rate and false negative rate. Upon detecting a change point, the conditional probability table parameters are relearned. The maximum likelihood estimation method is used to count the conditional frequency of each node in the samples within the window under different combinations of parent node states. The conditional frequency is divided by the number of occurrences of the parent node state combination to obtain the conditional probability estimate. To avoid the influence of outdated data, a forgetting factor is assigned to the samples within the window. The forgetting factor is set to 0.98. The sample weight decays exponentially with the time distance from the current time. The weight of the sample d time slices away from the current time is 0.98 to the power of d. When calculating the weighted conditional frequency, each sample contributes its weight value instead of a unit count. The updated conditional probability table parameters are output to the threat time series inference model.

[0040] The specific implementation of step S03 is as follows: After receiving the dynamic Bayesian network topology and the conditional probability table parameters, the threat temporal inference model completes model initialization. The threat temporal inference model allocates a corresponding liquid neuron structure to each security event node in the GPU memory. The membrane potential state variable of the liquid neuron structure is initialized to a resting potential value of 0.0, the leakage rate parameter is initialized to 0.1 per second, and the excitation threshold parameter is initialized to 1.0. When real-time security event evidence arrives, the threat temporal inference model encodes the real-time security event evidence as a pulse signal and inputs it into the corresponding liquid neuron. The amplitude of the pulse signal is proportional to the severity of the security event, and its value ranges from 0.1 to 1.0. After receiving a pulse signal, the liquid neuron updates its membrane potential state variable. The change in this variable is described by a first-order differential equation. The leakage term on the right-hand side of the equation causes the membrane potential state variable to decay towards the resting potential at a rate determined by the leakage rate parameter. The input driving term accumulates the pulse signal amplitude into the membrane potential state variable. The first-order differential equation is solved numerically using the fourth-order Runge-Kutta method, with a time step set to 0.01 seconds to ensure numerical stability and accuracy. When the membrane potential state variable of the liquid neuron exceeds the excitation threshold parameter, the liquid neuron outputs an output pulse and resets the membrane potential state variable to the resting potential value. The output pulse propagates to downstream liquid neurons through directed edges in the dynamic Bayesian network topology. Upon receiving the output pulse, the downstream liquid neuron determines the modulation coefficient of the pulse amplitude based on the conditional probability table parameters. The hypergraph matching layer constructs hyperedge connections based on the liquid neuron layer. These hyperedge connections are automatically generated by analyzing the co-occurrence patterns of security events in the training data. The joint occurrence frequency of each triplet and quadruple security event in the attack samples is counted. When the joint occurrence frequency exceeds 10%, candidate hyperedges connecting the security event nodes are created. The mutual information value of the candidate hyperedges is calculated. The mutual information value is quantified by the KL divergence of the product of the joint distribution and the edge distribution of the security event nodes. Hyperedges with a mutual information value greater than 0.2 are retained to form the hypergraph structure. During hypergraph inference, the current membrane potential state variable values ​​of each liquid neuron in the liquid neuron layer are extracted as observational evidence. For each hyperedge, the joint posterior probability of the safe event nodes it connects is calculated. The joint posterior probability is represented as a higher-order tensor, the dimension of which is equal to the number of safe event nodes connected by the hyperedge. Tucker decomposition is used to decompose the higher-order tensor into the product of a core tensor and multiple factor matrices. The rank of the factor matrix is ​​set to 50% of the original dimension to achieve data compression. The joint posterior probability is quickly calculated through matrix multiplication of the factor matrices.The readout layer extracts feature vectors from the dynamic state space of the liquid neuron layer. The feature vectors consist of the membrane potential state variables of all liquid neurons and the firing frequency within the last 50 milliseconds. The feature vectors are input into a pre-trained ridge regression model. The regression coefficient matrix of the ridge regression model is optimized by adding an L2 regularization term to the least squares objective function of the training set samples. The coefficient of the L2 regularization term is set to 0.01 to balance the fitting accuracy and generalization ability. The ridge regression model outputs a multi-dimensional threat category probability vector. The node posterior probability distribution obtained by conventional dynamic Bayesian network inference, the joint posterior probability obtained by hypergraph inference, and the threat category probability vector are weighted and fused. The weights are set to 0.4, 0.3, and 0.3, respectively. After fusion, the final node posterior probability distribution of the current time slice is obtained and output to step S04.

