Adaptive methods, devices, equipment and media for handling cybersecurity threats

Abstract

This application relates to the field of network security technology and proposes an adaptive network security threat handling method, apparatus, device, and medium. The method includes: real-time monitoring of multi-dimensional state parameters of distributed network nodes in a target network to identify abnormal nodes and collect corresponding target security data; performing feature association and fusion processing to construct a multi-dimensional security feature matrix; using a target network security identification model constructed based on the characteristics of the target network architecture to identify threat signals and determine the corresponding threat identification results; identifying the threat's spread range and impact based on the network topology to obtain dynamic risk assessment results; employing a two-way tracing mechanism to trace the threat's propagation path and source node to obtain tracing results; and generating and sending feedback messages. This scheme can accurately determine threat types and core attack points, adapt to different network layer characteristics to optimize identification sensitivity, and dynamically assess the threat's spread range and impact.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method, apparatus, device and medium for adaptive handling of network security threats. Background Technology

[0002] In recent years, with the continuous advancement of digital transformation, network access scenarios such as mobile office, remote access, and edge computing have become increasingly decentralized. The blurring of network boundaries and the dynamic nature of network nodes have posed significant challenges to the monitoring, identification, and response to network threats. At the same time, network attack techniques are becoming increasingly complex and intelligent, posing a severe test to traditional centralized and passive security protection systems.

[0003] In specific fields, such as critical information infrastructure with special information security requirements or industries like government and finance, the domestically developed IT application innovation (ITAI) system, built with domestically produced software and hardware, has become the mainstream. However, deploying security management solutions in the ITAI environment, especially in the aforementioned decentralized network scenarios, faces a prominent contradiction: on the one hand, the dispersed nodes and dynamically changing network environment require security devices or probes to be portable, lightweight, and able to quickly integrate into and adapt to different network structures; on the other hand, to effectively address advanced and persistent threats, it is necessary to introduce detection models with intelligent analysis and adaptive capabilities, which usually means higher computational and resource consumption.

[0004] Currently, most existing network security management solutions are designed for centralized, stable office networks. While these solutions can achieve a certain degree of threat detection through big data analysis and centralized control, their architecture and functionality are difficult to directly adapt to resource-constrained, structurally variable, and distributed scenarios. For example, some solutions rely on comprehensive network traffic mirroring and log collection, which is difficult to implement in mobile or temporary network environments; some AI-based detection models, although possessing learning capabilities, typically employ a one-size-fits-all identification strategy, failing to differentiate and accurately monitor and respond based on the different network nodes' positions within the network topology and their business importance. This can easily lead to insufficient protection for core services or excessive alerts for edge nodes. Summary of the Invention

[0005] This application provides a method, apparatus, device, and medium for adaptive handling of network security threats, aiming to solve technical problems such as inconvenient model architecture and inaccurate identification in related technologies.

[0006] In a first aspect, embodiments of this application provide an adaptive network security threat handling method, the method comprising: Real-time monitoring of multi-dimensional status parameters of distributed network nodes in the target network; identification of abnormal nodes based on multi-dimensional status parameters; and collection of corresponding target security data based on the abnormal nodes. The target security data is subjected to feature association and fusion processing to construct a multi-dimensional security feature matrix; The target network security identification model, constructed based on the characteristics of the target network architecture, identifies threat signals from the multi-dimensional security feature matrix and determines the corresponding threat identification results, wherein the threat identification results include threat type and core attack points; Based on the network topology and the threat identification results, the spread and impact of the threats are identified, and dynamic risk assessment results are obtained. A two-way attribution mechanism is used to trace the propagation path and source nodes of threats to obtain attribution results; Based on the dynamic risk assessment results and the source tracing results, a feedback message is generated and sent.

[0007] In one embodiment, optionally, determining the abnormal node through multi-dimensional state parameters includes: The abnormal confidence of a node is calculated based on the deviation of the operating parameters of each monitoring dimension, the preset importance weight of each dimension, the similarity between the current multi-dimensional operating status and the normal status of the same period in history, and the proportion of abnormal nodes associated with the node. When the anomaly confidence level is greater than or equal to the preset anomaly threshold, the node is determined to be an anomaly node; The monitoring dimensions include at least bandwidth utilization, number of connection sessions, CPU utilization, and memory usage; The target security data includes node running status data, interaction log data, configuration data, and related behavioral characteristic data.

[0008] In one embodiment, optionally, the feature association and fusion processing of the target security data to construct a multi-dimensional security feature matrix includes: The target security data is classified according to data type, and the security features corresponding to each type of security data are extracted. Calculate the credibility weight of various types of security data and the importance weight of each security feature, and use a weighted fusion method to correlate and fuse the extracted security features; A multi-dimensional security feature matrix is ​​constructed based on the fused feature data.

[0009] In one embodiment, optionally, the data type includes traffic data, log data, and configuration data; The security characteristics corresponding to the traffic data include: average data packet length, percentage of abnormal protocols, percentage of one-way data flow, port scan frequency, number of cross-network segment accesses, and data transmission rate fluctuation coefficient. The security features corresponding to the log data include: number of abnormal logins, frequency of permission changes, error command return rate, matching degree of critical file access records, proportion of abnormal process startups, and missing log fields. The security features corresponding to the configuration data include: port opening compliance, permission configuration deviation, firewall rule matching rate, software version update lag time, and configuration parameter tampering traces.

[0010] In one embodiment, optionally, calculating the credibility weights of various types of security data and the importance weights of each security feature includes: The credibility weight is calculated based on the collection integrity coefficient, transmission error rate, and inherent credibility benchmark of various types of security data. The importance weight is calculated based on the correlation between the security feature and the threat identification result, the discrimination coefficient and stability adjustment coefficient of the security feature, and the weight benchmark value.

[0011] In one embodiment, optionally, the target network security identification model constructed based on the characteristics of the target network architecture performs threat signal identification on the multi-dimensional security feature matrix to determine the corresponding threat identification result, including: A target network security identification model based on a hierarchical attention mechanism is constructed, and the hierarchical identifiers of the target network core layer, aggregation layer, and access layer, as well as the service carrying weights, are incorporated into the model as network architecture characteristic parameters. By combining network node connectivity and link association strength as prior information, the feature attention weights of nodes at each level are calculated, and the threat identification sensitivity of nodes at different levels is adaptively adjusted according to the feature attention weights. The multi-dimensional security feature matrix is ​​input into the target network security identification model. The target network security identification model extracts, enhances, and performs probability calculations on the multi-dimensional security feature matrix to complete threat signal identification and determine the threat identification result.

[0012] In one embodiment, optionally, determining the corresponding threat identification result includes: Calculate the cosine similarity between the multi-dimensional security feature matrix and the preset threat feature database, as well as the fit between the network behavior sequence and the preset threat behavior; The overall matching degree is obtained by weighted summation of the cosine similarity and the fit. If the overall matching degree is higher than a preset threshold, the corresponding threat type is output. Calculate the sum of the feature contribution values ​​of each port / process, and filter a preset number of ports / processes from high to low based on the sum of the contribution values ​​as the core attack points.

[0013] In one embodiment, optionally, based on the network topology and the threat identification results, the spread and impact of the threat are identified to obtain dynamic risk assessment results, including: A dynamic risk assessment value is obtained by weighting the factors of threat intensity, threat spread rate, spread attenuation, and the importance of affected nodes. The dynamic risk assessment value is mapped to three risk levels—high, medium, and low—according to a preset range. The dynamic risk assessment result includes the dynamic risk assessment value and the corresponding risk level.

[0014] In one embodiment, optionally, the bidirectional tracing mechanism is a log chain and timestamp bidirectional tracing mechanism, and tracing the propagation path and source node of the threat includes: Based on the communication logs of each node, threat-related data stream transmission records are extracted to construct a preliminary propagation path; By reverse engineering using timestamps, it is verified whether the attack time sequence of each node on the initial propagation path conforms to the propagation logic. A node trust verification is introduced. Only when the average trust of nodes on the path is higher than a preset trust threshold is the path confirmed as a valid propagation path, and the starting point of the path is the source node. If multiple valid propagation paths exist, the path with the highest average trust level and the shortest propagation time is selected as the final valid propagation path, and the corresponding source node is determined.

