A dynamic kill chain construction and reconfiguration method and apparatus

Abstract

The application discloses a dynamic killing chain construction and reconstruction method and device, which acquires real-time situation data and constructs a time-varying heterogeneous graph for representing a connection relationship of heterogeneous nodes and multi-dimensional constraints, performs phased searching in the time-varying heterogeneous graph based on a task demand, generates a candidate killing chain set containing a main chain and a backup chain, executes feasibility screening on the candidate killing chain set to eliminate chains that do not satisfy hard constraints and obtains a feasible chain set, then performs multi-objective collaborative optimization selection on the feasible chain set, outputs a backup chain set and a target main chain, and finally, when a node state change triggering a reconstruction condition is monitored, performs a hierarchical reconstruction operation based on the target main chain, the backup chain set and a time-varying heterogeneous graph updated in real time, and generates an updated killing chain execution scheme.

Description

Technical Field

[0001] This application relates to the field of equipment command and control technology, and in particular to a method and device for constructing and reconstructing a dynamic kill chain. Background Technology

[0002] As information-based warfare systems evolve towards intelligence and collaboration, dynamic kill chains have become a core operational element spanning perception, communication, guidance, strike, and assessment. In highly dynamic and intensely contested environments, battlefield situations, node states, and communication conditions change constantly. Simultaneously, missions must meet multiple requirements regarding timing, constraints, resources, and redundancy, placing extremely high demands on the real-time performance and reliability of rapid kill chain construction, dynamic adaptation, and emergency reconfiguration.

[0003] Current methods for planning and constructing kill chains mostly employ traditional static or semi-dynamic decision-making mechanisms, relying on fixed rules, general path search, or conventional optimization algorithms to generate links, which are difficult to adapt to complex constraints and real-time changing battlefield environments.

[0004] Existing technologies lack sufficient constraint handling capabilities, making it difficult to fully cover the multiple complex constraints in the kill chain closed loop. Furthermore, they have poor dynamic adaptability, requiring full chain replanning in the event of node failure or link interruption, resulting in slow recovery speed and excessive time consumption. Overall, they cannot meet the practical needs of agile chain construction and rapid reconstruction in highly dynamic and highly adversarial scenarios. Summary of the Invention

[0005] To address the aforementioned issues, this application provides a method and apparatus for constructing and reconstructing a dynamic kill chain.

[0006] The embodiments of this application disclose the following technical solutions: In a first aspect, embodiments of this application provide a method for constructing and reconstructing a dynamic kill chain, the method comprising: Acquire real-time situational data and construct a time-varying graph based on the real-time situational data; the time-varying graph is used to characterize the connection relationships and multidimensional constraints between heterogeneous nodes. Based on the task requirements, a phased search is performed on the time-varying graph to generate a set of candidate kill chains including the main chain and backup chains. Perform a feasibility screening on the candidate kill chain set, remove candidate kill chains that do not meet the hard constraints, and obtain a set of feasible chains; Perform multi-objective collaborative optimization selection on the set of feasible chains, and output a set of backup chains and a target main chain; When a node state change is detected and triggers the reconstruction condition, a hierarchical reconstruction operation is performed based on the target main chain, the set of backup chains, and the real-time updated time-varying graph to generate an updated kill chain execution plan.

[0007] In one possible implementation, the construction of the time-varying graph based on the real-time situational data includes: The real-time situational data is analyzed to extract the attribute information of heterogeneous nodes, the correlation and interaction data between heterogeneous nodes, and the preset hard constraint rules for the execution of the kill chain. The node set of the time-varying graph is constructed based on the attribute information of the heterogeneous nodes; The edge set of the time-varying graph is constructed based on the associated interaction data between the heterogeneous nodes; The preset hard constraint rules are encoded into the corresponding attributes of the node set and the edge set to construct the basic framework for the time-varying graph. Based on the dynamic updates of the real-time situational data, the node set, the edge set, and the corresponding constraint codes are updated to generate the time-varying graph that changes in real time with the battlefield situation.

[0008] In one possible implementation, the step of performing a phased search on the time-varying graph based on task requirements to generate a candidate kill chain set including the main chain and backup chains includes: The task requirements are broken down into multiple task stages with sequential dependencies; According to the order of the task stages, based on the capability vectors and roles that heterogeneous nodes can assume in the time-varying graph, heterogeneous nodes that satisfy the capability coverage of the current stage and the dependency relationship of the previous stage are searched in the time-varying graph stage by stage to form a sequence of heterogeneous nodes. For each heterogeneous node sequence obtained through the search, at least one alternative heterogeneous node sequence is configured to generate a candidate kill chain set including the main chain and the alternative chain.

[0009] In one possible implementation, the feasibility screening of the candidate kill chain set, eliminating candidate kill chains that do not meet the hard constraints, to obtain a feasible chain set, includes: Determine the kill chain that matches the requirements of this mission and execute hard constraint verification rules; the hard constraint verification rules include whether the candidate kill chain satisfies the temporal closed-loop constraint from the perception phase to the evaluation phase, whether the communication connectivity between each node in the candidate kill chain satisfies the preset communication constraint, whether the support conditions of the guiding node to the attack node in the candidate kill chain satisfy the preset guiding constraint, and whether the estimated success probability of the candidate kill chain is lower than a threshold. Based on the hard constraint verification rules, a full compliance verification is performed on each candidate kill chain in the candidate kill chain set; Candidate kill chains that fail compliance verification are removed, and all candidate kill chains that pass verification are aggregated to obtain a set of feasible chains.

[0010] In one possible implementation, the step of performing multi-objective collaborative optimization selection on the feasible chain set and outputting a backup chain set and a target main chain includes: Based on the requirements of this task, the evaluation dimensions, weight coefficients, and constraint thresholds for multi-objective collaborative optimization are determined. For each feasible chain in the feasible chain set, a full-dimensional quantitative score is performed based on the evaluation dimensions to obtain a multi-objective comprehensive evaluation result for each feasible chain; Using the multi-objective comprehensive evaluation result as the optimization objective, a preset optimization solution algorithm is used to perform collaborative optimization solution on the feasible chain set; Based on the optimization results, a target main chain that meets the task requirements is determined, and a set of backup chains that are compatible with the target main chain and meet the redundancy and survivability requirements are matched. The set of backup chains and the target main chain are then output.

[0011] In one possible implementation, the layered reconstruction operation includes backup chain switching, partial patching, and full chain reconstruction; The hierarchical reconstruction operation based on the target main chain, the set of backup chains, and the real-time updated time-varying graph specifically includes: If the failed node exists in the backup chain set and there is a replacement node for the corresponding link, then the backup chain switching operation is performed. If the failed node does not exist in the alternative nodes of the backup chain set, and its failure impact is assessed as a local impact, then the local patching operation is performed to search for alternative paths in the candidate kill chain set or the current time-varying graph to replace the affected link segment. If the failed node does not exist in the replacement nodes of the backup chain set, and its failure impact is assessed as a global impact, then the full chain reconstruction operation is triggered.

[0012] In one possible implementation, after outputting the target main chain and backup chain set, the method further includes: Extract the features of the target main chain; the features include node type combinations, constraint satisfaction, and performance indicators. When the hierarchical refactoring operation occurs, the failed node, the cause of failure, and the refactoring strategy adopted are recorded, and the failure mode library and the refactoring experience library are updated.

[0013] Secondly, embodiments of this application disclose a dynamic kill chain construction and reconstruction apparatus, the apparatus comprising: A construction module is used to acquire real-time situational data and construct a time-varying graph based on the real-time situational data; the time-varying graph is used to characterize the connection relationships and multidimensional constraints between heterogeneous nodes. The generation module is used to perform a phased search on the time-varying graph based on task requirements to generate a set of candidate kill chains including the main chain and backup chains. The filtering module is used to perform feasibility filtering on the candidate kill chain set, remove candidate kill chains that do not meet the hard constraints, and obtain a set of feasible chains. The output module is used to perform multi-objective collaborative optimization selection on the set of feasible chains and output the set of backup chains and the target main chain; The update module is used to perform a hierarchical reconstruction operation based on the target main chain, the set of backup chains, and the real-time updated time-varying graph when a node state change is detected and a reconstruction condition is triggered, so as to generate an updated kill chain execution plan.

[0014] In one possible implementation, the construction module is used to parse the real-time situational data, extract attribute information of heterogeneous nodes, correlation and interaction data between heterogeneous nodes, and preset hard constraint rules for kill chain execution; construct a node set of the time-varying graph based on the attribute information of the heterogeneous nodes; construct an edge set of the time-varying graph based on the correlation and interaction data between the heterogeneous nodes; encode the preset hard constraint rules into the corresponding attributes of the node set and the edge set to construct the basic framework of the time-varying graph; and update the node set, the edge set, and the corresponding constraint codes based on the dynamic updates of the real-time situational data to generate the time-varying graph that changes in real time with the battlefield situation.

[0015] In one possible implementation, the generation module is configured to decompose the task requirements into multiple task stages with sequential dependencies; according to the order of the task stages, based on the capability vectors and roles that heterogeneous nodes in the time-varying graph can assume, search for heterogeneous nodes in the time-varying graph stage by stage that satisfy the capability coverage of the current stage and the dependency relationship of the previous stage, forming a heterogeneous node sequence; and configure at least one alternative heterogeneous node sequence for each heterogeneous node sequence obtained through the search, so as to generate a candidate kill chain set including the main chain and the alternative chain.