[0041] The specific implementation of step S04 is as follows: Based on the posterior probability distribution of the nodes, the neuron excitation regulation function value is calculated. First, the membrane potential state variable values ​​of all liquid neurons within the current time window are statistically analyzed. The time window length is set to 1 second. The arithmetic mean of the membrane potential state variable values ​​is calculated as the average membrane potential value. The standard deviation of the membrane potential state variable values ​​is calculated as the membrane potential volatility. The number of liquid neurons that emit at least one output pulse within the time window is counted. The number of liquid neurons divided by the total number of liquid neurons yields the excitation sparsity rate. The average membrane potential value, the membrane potential volatility, and the excitation sparsity rate are each normalized by dividing by their respective maximum observed values ​​in historical data. The maximum observed values ​​are obtained by analyzing the operational data of the past 30 days. The normalized average membrane potential value is divided by the normalized membrane potential volatility to obtain the potential stability index. The potential stability index is multiplied by the normalized excitation sparsity rate to obtain the neuron excitation regulation function value. The parameter adjustment strategy is executed based on the range to which the neuron activation regulation function value belongs. When the neuron activation regulation function value belongs to the range [0, 0.3), the network is determined to be in a low-activity state. This low-activity state indicates that current security events are scarce or threat signals are weak. To improve system sensitivity, the leakage rate parameter of all liquid neurons is reduced by 20% from its current value. The reduction in the leakage rate parameter slows down the decay of membrane potential state variables, prolonging the memory retention time of historical events. At the same time, the activation threshold parameter is reduced by 15% from its current value. The reduction in the activation threshold parameter makes liquid neurons easier to activate, improving the response capability to weak signals. When the neuron activation regulation function value belongs to the range [0.3, 0.7), the network is determined to be in a normal active state. The leakage rate parameter and the activation threshold parameter are kept unchanged, maintaining the current inference state. When the neuron activation regulation function value falls within the range of [0.7, 1.0], the network is determined to be in a highly active state. This highly active state indicates the presence of numerous security events or dense potential threat signals. To avoid information overload and false alarms, the leakage rate parameter of all liquid neurons is increased by 20% from its current value to accelerate the decay of stale information. Simultaneously, the activation threshold parameter is increased by 15% from its current value to suppress interference from noise events. When the neuron activation regulation function value is greater than 1.0, the network is determined to be in an over-activated state. This over-activated state indicates that the system may be subject to distributed denial-of-service attacks or log flooding attacks. The leakage rate parameter is increased by 50% from its current value, and the activation threshold parameter is increased by 30% from its current value to quickly reduce network activity and restore it to a stable state. The parameter adjustment operation takes effect in the next time step, realizing dynamic adaptive control of the threat temporal inference model.

[0042] The specific implementation of step S05 is as follows: Traverse all posterior probability values ​​of threat nodes in the posterior probability distribution of the nodes. When the posterior probability value of any threat node exceeds a preset threat threshold, a distributed inference collaboration mechanism is triggered. The preset threat threshold is determined through subject operating characteristic curve analysis, with a typical value of 0.75. The hierarchical distributed inference collaboration module decomposes the global dynamic Bayesian network into local sub-networks based on the physical topology of the power monitoring system. The physical topology includes areas such as substations, new energy plants, and dispatch centers. Each area corresponds to a local sub-network, which is assigned to edge computing nodes deployed in that area. Boundary nodes between local sub-networks are identified. These boundary nodes are security event nodes that simultaneously appear in two adjacent local sub-networks. Information exchange between local sub-networks is achieved through these boundary nodes. Each edge computing node independently performs inference calculations for its local sub-network. Based on the dynamic Bayesian network topology and the conditional probability table parameters, it uses a variable elimination algorithm or a belief propagation algorithm to calculate the posterior probability of the local sub-network for each local node. The variable elimination algorithm simplifies the calculation by sequentially summing and eliminating non-query variables, while the belief propagation algorithm iteratively updates the edge probabilities through message passing between nodes. Edge computing nodes encapsulate the posterior probabilities of local subnetworks of boundary nodes into messages and send them to adjacent edge computing nodes via a message passing interface protocol. This protocol employs an asynchronous communication mechanism to avoid accumulated latency caused by waiting. Upon receiving a message from an adjacent edge computing node, the edge computing node uses the posterior probabilities of the local subnetworks of the external boundary nodes as new observation evidence, updates the evidence set of the local dynamic Bayesian network, and re-executes inference calculations to update the posterior probabilities of the local subnetworks of internal nodes. A damping factor is used to smooth the message updates; this factor is set to 0.6. The new message is a weighted sum of the current message multiplied by 0.6 and the previous message multiplied by 0.4. This damping mechanism prevents message oscillations and accelerates iterative convergence. The iteration process continues until a convergence condition is met. The convergence condition is defined as the maximum change in the posterior probabilities of the local subnetworks of all boundary nodes being less than 0.01 in two consecutive iterations. When this convergence condition is met, a globally consistent state is determined to be reached. When the posterior probability of a threat node in a local sub-network exceeds a preset threat threshold, the corresponding edge computing node sends an alarm message to the central coordination node. The central coordination node collects all alarm messages, analyzes the spatial distribution and propagation path of the threat, triggers global reasoning collaboration, and increases the message transmission frequency to three times the original frequency by broadcasting acceleration instructions to all edge computing nodes, thereby reducing the convergence threshold to 0.005 and accelerating the achievement of a globally consistent state.When generating the attack path probability graph, directed paths are extracted from the temporal unfolding structure of the dynamic Bayesian network layer. The starting point of each directed path is an initial normal state node, and the ending point is a final threat state node. A depth-first search algorithm is used to traverse all paths from the starting point to the ending point. A joint probability is calculated for each directed path. The joint probability is equal to the product of the security event node transition probabilities between adjacent nodes on the path. All directed paths are arranged in descending order of joint probability, and the joint probabilities are accumulated until the total probability reaches 95%. The directed paths in the accumulation process are selected to form a high-probability attack path set, and the high-probability attack path set is visualized and output as an attack path probability graph in the form of a tree diagram.