[0015] In one embodiment, optionally, the feedback message includes: a threat basic information field, a source tracing result field, an impact scope field, and a time dimension field; The basic threat information fields include: threat type, core attack point, and risk level; The traceability result fields include: a list of propagation path nodes, an identifier of the source node, and traceability credibility; The impact scope field includes: the number of affected nodes, hierarchical distribution, and correlation with key business operations; The time dimension field includes monitoring time, identification time, and traceability completion time; When sending the feedback message, the feedback priority is determined based on the dynamic risk assessment results, with high-risk messages being sent first.

[0016] Secondly, embodiments of this application provide a network security threat adaptive processing device, the device comprising: The first determination module is used to monitor the multi-dimensional status parameters of the distributed network nodes of the target network in real time, determine the abnormal nodes through the multi-dimensional status parameters, and collect the corresponding target security data based on the abnormal nodes. A construction module is used to perform feature association and fusion processing on the target security data to construct a multi-dimensional security feature matrix; The second determining module is used to construct a target network security identification model based on the characteristics of the target network architecture, identify threat signals on the multi-dimensional security feature matrix, and determine the corresponding threat identification results, wherein the threat identification results include threat type and core attack point; The threat identification module is used to identify the spread and impact of threats based on the network topology and the threat identification results, and to obtain dynamic risk assessment results. The source tracing module is used to trace the propagation path and source node of a threat using a two-way source tracing mechanism to obtain the source tracing results; The generation module is used to generate and send feedback messages based on the dynamic risk assessment results and the source tracing results.

[0017] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described adaptive handling method for network security threats.

[0018] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the aforementioned adaptive handling method for network security threats.

[0019] In this invention, multi-dimensional state parameters of distributed network nodes in the target network are monitored in real time. Abnormal nodes are identified through these parameters, and corresponding target security data is collected based on these abnormal nodes. Feature association and fusion processing is performed on the target security data to construct a multi-dimensional security feature matrix. A target network security identification model, constructed based on the characteristics of the target network architecture, identifies threat signals on the multi-dimensional security feature matrix to determine the corresponding threat identification results. These threat identification results include threat type and core attack points. Based on the network topology and the threat identification results, the spread range and impact of the threat are identified to obtain a dynamic risk assessment result. A two-way tracing mechanism is used to trace the propagation path and source node of the threat to obtain a tracing result. Based on the dynamic risk assessment result and the tracing result, a feedback message is generated and sent. The aforementioned technical solution, by real-time monitoring of multi-dimensional state parameters of dispersed network nodes in the target network, can accurately identify abnormal nodes and collect corresponding target security data, providing comprehensive and effective data support for subsequent security protection. By performing feature association and fusion processing on the target security data and constructing a multi-dimensional security feature matrix, it can effectively integrate the core security features of multi-source data, improving the accuracy of subsequent threat identification. The target network security identification model, built based on the characteristics of the target network architecture, identifies threat signals from the multi-dimensional security feature matrix, accurately determining threat types and core attack points, enhancing the targeted nature of threat protection. Based on the network topology, combined with threat types and core attack points... The system identifies the attack point, determines the scope and impact of threat spread, and generates dynamic risk assessment results, providing a reliable basis for protection decisions and facilitating precise control of threat damage. Employing a two-way tracing mechanism to trace the threat propagation path and source nodes enables rapid location of the root cause of the threat, supporting timely blocking of its spread. Generating and sending feedback messages based on dynamic risk assessment and tracing results ensures accurate and efficient transmission of critical threat information, improving protection response efficiency. Overall, it achieves effective security management of dispersed network scenarios, adapts to the needs of the domestic IT innovation ecosystem, balances portability with intelligent adaptive protection capabilities, solves the problem of existing technologies being difficult to implement effectively, and ensures the stable operation of network security. Attached Figure Description

[0020] To more clearly illustrate the technical solutions of the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 A schematic flowchart of a network security threat adaptive processing method according to an embodiment of this application is shown.

[0022] Figure 2A schematic flowchart illustrating the determination of abnormal nodes in a network security threat adaptive processing method according to an embodiment of this application is shown.

[0023] Figure 3 A schematic flowchart of step S102 in a network security threat adaptive processing method according to an embodiment of this application is shown.

[0024] Figure 4 A schematic flowchart of step S103 in a network security threat adaptive processing method according to an embodiment of this application is shown.

[0025] Figure 5 A schematic flowchart of step S105 in a network security threat adaptive processing method according to an embodiment of this application is shown.

[0026] Figure 6 A block diagram of a network security threat adaptive processing apparatus according to an embodiment of this application is shown.

[0027] Figure 7 A schematic diagram of the structure of a computer device according to an embodiment of this application is shown.

[0028] Figure 8 Another structural schematic diagram of a computer device according to an embodiment of this application is shown. Detailed Implementation

[0029] To better understand the technical solution of this application, the embodiments of this application will be described in detail below with reference to the accompanying drawings.

[0030] It should be understood that the described embodiments are merely some, not all, of the embodiments in this application. All other embodiments obtained by those skilled in the art based on the embodiments in this application without inventive effort are within the scope of protection of this application.

[0031] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to be limiting of this application. The singular forms “a,” “the,” and “the” used in the embodiments of this application and the appended claims are also intended to include the plural forms unless the context clearly indicates otherwise.

[0032] The following detailed description of some embodiments of this application is provided in conjunction with the accompanying drawings. Unless otherwise specified, the following embodiments and features can be combined with each other.

[0033] like Figure 1 As shown in the figure, this application provides a network security threat adaptive processing method, the method including: Step S101: Monitor the multi-dimensional status parameters of the distributed network nodes of the target network in real time, identify abnormal nodes through the multi-dimensional status parameters, and collect the corresponding target security data based on the abnormal nodes.

[0034] Target network: refers to the network that requires security protection. In this embodiment, it specifically refers to distributed networks such as mobile office networks, covering multiple levels of nodes such as core layer, aggregation layer, and access layer, and can be adapted to the information technology innovation ecosystem.

[0035] Distributed network nodes: These are network nodes that are scattered and have flexible access methods (such as mobile office terminals, distributed servers, remote access devices, etc.), which are different from traditional centralized network nodes.

[0036] Multi-dimensional status parameters: These refer to multiple core indicators used to characterize the operational status of network nodes, which can comprehensively reflect the operational health and security status of nodes.

[0037] Abnormal nodes: These are network nodes whose operating status deviates from the normal baseline and pose security risks. Their operating parameters do not conform to normal operating rules, and they may have been attacked or are at risk of being attacked.

[0038] Target security data: refers to various security-related data associated with abnormal nodes, used for subsequent threat identification, assessment and tracing, and is the core data foundation for subsequent security processing.

[0039] This step first activates the node monitoring mechanism to monitor all distributed network nodes in the target network in real time and continuously. The monitoring objects are the multi-dimensional status parameters of the nodes. Among them, the core monitoring dimensions include at least bandwidth utilization, number of connection sessions, CPU utilization, and memory usage. Other monitoring dimensions, such as port utilization and data transmission latency, can be added according to the actual network scale and protection requirements.

[0040] like Figure 2 As shown, in one embodiment, optionally, determining abnormal nodes through multi-dimensional state parameters includes: Step S201: Calculate the anomaly confidence of the node based on the deviation of the operating parameters of each monitoring dimension, the preset importance weight of each dimension, the similarity between the current multi-dimensional operating status and the normal status of the same period in history, and in combination with the node association anomaly ratio. The anomaly confidence level is calculated using the following formula: ; In the formula: Confidence level for node anomalies; The deviation weighting coefficient is a multi-dimensional state comprehensive deviation coefficient; The number of core monitoring dimensions for node operating status; The importance weight of the i-th monitoring dimension; The deviation of the running parameters in the i-th dimension; The similarity between the current multi-dimensional operating status and the normal multi-dimensional status during the same period in history; Associating nodes with abnormal weights; This is the preset minimum value; when A node is considered abnormal if its value is not less than a preset abnormal threshold. The security data surrounding an abnormal node includes node running status data, interaction log data, configuration data, and related behavioral characteristic data. The monitoring dimensions include at least bandwidth utilization, number of connection sessions, CPU utilization, and memory usage.