[0016] In one possible implementation, the filtering module is used to determine kill chains that match the requirements of this mission and apply hard constraint verification rules. The hard constraint verification rules include whether the candidate kill chains satisfy the temporal closed-loop constraints from the perception phase to the evaluation phase, whether the communication connectivity between nodes in the candidate kill chains satisfies preset communication constraints, whether the support conditions of the guiding nodes for the attack nodes in the candidate kill chains satisfy preset guiding constraints, and whether the estimated success probability of the candidate kill chains is lower than a threshold. Based on the hard constraint verification rules, a full compliance verification is performed on each candidate kill chain in the candidate kill chain set. Candidate kill chains that fail the compliance verification are eliminated, and all candidate kill chains that pass the verification are aggregated to obtain a feasible chain set.

[0017] In one possible implementation, the output module is used to determine the evaluation dimensions, weight coefficients, and constraint thresholds for multi-objective collaborative optimization based on the requirements of this task; for each feasible chain in the feasible chain set, perform full-dimensional quantitative scoring based on the evaluation dimensions to obtain the multi-objective comprehensive evaluation result corresponding to each feasible chain; use the multi-objective comprehensive evaluation result as the optimization objective, and use a preset optimization solution algorithm to perform collaborative optimization solution on the feasible chain set; based on the optimization solution result, determine the target main chain that meets the task requirements, and simultaneously match a set of backup chains that are compatible with the target main chain and meet the redundancy and damage resistance requirements, and output the set of backup chains and the target main chain.

[0018] In one possible implementation, the layered reconstruction operation includes backup chain switching, partial patching, and full chain reconstruction; The update module is configured to perform the backup chain switching operation if the failed node exists in the replacement node of the corresponding link in the backup chain set; if the failed node does not exist in the replacement node of the backup chain set and its failure impact is assessed as a local impact, then perform the local patching operation, searching for alternative paths in the candidate kill chain set or the current time-varying graph to replace the affected link segment; if the failed node does not exist in the replacement node of the backup chain set and its failure impact is assessed as a global impact, then trigger the full chain reconstruction operation.

[0019] In one possible implementation, the device further includes a reconstruction module, which is used to extract features of the target main chain after outputting the target main chain and backup chain set; the features include node type combination, constraint satisfaction status and performance indicators; when the hierarchical reconstruction operation occurs, the failed node, failure cause and reconstruction strategy adopted are recorded, and the failure mode library and reconstruction experience library are updated.

[0020] Thirdly, embodiments of this application disclose a control device, including a processor and a memory, wherein the memory is used to store programs, instructions or code, and the processor is used to execute the programs, instructions or code in the memory to complete the dynamic kill chain construction and reconstruction method as described in any of the first aspects.

[0021] Fourthly, embodiments of this application disclose a computer-readable storage medium storing a computer program, which is loaded by a processor to execute the dynamic kill chain construction and reconstruction method as described in any of the first aspects.

[0022] This application provides a method and apparatus for constructing and reconstructing dynamic kill chains. The method acquires real-time situational data and constructs a time-varying graph to characterize the connection relationships and multi-dimensional constraints of heterogeneous nodes. Based on task requirements, a phased search is performed on the time-varying graph to generate a candidate kill chain set containing a main chain and backup chains. Subsequently, a feasibility screening is performed on the candidate kill chain set to eliminate chains that do not meet hard constraints and obtain a feasible chain set. Then, a multi-objective collaborative optimization selection is performed on the feasible chain set to output a backup chain set and a target main chain. Finally, when a node state change is detected and a reconstruction condition is triggered, a hierarchical reconstruction operation is performed based on the target main chain, the backup chain set, and the real-time updated time-varying graph to generate an updated kill chain execution scheme.

[0023] The method provided in this application constructs a time-varying graph based on real-time situational data, which can accurately reflect the relationships and constraints of battlefield nodes and ensure the rationality of kill chain construction. By generating a candidate set with primary and backup chains through phased search and then performing feasibility screening and multi-objective optimization, the target primary chain and its supporting backup chain that meet the constraints and mission requirements can be obtained quickly, improving the efficiency of link generation and mission adaptability. By performing hierarchical reconstruction based on the target primary chain, the backup chain set, and the updated time-varying graph when the reconstruction conditions are triggered, the method can quickly respond to changes in node state, achieve stable and reliable operation of the kill chain, and ensure the continuity and resilience of the kill chain execution process. Attached Figure Description

[0024] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0025] Figure 1 A flowchart illustrating a dynamic kill chain construction and reconstruction method provided in an embodiment of this application; Figure 2This is a schematic diagram of a time-varying pattern provided in an embodiment of this application; Figure 3 A flowchart illustrating a staged search provided in this application embodiment; Figure 4 A flowchart of a phased solution provided in this application embodiment; Figure 5 A flowchart illustrating dynamic reconstruction and rapid recovery is provided as an embodiment of this application; Figure 6 A schematic diagram of an MDP model for a reinforcement learning reconstruction strategy provided in an embodiment of this application; Figure 7 A flowchart illustrating knowledge reinjection and continuous optimization provided in this application embodiment; Figure 8 This is a schematic diagram of a dynamic kill chain construction and reconstruction device provided in an embodiment of this application. Detailed Implementation

[0026] As described above, in highly dynamic and intensely contested informationized combat scenarios, dynamic kill chains need to meet multiple constraints and possess the ability to be rapidly constructed and reconstructed in emergencies. However, existing kill chain planning and construction methods mostly adopt static or semi-dynamic decision-making mechanisms, relying on fixed rules, general search, and conventional optimization. These methods are difficult to adapt to complex constraints and real-time situational changes, and generally suffer from problems such as insufficient constraint handling, poor dynamic survivability, difficulty in achieving real-time performance, and weak decision interpretability. They cannot meet the needs of agile chain construction and rapid reconstruction in actual combat.

[0027] To address this technical problem, embodiments of this application provide a method and apparatus for constructing and reconstructing dynamic kill chains. The method acquires real-time situational data and constructs a time-varying graph to characterize the connection relationships and multi-dimensional constraints of heterogeneous nodes. Based on task requirements, a phased search is performed on this time-varying graph to generate a candidate kill chain set containing a main chain and backup chains. Subsequently, a feasibility screening is performed on the candidate kill chain set to eliminate chains that do not meet hard constraints and obtain a feasible chain set. Then, a multi-objective collaborative optimization selection is performed on the feasible chain set to output a backup chain set and a target main chain. Finally, when a node state change is detected and a reconstruction condition is triggered, a hierarchical reconstruction operation is performed based on the target main chain, the backup chain set, and the real-time updated time-varying graph to generate an updated kill chain execution scheme.

[0028] The method provided in this application constructs a time-varying graph based on real-time situational data, which accurately reflects the relationships and constraints of battlefield nodes, ensuring the rationality of kill chain construction. By generating a candidate set with primary and backup chains through phased search and then performing feasibility screening and multi-objective optimization, a target primary chain and its supporting backup chains that meet the constraints and mission requirements can be quickly obtained, improving the efficiency of chain generation and mission adaptability. By performing hierarchical reconstruction based on the target primary chain, the backup chain set, and the updated time-varying graph when reconstruction conditions are triggered, a rapid response to node state changes can be achieved, ensuring the stable and reliable operation of the kill chain and guaranteeing the continuity and resilience of the kill chain execution process.

[0029] The method provided in this application can be widely applied to real-time combat scenarios involving multi-service coordination and networked heterogeneous equipment across the entire domain. It relies on a distributed combat system composed of various hardware devices such as battlefield awareness radar, unmanned reconnaissance platforms, communication relay nodes, precision-guided strike equipment, and command and control terminals, operating in highly adversarial environments characterized by dense nodes, limited communication, and rapidly changing situations. By accessing real-time status data from various combat terminals, the system rapidly completes the dynamic construction and second-level reconstruction of the kill chain, stably supporting typical combat missions such as forward assault, area containment, and joint strikes. It ensures uninterrupted combat loops and timely response in the event of equipment failure, link interruption, or target movement.

[0030] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present application.

[0031] See Figure 1 , Figure 1 This is a flowchart illustrating a dynamic kill chain construction and reconstruction method provided in an embodiment of this application. The method includes: S101: Acquire real-time situational data and construct a time-varying map based on the real-time situational data.

[0032] The system first collects real-time battlefield situational data across the entire domain through tactical data links, standardized communication interfaces for combat equipment, and data interaction interfaces of the command and control platform. In this embodiment, real-time situational data refers to the full amount of standardized data reflecting the real-time state of the battlefield, collected and synchronously updated in real time through combat equipment, tactical data links, and command and control terminals throughout the entire operational cycle. Real-time situational data includes core information such as the availability status, capability parameters, location information, communication link status, target attribute information, operational rule constraints, and battlefield environment parameters of combat nodes.

[0033] The system performs preprocessing operations on the collected multi-source heterogeneous data, such as data deduplication, outlier filtering, format standardization, and spatiotemporal alignment, to eliminate format differences and spatiotemporal deviations between data from different sources. Subsequently, a list of currently available heterogeneous combat nodes is extracted from the preprocessed situational data; these heterogeneous combat nodes are also referred to as heterogeneous nodes. In this embodiment, heterogeneous nodes refer to all-domain combat units with different combat functions, hardware attributes, and deployment methods, specifically including perception nodes, communication nodes, guidance nodes, strike nodes, assessment nodes, and decision-making nodes. The system simultaneously extracts the capability parameters and operational status of each node, the connectivity relationships between nodes, and the hard constraint rules of this combat mission, providing standardized basic data for graph model construction.