[0043] The specific implementation of step S06 is as follows: When calculating the comprehensive threat confidence, the posterior probability values ​​of all threat nodes in the posterior probability distribution of the nodes are extracted. Weights are assigned to each threat node based on its criticality in the attack chain. This criticality is determined by analyzing the frequency of occurrence of each threat node in historical attack samples and the success rate of subsequent attacks. Threat nodes with high criticality, such as those with completed privilege escalation and activated command control channels, have a weight of 0.3; those with medium criticality, such as those in the process of lateral movement, have a weight of 0.2; and those with low criticality, such as those involved in data leakage, have a weight of 0.1. The weighted summation of the posterior probability values ​​of the threat nodes yields the initial threat confidence. The joint probability value corresponding to the directed path with the highest joint probability in the attack path probability graph is extracted. The initial threat confidence is multiplied by the joint probability value to obtain the path modulation threat confidence. The path modulation operation combines single-point threat assessment with the overall probability of the attack sequence, improving the accuracy of the comprehensive assessment. The original comprehensive threat confidence is obtained by multiplying the path modulation threat confidence by 0.7 and summing it with the neuron activation regulation function value multiplied by 0.3. This original comprehensive threat confidence is then mapped to the 0% to 100% range using a minimum-maximum normalization method. This method uses historically observed minimum and maximum values ​​to determine the mapping range, resulting in the final comprehensive threat confidence. When identifying the status of key threat nodes, the posterior probability distribution of the nodes is traversed, and the security event node with the highest posterior probability value is selected. The threat status identifier corresponding to this security event node is extracted. This threat status identifier includes five predefined types: data leakage in progress, privilege escalation completed, lateral movement in progress, persistence mechanism established, and command control channel activated. The comprehensive threat confidence, the status of the key threat nodes, and the attack path probability graph are encapsulated into a network security assessment result. This network security assessment result uses a structured data format, including timestamps, monitoring area identifiers, threat levels, and detailed analysis fields. The network security assessment result is then pushed to the downstream decision engine via an application programming interface. The downstream decision engine executes response strategies based on the comprehensive threat confidence level. When the comprehensive threat confidence level exceeds 80%, it is determined to be a high threat level, triggering an automatic isolation response. The automatic isolation response includes disconnecting the network connection of the affected host, freezing suspicious accounts, and initiating forensic log collection. When the comprehensive threat confidence level is between 50% and 80%, it is determined to be a medium threat level, triggering a manual review process, sending alarm notifications to security operations personnel, and providing the attack path probability graph to assist in the analysis. When the comprehensive threat confidence level is below 50%, it is determined to be a low threat level, only logging is recorded in the security information and event management system without triggering an active response, and the network security assessment results are retained for subsequent threat intelligence analysis and model optimization.

[0044] It should be noted that the key technical ideas of this invention include the deep integration of the liquid neuron temporal inference algorithm and dynamic Bayesian networks, the high-order attack pattern recognition mechanism guided by embedded hypergraph matching, and the adaptive neuron excitation adjustment strategy. The liquid neuron temporal inference algorithm breaks through the static inference paradigm of traditional discrete-time Bayesian networks. By modeling node states as continuously evolving membrane potential variables, it achieves native support for asynchronous security event streams. The adaptive forgetting capability provided by the leakage integral mechanism avoids the information truncation problem caused by manually setting time windows. The pulse-driven event processing method transforms computation triggering from periodic polling to event response, significantly reducing invalid computational overhead while maintaining real-time performance. The high-dimensional dynamic state space generated by the reservoir computing framework provides a rich representation basis for attack temporal patterns, enabling the model to distinguish between normal behavior and attack behavior with the same event set but different temporal order. Compared with traditional sliding window-based temporal analysis methods, the liquid neuron algorithm exhibits stronger detection capabilities and lower false positive rates when dealing with persistent attacks and zero-day exploits. The attack pattern recognition mechanism guided by embedded hypergraph matching extends the pairwise dependencies of traditional graph models to arbitrary multivariate dependencies. By explicitly modeling the synergistic effects of multiple security events through hyperedge structures, it compensates for the deficiencies of conventional Bayesian networks in expressing high-order statistical correlations. The hyperedge weight quantization mechanism based on mutual information automatically identifies event combinations that significantly contribute to threat detection, reducing the reliance on expert knowledge. The community detection function driven by the spectral segmentation method automatically clusters semantically related security events into attack pattern clusters, providing a data-driven solution for pattern induction of unknown attacks. The inference operator based on tensor contraction controls computational complexity while maintaining expressive power through low-rank decomposition, enabling large-scale network inference involving hundreds of nodes and dozens of hyperedges to be completed within millisecond latency. Compared with traditional multi-step attack detection methods based on rule matching, the hypergraph matching algorithm significantly improves the accuracy and robustness of identifying complex attack chains. The adaptive neuron activation regulation strategy dynamically adjusts the parameters of liquid neurons by monitoring network activity in real time. In the low-activity state, it lowers the activation threshold to improve sensitivity and capture hidden threats, and in the high-activity state, it increases the leakage rate and threshold to suppress noise interference. This avoids the problem of insufficient adaptability of fixed parameter configuration under different threat scenarios. The regulation function design based on the statistical characteristics of membrane potential realizes a smooth transition of parameter adjustment and prevents inference instability caused by parameter mutation.The synergistic effect of these three technical approaches constructs a complete technical chain, from low-level temporal dynamics modeling to mid-level high-order pattern recognition and then to top-level adaptive control. The continuous state space provided by the liquid neuron algorithm provides refined node features for hypergraph matching. The attack pattern clusters identified by hypergraph matching guide the threshold setting of the neuron excitation regulation strategy. The network state optimized by the neuron excitation regulation strategy, in turn, improves the inference quality of the liquid neuron. The three form a positive feedback loop to continuously optimize threat assessment performance. Compared with existing security analysis systems that use a single algorithm in isolation, this invention demonstrates stronger detection capabilities, lower false alarm rates, and better real-time performance when facing unknown threats, persistent attacks, and large-scale collaborative attacks.