[0041] Step S202: When the anomaly confidence level is greater than or equal to the preset anomaly threshold, the node is determined to be an anomaly node. The monitoring dimensions include at least bandwidth utilization, number of connection sessions, CPU utilization, and memory usage; The target security data includes node running status data, interaction log data, configuration data, and related behavioral characteristic data.

[0042] In the above scheme, the process of determining abnormal nodes is as follows: First, calculate the deviation of the operating parameters of each monitoring dimension of the node (the normalized difference between the current parameter and the historical normal baseline parameter of the same dimension; the larger the difference, the more significant the deviation). Combine this with the preset importance weights of each dimension (set according to the degree of influence of the dimension on node security, such as CPU utilization and memory usage having higher weights than bandwidth utilization), and the similarity between the current multi-dimensional operating status and the historical normal status of the same period (calculated based on the multi-dimensional vector cosine similarity algorithm; the lower the similarity, the higher the probability of node abnormality). Then, incorporate the node association abnormality ratio (the proportion of nodes directly connected to the node that have been identified as abnormal). The abnormality confidence of the node is obtained through weighted calculation. When the abnormality confidence is greater than or equal to the preset abnormality threshold (which can be set according to the network security level, such as 0.7 for high-security networks and 0.75 for ordinary networks), the node is determined to be an abnormal node.

[0043] Once an abnormal node is identified, a targeted data collection mechanism is triggered to collect target security data around the abnormal node. The collection scope covers directly related nodes and secondary jump nodes of the abnormal node. The collected content includes node operation status data (such as real-time parameters of various monitoring dimensions), interaction log data (such as inter-node communication logs and terminal operation logs), configuration data (such as node port configuration, permission configuration, and firewall rules), and related behavioral characteristic data (such as node access behavior and data transmission behavior). This ensures that the collected data is comprehensive and accurate, providing support for subsequent processing.

[0044] In this way, by using multi-dimensional state parameter monitoring instead of single-dimensional monitoring, and combining historical baseline similarity and the proportion of abnormal node associations, the accuracy of abnormal node identification is greatly improved, reducing false positives and false negatives. This avoids misjudging a node as an abnormal node due to fluctuations in a single parameter, or false negatives due to missing associated abnormal nodes. Targeted collection of security data around abnormal nodes, rather than collecting all data from the entire network, reduces resource consumption for data collection and focuses on abnormal areas, ensuring the targeted and efficient nature of subsequent processing. Clearly defining the types of target security data collected provides a standardized and comprehensive data foundation for subsequent feature extraction, fusion, and threat identification, avoiding the impact of missing or non-standard data on subsequent processing results.

[0045] Step S102: Perform feature association and fusion processing on the target security data to construct a multi-dimensional security feature matrix; like Figure 3 As shown, in one embodiment, optionally, step S102 includes: Step S301: Classify the target security data according to data type and extract the security features corresponding to each type of security data; In one embodiment, optionally, the data type includes traffic data, log data, and configuration data; The security characteristics corresponding to the traffic data include: average data packet length, percentage of abnormal protocols, percentage of one-way data flow, port scan frequency, number of cross-network segment accesses, and data transmission rate fluctuation coefficient. The security features corresponding to the log data include: number of abnormal logins, frequency of permission changes, error command return rate, matching degree of critical file access records, proportion of abnormal process startups, and missing log fields. The security features corresponding to the configuration data include: port opening compliance, permission configuration deviation, firewall rule matching rate, software version update lag time, and configuration parameter tampering traces.

[0046] Step S302: Calculate the credibility weight of various types of security data and the importance weight of each security feature, and use a weighted fusion method to correlate and fuse the extracted security features; The fusion formula is: ; In the formula: The nth eigenvalue of the m-th sample in the security feature matrix; The credibility weight of the k-th class of data; The importance weights of the nth dimension feature; It represents the nth dimension of the original feature value of the mth sample in the kth class of data.

[0047] The above formula first extracts the core security features of three different data types: traffic, logs, and configuration. Then, it performs weighted fusion by weighting the data credibility weight and the feature importance weight. This takes into account the quality differences and inherent attributes of different data, while highlighting the focus on key features for threat identification. This allows the constructed multi-dimensional security feature matrix to comprehensively and accurately integrate various types of security data.

[0048] In one embodiment, optionally, calculating the credibility weights of various types of security data and the importance weights of each security feature includes: The credibility weight is calculated based on the collection integrity coefficient, transmission error rate, and inherent credibility benchmark of various types of security data. The importance weight is calculated based on the correlation between the security feature and the threat identification result, the discrimination coefficient and stability adjustment coefficient of the security feature, and the weight benchmark value.

[0049] Furthermore, the credibility weight Importance weight The calculation formula is: ; In the formula: Let be the data collection integrity coefficient for the k-th type of data; Let be the bit error rate of the k-th type of data; The inherent reliability benchmark coefficient for the k-th type of data; Let be the mutual information value between the nth dimension feature and the threat identification result; The discriminant coefficient of the nth feature; This is the characteristic stability adjustment coefficient; The weight baseline value is n∈1,2,...,N, where N represents the total number of feature dimensions.

[0050] In the above formula, the data credibility weight combines the integrity of data collection, the transmission error rate, and the inherent credibility benchmark coefficient to objectively reflect the data quality; the feature importance weight is dynamically calculated based on the mutual information value, the discrimination coefficient, and the stability adjustment coefficient of the feature and threat identification results, so that the weight allocation can be adapted to different data quality and feature effectiveness, avoiding the adaptation limitations brought by fixed weights, and making the subsequent fusion and identification process more in line with the actual data scenario. in, Take the ratio of the actual amount of valid data collected to the theoretical amount of data to be collected; take 1 if there is no packet loss during the collection process. Based on the stability preset of the data type, the value range of traffic data, log data and configuration data are all in [0.8, 1], and the inherent reliability benchmark coefficient of configuration data is not lower than that of traffic data; Take the difference between the mean of this feature in abnormal samples and the mean in normal samples; Based on this characteristic, the volatility variance is determined in historical data; the smaller the volatility variance, the better. The larger the value, the range is [0.9, 1.1]; This is the default value; Step S303: Construct a multi-dimensional security feature matrix based on the fused feature data.

[0051] Multi-dimensional security feature matrix: refers to a matrix formed by arranging the fused security features according to certain rules with features as columns and data samples as rows. It is the input data for subsequent threat identification models and can comprehensively and centrally reflect the core security information of the target security data.

[0052] In the above steps, firstly, the collected target security data is classified according to data type, with the core categories being traffic data, log data, and configuration data, ensuring clear data classification and facilitating subsequent feature extraction. Secondly, corresponding security features are extracted for each type of data, with different focus areas for feature extraction depending on the data type. Invalid and redundant features are removed during the extraction process, retaining the core features relevant to threat identification. Next, the credibility weights of each type of security data and the importance weights of each security feature are calculated. The credibility weights are used to measure the quality and reliability of different types of data, while the importance weights are used to highlight the emphasis on key features for threat identification. A weighted fusion method is used to correlate and fuse all extracted security features, eliminating conflicts and redundancies between features of different data types. Finally, based on the fused feature data, a multi-dimensional security feature matrix is ​​constructed, where each element in the matrix corresponds to a feature value of a sample, ensuring that the matrix can comprehensively and accurately reflect the security status of the target security data.

[0053] In this way, classifying and extracting features from target security data can filter out core features related to threat identification, eliminate invalid and redundant data, reduce the complexity of subsequent data processing, and improve processing efficiency. By using weighted fusion to achieve the correlation and integration of features from multiple sources, the problem of scattered and difficult-to-coordinate multi-source data can be solved, making the fused features more representative and able to comprehensively reflect the security status of abnormal nodes and their surroundings. Constructing a multi-dimensional security feature matrix provides standardized and structured input data for subsequent threat identification models, ensuring that the models can efficiently and accurately identify threat signals and laying the foundation for subsequent processing.