[0034] Based on the extracted standardized basic data, a variation graph is constructed during system building. For example... Figure 2 As shown, Figure 2 This is a schematic diagram of a time-varying graph provided in an embodiment of this application. A time-varying graph refers to a directed graph model based on graph theory, where nodes, edges, and attributes can be dynamically updated with time and battlefield situation. It is the core data carrier that carries battlefield combat resources, node collaboration relationships, and combat constraint rules. The time-varying graph is used to uniformly represent the connectable relationships between heterogeneous combat nodes and the multi-dimensional constraints of kill chain execution. Among these, multi-dimensional constraints refer to all hard rules and restrictions that must be met to complete the full closed-loop execution of the kill chain, such as capability coverage constraints, temporal dependency constraints, communication connectivity constraints, guidance support constraints, resource mutual exclusion constraints, and damage resistance redundancy constraints. During the construction process, the system abstracts each available heterogeneous node as an independent heterogeneous node in the graph model, configures corresponding attribute labels for each heterogeneous node, and stores core attributes such as the node's functional type, capability parameters, availability status, resource reserves, and location information. Meanwhile, the communication links, guidance and support relationships, functional dependencies, and temporal sequences that can be established between heterogeneous nodes are abstracted into directed edges in a graph model. Each edge is configured with a corresponding attribute label, and core attributes such as edge connectivity, transmission latency, communication bandwidth, execution success probability, and constraints are stored, thus completing the basic framework for time-varying graph construction.

[0035] After the basic graph framework is built, the system will explicitly encode the extracted multidimensional constraints into the attributes of the corresponding nodes and edges, so that the graph model can be directly used to verify whether the links meet the operational constraints. At the same time, the system establishes a real-time situation data synchronization update mechanism, continuously collecting the latest situation data according to the preset millisecond time granularity. When changes in node status, changes in link connectivity, or adjustments to constraint rules are detected, the node attributes, edge attributes, and constraint codes in the graph model are updated in real time, so that the graph model always keeps in line with the current battlefield situation and forms a dynamically refreshable time-varying graph.

[0036] To further clarify the construction logic of the time-varying graph and ensure that the graph model can accurately and completely represent the battlefield combat resources, node coordination relationships, and kill chain execution constraints, this application embodiment also refines the steps for constructing the time-varying graph based on real-time situational data. The specific implementation process is as follows: Real-time situational data is analyzed to extract attribute information of heterogeneous nodes, correlation and interaction data between heterogeneous nodes, and preset hard constraint rules for kill chain execution. Based on the attribute information of heterogeneous nodes, a node set for the time-varying graph is constructed, and based on the correlation and interaction data between heterogeneous nodes, an edge set for the time-varying graph is constructed. The preset hard constraint rules are encoded into the corresponding attributes of the node set and edge set, constructing the basic framework of the time-varying graph. Based on the dynamic updates of real-time situational data, the node set, edge set, and corresponding constraint codes are updated to generate a time-varying graph that changes in real time with the battlefield situation.

[0037] In this embodiment, after completing the acquisition and standardized preprocessing of real-time situational data, the system performs deep analysis on the processed full-volume situational data. Through preset feature extraction rules and field matching logic, it extracts three categories of core basic data from the multi-source situational data. The first category is the attribute information of heterogeneous nodes, including core attributes such as the functional type, capability parameters, operating status, resource reserves, deployment location, and roles of various combat nodes like sensing radars, unmanned reconnaissance platforms, and communication relay stations, clarifying the available capability boundaries of each combat node. The second category is the correlation and interaction data between heterogeneous nodes, including the communication link connectivity status, transmission bandwidth and latency, guidance and support matching relationships, functional dependency logic, and timing coordination requirements between nodes, clarifying the boundaries of legally established collaborative connections between nodes. The third category is the preset hard constraint rules for kill chain execution, including timing dependency constraints, capability coverage constraints, communication connectivity constraints, guidance and support constraints, resource mutual exclusion constraints, and damage resistance redundancy constraints corresponding to this combat mission, clarifying the hard rule boundaries that must be followed in the construction of the kill chain.

[0038] After extracting the core data, the system constructs a time-varying graph node set based on the attribute information of heterogeneous nodes. Each available heterogeneous combat node is abstracted as an independent graph node within the node set. A globally unique identifier is assigned to each graph node, and all attribute information, including the node's functional type, capability parameters, and availability status, is stored as attribute tags in standardized key-value pairs, achieving a unified digital representation of heterogeneous combat nodes across the entire battlefield. Building upon this, the system constructs an edge set for the time-varying graph based on the interconnected interaction data between heterogeneous nodes. Communication links, guidance and support relationships, functional dependencies, and temporal coordination relationships that can be established between nodes are abstracted as directed edges between corresponding graph nodes in the node set. A globally unique identifier is assigned to each directed edge, and the corresponding connectivity, transmission parameters, matching relationships, and constraints are stored as attribute tags for the directed edges, fully representing the collaborative interaction logic and connection constraints between nodes.

[0039] After completing the basic construction of the node and edge sets, the system explicitly encodes the extracted preset hard constraint rules into the corresponding attribute labels of the node and edge sets. This allows each hard constraint rule to be validated for compliance through attribute verification of graph nodes and edges, giving the constructed graph model inherent constraint verification capabilities and avoiding the possibility of generating non-compliant kill links at the data foundation level. After completing the basic framework, the system establishes a real-time synchronization update mechanism between situational data and the graph model. It continuously acquires the latest real-time situational data according to a preset millisecond-level acquisition cycle. When dynamic changes are detected in node operating status, link connectivity, or combat constraint rules, the system synchronously updates the corresponding attribute labels and constraint codes in the node and edge sets in real time, ensuring that the graph model always remains consistent with the current battlefield situation. Ultimately, it generates a time-varying graph that can dynamically change with the battlefield situation.

[0040] S102: Based on the task requirements, perform a phased search in the time-varying graph to generate a set of candidate kill chains including the main chain and backup chains.

[0041] The system can receive operational mission requirements issued by commanders through the interactive interface of the command and control platform. Mission requirements refer to the closed-loop execution requirements of the kill chain for a specific operational target, including core strike targets, phase division rules for the operational closed loop, capability thresholds for each phase node, sequential execution logic, and redundancy backup requirements. The system performs structured parsing of the received mission requirements, breaking down unstructured operational instructions into standardized sequential operational phases. In this embodiment, these phases are uniformly broken down into five sequentially connected closed-loop phases: perception, communication, guidance, strike, and effect assessment. The system also clearly defines the functional types, capability requirements, and connectability rules for each phase's corresponding nodes, establishing clear execution boundaries and compliance verification standards for subsequent path searching.

[0042] like Figure 3 As shown, based on the standardized operational phases and compliance verification standards obtained from the analysis, the system performs a phased search operation in the time-varying graph. In this embodiment, the phased search refers to a search method that matches nodes and legally connected edges that meet the requirements in the time-varying graph stage by stage according to the decomposed sequential operational phases, thus completing the progressive generation of paths, which is different from the traditional global indiscriminate path search. In the specific execution process, the system takes the first perception phase as the starting point of the search, and selects perception-type nodes with matching functional types, capability parameters that meet the mission requirements, and current status that are available from the node set of the time-varying graph, as the starting node set of the path. Subsequently, in the second communication phase, based on the edge set of the time-varying graph, communication-type nodes that have legal communication connections with the perception nodes in the starting node set and meet the transmission latency and bandwidth requirements are selected, completing the node matching and path extension of the second phase. Similarly, the system completes the matching and path extension of guidance nodes, attack nodes, and evaluation nodes in the order of the combat phases. During the matching process of each phase, hard constraint rules encoded in the time-varying graph are used to eliminate nodes and connecting edges that do not meet the requirements, thus avoiding the extension and calculation of invalid paths.

[0043] After completing the path search and extension for all phases, the system aggregates all valid paths covering the complete operational loop and generates a candidate kill chain set. In this embodiment, the candidate kill chain set refers to the set of all valid paths covering the entire closed-loop phase of the kill chain and passing the basic constraint verification. The main chain refers to the core path that fully covers the entire operational phase and can independently execute kill missions, while the backup chain refers to a redundant path whose execution logic matches the corresponding main chain and which has alternative solutions configured for key nodes in the main chain for the same phase. Specifically, during the generation process, the system identifies each valid path with a complete closed loop as a main chain. Simultaneously, for each core node in each phase of the main chain, it searches for replaceable nodes within the same phase that meet the same constraint requirements, generating corresponding redundant backup chains to ensure that each main chain is configured with at least one matching backup chain. Finally, the system aggregates all identified main chains and corresponding backup chains to form a complete candidate kill chain set, providing basic data for subsequent feasibility screening and optimization.

[0044] This application employs a phased search approach, matching nodes and filtering invalid paths stage by stage according to the sequential execution phases of the kill chain. Compared to the traditional global indiscriminate search method, this significantly reduces the computational load and effectively improves the generation efficiency of candidate kill chains. It can quickly generate all candidate chains, meeting the real-time requirements of practical scenarios. Simultaneously, compliance filtering is performed based on constraint rules in the time-varying graph during the phased search process, ensuring that all generated candidate kill chains meet basic operational constraints, reducing the generation of non-compliant and invalid links from the source. Furthermore, during candidate chain generation, a backup chain is configured for the main chain, completing the planning of redundant backup paths in advance. This not only provides more compliant alternatives for subsequent optimization but also lays a solid foundation for rapid reconstruction in unexpected abnormal scenarios, effectively improving the resilience and redundancy of the kill chain solution.

[0045] To further clarify the generation logic of candidate kill chains, improve the execution efficiency and compliance of path search, and ensure that the generated kill chains are naturally adapted to task timing requirements and redundancy and survivability needs, this application embodiment also refines the steps of performing a phased search based on task requirements in the time-varying graph to generate a set of candidate kill chains including the main chain and backup chains. The specific implementation process is as follows: The task requirements are decomposed into multiple task stages with sequential dependencies. Following the order of the task stages, and based on the capability vectors and roles that heterogeneous nodes can assume in the time-varying graph, heterogeneous nodes that satisfy the capability coverage of the current stage and the dependency relationship of the previous stage are searched in the time-varying graph stage by stage, forming a heterogeneous node sequence. For each heterogeneous node sequence obtained through the search, at least one alternative heterogeneous node sequence is configured to generate a candidate kill chain set including the main chain and the alternative chains.

