Intelligent perception and dynamic defense method for network security situation of smart park

Abstract

The application discloses a network security situation intelligent perception and dynamic defense method for a smart park, relates to the technical field of network security, and solves the technical problems that the traditional defense is difficult to predict the intention of an attacker and unknown threats, multi-region defense lacks cooperation and is prone to strategy conflicts, the defense strategy is fixed and single, and it is difficult to balance protection, dynamic estimation of an implicit parameter of an attacker, reduction of information difference, modeling of an attacker type and intention as an implicit variable, dynamic estimation of a posterior distribution through Bayesian updating, support of a psychological deterrence type active defense strategy based on dynamic estimation of an attacker type, targeted design of a deterrence utility function, guidance of a defense strategy from passive interception to active deterrence, training of a globally optimal flexible defense strategy, combination of PPO+GAE training of a global strategy, automatic generation of IP hopping, port randomization, path deception and other flexible defense actions under multi-target constraints, and avoidance of the limitations of a single defense action.

Description

Technical Field

[0001] This invention belongs to the field of network security, specifically a method for intelligent perception and dynamic defense of network security situation in smart parks. Background Technology

[0002] With the deepening digitalization and networking of smart parks, the number of IoT terminals, business systems, and cross-domain interaction nodes has surged, leading to more complex park network topologies and more diversified business scenarios. Park boundaries are becoming increasingly blurred, resulting in frequent network attacks such as malicious scanning, vulnerability exploitation, data breaches, and lateral movement. Attack methods are becoming more covert, phased, and coordinated. General security devices primarily rely on single-point alerts and passive interception, lacking a global perspective and failing to depict the overall network security status, making them unsuitable for the complex and dynamic attack and defense environment of smart parks. Therefore, network security situational awareness and proactive dynamic defense have become core requirements for the security construction of smart parks.

[0003] Existing cybersecurity situational awareness and defense solutions lack the ability to predict attacker behavior patterns. Traditional defenses cannot dynamically estimate attacker types and intentions, and can only passively respond to known attacks, lacking the ability to predict unknown threats such as zero-day attacks and APT attacks. Furthermore, multi-subdomain defense agents lack coordination among independent subdomain decisions, potentially leading to conflicting defense actions or wasted resources, failing to form a globally optimal defense strategy. Defense actions are often simplistic and cannot meet multi-objective constraints. Traditional defenses often employ fixed strategies, failing to dynamically balance defense effectiveness, business impact, and resource consumption, resulting in either insufficient or excessive defense impacting business. Static decoys are easily detected by attackers. Traditional honeypots use fixed configurations, making them easily fingerprinted by attackers and unable to achieve dynamic path guidance and trapping. Data silos exist between campuses, hindering threat intelligence sharing. Each campus operates independently, lacking a unified mechanism for sharing de-identified intelligence, preventing the reuse of defense experience from a single campus within the alliance, and allowing attack patterns to easily spread horizontally within the alliance. Summary of the Invention

[0004] This invention aims to solve at least one of the technical problems existing in the prior art; to this end, this invention proposes a network security situational awareness and dynamic defense method for smart parks, which is used to solve the technical problems of traditional defenses being unable to predict attackers' intentions and unknown threats, lack of coordination in multi-area defenses and easy policy conflicts, and fixed and single defense strategies that are difficult to balance protection.