[0054] Step S103: Based on the target network architecture characteristics, a target network security identification model is constructed to identify threat signals in the multi-dimensional security feature matrix and determine the corresponding threat identification results. The threat identification results include threat type and core attack point. Target network architecture characteristics: These refer to the inherent characteristics of the target network, such as its hierarchical structure (core layer, aggregation layer, access layer), the service carrying capacity of each node, node connectivity, and link association strength. These characteristics directly affect the focus and sensitivity of threat identification.

[0055] Target network security identification model: refers to an intelligent model built based on the characteristics of the target network architecture to identify network threats. It has the ability to adaptively adjust the identification sensitivity and can adapt to the security protection needs of different levels of nodes.

[0056] Threat signal identification: This refers to analyzing and calculating a multi-dimensional security feature matrix using a model to identify the threat signals contained within it, and to determine whether a network threat exists and the specific details of the threat.

[0057] Threat identification results: These refer to the specific information about network threats output by the model, which mainly includes threat type (such as brute-force attacks, port scanning, malicious code attacks, etc.) and core attack points (such as the attacked ports, processes, etc.).

[0058] Core attack points: These refer to the main carriers of threat attacks, the key ports or processes through which threats take effect, and the focus of subsequent protection and response.

[0059] like Figure 4 As shown, in one embodiment, optionally, step S103 includes: Step S401: Construct a target network security identification model based on a hierarchical attention mechanism, and incorporate the hierarchical identifiers of the target network core layer, aggregation layer, and access layer, as well as the service carrying weights, as network architecture characteristic parameters into the model. Step S402: Combining network node connectivity and link association strength as prior information, calculate the feature attention weights of nodes at each level, and adaptively adjust the threat identification sensitivity of nodes at different levels according to the feature attention weights. Based on a hierarchical attention mechanism, the hierarchical identifiers and service carrying weights of the target network's core layer, aggregation layer, and access layer are used as architectural characteristic parameters to calculate the feature attention weights of corresponding layer nodes. During model training, network node connectivity and link association strength are incorporated as prior information, enabling adaptive adjustment of threat identification sensitivity for different layer nodes. ; In the formula: The feature attention weights are assigned to the i-th node in the L-th level. The basic weights for level L; The service carrying weight of the i-th node; Let be the normalized connectivity of the i-th node; Normalization factor; The threat identification sensitivity of the i-th node in the L-th level; This is the preset base sensitivity; Let L be the tolerance coefficient for misjudgment at level L; in, make , The total number of nodes at level L.

[0060] The above formula combines the hierarchical basic weight, the node service carrying weight, and the normalized connectivity to calculate the feature attention weight. Then, the node threat identification sensitivity is adjusted by the hierarchical misjudgment tolerance coefficient. Core layer nodes are set with a lower misjudgment tolerance coefficient because they support core services. At the same time, prior information such as network node connectivity and link association strength is incorporated to make threat identification adaptable to the differences in importance of nodes at different levels. This ensures the identification sensitivity of core nodes and avoids excessive misjudgment of edge nodes, thereby improving the model's adaptability to the network architecture. in, make , The total number of nodes at level L; The value of follows: , ∈[0.5, 1.5], the stronger the node's level of support for the core network business and the better the overall connectivity guarantee, the smaller the value; conversely, the smaller the value. Step S403: Input the multi-dimensional security feature matrix into the target network security identification model, and use the target network security identification model to extract, enhance and perform probability calculations on the multi-dimensional security feature matrix to complete threat signal identification and determine the threat identification result.

[0061] In one embodiment, optionally, determining the corresponding threat identification result includes: Calculate the cosine similarity between the multi-dimensional security feature matrix and the preset threat feature database, as well as the fit between the network behavior sequence and the preset threat behavior; The overall matching degree is obtained by weighted summation of the cosine similarity and the fit. If the overall matching degree is higher than a preset threshold, the corresponding threat type is output. Calculate the sum of the feature contribution values ​​of each port / process, and filter a preset number of ports / processes from high to low based on the sum of the contribution values ​​as the core attack points.

[0062] In the above steps, a weighted sum is calculated using the cosine similarity between the security feature matrix and the preset threat feature library, and the fit between the network behavior sequence and typical threat behavior. The sum is denoted as the comprehensive matching degree. The weights used for the cosine similarity between the security feature matrix and the preset threat feature library, and the fit between the network behavior sequence and typical threat behavior, are subject to the constraint that their sum must be 1. When the comprehensive matching degree is higher than a preset threshold, the corresponding threat type is output. In the core attack point determination stage, the core attack point is determined by sorting the sum of feature contribution values. The contribution value calculation formula is as follows: ,in This represents the sum of the contributions of port / process p. This represents the number of feature dimensions in the security feature matrix. This represents the importance weight of the d-th dimension feature. This represents the contribution value of the d-th dimension feature to the gradient backpropagation of p. The top N ports / processes with the highest total contribution value are selected as the core attack points, and N is preset according to the network size or user protection requirements.

[0063] The above formula quantifies the impact of ports / processes on threats by weighted summation of feature importance weights and gradient backpropagation contribution values. The gradient contribution value combines the frequency ratio of features and ports / processes and service dependencies to highlight the close association between features and specific attack vectors. Then, the core attack points are screened by sorting the contribution values. This takes into account both the importance of the features themselves and the accurate association with the actual attack vectors, making the positioning of core attack points more targeted, thereby adapting to the dependencies of different network services and attack scenarios. in, As a preset, and , The gradient value of the d-th feature in the output layer of the intelligent recognition model is calculated by weighting the mapping correlation coefficient. The mapping correlation coefficient represents the degree of correlation between the d-th feature and the port / process p. It is determined based on the frequency ratio of network data flow passing through port / process p and the service dependency relationship corresponding to the feature, and the value range is 0-1.

[0064] In the above scheme, a target network security identification model is first constructed. This model is built based on a hierarchical attention mechanism. During construction, the hierarchical identifiers of the target network's core layer, aggregation layer, and access layer, as well as the service-bearing weights of each layer's nodes (determined based on the proportion of core services carried by each node), are incorporated into the model as network architecture characteristic parameters. Simultaneously, network node connectivity (the ratio of the actual number of connections to the maximum number of connections) and link association strength are used as prior information to ensure the model closely matches the actual architecture of the target network. After model construction, the feature attention weights of each layer's nodes are calculated. Based on these feature attention weights, the threat identification sensitivity of different layers' nodes is adaptively adjusted. Core layer nodes, carrying core services, have high feature attention weights, high identification sensitivity, and low false positive tolerance. Access layer nodes, being edge nodes, have low feature attention weights, moderate identification sensitivity, and high false positive tolerance, achieving differentiated identification of nodes at different layers. The multi-dimensional security feature matrix is ​​input into the model. The model first extracts local features from the feature matrix, then strengthens the key features at each level through hierarchical attention layers, and finally outputs the probability distribution of various threats through probability calculation to complete threat signal identification and determine the threat identification result: the threat type is determined by the comprehensive matching degree, and the core attack point is determined by sorting and filtering the sum of feature contribution values.

[0065] In this way, the model is built based on the characteristics of the target network architecture, rather than a general identification model. This allows it to adapt to the hierarchical structure and business distribution of the target network, improving the adaptability and accuracy of threat identification. The hierarchical attention mechanism enables adaptive adjustment of the identification sensitivity of nodes at different levels, ensuring the timeliness of threat identification for core nodes while avoiding excessive misjudgment of edge nodes, thus balancing identification accuracy and misjudgment rate. At the same time, it identifies threat types and core attack points, providing clear targets for subsequent risk assessment, tracing, and protection measures, enhancing the targeting of protection and avoiding blind action.