[0046] After receiving the operational mission requirements from the command center, the system performs structured analysis and standardized decomposition of the mission requirements, clarifies the core strike targets, execution boundaries, capability thresholds and timing execution rules of the mission, and then decomposes the complete operational mission requirements into multiple mission stages with strict sequential dependencies.

[0047] After decomposing and defining the rules for each task phase, the system performs a progressive path search in the time-varying graph according to the sequence of task phases. Specifically, starting with the first task phase, the system filters out heterogeneous nodes from the node set of the time-varying graph that match the functional type, whose capability vectors meet the capability coverage requirements of the current phase, whose operational status is available, and who can undertake the corresponding task role, forming a candidate node set for the current phase. Then, moving to the next task phase, based on the node relationships and dependency rules encoded in the time-varying graph, the system filters out heterogeneous nodes that have a legal connection to the candidate nodes of the previous phase, meet the inter-phase dependency requirements, and simultaneously meet the capability and role requirements of the current phase, completing node matching and path extension for the current phase. This process continues, with the system progressively filtering nodes and advancing paths according to the sequence of task phases until all task phases are covered, forming multiple complete heterogeneous node sequences that cover the entire task loop and meet the phase sequence dependency requirements. Each complete heterogeneous node sequence is a basic link capable of independently executing a kill task.

[0048] After completing the search and generation of all heterogeneous node sequences, the system configures at least one alternative heterogeneous node sequence for each heterogeneous node sequence obtained through the full-stage search, completing the labeling and matching of the main chain and backup chains. In this embodiment, the system labels the complete heterogeneous node sequence obtained from the original search as the main chain. For the core nodes of each task stage of the main chain, it searches for alternative heterogeneous nodes in the time-varying graph that meet the same capability requirements, role matching rules, and can establish legal connections with nodes in adjacent stages. After replacing the nodes in the corresponding stage of the main chain, alternative heterogeneous node sequences that are consistent with the execution goal of the main chain and have the ability to replace redundant nodes are generated, i.e., backup chains that match the main chain. The system ensures that each main chain is configured with at least one matching backup chain. Finally, the system summarizes and integrates all the labeled main chains and corresponding backup chains to form a candidate kill chain set containing the main chain and corresponding backup chains, providing complete basic link data for subsequent feasibility screening and multi-objective optimization selection.

[0049] S103: Perform feasibility screening on the candidate kill chain set, eliminate candidate kill chains that do not meet the hard constraints, and obtain the feasible chain set.

[0050] After acquiring the candidate kill chain set, including the main chain and corresponding backup chains, the system first retrieves the hard constraint rules for kill chain execution from the pre-existing operational knowledge base, as well as the hard indicator thresholds corresponding to the requirements of this operational mission, to determine the unified verification benchmark for this feasibility screening. Feasibility screening refers to a pre-filtering operation that performs compliance verification and eliminates invalid links that do not meet the requirements for each link in the candidate kill chain set, based on inviolable hard operational rules. Hard constraints refer to mandatory compliance rules that must be met to complete the actual execution of the kill chain, with no room for flexible adjustment, as opposed to soft optimization goals that can be optimized and adjusted. These constraints specifically include five categories: closed-loop integrity constraints, temporal dependency constraints, communication connectivity constraints, guidance support constraints, and mission performance baseline constraints. Simultaneously, the system synchronizes and aligns this verification benchmark with the constraint rules encoded in the time-varying graph, ensuring that the screening rules are consistent with the constraint encoding of the graph model, and avoiding invalid calculations caused by inconsistent verification standards.

[0051] After determining the verification benchmark, the system performs multi-dimensional progressive hard constraint verification on each candidate kill chain in the candidate kill chain set. Upon completion of verification for each dimension, candidate kill chains that do not meet the constraints of that dimension are eliminated and do not proceed to subsequent dimensions, thereby reducing unnecessary computational overhead. After completing the full-dimensional progressive verification, the system collects all candidate kill chains that have passed all hard constraint verifications, deduplicates redundant chains, and retains the matching relationship between each main chain and its corresponding backup chain, ultimately forming a feasible chain set. In this embodiment, the feasible chain set refers to the collection of all kill chains that conform to operational hard constraint rules and are executable. It serves as the foundational data pool for subsequent multi-target collaborative optimization selection. All chains entering the feasible chain set meet the minimum compliance requirements for actual combat execution and do not have any fundamental compliance defects.

[0052] This application embodiment uses a multi-dimensional, progressive feasibility screening process to eliminate invalid links before multi-objective optimization, thereby reducing the amount of computational data required for subsequent optimization steps, lowering the computational overhead of optimization, and effectively improving the overall generation efficiency of kill chain schemes.

[0053] To further standardize the compliance verification logic of candidate kill chains, eliminate invalid chains that do not meet the hard requirements of actual combat in advance, reduce the computational overhead of subsequent multi-target optimization, and ensure that the final output kill chain solution has a compliant basis for implementation, this application embodiment also refines the steps of performing feasibility screening on the candidate kill chain set, eliminating candidate kill chains that do not meet hard constraints, and obtaining a set of feasible chains. The specific implementation process is as follows: Determine the kill chain that matches the requirements of this mission and apply hard constraint verification rules. The hard constraint verification rules include whether the candidate kill chain satisfies the temporal closed-loop constraint from the perception phase to the evaluation phase, whether the communication connectivity between nodes in the candidate kill chain satisfies the preset communication constraint, whether the support conditions of the guiding node to the strike node in the candidate kill chain satisfy the preset guiding constraint, and whether the estimated success probability of the candidate kill chain is lower than a threshold.

[0054] Based on hard constraint verification rules, a full compliance verification is performed on each candidate kill chain in the candidate kill chain set. Candidate kill chains that fail the compliance verification are removed, and all candidate kill chains that pass the verification are aggregated to obtain the feasible chain set.

[0055] After acquiring the candidate kill chain set, the system, in conjunction with the core requirements of this operational mission, the standardized operational execution specifications pre-stored in the operational rule base, and the constraints encoded in the time-varying graph, determines the hard constraint verification rules for kill chain execution that precisely match this mission. The hard constraint verification rules are mandatory compliance requirements that the kill chain must meet in actual combat execution, with no room for flexible adjustment. The hard constraint verification rules include four verification dimensions. The first is the time-series closed-loop constraint, used to verify whether the candidate kill chain fully covers the entire sequential operational phase from target perception, information transmission, guidance and locking, fire strike to effect evaluation, and whether it meets the requirement that the order of dependencies between phases cannot be reversed. The second is the communication constraint, used to verify whether the connectivity, transmission latency, and communication bandwidth of the communication links between adjacent heterogeneous nodes in the candidate kill chain meet the preset actual combat transmission requirements. The third is the guidance constraint, used to verify whether the guidance accuracy, operating frequency band, and locking capability of the guidance nodes in the candidate kill chain meet the support conditions for the corresponding strike nodes, ensuring a precise match between guidance and strike capabilities. The fourth is the task success rate threshold constraint, which is used to verify whether the estimated success probability of the entire candidate kill chain is not lower than the preset hard threshold, and to eliminate chains that do not meet the execution reliability standards.

[0056] After determining the hard constraint verification rules, the system uses this unified verification benchmark to perform full and multi-dimensional compliance verification on each candidate kill chain in the candidate kill chain set, including each main chain and its corresponding backup chain. In this embodiment, the system adopts a multi-threaded parallel verification mode to perform batch verification operations to adapt to the computing power conditions of battlefield edge computing devices and shorten the verification time. During the verification process, the system synchronously retrieves real-time attribute data of nodes and edges in the time-varying graph to ensure that the node status, link connectivity, and capability parameters used for verification are consistent with the current real-time battlefield situation, avoiding result deviations caused by static verification. At the same time, the system sets strict verification rules. Only when all candidate kill chains pass the hard constraint verification in the four dimensions can they be determined as compliant links. If any verification dimension fails to meet the requirements, it is determined as an invalid link that has failed the compliance verification.

[0057] After completing the compliance verification of all candidate kill chains, the system summarizes and statistically analyzes all verification results, accurately locates and completely eliminates all candidate kill chains that fail the compliance verification, and these are no longer included in subsequent processing stages. For all compliant candidate kill chains that pass the hard constraint verification across the four dimensions, the system first deduplicates redundant links while fully preserving the matching relationship between the main chain and its corresponding backup chain to avoid confusion in the correspondence between the main and backup chains. Finally, all compliant links are summarized and integrated to obtain a feasible chain set. In this embodiment, all kill chains within the feasible chain set have met the minimum compliance requirements for practical execution and do not have any fundamental execution defects, providing a clean, compliant, and implementable basic data pool for subsequent multi-objective collaborative optimization selection steps.

[0058] S104: Perform multi-objective collaborative optimization selection on the feasible chain set, and output the backup chain set and the target main chain.

[0059] The system acquires a set of feasible chains. This set refers to a collection of kill chains that have passed hard constraint compliance checks, have no fundamental execution flaws, and possess a basis for practical application. It includes multiple main chains capable of independently executing combat missions and corresponding backup chains. The system simultaneously analyzes the core requirements and execution priorities of this combat mission, determining the core rules for multi-objective collaborative optimization selection. In this embodiment, multi-objective collaborative optimization selection refers to a decision-making process that, for links within the feasible chain set, takes multiple interrelated and mutually constraining combat objectives as optimization directions, conducting a comprehensive quantitative assessment and finding the global optimal solution. This differs from traditional single-objective optimization models and can simultaneously consider multiple core performance indicators during kill chain execution.