[0045] A second aspect of the present invention provides a computer-readable storage medium storing program instructions that, when executed in a computer, perform the aforementioned network threat assessment method based on a dynamic Bayesian network.

[0046] A third aspect of the present invention provides a network threat assessment system based on dynamic Bayesian networks, comprising the aforementioned computer-readable storage medium. The system can be any one of a computer, a server, or a microcontroller. The computer-readable storage medium is disposed within the system, and the system is provided with a microprocessor that executes the program instructions stored in the computer-readable storage medium.

[0047] Specifically, the principle of this invention is as follows: This invention solves the aforementioned technical problems by using a causal structure learning unit to test the conditional independence of security event variable pairs and introducing intervention calculus theory to compare the divergence between the observation distribution and the intervention distribution. This automatically discovers true causal edges from the data, rather than superficial correlations, and the constructed dynamic Bayesian network topology accurately reflects the causal chain of attack propagation. Based on this, the liquid neuron layer transforms the posterior probability of each security event node into a continuously evolving membrane potential state variable. The leakage integral dynamics described by the first-order differential equation cause the membrane potential to accumulate according to the input security event pulses and decay naturally over time, overcoming the limitation of fixed time windows in adaptively forgetting old events. The pulse-driven asynchronous processing mechanism avoids the delay of waiting for event synchronization. The hypergraph matching layer connects any number of security event nodes simultaneously through hyperedges. The hyperedge weight is defined as the divergence of the product of the joint distribution of connected nodes and the edge distribution, quantifying the intensity of higher-order mutual information. The spectral segmentation method performs community detection on the hypergraph, identifying closely related security events as attack pattern clusters. The tensor contraction operator represents higher-order conditional probabilities as tensor elements and accelerates inference calculations through low-rank decomposition. The synergistic effect of the three-layer architecture enables this invention to simultaneously model causal dependencies and higher-order collaborations, which aligns with the inherent logic of multi-stage propagation in network attacks.

[0048] The following provides a specific embodiment 1 of the present invention. The specific implementation of each step involving calculation in this embodiment 1 is described in detail below.

[0049] The specific implementation of the causal structure learning unit in step S02 is as follows: when performing conditional independence tests on the variable pairs in the historical security data sample, the chi-square test statistic is used. The formula for calculating the chi-square test statistic is expressed as follows: ; In the formula, This is the chi-square test statistic, which is dimensionless. For the first The status of the security event variable and the first The observation frequency of a combination of security event variable states, expressed in times; For the first The status of the security event variable and the first The expected frequency of a combination of security event variable states, expressed in times; The number of states for the first security event variable is dimensionless. The number of states for the second security event variable is dimensionless. The state index of the first variable, with a value range of 1 to... Dimensionless; The state index of the second variable, with a value range of 1 to... Dimensionless. The expected frequency is... The calculation formula is In the formula For the first The total frequency of rows in each state, in times; For the first The total frequency of each state is expressed in times. This represents the total number of samples, expressed in units of tests. When testing... A value less than 0.05 indicates that the independence hypothesis is rejected, and a statistical association is determined between the two safety event variables. The KL divergence formula between the intervention distribution and the observation distribution is expressed as follows: ; In the formula, The KL divergence is expressed in bits. For variables Variables after intervention The probability distribution is dimensionless; Variables without intervention The conditional probability distribution of is dimensionless; For variables The value of is dimensionless; For variables The value of is dimensionless; The variable representing the security event being intervened upon is dimensionless. For safety event variables downstream of causation, dimensionless; Represents the variable The applied value is The intervention operation is dimensionless. A causal dependency is determined when the KL divergence is greater than 0.15 bits. The calculation formula for the BIC criterion in the score-based hill-climbing algorithm is as follows: ; In the formula, The value of the Bayesian information criterion is dimensionless. For given parameters and data The likelihood function value is dimensionless; The set of model parameters, dimensionless; The training dataset is dimensionless. The number of model parameters, dimensionless; The BIC value represents the number of samples used for structure learning, expressed in units of samples. A lower BIC value indicates higher model quality.