[0066] Step S104: Based on the network topology and the threat identification results, identify the scope of threat spread and the degree of impact to obtain dynamic risk assessment results; In one embodiment, optionally, step S104 includes: A dynamic risk assessment value is obtained through weighted calculation, taking into account the overall threat intensity, threat spread rate, spread attenuation, and the importance of affected nodes. The dynamic risk assessment value is mapped to three risk levels—high, medium, and low—according to a preset range. The dynamic risk assessment result includes the dynamic risk assessment value and the corresponding risk level.

[0067] Furthermore, the results of the dynamic risk assessment are expressed as follows: ; In the formula: This is a dynamic risk assessment value; Threat intensity coefficient; Threat intensity index; The diffusion attenuation coefficient; For the speed of threat spread; The importance index of the affected nodes; The risk levels are mapped to high, medium, and low according to the preset range.

[0068] The above formula integrates three core factors: threat intensity, diffusion speed, and the importance of affected nodes. It adapts to different threat types through a threat intensity coefficient, reflects the difference between network medium density and diffusion path complexity through a diffusion attenuation coefficient, and distinguishes the influence weights of the core layer, aggregation layer, and access layer according to their levels. At the same time, it introduces an exponential function to reflect the attenuation effect of diffusion speed, dynamically calculates risk values ​​and maps them to three levels of risk, so that risk assessment not only covers the intensity of the threat itself, but also takes into account the importance of diffusion trend and scope of impact. The risk levels are mapped to high, medium, and low according to a preset range. in, ∈ (0,1), Based on threat type presets; It is calculated by combining attack frequency, attack traffic percentage, and destructive capability weight; ∈[0.01, 0.99], the higher the medium density and the more complex the diffusion path, the larger the value, and vice versa; Take the percentage of the increase in the number of affected nodes per unit time. ∈ (0,1), the core layer node index is higher than the aggregation layer index, and the aggregation layer index is higher than the access layer index.

[0069] This step first obtains the topology of the target network, clarifies the connection relationships between nodes, hierarchical distribution, and service carrying capacity of each node; combined with the threat identification results obtained in step S103, it analyzes the propagation characteristics of the threat, such as the speed of threat spread, propagation path preferences, identifies the scope of threat spread, determines the number of nodes affected by the threat, their level, and whether core layer nodes or critical business nodes are involved. Subsequently, a dynamic risk assessment value is obtained by weighting the overall threat intensity (based on preset threat types, such as brute-force attacks being more powerful than ordinary port scans), threat spread speed (the percentage of incremental affected nodes per unit time), spread attenuation (the weakening effect of network media density and spread path complexity on threat spread), and the importance of affected nodes (core layer nodes are more important than aggregation layer and access layer nodes). The dynamic risk assessment value is then mapped to three risk levels (high, medium, and low) according to preset ranges (e.g., an assessment value of 0.8 or above is high risk, 0.5-0.8 is medium risk, and below 0.5 is low risk). The final dynamic risk assessment result is obtained, where a high risk level indicates that the threat has affected core business and requires immediate action; a low risk level indicates that the threat has a small impact range and low degree of damage, and can be monitored routinely.

[0070] In this way, by combining network topology and threat identification results, the spread and impact of threats can be accurately determined, avoiding misjudgments of threat harm. Dynamic risk assessment enables real-time quantification of network risks. Unlike static risk assessment, it can be updated in real time as threats spread and the handling process progresses, providing a reliable and timely basis for protection decisions. The classification of risk levels can clarify protection priorities, making it easier for staff to prioritize the handling of high-risk threats, improving the rationality and efficiency of protection response, and reducing the losses caused by threats.

[0071] Step S105: Using a two-way tracing mechanism, the propagation path and source node of the threat are traced to obtain the tracing results; Two-way tracing mechanism: refers to a dual tracing method that combines forward tracing of log chains and reverse deduction of timestamps. It can mutually verify the accuracy of tracing results and ensure the reliability of tracing paths and source nodes, which is different from the single log tracing method.

[0072] Propagation path: refers to the complete path of a threat from the source node to the abnormal node and other affected nodes, reflecting the propagation process of the threat and the relationship between nodes.

[0073] Source node: refers to the initial node from which the threat is launched. It may be a node that has been compromised inside the network or an attack node outside the network. It is the key to blocking the spread of the threat and completely eliminating the threat.

[0074] Source tracing results: These refer to the core information obtained during the source tracing process, including threat propagation paths, source node identifiers, and source tracing credibility, providing core evidence for threat handling.

[0075] like Figure 5 As shown, in one embodiment, optionally, step S105 includes: Step S501: Based on the communication logs of each node, extract threat-related data stream transmission records and construct a preliminary propagation path; Step S502: By reverse deducing through timestamps, verify whether the attack time sequence of each node on the initial propagation path conforms to the propagation logic; Step S503 introduces node trust verification. Only when the average trust of nodes on the path is higher than the preset trust threshold is the path confirmed as a valid propagation path, and the starting point of the path is the source node. Trust , This represents the node's historical security trust value. Record the error rate for node logs.

[0076] Step S504: If there are multiple valid propagation paths, select the path with the highest average trust level and the shortest propagation time as the final valid propagation path and determine the corresponding source node.

[0077] The bidirectional tracing mechanism used in this step is specifically a log chain and timestamp-based bidirectional tracing. The specific process is as follows: First, based on the communication logs of each node, data flow transmission records related to the threat (such as abnormal data transmission and suspicious connection records) are extracted. Combined with the network topology, a preliminary propagation path of the threat is constructed. Second, through reverse deduction using timestamps, it is verified whether the attack time order of each node on the preliminary propagation path conforms to the propagation logic (e.g., the source node was attacked earlier than the abnormal node, and the abnormal node was attacked earlier than other affected nodes). Preliminary paths that do not conform to the logic are eliminated. Then, node trust verification is introduced. The node trust is calculated by combining the node's historical security trust value (the node's past security operation status) and the node's log recording error rate (the accuracy of log data). Only when the average trust of all nodes on the path is higher than the preset trust threshold is the path confirmed as a valid propagation path, and the starting point of the path is the threat source node. If there are multiple valid propagation paths, the path with the highest average trust and the shortest propagation time is selected as the final valid propagation path, and the corresponding source node is determined. Finally, a tracing result containing the propagation path, source node, and tracing credibility is formed.

[0078] By combining a two-way tracing mechanism with dual verification of log chains and timestamps, the problems of path misjudgment and inaccurate source location that are prone to occur in single log tracing are solved, improving the accuracy and reliability of tracing results. Node trust verification further filters effective propagation paths, avoiding tracing deviations caused by log data errors and ensuring the credibility of tracing results. It can quickly and accurately locate threat source nodes and complete propagation paths, providing clear evidence for staff to block threat spread and completely eliminate threats, preventing threats from recurring and improving the thoroughness of threat handling.

[0079] Step S106: Generate and send a feedback message based on the dynamic risk assessment results and the source tracing results.

[0080] In one embodiment, optionally, the feedback message includes: a threat basic information field, a source tracing result field, an impact scope field, and a time dimension field; The basic threat information fields include: threat type, core attack point, and risk level; The traceability result fields include: a list of propagation path nodes, an identifier of the source node, and traceability credibility; The impact scope field includes: the number of affected nodes, hierarchical distribution, and correlation with key business operations; The time dimension field includes monitoring time, identification time, and traceability completion time; When sending the feedback message, the feedback priority is determined based on the dynamic risk assessment results, with high-risk messages being sent first.

[0081] Feedback messages: These are structured messages containing key threat information, used to transmit security alerts and handling suggestions to pre-defined receiving terminals (such as network security management centers and operation and maintenance personnel terminals). They are the core carrier for achieving rapid threat response.

[0082] Feedback Priority: This refers to the message sending priority set based on the results of dynamic risk assessment. Messages corresponding to high-risk threats are sent first to ensure that high-risk threats can be dealt with in a timely manner.

[0083] Preset receiver: refers to a pre-set terminal or system that is responsible for receiving feedback messages and handling threats. It is usually a network security management and control center, or a work terminal for operation and maintenance personnel.