[0060] The system determines the evaluation dimensions, corresponding weight coefficients, and qualification thresholds for optimization based on task priority. In this embodiment, the core evaluation dimensions include the kill chain closed-loop execution time, the estimated mission execution success rate, the end-to-end damage robustness, and the operational resource utilization rate. For emergency mobile target strike missions, the system assigns the highest weight to the closed-loop execution time; for high-value fixed target strike missions, the system assigns the highest weight to the mission execution success rate, ensuring that the optimization direction is fully matched with the core requirements of the mission.

[0061] After determining the optimization rules and evaluation system, the system performs a full-dimensional quantitative scoring calculation for each kill chain in the feasible chain set, including all main chains and their corresponding backup chains. During the scoring process, the system simultaneously retrieves real-time attribute data of nodes and edges in the time-varying graph to ensure that the node capabilities, link status, latency parameters, success probabilities, and other data used for scoring are completely consistent with the current real-time battlefield situation, avoiding result deviations caused by static scoring.

[0062] After completing the quantitative evaluation of all feasible chains, the system uses the multi-objective comprehensive evaluation score as the core basis and employs a pre-set constraint programming combined with a local search optimization algorithm to perform collaborative optimization on the feasible chain set, completing the comprehensive ranking of feasible chains and the selection of the optimal solution. The system marks the kill chain with the highest comprehensive evaluation score and that perfectly matches the mission execution priority as the target main chain to be executed first in this combat mission. In this embodiment, the target main chain refers to the core kill chain that is executed by default in this combat mission and has the best comprehensive execution efficiency. At the same time, for the marked target main chain, the system selects backup chains from the feasible chain set that are consistent with the execution objectives of the target main chain, have the ability to replace key nodes with redundancy, and whose comprehensive evaluation scores meet the preset qualified threshold, and matches them to form a backup chain set that corresponds one-to-one with the target main chain. In this embodiment, the backup chain set refers to the set of emergency replacement links when the target main chain experiences a sudden anomaly. The system ensures that the backup chain set includes at least two backup chains that can seamlessly connect to the mission execution, ensuring the continuity of the combat mission. Finally, the system will synchronously output the calibrated target main chain and the corresponding backup chain set to the command and control platform, completing the optimized selection of the kill chain and the output of the solution.

[0063] To further achieve the optimal global match between operational effectiveness and mission requirements based on a compliant and feasible kill chain, while ensuring the redundancy and survivability of the operational plan and its adaptability to actual combat, this application embodiment further refines the steps of multi-target collaborative optimization selection of the feasible chain set and outputting the backup chain set and the target main chain. The specific implementation process is as follows: like Figure 4As shown, based on the requirements of this task, the evaluation dimensions, weight coefficients, and constraint thresholds for multi-objective collaborative optimization are determined. For each feasible chain in the feasible chain set, a full-dimensional quantitative score is performed based on the evaluation dimensions to obtain the multi-objective comprehensive evaluation result for each feasible chain. The evaluation dimensions include, for example, loop closure time, success probability, robustness, communication cost, and switching cost. Using the multi-objective comprehensive evaluation result as the optimization objective, a preset optimization algorithm is used to collaboratively optimize the feasible chain set. The preset optimization algorithm is, for example, Mixed Integer Programming (MIP) combined with Lagrange relaxation algorithm, or Cyclic Prefix (CP) combined with local search algorithm. Based on the optimization results, the target main chain that meets the task requirements is determined, and a set of backup chains that are compatible with the target main chain and meet the redundancy and resilience requirements is matched. The backup chain set and the target main chain are then output.

[0064] After acquiring the set of feasible chains, the system analyzes the core objectives, execution priorities, and operational boundary requirements of the current combat mission. Combining this with pre-stored operational effectiveness evaluation specifications, it determines the evaluation dimensions for multi-objective collaborative optimization, the corresponding weight coefficients for each dimension, and the insurmountable constraint thresholds. In this embodiment, the evaluation dimensions are set around the core effectiveness indicators of the kill chain's operational execution, specifically including the kill chain's full closed-loop execution time, the estimated mission execution success rate, the end-to-end robustness, and the operational resource utilization rate. These dimensions can be flexibly increased or decreased according to the mission type. The weight coefficients are strongly tied to the core requirements of the mission. For missions targeting urgent mobile targets, the highest weight is assigned to the full closed-loop execution time; for missions targeting high-value fixed targets, the highest weight is assigned to the mission execution success rate; and for continuous combat missions in highly contested environments, the highest weight is assigned to the end-to-end robustness. The constraint thresholds are aligned with the hard constraint verification rules, setting minimum passing lines for each evaluation dimension to ensure that the optimization process never exceeds the bottom-line requirements of operational execution.

[0065] After completing the construction of the optimized evaluation system, the system performs full-dimensional quantitative scoring on each feasible chain in the feasible chain set, including each main chain and its corresponding backup chains, based on determined evaluation dimensions. During the scoring process, the system synchronously retrieves real-time attribute data of nodes and edges in the time-varying graph to ensure that the basic data used for scoring, such as node capability parameters, link transmission indicators, and execution success probabilities, are completely consistent with the current real-time battlefield situation, avoiding result deviations caused by static scoring. In specific execution, the system obtains a single-dimensional standardized score for each evaluation dimension through a standardized calculation model, eliminating the differences in the dimensions of different dimensions. Then, it combines the preset weight coefficients to perform a weighted summation of the scores for each single dimension, ultimately obtaining the multi-objective comprehensive evaluation result corresponding to each feasible chain, completing the preliminary preparation for the quantitative evaluation and ranking of all feasible chains.

[0066] After completing the quantitative evaluation of all feasible chains, the system uses the multi-objective comprehensive evaluation results as the core optimization objective. It employs a pre-defined optimization algorithm to collaboratively optimize the feasible chain set. In this embodiment, a constraint planning algorithm adapted to battlefield edge computing power combined with a local search algorithm is used, significantly reducing computation time while ensuring solution accuracy and meeting the real-time requirements of actual combat scenarios. Based on the final optimization results, the system identifies the feasible chain with the best comprehensive evaluation and that perfectly matches the core requirements and priority of the mission as the primary target chain for this combat mission. Simultaneously, for the identified primary target chain, feasible chains that align with the execution objectives of the primary target chain, possess critical node redundancy replacement capabilities, and whose comprehensive evaluation results meet pre-defined constraint thresholds are selected from the feasible chain set. These are matched to form a backup chain set that meets redundancy and anti-destruction requirements, ensuring that the backup chain set can seamlessly take over the combat mission when the primary target chain malfunctions. Finally, the system synchronously outputs the identified primary target chain and the corresponding backup chain set to the command and control platform, completing the optimization decision and scheme output for the kill chain.

[0067] To further enhance the reusability of kill chain construction and the rapid response capability of reconstruction, and to accumulate practical experience to optimize subsequent combat decisions, this embodiment of the application adds related operations for chain template storage and experience base updates after outputting the target main chain and backup chain sets. The specific implementation process is as follows: Extract the features of the target main chain. When the hierarchical reconstruction operation occurs, record the failed node, the cause of failure, and the reconstruction strategy adopted, and update the failure mode library and the reconstruction experience library.

[0068] After outputting the target main chain and backup chain sets, the system performs feature extraction on the target main chain to ensure that the extracted features fully reflect the core attributes and execution characteristics of the target main chain, providing accurate feature support for subsequent link reuse. Specifically, the features extracted by the system mainly include node type combination features, constraint satisfaction features, and performance index features. Node type combination features refer to the heterogeneous node function types, number of nodes, and combination order corresponding to each task stage in the target main chain, clarifying the core component structure of the link. Constraint satisfaction features refer to the specific satisfaction status of the target main chain for each hard constraint verification rule, constraint adaptability, and execution boundaries of key constraints. Performance index features refer to the specific values ​​of core performance parameters such as the full closed-loop execution time of the target main chain, the estimated task execution success rate, damage resistance robustness, and resource utilization rate. After extraction, the system organizes and encodes these features according to a preset standardized format and stores them in a preset chain template library. The chain template library adopts a classified storage mechanism, which can classify and archive templates according to combat mission type and node combination mode, facilitating rapid retrieval and reuse in subsequent similar mission scenarios and reducing the computational overhead of repeatedly building links.

[0069] After completing the target main chain feature storage, the system establishes a real-time recording and updating mechanism for failure modes and reconstruction experience. This is used to accumulate experience in handling anomalies in practice and optimize the decision-making efficiency and accuracy of subsequent layered reconstructions. Specifically, when a node state change is detected and triggers a layered reconstruction operation, the system will simultaneously record the information of the failed node, the cause of failure, and the reconstruction strategy adopted for this reconstruction event. The information of the failed node includes the functional type, location, capability parameters, and role of the failed node in the target main chain. The cause of failure is used to clarify whether the node failure was caused by specific factors such as hardware failure, link interruption, enemy interference, or resource exhaustion. The reconstruction strategy adopted includes key information such as the backup chain selected during the reconstruction process, the node replacement scheme, the link adjustment logic, and the reconstruction completion time.

[0070] After recording, the system organizes and updates the failure node and failure cause information to the failure mode library, establishing a correspondence between failure modes and response directions. Simultaneously, it adds the refactoring strategy and its effects to the refactoring experience library, forming standardized refactoring experience templates. Through these operations, the chain template library can continuously accumulate high-quality kill chain templates adapted to different mission scenarios. When encountering similar combat missions in the future, these templates can be directly invoked to quickly generate candidate kill chains, significantly shortening the chain construction time.