[0050] The specific implementation of the parameter adaptive learning unit in step S02 is as follows: the Bayesian online change point detection algorithm recursively calculates the posterior probability ratio, and the formula for calculating the posterior probability ratio is expressed as follows: ; In the formula, For the first The posterior probability ratio of each time slice, dimensionless; The location of the variable point is measured in time slices. For time slice 1 to time slice The observation data sequence is dimensionless; The change point occurs at the 1st The posterior probability of each time slice, dimensionless; The change point occurs at the 1st The posterior probability prior to time slices is dimensionless. This is the index of the current time slice, dimensionless. A change-point alarm is triggered when the posterior probability ratio of five consecutive time slices is greater than 3.0. The formula for calculating the forgetting factor weight is as follows: ; In the formula, For the first The weights of each sample are dimensionless. The forgetting factor has a value of 0.98 and is dimensionless. This is the index for the current time slice, dimensionless. This is the time slice index of the sample, dimensionless. The time distance between the sample and the current time is expressed in time slices. The maximum likelihood estimation formula for the parameters of the conditional probability table is as follows: ; In the formula, For nodes Combining the parent node's state The next value is The conditional probability is dimensionless. This represents the number of samples within the sliding time window, with a value of 1000, in units of samples. For the first The forgetting factor weights for each sample, dimensionless; This is an indicator function that takes the value 1 when the condition inside the parentheses is met and 0 otherwise; it is dimensionless. For the first Nodes in each sample The observed values ​​are dimensionless; For the first Nodes in each sample The parent node state combination is dimensionless; For nodes A certain value of , dimensionless; It is a combination of states of the parent node, and is dimensionless. For the first in a dynamic Bayesian network Each security event node is dimensionless. For nodes The set of parent nodes, dimensionless; This is the sample index, with a value range of 1 to... , dimensionless.

[0051] The specific implementation method for the neuron activation regulation function value in step S04 is as follows: The formula for calculating the neuron activation regulation function value is expressed as follows: ; In the formula, The value of the neuron excitation regulation function is dimensionless. This represents the average membrane potential state variable value of all liquid neurons within the current time window, in millivolts. This represents the maximum value of the average membrane potential state variable observed historically, in millivolts. represents the standard deviation of the membrane potential state variables of all liquid neurons, in millivolts; This represents the maximum standard deviation of the observed membrane potential in history, expressed in millivolts. The number of liquid neurons that emit output pulses, expressed in units; This represents the total number of liquid neurons, expressed in units. The leakage rate parameter and the activation threshold parameter are adjusted according to the interval to which the neuron activation regulation function value belongs. The adjustment formula is as follows: When... hour, and ;when hour, and ;when hour, and ;when hour, and In the formula, The adjusted time constant is expressed in milliseconds. The time constant before adjustment, in milliseconds; The adjusted excitation threshold parameter is expressed in millivolts. The excitation threshold parameter before adjustment is in millivolts.

[0052] The specific implementation of the hierarchical distributed reasoning collaboration module in step S05 is as follows, and the convergence condition determination formula is expressed as follows: ; In the formula, The set of boundary nodes, dimensionless; Indexes for boundary nodes, dimensionless; The node state is dimensionless; For the first Boundary nodes in the next iteration In state The posterior probability of the local subnetwork under the given condition is dimensionless. For the first Boundary nodes in the next iteration In state The posterior probability of the local subnetwork under the given condition is dimensionless. Let be the number of iterations, which is dimensionless. The message update formula for damping factor smoothing is expressed as follows: ; In the formula, This is a new message, dimensionless; The current computation message is dimensionless; The previous message is dimensionless; 0.6 is the damping factor, dimensionless; 0.4 is the complementarity factor, dimensionless.

[0053] The specific implementation method for the comprehensive threat confidence level in step S06 is as follows: The formula for calculating the comprehensive threat confidence level is expressed as follows: ; In the formula, The overall threat confidence level is measured in terms of value, ranging from 0 to 1, and is dimensionless. The initial threat confidence level is dimensionless. The highest joint probability in the attack path probability graph is dimensionless. The maximum initial threat confidence level observed in history is dimensionless. To reference the highest joint probability, it is usually taken as 1.0, which is dimensionless; The value of the neuron excitation regulation function is dimensionless. The maximum value of the neuronal activation regulation function observed in history is dimensionless; 0.7 and 0.3 are linear combination coefficients, both dimensionless. The formula for calculating the initial threat confidence is as follows: ; In the formula, The set of threat nodes is dimensionless. The index for threat nodes is dimensionless. Threat nodes The weighting coefficients are dimensionless and are determined based on the criticality of each threat node in the attack chain. Threat nodes The posterior probability value is dimensionless; Threat nodes The historical maximum posterior probability value is dimensionless. The formula for calculating the joint probability of attack paths is as follows: ; In the formula, Let be the joint probability of directed paths, which is dimensionless; This represents the path length, in jumps. To start from security event nodes Transfer to security event node The transition probability is dimensionless. The node index in the path, with a value ranging from 1 to... Dimensionless; For the first in the path Each security event node is dimensionless. For the first in the path Each security event node is dimensionless.