[0005] To address the aforementioned problems, the first aspect of this invention provides a method for intelligent perception and dynamic defense of network security situation in smart parks, comprising the following steps: The campus network is modeled as a dynamic heterogeneous graph. By deploying distributed probes and graph neural networks, multi-source logs, network traffic and terminal behavior data are collected in real time. Spatiotemporal features are extracted through a time-series graph attention network to calculate the probability of each node deviating from the expected behavior and the information value. By using a Bayesian deep inference engine, the attacker's implicit parameters are modeled as latent variables, and the posterior distribution is updated to quantify the risk of information asymmetry. The value decomposition network enables collaborative decision-making among multi-subdomain agents, and the global policy is trained by combining the near-end policy optimization algorithm. Based on the deep Q network, the IP jump defense action, port randomization defense action, or path deception defense action are dynamically selected. By combining the deviation probability and information value of network nodes from the expected behavior with the global policy, flexible defense actions that meet multi-objective constraints are generated. Based on the results of information asymmetry risk analysis, risk crisis nodes are screened, and decoy node chains are set up for the risk crisis nodes by using a deep Q network. Within the smart park alliance, de-identified threat intelligence is shared, and joint defense within the smart park alliance is carried out based on flexible defense actions and decoy node chains of nodes in different smart parks.

[0006] Optionally, in one example of the above aspects, the campus network is modeled as a dynamic heterogeneous graph, and multi-source logs, network traffic, and terminal behavior data are collected in real time by deploying distributed probes and graph neural networks, including the following steps: The campus network is modeled as a dynamic heterogeneous graph. Host nodes, server nodes, and user nodes are grouped into node sets. Edges are established based on the communication and access relationships between nodes in the node sets. A graph snapshot is constructed for each preset time window. , take a snapshot Input the TGAT temporal graph attention network, and compute the representation vector of each node in the TGAT temporal graph attention network through aggregation functions and attention mechanisms; Output the representation vector of each node, and collect multi-source logs, network traffic and terminal behavior data of nodes in the node cluster in real time through deployed distributed probes.

[0007] Optionally, in one example of the above aspects, spatiotemporal features are extracted using a temporal graph attention network, and the probability of deviation from expected behavior and information value of each node are calculated, including the following steps: Spatiotemporal features are extracted using a temporal graph attention network, and the probability of deviation from the expected behavior of each node is calculated. By proactively requesting high-precision logs from key nodes, and using an information value function, the information value of the nodes is analyzed. Calculate and dynamically select the top-K information value nodes; for the top-K information value nodes, determine whether their probability of deviating from the expected behavior is greater than a threshold; if it is greater than the threshold, issue a deviation warning for the corresponding high-risk financial business node.

[0008] Optionally, in one example of the above aspects, the attacker's latent parameters are modeled as latent variables using a Bayesian deep inference engine, and the posterior distribution is updated to quantify the risk of information asymmetry, including the following steps: Model the defender's implicit parameters (capabilities, resources, targets) against the attacker as latent variables. The implicit parameters include: capabilities, resources, and objectives, and the posterior distribution is updated in real time using variational inference; By using a Bayesian neural network to output the joint distribution of action intentions, information asymmetry is transformed into probabilistic risk, thereby quantifying the risk of information asymmetry.

[0009] Optionally, in one example of the above aspects, collaborative decision-making among multi-subdomain agents is achieved through a value decomposition network, and a global policy is trained by combining a proximal policy optimization algorithm, including the following steps: The smart park is divided into N defense subdomains according to functional boundaries, including: office area, server area, and entrance / exit. Each subdomain deploys an R-Agent to execute intelligent agents, and each R-Agent only observes the local state of its own subdomain. This includes traffic characteristics, asset status, and alarm information corresponding to the subdomain; and outputs local defense actions. This includes updating access control for the corresponding subdomain, deploying honeypots, and scrubbing traffic. All R-Agents share a single C-Agent global decision-making agent, which is responsible for summarizing global information and learning the joint value function; By using Value Decomposition Network (VDN) to model the joint Q-value ; Set the local observation state of the subdomain as follows: The action is ; The joint Q-value is calculated by the C-Agent global decision-making agent, and backpropagation of the TD error is used to update the local Q-network and residual cooperative terms of all R-Agents simultaneously; during the execution phase, the R-Agents update the local Q-network and residual cooperative terms based on local observations. and local Q value Output Action ; Based on local observation Local Q value and the output action The entire defense system is modeled as a partially observable Markov decision process (POMDP), where, in each decision cycle, the observation... This includes: graph embeddings from TGAT output, Bayesian risk posterior, resource status; and defensive actions. High-dimensional combinations include: MTD type, access control list updates, honeypot deployment location; attacker type. This includes: script kiddies, APT groups, and insider malicious actors; Attacker type is estimated based on Bayesian game theory, and a global policy is trained using a function containing active deterrence effect as the reward signal.