[0071] S105: When a node state change is detected and a reconstruction condition is triggered, a hierarchical reconstruction operation is performed based on the target main chain, the set of backup chains, and the real-time updated time-varying graph to generate an updated kill chain execution plan.

[0072] like Figure 5 As shown, after outputting the target main chain and backup chain sets, the system continuously monitors the online status, communication connectivity, capability parameters, and operational health of each heterogeneous node in real time through battlefield awareness terminals, data chains, and node self-check information to determine whether there are status changes such as node failure, link interruption, or capability degradation. When the degree of node status change reaches a preset threshold, or the target main chain can no longer perform its tasks normally, it is determined that the reconstruction trigger condition is met, and the kill chain layered reconstruction process is initiated. The layered reconstruction mentioned here refers to carrying out link recovery in stages according to the scope of the anomaly's impact and the difficulty of repair. Priority is given to direct switching within the backup chain set, followed by partial replacement within nodes of the same stage, and finally a re-search across the entire map, thereby achieving a graded rapid response under anomalies of different intensities.

[0073] After initiating reconstruction, the system loads the latest updated time-varying graph to ensure that the nodes, links, and constraints used in the reconstruction are consistent with the real-time battlefield situation. It then retrieves the determined target main chain structure and its corresponding set of backup chains, and performs layered reconstruction based on the original main-backup chain relationship. The first layer is the direct backup chain replacement layer. If a failed node does not affect the overall structure and the backup chain is available, the backup chain with the highest matching degree and best performance is directly selected from the backup chain set to replace the original target main chain, quickly restoring the closed loop without modifying the node sequence. The second layer is the local node replacement layer. If the backup chain is unavailable or also affected, alternative nodes that meet the capability, connectivity, and constraint requirements are searched within the nodes of the same stage in the time-varying graph. Only failed nodes are replaced, maintaining the overall structure of the main chain unchanged. The third layer is the local path replanning layer. If local replacement still cannot meet the requirements, a small-scale path research is performed within the affected stage and adjacent stages to form a corrected new kill chain sequence.

[0074] After completing the reconstruction calculations at the corresponding level, the system performs a brief feasibility check on the newly generated kill chain to ensure it meets hard constraints such as timing, communication, guidance, and success rate, thus avoiding unexecutability issues after reconstruction. Once the check passes, the updated node sequence, execution logic, and master-slave relationship are integrated to form the final updated kill chain execution plan, which is then distributed to each combat node and command terminal to achieve uninterrupted execution of combat missions.

[0075] To further clarify the specific execution logic of layered reconstruction, achieve accurate response and rapid recovery under different failure scenarios, and balance reconstruction efficiency with operational continuity, this application embodiment also refines the specific implementation process of layered reconstruction operations, clarifying the triggering conditions and execution methods of three operations: backup chain switching, partial repair, and full chain reconstruction. The specific implementation process is as follows: If the failed node exists in the standby chain set and there is a replacement node for the corresponding link, then a standby chain switching operation is performed. If the failed node does not exist in the standby chain set and its failure impact is assessed as a local impact, then a local patching operation is performed, searching for alternative paths in the candidate kill chain set or the current time-varying graph to replace the affected link segment. If the failed node does not exist in the standby chain set and its failure impact is assessed as a global impact, then a full chain reconstruction operation is triggered.

[0076] After detecting changes in node status and triggering reconstruction conditions, the system loads a real-time updated time-varying graph, synchronously retrieves the target main chain, backup chain set, and candidate kill chain set, and conducts a comprehensive analysis of relevant information of the failed node, including the functional type of the failed node, its position in the target main chain, the degree of failure, and the scope of the failure's impact on the target main chain's closed-loop execution, thus completing the failure impact assessment and providing a basis for subsequent selection of corresponding layered reconstruction operations.

[0077] The layered reconstruction operation includes backup chain switching, partial repair, and full chain reconstruction. The three modes are arranged in order of response speed from fast to slow, computational overhead from small to large, and impact range from local to global, corresponding to different levels of node failure scenarios.

[0078] If, after system evaluation, it is found that the failed node exists within the replacement node of the corresponding link in the backup chain set—meaning that the backup chain set has already planned a node that can directly replace the failed node, and the corresponding backup chain is complete, usable, and meets the current battlefield situation and hard constraints—then the backup chain switching operation will be performed first. Specifically, the system directly selects the backup chain with the highest compatibility and best performance with the target main chain from the backup chain set, and which can avoid the failed node. This backup chain is then switched to the new target main chain. At the same time, the backup chain set is updated to add new redundant backup chains. The entire process does not require significant adjustments to the link structure; simply replacing the main chain is sufficient to quickly restore the kill chain closed-loop execution, minimizing reconstruction time and achieving second-level emergency response.

[0079] If, after system evaluation, it is found that the failed node does not exist among the alternative nodes in the backup chain set, and the failure impact analysis determines that its impact is localized—meaning it only affects a segment of the target main chain or a single task stage, without affecting the entire kill chain loop and the normal execution of other stages—then a local repair operation is performed. Specifically, the system prioritizes searching the candidate kill chain set for alternative paths that match the structure of the affected link segment and meet the hard constraints. If no suitable alternative path exists in the candidate kill chain set, then based on the currently updated time-varying graph, it quickly searches for alternative nodes and connecting links that meet the capability requirements and constraints within the affected stage and adjacent related stages. Only the affected link segment is replaced and repaired, maintaining the overall structure of the target main chain unchanged. This ensures the reconstruction effect while reducing computational overhead and avoiding unnecessary full-chain adjustments.

[0080] If, after system evaluation, it is found that the failed node does not exist in the replacement nodes of the backup chain set, and the failure impact analysis determines that its failure impact is a global impact—meaning the failed node is a core critical node of the target main chain, and its failure will cause the entire kill chain loop to break, multiple task stages to fail to execute normally, or the failure scope covers the entire link and cannot be restored to a closed loop through local adjustments—then a full-chain reconstruction operation is triggered. Specifically, based on the currently updated time-varying graph, the system re-executes steps S102 to S104, that is, based on task requirements, it re-performs phased searches, feasibility screening, and multi-target collaborative optimization selection, generating a brand-new target main chain and backup chain set. While completing the full-chain reconstruction, the chain template library, failure mode library, and reconstruction experience library are updated simultaneously to ensure that the newly generated kill chain execution plan is fully adapted to the current battlefield situation, ensuring that the combat mission can continue to advance without interruption.

[0081] To further enhance the interpretability and transparency of system decision-making, help researchers and analysts clarify the logic of link selection, and support commanders in making scientific operational decisions quickly, this application embodiment also refines the specific implementation process, interpretation content, and output format of the auxiliary decision-making module. It relies on a large model to complete multi-dimensional and accurate interpretation, and uses visualization charts to improve information transmission efficiency. The specific implementation process is as follows.

[0082] In this embodiment, the decision support module serves as the core support module of the system. It synchronously acquires core data from each stage of the system, including node attributes and link parameters of the time-varying graph, quantitative scoring results of the feasible chain set, detailed information on the target main chain and backup chain sets, failure simulation data, and reconstruction process records. This provides comprehensive and accurate data support for subsequent multi-dimensional interpretation. Simultaneously, the module is equipped with a dedicated large-scale model adapted to the operational domain. It pre-imports operational knowledge bases, constraint rule bases, and historical decision data to complete the training and adaptation of the interpretation logic. This ensures that the output interpretation content conforms to professional operational standards while being easily understandable, catering to the different reading needs of research analysts and commanders.

[0083] After the module starts, it first completes data synchronization and preprocessing, classifying, deduplicating, and verifying the retrieved multi-source data to ensure accuracy and consistency. Then, relying on the reasoning capabilities of the large model, it conducts in-depth analysis and natural language generation dimension by dimension. Regarding chain selection explanation, the module compares the target main chain with other candidate chains in terms of multi-objective comprehensive scores and performance parameters across various dimensions, clearly explaining the core reasons for selecting the target main chain and highlighting its outstanding advantages in real-time performance, success rate, and resource consumption. It also briefly explains the shortcomings of other candidate chains, making the decision-making logic traceable. Regarding trade-off analysis, the module, in conjunction with the priority weighting configuration of this operational mission, interprets the balance logic between the system's three core indicators: closed-loop time, execution success rate, and link robustness. It clarifies the trade-off strategy of "prioritizing core needs while considering secondary indicators," making indicator choices easier to understand.

[0084] For bottleneck analysis, the module uses a large model to deeply mine link data, accurately locating bottleneck nodes and critical edges of the current target main chain and system. It clarifies the functional type, current operating status, and impact on link performance of bottleneck nodes, and marks the core shortcomings of critical edges, such as connectivity and transmission parameters, providing clear direction for subsequent optimization and adjustments. For robustness assessment, the module quantifies the resilience of the current link based on node failure simulation data, backup link adaptability, and reconstruction response time, predicting the recovery probability and recovery time after different node failures, allowing command personnel to clearly understand the stability of the link. For alternative solutions, the module selects highly adaptable alternative links that meet hard constraints from the backup link set and feasible link set, detailing the core performance parameters and applicable scenarios of each alternative solution, providing command personnel with diverse emergency options.

[0085] The module can input natural language explanations and visualizations, ensuring intuitive and efficient information delivery. Both the explanations and visualizations are simultaneously pushed to the command and control terminal and the research and analysis platform, providing two-way support and fully leveraging the module's value in assisting decision-making.