[0054] The specific implementation of the dynamic change of membrane potential in the liquid neuron temporal inference algorithm is as follows: The differential equation of the membrane potential state variable is expressed as follows: ; In the formula, For the first A liquid neuron at time The membrane potential state variable, in millivolts; It is a continuous time variable, with the unit being milliseconds; For the first The time constant of each liquid neuron, in milliseconds; Leakage rate, in milliseconds. ; This is the resting potential, measured in millivolts, with an empirical value of -70 millivolts. For the first A liquid neuron at time The received input driver is expressed in millivolts per millisecond. For indexing liquid neurons, dimensionless. When The liquid neuron emits an output pulse, where For the first The firing threshold parameter of a liquid neuron, in millivolts, is reset to [value missing] after pulse firing. The formula for calculating the input-driven term is as follows: ; In the formula, For the first A liquid neuron at time The input driver term is expressed in millivolts per millisecond; For the first A collection of precursor liquid neurons for each liquid neuron, dimensionless; Index of precursor fluid neurons, dimensionless; To obtain from liquid neurons To fluid neurons Synaptic weights, in millivolts per millisecond; Liquid neurons At any moment The pulse emission state is 1 when a pulse is emitted and 0 otherwise, and is dimensionless.

[0055] The specific implementation of hyperedge weights in the attack pattern recognition algorithm guided by embedded hypergraph matching is as follows: The calculation formula for hyperedge weights is expressed as follows: ; In the formula, For super-edge The weights are expressed in bits. It is a super-edge index, dimensionless; For super-edge Connected Each security event node is dimensionless. The joint distribution of the connected security event nodes is dimensionless. For the first The edge distribution of security event nodes is dimensionless. It is the product of marginal distributions and is dimensionless; The number of secure event nodes connected by the hyperedge, dimensionless; This is the security event node number, with a value ranging from 1 to... Dimensionless; Here, is the KL divergence operator, expressed in bits. The Tucker decomposition formula is as follows: ; In the formula, The original third-order tensor has a dimension of . Dimensionless; The core tensor has dimensions of Dimensionless; This is the first factor matrix, with dimension 1. Dimensionless; This is the second factor matrix, with dimension 1. Dimensionless; This is the third factor matrix, with dimension 1. Dimensionless; Indicates the first Modular tensor multiplication operator, dimensionless; This refers to the number of time slices, expressed in units. The number of security event nodes, expressed in units of individuals; The number of states enumerated, in units of 1; The rank is the rank of the three dimensions, all of which are dimensionless and are typically taken as 10% to 30% of the original dimension.

[0056] The specific implementation method of the area under the subject operating characteristic curve in the preset threat threshold determination method is as follows: The formula for calculating the area under the subject operating characteristic curve is expressed as follows: ; In the formula, The area under the receiver operating characteristic curve is dimensionless and ranges from 0 to 1. The true positive rate is dimensionless. The false positive rate is dimensionless. It is the inverse function of the false positive rate and is dimensionless; The variable is a dimensionless integral variable. The choice is to make... The highest threshold is used as the preset threat threshold.

[0057] Example 2: To verify the effectiveness of the present invention, technicians built a test environment and conducted a practical application test on the threat assessment method proposed in this invention by accessing historical security logs and real-time monitoring data streams from a power monitoring system. The test environment includes six core components: a data aggregation engine, a causal structure learning unit, a parameter adaptive learning unit, a threat temporal inference model, a hierarchical distributed inference collaboration module, and a downstream decision engine. It is deployed on a computing server equipped with an NVIDIA A100 GPU, running Ubuntu 20.04 with CUDA version 11.8.

[0058] Technicians first collected 30 consecutive days of safety log data from the power monitoring system, totaling... The original log records cover network traffic, user login behavior, and file operation activities of 156 monitoring nodes. The data aggregation engine cleans and extracts features from the original logs, calculating a standardized multidimensional security feature vector, as shown in Table 1.

[0059] Table 1. Standardized security feature vector samples of typical time slices

[0060] Table 1 shows that the three security characteristic values ​​exhibit a continuous upward trend over six consecutive time slices from 1580 to 1585, indicating that the system may be under a progressive attack. Technicians input this data into a causal structure learning unit (CSM) for topology construction. The CSM performed conditional independence tests on 23 security event variables in the historical data, executing 253 chi-square tests and identifying 87 pairs of variables with statistical dependencies. Subsequently, Do-calculus theory was used to simulate intervention experiments on these 87 pairs of variables. By calculating the KL divergence between the observed and intervention distributions, 42 pairs of variables were confirmed to have causal dependencies, with the maximum KL divergence reaching 0.34 and the minimum 0.16. Combining 15 causal prior constraints provided by experts in the field of power system security, and eliminating 3 pairs of variable relationships that conflicted with expert knowledge, a hill-climbing algorithm based on scoring was used to search for the optimal network structure. After 128 iterations, the algorithm converged, resulting in a dynamic Bayesian network topology with 23 nodes and 39 directed edges, achieving a negative BIC score. .