[0084] This step first integrates the dynamic risk assessment results (dynamic risk assessment value, risk level) obtained in step S104 and the source tracing results (propagation path, source node, source tracing credibility) obtained in step S105, and generates a feedback message according to a preset format. The feedback message contains four core fields: basic threat information field (threat type, core attack point, risk level), source tracing result field (propagation path node list, source node identifier, source tracing credibility), impact scope field (number of affected nodes, hierarchical distribution, key business relevance), and time dimension field (monitoring time, identification time, source tracing completion time), ensuring that the message information is comprehensive and standardized, facilitating the receiving end to quickly grasp the threat situation. After generating the feedback message, the feedback priority is determined according to the dynamic risk assessment results, with high-risk level messages being sent to the preset receiving end first, and messages of the same level being sent in order of source tracing completion time. After receiving the feedback message, the receiving end can quickly formulate a handling plan based on the message information (such as blocking the source node IP, closing the core attack port, and investigating the affected nodes), realizing rapid threat response and handling.

[0085] The aforementioned technical solution integrates core information from risk assessment and attribution into the feedback message. Its clear structure and comprehensive content enable the receiving end to quickly grasp the key aspects of the threat without needing to integrate data from multiple stages, thus improving the efficiency of threat handling. By setting feedback priorities according to risk levels, it ensures that high-risk threats are handled first, avoiding delays in handling high-risk threats due to low-risk messages consuming resources, and reducing losses caused by threats. Furthermore, it achieves accurate transmission of threat information, establishing a complete closed loop of "monitoring-identification-assessment-attribution-feedback," ensuring the timeliness and targeted nature of threat handling, and improving the response efficiency of the entire network security protection system.

[0086] The above-mentioned solution in this application can capture network anomalies in real time, accurately identify threat types and core attack points, dynamically assess the scope and impact of risk spread, quickly trace the source and propagation path of threats, and promptly provide feedback on key security information. Moreover, it can be adapted to different network architectures, improve the efficiency and accuracy of protection response, effectively reduce the losses caused by security risks, and provide reliable protection for stable network operation.

[0087] The above technical solution of the present invention will be described in detail below with reference to a specific embodiment.

[0088] A certain group deployed an office network based on the domestic IT innovation architecture, which includes a core layer, aggregation layer, and access layer with a total of 45 nodes. The core layer nodes are responsible for key tasks such as financial data management and operation and maintenance of core business systems. This system was introduced to achieve dynamic network security protection.

[0089] After the system was operational, it continuously monitored the operating status of each node across four core dimensions: bandwidth utilization, number of connection sessions, CPU utilization, and memory usage. Monitoring revealed that several operating parameters of access layer node X differed significantly from its historical normal operating status. The calculated anomaly confidence level for this node was 0.83 (higher than the preset anomaly threshold of 0.75), thus classifying it as an abnormal node. Based on node X's network layer and connection radius, the system selectively collected operating status data and interaction log data from its directly associated nodes and secondary hop nodes, covering the four core monitoring dimensions of the five associated nodes.

[0090] The collected traffic data, log data, and configuration data are classified and processed: features such as the proportion of abnormal protocols and the number of cross-network segment accesses are extracted from the traffic data; features such as the number of abnormal logins and the matching degree of key file access records are extracted from the log data; and features such as the deviation of permission configuration and the lag time of software version updates are extracted from the configuration data. Then, the credibility weight is calculated based on the completeness of the collection of various types of data and the transmission error rate. The importance weight is determined by combining the correlation between each feature and threat identification. A multi-dimensional security feature matrix containing 10 samples and 16 features is constructed through weighted fusion, and the feature values ​​of each dimension are standardized and quantified.

[0091] Based on the characteristics of the group's network architecture, an intelligent identification model integrating a hierarchical attention mechanism was constructed. The hierarchical identifiers and service carrying weights of the three-layer network were used as architectural parameters. The calculated feature attention weights of core layer nodes were concentrated between 0.88 and 0.92, indicating significantly higher threat identification sensitivity than the aggregation and access layers (the core layer has the lowest tolerance for false positives). After extracting local features through convolutional layers and strengthening key features of core nodes through attention layers, the model calculated the weighted sum of the cosine similarity between the security feature matrix and the preset threat feature library, and the fit between network behavior and typical threat behavior. This sum was 0.91 (higher than the preset threshold of 0.82), indicating a brute-force attack. Based on the statistical ranking of feature contribution values, the top three ports / processes (port 22, process SSHd, and port 3389) were selected as the core attack points.

[0092] Based on the network topology and threat assessment results, the calculated threat strength index is 0.87, the diffusion attenuation coefficient is 0.55 (due to high network density), and the threat diffusion rate is 12% of the increase in affected nodes per unit time. Among the affected nodes, the importance index is 0.88 for core layer nodes, 0.65 for aggregation layer nodes, and 0.45 for access layer nodes. The final dynamic risk assessment value is 0.79, corresponding to a high-risk level. The assessment results show that the threat has spread to one core layer node and two aggregation layer nodes, potentially leading to the risk of financial data leakage.

[0093] By using bidirectional tracing of log chains and timestamps, communication logs of related nodes were extracted to construct two candidate propagation paths. After verifying the rationality of the path propagation logic through reverse deduction using timestamps, the average trust level of each path node was calculated. One path had an average trust level of 0.94 (higher than the preset threshold of 0.88) and the shortest propagation time (18 minutes), and was determined to be the effective propagation path. The tracing revealed that the threat propagation path was "external node F → access layer node X → aggregation layer node Y → core layer node Z", with the source node being external node F, and the tracing credibility was 0.92.

[0094] A feedback message containing information such as threat type, core attack points, high-risk level, propagation path, and source node is generated. Due to the high risk level, it is given priority to the group's network security control center. Upon receiving the message, the control center immediately takes measures such as blocking the source IP and temporarily closing the core attack ports, successfully preventing the further spread of the threat and ensuring the normal operation of core businesses.

[0095] In summary, the above embodiments can capture abnormal network node states in real time, efficiently integrate multiple types of data to form comprehensive security features, accurately determine threat types and core attack points, optimize identification sensitivity to adapt to different network layer characteristics, dynamically assess the scope and impact of threat spread, quickly locate the source and propagation path of threats through a two-way tracing mechanism, accurately push feedback content containing key information according to risk priority, adapt to the domestic IT innovation environment and have portability, effectively improve the initiative and targeting of network threat protection, reduce the risk and loss of threat spread, and ensure the stable operation of network systems.

[0096] like Figure 6 As shown, in a second aspect, embodiments of this application provide a network security threat adaptive processing device 60, the device comprising: The first determining module 61 is used to monitor the multi-dimensional status parameters of the distributed network nodes of the target network in real time, determine the abnormal nodes through the multi-dimensional status parameters, and collect the corresponding target security data according to the abnormal nodes. The construction module 62 is used to perform feature association and fusion processing on the target security data to construct a multi-dimensional security feature matrix; The second determining module 63 is used to construct a target network security identification model based on the characteristics of the target network architecture, identify threat signals on the multi-dimensional security feature matrix, and determine the corresponding threat identification results, wherein the threat identification results include threat type and core attack point; The threat identification module 64 is used to identify the spread and impact of threats based on the network topology and the threat identification results, and to obtain dynamic risk assessment results. The source tracing module 65 is used to trace the propagation path and source node of a threat using a two-way source tracing mechanism to obtain the source tracing results; The generation module 66 is used to generate and send feedback messages based on the dynamic risk assessment results and the source tracing results.

[0097] In one embodiment, optionally, the first determining module includes: The first calculation unit is used to calculate the anomaly confidence of a node based on the deviation of the operating parameters of each monitoring dimension of the node, the preset importance weight of each dimension, the similarity between the current multi-dimensional operating status and the normal status of the same period in history, and in combination with the node association anomaly ratio. The determination unit is used to determine that the node is an abnormal node when the abnormal confidence level is greater than or equal to a preset abnormal threshold. The monitoring dimensions include at least bandwidth utilization, number of connection sessions, CPU utilization, and memory usage; The target security data includes node running status data, interaction log data, configuration data, and related behavioral characteristic data.