[0010] Optionally, in one example of the above aspects, the attacker type is estimated based on Bayesian game theory, and a global policy is trained via PPO using a function containing active deterrence utility as the reward signal, including the following steps: The defender performs a Bayesian update based on the prior distribution of attacker types to dynamically estimate the current attacker type. Active deterrence utility function in Bayesian game theory As a reward function, the reward function is set to guide the strategy to learn proactive defense. The deterrent factor is directly related to the effectiveness of active defense; Based on the set reward function, the global policy is trained by optimizing the PPO proximal policy.

[0011] Optionally, in one example of the above aspects, based on the deep Q network, a flexible defense action that satisfies multi-objective constraints is generated by dynamically selecting IP hopping defense action, port randomization defense action, or path spoofing defense action, and combining the probability of network nodes deviating from expected behavior with information value, along with a global strategy. This includes the following steps: Obtain the information value of each node And the probability that a network node deviates from its expected behavior at time t. And perform normalization processing; The value of the normalized node information and the probability of the network node deviating from the expected behavior are weighted and summed to obtain the node's comprehensive risk score. The risk will be divided into three levels based on the node's overall risk score (RiskScore). Maintain an independent DQN agent for each subdomain, and set its state to... The action is ; The reward function is set by combining security gains and resource costs; The DQN agent dynamically selects MTD actions based on a reward function and through a deep Q-network. In the historical data, feature data corresponding to nodes that were successfully defended using different flexible defense actions, as well as feature data corresponding to nodes that were not successfully defended, are selected. The feature data corresponding to the selected nodes are labeled as successfully defended and unsuccessfully defended. Based on the risk level, MTD action and global strategy obtained from the analysis of the feature data corresponding to the nodes, an AI large model is trained to output the corresponding flexible defense action.

[0012] Optionally, in one example of the above aspects, based on the results of information asymmetry risk analysis, risk crisis nodes are screened, and a decoy node chain is set up for the risk crisis nodes using a deep Q-network, including the following steps: Based on the results of the information asymmetry risk analysis, the information asymmetry risk value at the node. When the threshold is exceeded, a decoy node chain is designed to be used when the corresponding node is attacked. Multiple masquerading services are inserted into the real topology. For nodes that are to be set up with decoy node chains, a deep Q network agent dynamically decides which decoy node to expose to the virtual attacker of the current node. The status is the sequence of nodes recently visited by the virtual attacker, the alarms triggered, and the response history. The action is to select the next decoy ID to be exposed. Based on the set reward function, the next exposed decoy ID is output by the virtual attacker after training the deep Q network agent. Based on the output of the next exposed decoy ID, a decoy node chain of risk crisis nodes is formed.

[0013] Optionally, in one example of the above aspects, sharing de-identified threat intelligence within a smart park alliance and conducting joint defense within the smart park alliance based on flexible defense actions and decoy node chains of nodes within different smart parks includes the following steps: Each smart park node collects threat intelligence, including the attack source IP, attack type, attack time, and affected nodes; The collected intelligence is categorized according to the type of attack, including malicious scanning, vulnerability exploitation, and data breach. Sensitive information involving the park's internal areas is masked or replaced with virtual information, and the de-identified intelligence is encrypted. An intelligence-sharing platform is built within the alliance. Encrypted data is uploaded to the intelligence-sharing platform, which uses a large language model to generate joint defense suggestions for smart parks based on the flexible defense actions and decoy node chains of nodes in different smart parks.

[0014] According to another aspect of this disclosure, a network security situation intelligent perception and dynamic defense system for smart parks is provided, characterized in that the system adopts the network security situation intelligent perception and dynamic defense method for smart parks as described in any one of claims 1-9 to realize network security situation intelligent perception and dynamic defense for smart parks.