[0061] The parameter adaptive learning unit uses a sliding window of length 1000 time slices to extract training samples from the data stream, such as... Figure 2The diagram illustrates the detected change points during the window's sliding process. Technicians observed three significant change points at positions 3200, 5800, and 8100 of the time slice sequence. These change points correspond to the times of system operation and maintenance strategy adjustments and the emergence of new attack patterns. At time slice 5800, the posterior probability ratio of the Bayesian online change point detection algorithm exceeded 3.0 for seven consecutive time slices, reaching a maximum of 4.7, triggering a change point alarm. The system immediately initiated conditional probability table parameter relearning, using a forgetting factor of 0.98 to assign weights to samples within the window, while the weights of samples from 800 time slices away from the current time were decayed to [a specific value]. The value is approximately 0.000028, effectively suppressing the influence of outdated data. After relearning, the average change in the conditional probability table parameters of each node reached 0.17, with the conditional probability parameter of the login failure count node showing the most significant change, updating from 0.12 to 0.31.

[0062] After the threat time-series inference model was built, technicians trained it using a dataset containing 8500 training samples, 1000 validation samples, and 1000 test samples. The training samples included 6200 normal operation samples and 2300 known attack samples, covering five major attack types: data leakage, privilege escalation, lateral movement, persistence mechanism establishment, and command control channel activation. The model employed a reservoir computing framework with 128 liquid neurons. The initial leakage rate parameter for each liquid neuron was set to 0.15, the activation threshold parameter to 0.8, and the resting membrane potential value to 0. The hypergraph matching layer initially constructed 56 hyperedges: 42 triplet hyperedges connecting 3 nodes and 14 quadruple hyperedges connecting 4 nodes. During training, reinforcement learning was used to optimize the hyperedge configuration, ultimately retaining 34 hyperedges with weights exceeding the threshold of 0.25 and deleting 22 redundant hyperedges. Figure 3 As shown, the curve of the F1 score of the model on the validation set during the training process is displayed. After 200 rounds of time-series backpropagation training, the F1 score increased from the initial 0.58 to 0.87. Then, 100 rounds of reinforcement learning further improved the F1 score to 0.91. Finally, 50 rounds of end-to-end fine-tuning stabilized the F1 score at 0.93.

[0063] In practical threat assessment applications, technicians input real-time security event streams into a pre-trained threat temporal inference model. In a test scenario, the system detected abnormal login behavior at time slice 1582, with an anomalous login behavior score of 0.71. At this time, the average membrane potential of the 128 liquid neurons was 0.42, the membrane potential fluctuation was 0.18, the firing sparsity was 0.35, and the calculated neuron firing regulation function value was 0.82, indicating that the network was in a highly active state. The system automatically increased the leakage rate parameter of all liquid neurons from 0.15 to 0.18 and the firing threshold parameter from 0.8 to 0.92 to suppress potential noise interference. Subsequently, at time slices 1583 and 1584, abnormal network traffic deviation and an increased file operation suspicion index were detected successively. The membrane potential values ​​of the corresponding liquid neurons continued to accumulate, and at time slice 1585, the posterior probability of the threat node reached 0.78, exceeding the preset threat threshold of 0.65.

[0064] The hierarchical distributed inference collaboration module decomposes the global dynamic Bayesian network into five local sub-networks, corresponding to the five logical partitions of the power monitoring system: the power generation area, transmission area, substation area, distribution area, and dispatch center. Each edge computing node independently executes local inference and then asynchronously exchanges the posterior probabilities of the boundary nodes through a message passing interface protocol. For example... Figure 4 As shown, the convergence process of the iterative belief propagation algorithm is illustrated. After 17 iterations, the maximum change in the posterior probability of all boundary nodes decreases to 0.008, satisfying the convergence condition. After the central coordination node collects two alarm messages from the transmission area and the substation area, it triggers global inference collaboration, increasing the message transmission frequency from 2 times per second to 5 times per second and reducing the convergence threshold from 0.01 to 0.005, accelerating the achievement of a globally consistent state, and finally completing global inference within 3.2 seconds.

[0065] Technicians extracted all directed paths from the initial normal state to the final threat state from the temporal unfolding structure of the dynamic Bayesian network, identifying a total of 189 attack paths. After calculating the joint probability of each path, they were sorted in descending order, and the top 18 paths with a sum of joint probabilities reaching 95% were selected as the set of high-probability attack paths, as shown in Table 2.

[0066] Table 2 High-probability attack paths and their combined probabilities

[0067] As shown in Table 2, path P1 has the highest joint probability of 0.183, indicating that this attack sequence is most likely to occur. This path contains 5 key event nodes, consistent with a typical APT attack pattern: the attacker gains initial access through abnormal login, then escalates privileges and moves laterally, establishes a persistence mechanism, and finally implements data leakage. Figure 5As shown, the generated attack path probability graph visualizes high-probability attack paths in a tree structure, which contains three super-edge nodes, respectively identifying the synergistic points of privilege escalation and lateral movement, lateral movement and persistence, and persistence and data leakage. The super-edge weights are 0.42, 0.38, and 0.51, respectively.