[0098] In one embodiment, optionally, the building module includes: The extraction unit is used to classify the target security data according to the data type and extract the security features corresponding to each type of security data. The second calculation unit is used to calculate the credibility weight of various types of security data and the importance weight of each security feature, and to perform correlation fusion on the extracted security features using a weighted fusion method. The matrix construction unit is used to construct a multi-dimensional security feature matrix based on the fused feature data.

[0099] In one embodiment, optionally, the data type includes traffic data, log data, and configuration data; The security characteristics corresponding to the traffic data include: average data packet length, percentage of abnormal protocols, percentage of one-way data flow, port scan frequency, number of cross-network segment accesses, and data transmission rate fluctuation coefficient. The security features corresponding to the log data include: number of abnormal logins, frequency of permission changes, error command return rate, matching degree of critical file access records, proportion of abnormal process startups, and missing log fields. The security features corresponding to the configuration data include: port opening compliance, permission configuration deviation, firewall rule matching rate, software version update lag time, and configuration parameter tampering traces.

[0100] In one embodiment, optionally, the second computing unit is used for: The credibility weight is calculated based on the collection integrity coefficient, transmission error rate, and inherent credibility benchmark of various types of security data. The importance weight is calculated based on the correlation between the security feature and the threat identification result, the discrimination coefficient and stability adjustment coefficient of the security feature, and the weight benchmark value.

[0101] In one embodiment, optionally, the second determining module includes: The model building unit is used to build a target network security identification model based on a hierarchical attention mechanism, and incorporates the hierarchical identifiers of the target network core layer, aggregation layer, and access layer, as well as the service carrying weights, as network architecture characteristic parameters into the model. The third calculation unit is used to combine network node connectivity and link association strength as prior information to calculate the feature attention weights of nodes at each level, and adaptively adjust the threat identification sensitivity of nodes at different levels according to the feature attention weights. The processing unit is used to input the multi-dimensional security feature matrix into the target network security identification model, extract, enhance and perform probability calculations on the multi-dimensional security feature matrix through the target network security identification model, complete threat signal identification, and determine the threat identification result.

[0102] In one embodiment, optionally, the second determining module further includes: The fourth calculation unit is used to calculate the cosine similarity between the multi-dimensional security feature matrix and the preset threat feature database, as well as the fit between the network behavior sequence and the preset threat behavior. The fifth calculation unit is used to perform a weighted summation based on the cosine similarity and the fit to obtain the comprehensive matching degree; The output unit is used to output the corresponding threat type in response to the overall matching degree being higher than a preset threshold; The filtering unit is used to calculate the sum of the feature contribution values ​​of each port / process, and filter a preset number of ports / processes from high to low according to the sum of the contribution values ​​as the core attack points.

[0103] In one embodiment, optionally, the threat identification module includes: The sixth calculation unit is used to comprehensively consider threat intensity, threat spread rate, spread attenuation, and the importance of affected nodes, and obtain a dynamic risk assessment value through weighted calculation; The rating unit is used to map dynamic risk assessment values ​​to three risk levels—high, medium, and low—according to a preset range. The dynamic risk assessment results include dynamic risk assessment values ​​and corresponding risk levels.

[0104] In one embodiment, optionally, the tracing module includes: The path construction unit is used to extract threat-related data stream transmission records based on the communication logs of each node and construct a preliminary propagation path; The verification unit is used to reverse-engineer the timestamps to verify whether the attack time sequence of each node on the initial propagation path conforms to the propagation logic. The first determining unit is used to introduce node trust verification. Only when the average trust of nodes on the path is higher than the preset trust threshold, the path is confirmed as a valid propagation path, and the starting point of the path is the source node. The second determining unit is used to select the path with the highest average trust level and the shortest propagation time as the final effective propagation path if there are multiple effective propagation paths, and to determine the corresponding source node.

[0105] In one embodiment, optionally, the feedback message includes: a threat basic information field, a source tracing result field, an impact scope field, and a time dimension field; The basic threat information fields include: threat type, core attack point, and risk level; The traceability result fields include: a list of propagation path nodes, an identifier of the source node, and traceability credibility; The impact scope field includes: the number of affected nodes, hierarchical distribution, and correlation with key business operations; The time dimension field includes monitoring time, identification time, and traceability completion time; When sending the feedback message, the feedback priority is determined based on the dynamic risk assessment results, with high-risk messages being sent first.

[0106] Thirdly, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the steps of the above-described adaptive handling method for network security threats.

[0107] Fourthly, a computer-readable storage medium is provided, which stores a computer program that, when executed by a processor, implements the steps of the aforementioned adaptive handling method for network security threats.

[0108] Specific limitations regarding the adaptive processing device for network security threats can be found in the limitations of the adaptive processing method for network security threats described above, and will not be repeated here. Each module in the aforementioned adaptive processing device for network security threats can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device in hardware form, or stored in the memory of a computer device in software form, so that the processor can call and execute the corresponding operations of each module.

[0109] The software tools or components not belonging to our company that appear in the embodiments of this application are merely examples and do not represent actual use.

[0110] In one embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 7 As shown, the computer device includes a processor, memory, network interface, and database connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile and / or volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage media. The network interface is used to communicate with external clients via a network connection. When the computer program is executed by the processor, it implements the functions or steps of a network security threat adaptive handling method on the server side.

[0111] In one embodiment, a computer device is provided, which may be a client, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, network interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The network interface is used to communicate with an external server via a network connection. When the computer program is executed by the processor, it implements the client-side functions or steps of a network security threat adaptive handling method.

[0112] It should be understood that the processor can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. Among these, a general-purpose processor can be a microprocessor or any conventional processor.

[0113] In one embodiment, a computer device is provided, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in any one of the first aspect embodiments.

[0114] It should be noted that the functions or steps that can be implemented by the computer-readable storage medium or electronic device described above can be referred to the relevant descriptions in the foregoing method embodiments. To avoid repetition, they will not be described one by one here.

[0115] It should be understood that the term "and / or" used in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Additionally, the character " / " in this article generally indicates that the preceding and following related objects have an "or" relationship.

[0116] It should be understood that although the terms "first," "second," etc., may be used to describe the setting units in the embodiments of this application, these setting units should not be limited to these terms. These terms are only used to distinguish the setting units from each other. For example, without departing from the scope of the embodiments of this application, the first setting unit may also be referred to as the second setting unit, and similarly, the second setting unit may also be referred to as the first setting unit.

[0117] Depending on the context, the word "if" as used here can be interpreted as "when," "when," "in response to determination," or "in response to detection." Similarly, depending on the context, the phrase "if determination" or "if detection (of the stated condition or event)" can be interpreted as "when determination," "in response to determination," "when detection (of the stated condition or event)," or "in response to detection (of the stated condition or event)."

[0118] In the several embodiments provided in this application, it should be understood that the disclosed systems, apparatuses, and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0119] Furthermore, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or in a combination of hardware and software functional units.

[0120] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments of the above methods. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include non-volatile and / or volatile memory. Non-volatile memory may include read-only memory (ROM), programmable ROM (PROM), electrically programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), or flash memory. Volatile memory may include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM is available in a variety of forms, such as static RAM (SRAM), dynamic RAM (DRAM), synchronous DRAM (SDRAM), dual data rate SDRAM (DDRSDRAM), enhanced SDRAM (ESDRAM), synchronous link DRAM (SLDRAM), RAMbus direct RAM (RDRAM), direct memory bus dynamic RAM (DRDRAM), and memory bus dynamic RAM (RDRAM), etc.

[0121] The above-described embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should all be included within the protection scope of the present invention.