[0086] To further enhance the intelligence level of decision-making in hierarchical reconstruction operations and achieve autonomous optimization and rapid response of reconstruction strategies, this application also provides a Markov Decision Process (MDP) model for reconstruction strategies based on reinforcement learning. The architecture, functions of each module, and operation flow of this model are described in detail with reference to the accompanying drawings. Figure 6 As shown, the details are as follows: The reinforcement learning reconstruction strategy MDP model adopts a hierarchical closed-loop architecture. It takes the real-time battlefield situation of the dynamic kill chain as input and the optimal reconstruction execution strategy as output. The core is divided into six major modules: situation awareness layer, state space layer, reward function layer, strategy iteration layer, reconstruction execution layer and experience feedback layer. The modules are deeply linked through data flow to form a complete closed loop of perception, decision-making, execution and optimization, providing intelligent decision support for hierarchical reconstruction of the kill chain.

[0087] The top layer of the model consists of the state space and the dynamic space, which form the model's input perception layer. The state space is responsible for collecting real-time situational data during the kill chain execution process, including the current state of each node / edge, link connectivity quality, available resources, communication status, mission execution progress, and historical reconstruction counts—basic situational information. The dynamic space is responsible for collecting constraint and requirement data related to the combat mission, including mission phase execution, overall single / multi-node activation, resource redundancy, and reconstruction strategies—mission constraint information. After aggregating the data from both spaces, environmental changes are detected, node states are updated, and new states are calculated sequentially to generate a standardized MDP state for the current moment. This provides accurate state input for subsequent decision-making, corresponding to the core flow logic in the purple area of ​​the attached diagram.

[0088] The new state S output from the state space tThe data is input to the reward function module, which is the core evaluation benchmark for model decision-making. This module quantifies and scores the execution effect of reconstruction actions through a multi-dimensional reward function. In this embodiment, the reward function includes five core dimensions: delay time reward (rat×ΔT_time), success rate reward (rat×ΔP_succ), robustness enhancement (rat×ΔR_obust), reconstruction cost reduction (rat×C_reconstruct), and failure penalty (adj×penalty). The system calculates the reward value in real time based on the current state and the executed reconstruction action, providing a clear optimization direction for strategy optimization and ensuring that reconstruction actions always iterate towards "improving kill chain efficiency and reducing reconstruction cost."

[0089] The reward value output by the reward function is input into the MDP process module to complete the core modeling of the Markov decision process. Subsequently, through reinforcement learning algorithms such as Q-Learning / PolicyGradient, policy iteration and gradient optimization are performed to output the optimal set of reconstruction actions in the current state. The optimal policy is then input into the optimal policy module, which is responsible for classifying and decomposing the optimal policy into three types of operations corresponding to hierarchical reconstruction: parallel / sequential reconstruction, parallel / selective reconstruction type, parallel / switching of backup chains, and parallel / execution of local patching. This ensures that the reconstruction actions and hierarchical reconstruction logic are accurately matched, and that the policy output is fully adapted to different failure scenarios.

[0090] After the strategy is decomposed, it is input into the experience pool module to execute online inference, real-time decision-making, and rapid response processes. This completes the real-time output and execution of reconstruction actions, enabling rapid hierarchical reconstruction of the kill chain. After reconstruction is completed, the process enters the feedback loop module. The system records the execution results, updates the battlefield state, and feeds the new state, actions, and reward data back to the MDP model. Simultaneously, it forms a phased optimization strategy, continuously iterating and optimizing the model's policy network. This completes the update of the experience pool and the autonomous evolution of the model, forming a complete closed-loop learning mechanism. This allows the model to continuously accumulate reconstruction experience in actual combat, gradually improving the accuracy and response speed of reconstruction decisions.

[0091] This MDP model solves the problem that traditional reconstruction strategies rely on fixed rules and cannot adapt to complex and dynamic battlefields by deeply integrating reinforcement learning and hierarchical reconstruction. It can learn the optimal reconstruction strategy autonomously according to the real-time situation, and continuously optimize the reconstruction effect while ensuring reconstruction efficiency. This further enhances the intelligent reconstruction capability and practical adaptability of the dynamic kill chain in highly dynamic and highly confrontational environments.

[0092] To further achieve closed-loop iteration of kill chain construction and reconstruction capabilities, and to transform historical combat experience into reusable system capabilities, continuously improving chain construction efficiency, reconstruction response speed, and mission success rate, this application also provides a knowledge reinjection and continuous optimization module. The architecture, operation process, and implementation effects of this module are described in detail with reference to the accompanying drawings. Figure 7 As shown.

[0093] In this embodiment, the knowledge reinjection and continuous optimization module takes the execution data of the entire lifecycle of the kill chain as input. Through a complete closed loop of execution collection, case diversion, knowledge base update, knowledge generalization, continuous optimization and effect feedback, it transforms scattered combat experience into standardized and reusable system knowledge, realizing the autonomous iterative upgrade of system capabilities. The overall architecture of the module corresponds to the layered flow logic in the attached figure.

[0094] The module begins with the execution phase. During the execution of the chain-building scheme, the system continuously monitors the entire process, recording key events, node status, and link performance, providing raw data support for subsequent knowledge accumulation. After execution, the system categorizes cases into two types based on the results: successful cases and failed cases. For scenarios where the chain is successfully built, the system extracts the chain's core features, including node combinations, constraint satisfaction, and performance metrics, and then calculates key performance parameters such as loop closure time, execution success rate, and robustness, forming standardized successful case data. Failed cases are for scenarios where chain construction fails or triggers refactoring. The system analyzes the core reasons for failure, such as constraint conflicts and insufficient performance, identifies the corresponding failure modes, including node type and failure type, forming standardized failed case data.

[0095] After aggregating the data from both types of cases, the knowledge base is updated simultaneously, completing precise updates to the four core knowledge bases: First, the rule base, which supplements newly discovered constraint rules, prohibited combinations, and priority weights to improve the constraint verification system for chain construction; second, the chain template base, which accumulates frequently occurring successful chain patterns, chain templates for specific scenarios, and best practices to provide a basis for rapid reuse in similar tasks; third, the failure mode base, which updates common failure modes, failure causes, and corresponding coping strategies to support anomaly prediction and rapid handling; and fourth, the reconstruction experience base, which supplements experience data such as optimal recovery paths after node failure, reconstruction time statistics, and backup chain configurations to optimize reconstruction decision-making efficiency.

[0096] After the knowledge base update is completed, the system enters the knowledge clustering and generalization phase. Regular clustering analysis is performed on the entire knowledge base to extract common patterns, forming reusable rules and new templates. This transforms scattered case experiences into systematic system capabilities, avoiding knowledge fragmentation and enabling large-scale knowledge reuse. The generalized knowledge then enters a continuous optimization phase, optimizing the core system processes from four dimensions: first, optimizing candidate chain generation by significantly shortening chain construction time through template acceleration; second, optimizing online selection by improving chain filtering efficiency through rule pruning; third, optimizing reconstruction strategies by improving reconstruction response speed through experience-guided improvement; and fourth, optimizing parameter weights by dynamically adapting weights based on historical data.

[0097] The optimized system capabilities directly impact the next round of tasks, achieving a comprehensive performance improvement: candidate chain generation is optimized by directly calling templates to skip the generation phase; reconstruction speed is accelerated and reconstruction response is optimized by pre-configuring backup chains; preventative maintenance is implemented through early risk monitoring, improving system stability; and both efficiency and time are optimized through performance enhancements. Ultimately, the module achieves quantifiable optimization results, reducing initial chain construction time, reducing reconstruction response time, improving system efficiency, and increasing task success rate, continuously strengthening the dynamic kill chain system's combat capabilities in highly dynamic and intensely competitive battlefield environments.

[0098] This application also provides a dynamic kill chain construction and reconstruction device, such as... Figure 8 As shown, the device includes: The construction module 801 is used to acquire real-time situational data and construct a time-varying graph based on the real-time situational data; the time-varying graph is used to characterize the connection relationships and multidimensional constraints between heterogeneous nodes. The generation module 802 is used to perform a phased search in the time-varying graph based on task requirements to generate a set of candidate kill chains including the main chain and the backup chain. The filtering module 803 is used to perform feasibility filtering on the candidate kill chain set, eliminating candidate kill chains that do not meet the hard constraints, and obtaining a set of feasible chains. Output module 804 is used to perform multi-objective collaborative optimization selection on the feasible chain set and output the backup chain set and the target main chain; The update module 805 is used to perform a hierarchical reconstruction operation based on the target main chain, the set of backup chains, and the real-time updated time-varying graph when a node state change is detected and a reconstruction condition is triggered, so as to generate an updated kill chain execution scheme.

[0099] In one possible implementation, the construction module 801 is used to parse the real-time situational data, extract attribute information of heterogeneous nodes, correlation and interaction data between heterogeneous nodes, and preset hard constraint rules for kill chain execution; construct a node set of the time-varying graph based on the attribute information of the heterogeneous nodes; construct an edge set of the time-varying graph based on the correlation and interaction data between the heterogeneous nodes; encode the preset hard constraint rules into the corresponding attributes of the node set and the edge set to construct the basic framework of the time-varying graph; and update the node set, the edge set, and the corresponding constraint codes based on the dynamic update of the real-time situational data to generate the time-varying graph that changes in real time with the battlefield situation.

[0100] In one possible implementation, the generation module 802 is used to decompose the task requirements into multiple task stages with sequential dependencies; according to the order of the task stages, based on the capability vectors and roles that heterogeneous nodes in the time-varying graph can assume, it searches for heterogeneous nodes in the time-varying graph stage by stage that satisfy the capability coverage of the current stage and the dependency relationship of the previous stage, forming a heterogeneous node sequence; and configures at least one alternative heterogeneous node sequence for each heterogeneous node sequence obtained through the search, so as to generate a candidate kill chain set including the main chain and the alternative chain.