[0015] Compared with the prior art, the beneficial effects of the present invention are: This invention dynamically estimates the attacker's latent parameters, reducing information asymmetry by modeling attacker type and intent as latent variables. Through Bayesian updates, it dynamically estimates the posterior distribution, resolving the information asymmetry problem between attackers and defenders. This allows the defender to predict attacker behavior patterns instead of reacting passively. Supporting proactive defense strategies based on psychological deterrence, this invention allows for the targeted design of deterrence utility functions, guiding defense strategies from passive interception to proactive deterrence and improving long-term defense effectiveness.

[0016] This invention trains a globally optimal flexible defense strategy by combining PPO+GAE to train the global strategy. Under the multi-objective constraints of defense effectiveness, business cost, and resource overhead, it automatically generates flexible defense actions such as IP hopping, port randomization, and path spoofing, avoiding the limitations of single defense actions. Simultaneously, it achieves dynamic path guidance and trapping of high-risk nodes. Based on node risk and information value, a DQN agent dynamically selects the decoy node exposure strategy, leading attackers into a fictitious subnet. This both consumes their resources and collects their behavioral characteristics, achieving the dual objectives of trapping and intelligence gathering. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Figure 1 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0019] The technical solution of the present invention will be clearly and completely described below with reference to the embodiments. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Please see Figure 1The first aspect of this invention provides a method for intelligent perception and dynamic defense of network security situation in smart parks, comprising the following steps: The campus network is modeled as a dynamic heterogeneous graph. By deploying distributed probes and graph neural networks, multi-source logs, network traffic and terminal behavior data are collected in real time. Spatiotemporal features are extracted through a time-series graph attention network to calculate the probability of each node deviating from the expected behavior and the information value. By using a Bayesian deep inference engine, the attacker's implicit parameters are modeled as latent variables, and the posterior distribution is updated to quantify the risk of information asymmetry. The value decomposition network enables collaborative decision-making among multi-subdomain agents, and the global policy is trained by combining the near-end policy optimization algorithm. Based on the deep Q network, the IP jump defense action, port randomization defense action, or path deception defense action are dynamically selected. By combining the deviation probability and information value of network nodes from the expected behavior with the global policy, flexible defense actions that meet multi-objective constraints are generated. Based on the results of information asymmetry risk analysis, risk crisis nodes are screened, and decoy node chains are set up for the risk crisis nodes by using a deep Q network. Within the smart park alliance, de-identified threat intelligence is shared, and joint defense within the smart park alliance is carried out based on flexible defense actions and decoy node chains of nodes in different smart parks.

[0021] Specifically, in this embodiment, the campus network is modeled as a dynamic heterogeneous graph. TGAT is used to simultaneously learn the spatial interaction and temporal evolution patterns between nodes. The extracted node representation vectors can more comprehensively characterize behavioral features, solving the problem that traditional static graph models have difficulty capturing dynamic attacks.

[0022] The output of quantifiable node risk indicators is based on node representation vectors, which can directly calculate the probability of deviation from expected behavior and information value, realizing a quantitative upgrade from the number of alarms to the degree of risk, and providing a reliable basis for subsequent defense decisions.

[0023] Dynamically estimating attacker's latent parameters reduces information gaps by modeling attacker type and intent as latent variables and dynamically estimating their posterior distribution through Bayesian updates. This solves the problem of information asymmetry between attackers and defenders, allowing defenders to predict attacker behavior patterns instead of responding passively.

[0024] Supporting proactive defense strategies based on psychological deterrence involves dynamic estimation of attacker type, allowing for the design of targeted deterrence utility functions. This guides defense strategies from passive interception to proactive deterrence, improving long-term defense effectiveness.

[0025] The problem of collaboration and credit allocation among multi-subdomain defense agents is solved by using a value decomposition network to decompose the global Q-value into local Q-values ​​plus residual collaboration terms. This not only ensures the distributed execution of subdomain agents but also realizes implicit collaboration across subdomains, thus solving the problem of each agent fighting alone in multi-agent defense.