[0068] In calculating the overall threat confidence, technicians extracted the posterior probability values ​​of five threat nodes from the posterior probability distribution: data leakage node (0.78), privilege escalation node (0.65), lateral movement node (0.58), persistence node (0.52), and command control node (0.43). Weights were assigned to each threat node based on its criticality in the attack chain: data leakage node (0.30), privilege escalation node (0.25), lateral movement node (0.20), persistence node (0.15), and command control node (0.10). These weighted sums yielded an initial threat confidence of 0.61. Multiplying this initial threat confidence by the highest joint probability (0.183) in the attack path probability graph yielded a path modulation threat confidence of 0.112. A linear combination of the path modulation threat confidence and the neuron activation regulation function value (0.82) was performed, with coefficients of 0.7 and 0.3, respectively, resulting in an overall threat confidence of 0.324, which, after normalization to a percentage, is 32.4%. Since the overall threat confidence level is below 50%, the system only logs the information without triggering an automatic response, and pushes the assessment results to the manual review queue. The critical threat node status is identified as data leakage in progress, prompting security operations personnel to pay close attention to access and transmission of sensitive data.

[0069] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in the present invention should be included within the scope of protection of the present invention.

Claims

1. A network threat assessment method based on dynamic Bayesian networks, characterized in that, Includes the following steps: Receive a standardized multidimensional security feature vector from the data aggregation engine. The standardized multidimensional security feature vector includes login behavior anomaly score, network traffic deviation degree, and file operation suspicious index. Standardized multidimensional security feature vectors are input into the causal structure learning unit. The true causal relationship between security event variables is identified through a constraint-based independence test framework and intervention analysis. A dynamic Bayesian network topology is constructed. The parameter adaptive learning unit uses a sliding time window mechanism and a Bayesian online change point detection algorithm to identify the moment of distribution change and update the conditional probability table parameters. The dynamic Bayesian network topology and conditional probability table parameters are input into the threat temporal inference model. The threat temporal inference model receives real-time security event evidence and outputs the posterior probability distribution of nodes in the current time slice. The neuron activation regulation function value is calculated based on the posterior probability distribution of the nodes, and the leakage rate parameter and activation threshold parameter of the liquid neurons in the threat time sequence reasoning model are dynamically adjusted according to the interval to which the neuron activation regulation function value belongs. When the posterior probability of any threatening node in the node posterior probability distribution exceeds the preset threat threshold, the hierarchical distributed reasoning collaboration module asynchronously exchanges the posterior probabilities of the local sub-network and executes the iterative belief propagation algorithm to converge to a globally consistent state, generating an attack path probability map. The network security assessment results are output to the downstream decision engine. The network security assessment results include comprehensive threat confidence, key threat node status and attack path probability graph.

2. The method according to claim 1, characterized in that, The causal structure learning unit first performs conditional independence tests on the pairs of variables in the historical security data sample, and uses the chi-square test statistic to determine whether the two security event variables are independent under the condition of a third-party variable.

3. The method according to claim 2, characterized in that, The causal structure learning unit introduces intervention calculus theory to simulate intervention experiments on pairs of variables with causal relationships, and identifies the true causal direction by comparing the divergence between the observation distribution and the intervention distribution.

4. The method according to claim 3, characterized in that, The causal structure learning unit combines a set of causal prior constraints provided by domain experts and uses a scoring-based hill-climbing algorithm to search for the optimal network structure. The scoring function uses the Bayesian information criterion to balance the model fit and complexity.

5. The method according to claim 4, characterized in that, The parameter adaptive learning unit uses a sliding time window with a length of one thousand time slices to extract training samples from the historical data stream. It then performs a Bayesian online change point detection algorithm on the data within the window and recursively calculates the posterior probability ratio to identify the moment when the data distribution changes significantly.

6. The method according to claim 5, characterized in that, Once the parameter adaptive learning unit detects a change point, it immediately initiates the relearning process of the conditional probability table parameters and uses the maximum likelihood estimation method to recalculate the conditional probability of each node under different combinations of parent node states based on the data in the window.

7. The method according to claim 6, characterized in that, The underlying layer of the threat temporal reasoning model is a dynamic Bayesian network layer, containing fifty to two hundred security event nodes. The security event nodes are connected by directed edges to form a temporally unfolded network structure.

8. The method according to claim 7, characterized in that, A liquid neuron layer is superimposed on the dynamic Bayesian network layer. Each security event node is mapped to a liquid neuron structure in the graphics processing unit memory. The liquid neuron structure contains three fields: membrane potential state variable, leakage rate parameter, and excitation threshold parameter.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores program instructions, which, when executed in a computer, are used to perform a network threat assessment method based on a dynamic Bayesian network as described in any one of claims 1-8.

10. A network threat assessment system based on dynamic Bayesian networks, characterized in that, The system comprises the computer-readable storage medium of claim 9, wherein the system is a computer, the computer-readable storage medium is disposed within the system, and the system is provided with a microprocessor that executes program instructions stored in the computer-readable storage medium.

Images