Claims

1. A method for adaptive handling of network security threats, characterized in that, The method includes: Real-time monitoring of multi-dimensional status parameters of distributed network nodes in the target network; identification of abnormal nodes based on multi-dimensional status parameters; and collection of corresponding target security data based on the abnormal nodes. The target security data is subjected to feature association and fusion processing to construct a multi-dimensional security feature matrix; The target network security identification model, constructed based on the characteristics of the target network architecture, identifies threat signals from the multi-dimensional security feature matrix and determines the corresponding threat identification results, wherein the threat identification results include threat type and core attack points; Based on the network topology and the threat identification results, the spread and impact of the threats are identified, and dynamic risk assessment results are obtained. A two-way attribution mechanism is used to trace the propagation path and source nodes of threats to obtain attribution results; Based on the dynamic risk assessment results and the source tracing results, a feedback message is generated and sent. The step of performing feature association and fusion processing on the target security data to construct a multi-dimensional security feature matrix includes: The target security data is classified according to data type, and the security features corresponding to each type of security data are extracted. Calculate the credibility weight of various types of security data and the importance weight of each security feature, and use a weighted fusion method to correlate and fuse the extracted security features; Based on the fused feature data, a multi-dimensional security feature matrix is ​​constructed; The calculation of the credibility weights of various types of security data and the importance weights of each security feature includes: The credibility weight is calculated based on the collection integrity coefficient, transmission error rate, and inherent credibility benchmark of various types of security data. The importance weight is calculated based on the degree of correlation between the security feature and the threat identification result, the discrimination coefficient and stability adjustment coefficient of the security feature, and the weight benchmark value. The target network security identification model, constructed based on the characteristics of the target network architecture, identifies threat signals from the multi-dimensional security feature matrix and determines the corresponding threat identification results, including: A target network security identification model based on a hierarchical attention mechanism is constructed, and the hierarchical identifiers of the target network core layer, aggregation layer, and access layer, as well as the service carrying weights, are incorporated into the model as network architecture characteristic parameters. By combining network node connectivity and link association strength as prior information, the feature attention weights of nodes at each level are calculated, and the threat identification sensitivity of nodes at different levels is adaptively adjusted according to the feature attention weights. The multi-dimensional security feature matrix is ​​input into the target network security identification model. The target network security identification model extracts, enhances, and performs probability calculations on the multi-dimensional security feature matrix to complete threat signal identification and determine the threat identification result.

2. The method according to claim 1, characterized in that, The method of determining abnormal nodes through multi-dimensional state parameters includes: The abnormal confidence of a node is calculated based on the deviation of the operating parameters of each monitoring dimension, the preset importance weight of each dimension, the similarity between the current multi-dimensional operating status and the normal status of the same period in history, and the proportion of abnormal nodes associated with the node. When the anomaly confidence level is greater than or equal to the preset anomaly threshold, the node is determined to be an anomaly node; The monitoring dimensions include at least bandwidth utilization, number of connection sessions, CPU utilization, and memory usage; The target security data includes node running status data, interaction log data, configuration data, and related behavioral characteristic data.

3. The method according to claim 1, characterized in that, The data types include traffic data, log data, and configuration data; The security characteristics corresponding to the traffic data include: average data packet length, percentage of abnormal protocols, percentage of one-way data flow, port scan frequency, number of cross-network segment accesses, and data transmission rate fluctuation coefficient. The security features corresponding to the log data include: number of abnormal logins, frequency of permission changes, error command return rate, matching degree of critical file access records, proportion of abnormal process startups, and missing log fields. The security features corresponding to the configuration data include: port opening compliance, permission configuration deviation, firewall rule matching rate, software version update lag time, and configuration parameter tampering traces.

4. The method according to claim 1, characterized in that, The determination of the corresponding threat identification result includes: Calculate the cosine similarity between the multi-dimensional security feature matrix and the preset threat feature database, as well as the fit between the network behavior sequence and the preset threat behavior; The overall matching degree is obtained by weighted summation of the cosine similarity and the fit. If the overall matching degree is higher than a preset threshold, the corresponding threat type is output. Calculate the sum of the feature contribution values ​​of each port / process, and filter a preset number of ports / processes from high to low based on the sum of the contribution values ​​as the core attack points.

5. The method according to claim 1, characterized in that, Based on the network topology and the threat identification results, the spread and impact of threats are identified, resulting in a dynamic risk assessment, including: A dynamic risk assessment value is obtained by weighting the factors of threat intensity, threat spread rate, spread attenuation, and the importance of affected nodes. The dynamic risk assessment value is mapped to three risk levels—high, medium, and low—according to a preset range. The dynamic risk assessment result includes the dynamic risk assessment value and the corresponding risk level.

6. The method according to claim 1, characterized in that, The bidirectional tracing mechanism uses both log chain and timestamp tracing to trace the propagation path and source node of the threat, including: Based on the communication logs of each node, threat-related data stream transmission records are extracted to construct a preliminary propagation path; By reverse engineering using timestamps, it is verified whether the attack time sequence of each node on the initial propagation path conforms to the propagation logic. A node trust verification is introduced. Only when the average trust of nodes on the path is higher than a preset trust threshold is the path confirmed as a valid propagation path, and the starting point of the path is the source node. If multiple valid propagation paths exist, the path with the highest average trust level and the shortest propagation time is selected as the final valid propagation path, and the corresponding source node is determined.

7. The method according to claim 1, characterized in that, The feedback message includes: threat basic information field, source tracing result field, impact scope field, and time dimension field; The basic threat information fields include: threat type, core attack point, and risk level; The traceability result fields include: a list of propagation path nodes, an identifier of the source node, and traceability credibility; The impact scope field includes: the number of affected nodes, hierarchical distribution, and correlation with key business operations; The time dimension field includes monitoring time, identification time, and traceability completion time; When sending the feedback message, the feedback priority is determined based on the dynamic risk assessment results, with high-risk messages being sent first.

8. A network security threat adaptive processing device, characterized in that, The device includes: The first determination module is used to monitor the multi-dimensional status parameters of the distributed network nodes of the target network in real time, determine the abnormal nodes through the multi-dimensional status parameters, and collect the corresponding target security data based on the abnormal nodes. A construction module is used to perform feature association and fusion processing on the target security data to construct a multi-dimensional security feature matrix; The second determining module is used to construct a target network security identification model based on the characteristics of the target network architecture, identify threat signals on the multi-dimensional security feature matrix, and determine the corresponding threat identification results, wherein the threat identification results include threat type and core attack point; The threat identification module is used to identify the spread and impact of threats based on the network topology and the threat identification results, and to obtain dynamic risk assessment results. The source tracing module is used to trace the propagation path and source node of a threat using a two-way source tracing mechanism to obtain the source tracing results; The generation module is used to generate and send feedback messages based on the dynamic risk assessment results and the source tracing results; The building module includes: The extraction unit is used to classify the target security data according to the data type and extract the security features corresponding to each type of security data. The second calculation unit is used to calculate the credibility weight of various types of security data and the importance weight of each security feature, and to perform correlation fusion on the extracted security features using a weighted fusion method. The matrix construction unit is used to construct a multi-dimensional security feature matrix based on the fused feature data. The second computing unit is used for: The credibility weight is calculated based on the collection integrity coefficient, transmission error rate, and inherent credibility benchmark of various types of security data. The importance weight is calculated based on the degree of correlation between the security feature and the threat identification result, the discrimination coefficient and stability adjustment coefficient of the security feature, and the weight benchmark value. The second determining module includes: The model building unit is used to build a target network security identification model based on a hierarchical attention mechanism, and incorporates the hierarchical identifiers of the target network core layer, aggregation layer, and access layer, as well as the service carrying weights, as network architecture characteristic parameters into the model. The third calculation unit is used to combine network node connectivity and link association strength as prior information to calculate the feature attention weights of nodes at each level, and adaptively adjust the threat identification sensitivity of nodes at different levels according to the feature attention weights. The processing unit is used to input the multi-dimensional security feature matrix into the target network security identification model, extract, enhance and perform probability calculations on the multi-dimensional security feature matrix through the target network security identification model, complete threat signal identification, and determine the threat identification result.

9. A computer device, characterized in that, include: At least one processor; And, a memory communicatively connected to the at least one processor; The memory stores instructions that can be executed by the at least one processor; The instructions are configured to perform the method described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, The device stores computer-executable instructions for performing the method as described in any one of claims 1 to 7.

Images