[0101] In one possible implementation, the filtering module 803 is used to determine kill chains that match the requirements of this mission and execute hard constraint verification rules. The hard constraint verification rules include whether the candidate kill chains meet the temporal closed-loop constraints from the perception phase to the evaluation phase, whether the communication connectivity between nodes in the candidate kill chains meets preset communication constraints, whether the support conditions of the guiding nodes for the attack nodes in the candidate kill chains meet preset guiding constraints, and whether the estimated success probability of the candidate kill chains is lower than a threshold. Based on the hard constraint verification rules, a full compliance verification is performed on each candidate kill chain in the candidate kill chain set. Candidate kill chains that fail the compliance verification are eliminated, and all candidate kill chains that pass the verification are summarized to obtain a feasible chain set.

[0102] In one possible implementation, the output module 804 is used to determine the evaluation dimensions, weight coefficients, and constraint thresholds for multi-objective collaborative optimization based on the requirements of this task; for each feasible chain in the feasible chain set, perform full-dimensional quantitative scoring based on the evaluation dimensions to obtain the multi-objective comprehensive evaluation result corresponding to each feasible chain; use the multi-objective comprehensive evaluation result as the optimization objective, and use a preset optimization solution algorithm to perform collaborative optimization solution on the feasible chain set; based on the optimization solution result, determine the target main chain that meets the task requirements, and simultaneously match a set of backup chains that are compatible with the target main chain and meet the redundancy and anti-destruction requirements, and output the set of backup chains and the target main chain.

[0103] In one possible implementation, the layered reconstruction operation includes backup chain switching, partial patching, and full chain reconstruction; The update module 805 is configured to perform the backup chain switching operation if the failed node exists in the replacement node of the corresponding link in the backup chain set; if the failed node does not exist in the replacement node of the backup chain set and its failure impact is assessed as a local impact, then perform the local patching operation to search for alternative paths in the candidate kill chain set or the current time-varying graph to replace the affected link segment; if the failed node does not exist in the replacement node of the backup chain set and its failure impact is assessed as a global impact, then trigger the full chain reconstruction operation.

[0104] In one possible implementation, the device further includes a reconstruction module, which is used to extract features of the target main chain after outputting the target main chain and backup chain set; the features include node type combination, constraint satisfaction status and performance indicators; when the hierarchical reconstruction operation occurs, the failed node, failure cause and reconstruction strategy adopted are recorded, and the failure mode library and reconstruction experience library are updated.

[0105] This application also provides a control device. The control device may include a memory and a processor. The processor is used to execute the dynamic kill chain construction and reconstruction method described in any of the above embodiments. The memory may be random access memory (RAM), flash memory, read-only memory (ROM), non-volatile read-only memory (EPROM), registers, hard disk, removable disk, etc.

[0106] Memory can store computer instructions. When these instructions are executed by the processor, the processor can use them to perform dynamic kill chain construction and reconfiguration methods. Memory can also store data.

[0107] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. A computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the flow or function according to the embodiments of this application is generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, Digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape) or a semiconductor medium (e.g., solid-state disk (SSD)).

[0108] This application also provides a readable storage medium for storing the methods provided in the above embodiments. For example, RAM, flash memory, ROM, EPROM, registers, hard disk, removable disk, or any other form of storage medium in the art.

[0109] In the embodiments of this application, the terms "first" and "second" (if they exist) are used only as name identifiers and do not represent the order of first and second.

[0110] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Regarding the methods disclosed in the embodiments, since they correspond to the product embodiments disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the description of the product embodiments.

[0111] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for constructing and reconstructing a dynamic kill chain, characterized in that, include: Acquire real-time situational data and construct a time-varying graph based on the real-time situational data; The time-varying graph is used to characterize the connection relationships and multidimensional constraints between heterogeneous nodes; Based on the task requirements, a phased search is performed on the time-varying graph to generate a set of candidate kill chains including the main chain and backup chains. Perform a feasibility screening on the candidate kill chain set, remove candidate kill chains that do not meet the hard constraints, and obtain a set of feasible chains; Perform multi-objective collaborative optimization selection on the set of feasible chains, and output a set of backup chains and a target main chain; When a node state change is detected and triggers the reconstruction condition, a hierarchical reconstruction operation is performed based on the target main chain, the set of backup chains, and the real-time updated time-varying graph to generate an updated kill chain execution plan.

2. The method according to claim 1, characterized in that, The time-varying graph constructed based on the real-time situational data includes: The real-time situational data is analyzed to extract the attribute information of heterogeneous nodes, the correlation and interaction data between heterogeneous nodes, and the preset hard constraint rules for the execution of the kill chain. The node set of the time-varying graph is constructed based on the attribute information of the heterogeneous nodes; The edge set of the time-varying graph is constructed based on the associated interaction data between the heterogeneous nodes; The preset hard constraint rules are encoded into the corresponding attributes of the node set and the edge set to construct the basic framework for the time-varying graph. Based on the dynamic updates of the real-time situational data, the node set, the edge set, and the corresponding constraint codes are updated to generate the time-varying graph that changes in real time with the battlefield situation.

3. The method according to claim 2, characterized in that, The step of performing a phased search on the time-varying graph based on task requirements to generate a candidate kill chain set including the main chain and backup chains includes: The task requirements are broken down into multiple task stages with sequential dependencies; According to the order of the task stages, based on the capability vectors and roles that heterogeneous nodes can assume in the time-varying graph, heterogeneous nodes that satisfy the capability coverage of the current stage and the dependency relationship of the previous stage are searched in the time-varying graph stage by stage to form a sequence of heterogeneous nodes. For each heterogeneous node sequence obtained through the search, at least one alternative heterogeneous node sequence is configured to generate a candidate kill chain set including the main chain and the alternative chain.

4. The method according to claim 1, characterized in that, The feasibility screening of the candidate kill chain set, eliminating candidate kill chains that do not meet the hard constraints, yields a feasible chain set, including: Determine the kill chain that matches the requirements of this mission and execute hard constraint verification rules; the hard constraint verification rules include whether the candidate kill chain satisfies the temporal closed-loop constraint from the perception phase to the evaluation phase, whether the communication connectivity between each node in the candidate kill chain satisfies the preset communication constraint, whether the support conditions of the guiding node to the attack node in the candidate kill chain satisfy the preset guiding constraint, and whether the estimated success probability of the candidate kill chain is lower than a threshold. Based on the hard constraint verification rules, a full compliance verification is performed on each candidate kill chain in the candidate kill chain set; Candidate kill chains that fail compliance verification are removed, and all candidate kill chains that pass verification are aggregated to obtain a set of feasible chains.

5. The method according to claim 1, characterized in that, The step of performing multi-objective collaborative optimization selection on the feasible chain set and outputting a backup chain set and a target main chain includes: Based on the requirements of this task, the evaluation dimensions, weight coefficients, and constraint thresholds for multi-objective collaborative optimization are determined. For each feasible chain in the feasible chain set, a full-dimensional quantitative score is performed based on the evaluation dimensions to obtain a multi-objective comprehensive evaluation result for each feasible chain; Using the multi-objective comprehensive evaluation result as the optimization objective, a preset optimization solution algorithm is used to perform collaborative optimization solution on the feasible chain set; Based on the optimization results, a target main chain that meets the task requirements is determined, and a set of backup chains that are compatible with the target main chain and meet the redundancy and survivability requirements are matched. The set of backup chains and the target main chain are then output.

6. The method according to claim 1, characterized in that, The layered reconstruction operation includes backup chain switching, partial patching, and full chain reconstruction. The hierarchical reconstruction operation based on the target main chain, the set of backup chains, and the real-time updated time-varying graph specifically includes: If the failed node exists in the backup chain set and there is a replacement node for the corresponding link, then the backup chain switching operation is performed. If the failed node does not exist in the alternative nodes of the backup chain set, and its failure impact is assessed as a local impact, then the local patching operation is performed to search for alternative paths in the candidate kill chain set or the current time-varying graph to replace the affected link segment. If the failed node does not exist in the replacement nodes of the backup chain set, and its failure impact is assessed as a global impact, then the full chain reconstruction operation is triggered.

7. The method according to claim 1, characterized in that, After outputting the target main chain and backup chain set, the method further includes: Extract the features of the target main chain; the features include node type combinations, constraint satisfaction, and performance indicators. When the hierarchical refactoring operation occurs, the failed node, the cause of failure, and the refactoring strategy adopted are recorded, and the failure mode library and the refactoring experience library are updated.

8. A device for constructing and reconstructing a dynamic kill chain, characterized in that, The device includes: A construction module is used to acquire real-time situational data and construct a time-varying graph based on the real-time situational data; the time-varying graph is used to characterize the connection relationships and multidimensional constraints between heterogeneous nodes. The generation module is used to perform a phased search on the time-varying graph based on task requirements to generate a set of candidate kill chains including the main chain and backup chains. The filtering module is used to perform feasibility filtering on the candidate kill chain set, remove candidate kill chains that do not meet the hard constraints, and obtain a set of feasible chains. The output module is used to perform multi-objective collaborative optimization selection on the set of feasible chains and output the set of backup chains and the target main chain; The update module is used to perform a hierarchical reconstruction operation based on the target main chain, the set of backup chains, and the real-time updated time-varying graph when a node state change is detected and a reconstruction condition is triggered, so as to generate an updated kill chain execution plan.

9. A control device, characterized in that, It includes a processor and a memory, the memory being used to store programs, instructions, or code, and the processor being used to execute the programs, instructions, or code in the memory to complete the dynamic kill chain construction and reconstruction method as described in any one of claims 1-7.

10. A computer-readable storage medium, characterized in that, The system contains a computer program that is loaded by a processor to execute the dynamic kill chain construction and reconstruction method as described in any one of claims 1-7.

Images