[0026] The training of globally optimal flexible defense strategies combines PPO+GAE to train global strategies. Under the multi-objective constraints of defense effectiveness, business cost, and resource consumption, it automatically generates flexible defense actions such as IP hopping, port randomization, and path spoofing, avoiding the limitations of single defense actions.

[0027] Dynamic path guidance and trapping of high-risk nodes are achieved based on node risk and information value. The DQN agent dynamically selects the decoy node exposure strategy to lure attackers into a fictitious subnet, thereby consuming their resources and collecting their behavioral characteristics, achieving the dual goals of trapping and intelligence gathering.

[0028] Cross-park threat intelligence sharing and defense strategy migration utilize an anonymized intelligence sharing platform to transform single-park defense experience into alliance-level joint defense knowledge while protecting privacy. This allows for the recommendation of suitable defense strategies for new parks, enabling the alliance to mitigate single-point threats.

[0029] In one embodiment of the present invention, the campus network is modeled as a dynamic heterogeneous graph. By deploying distributed probes and graph neural networks, multi-source logs, network traffic, and terminal behavior data are collected in real time, including the following steps: The campus network is modeled as a dynamic heterogeneous graph, and host nodes, server nodes, and user nodes are grouped into node sets. ,in, Indicates the host node, Indicates a service node. Representing user nodes, edges are established based on the communication and access relationships between nodes in the node set, and a graph snapshot is constructed for each preset time window. , take a snapshot Inputting the TGAT temporal graph attention network, the network simultaneously captures spatial adjacency relationships and temporal evolution patterns, generating a low-dimensional representation vector for each node. The representation vector for each node is then calculated within the TGAT temporal graph attention network using aggregation functions and attention mechanisms, as shown in the formula: in, Let be the representation vector of node v at time t. For node v in time The low-dimensional representation vector, For nodes In time The low-dimensional representation vector of node v; AGGREGATE is the aggregation function used to aggregate information from different time steps; ATTENTION is the attention function used to calculate the attention weights between a node and its neighboring nodes; N(v) is the set of neighboring nodes of node v; Output the representation vector of each node, and collect multi-source logs, network traffic and terminal behavior data of nodes in the node cluster in real time through deployed distributed probes.

[0030] In one embodiment of the present invention, spatiotemporal features are extracted using a temporal graph attention network, and the probability of deviation from expected behavior and information value of each node are calculated, including the following steps: Spatiotemporal features are extracted using a temporal graph attention network, and the probability of deviation from the expected behavior for each node is calculated using the following formula: in, This represents the probability that a network node deviates from its expected behavior at time t. This value reflects the degree to which the node's behavior deviates from the normal pattern; the higher the value, the greater the probability of deviation. The activation function is, in this embodiment, the activation function is the sigmoid function, which maps the input value to between 0 and 1, so that the output can be interpreted as a probability; d is the scaling factor, which is usually related to the key dimension in the attention mechanism and is used to adjust the scale of the inner product to prevent the value from being too large or too small; Given the query vector for the current observation at time t, in the attention mechanism, the query vector is used to match it with the key vector to determine the relevance of different parts; Given the key vector in the past window at time t, the key vector is multiplied by the query vector to calculate the attention weights. This is the transpose of the key vector at time t, used for matrix multiplication with the query vector; Given a value vector at time t, in the attention mechanism, the value vector contains actual information. It is weighted and summed according to the attention weights to obtain the final output. In this embodiment, the threshold for the probability of deviation from expected behavior is set by the maximum value of the probability of deviation from expected behavior when no network security failure occurs in the statistical historical data.

[0031] By actively requesting high-precision logs from key nodes, and using an information value function, the information value of the nodes is analyzed. The formula is as follows: in, The information value of nodes; To address the uncertainty of nodes, entropy is predicted using a model. As a measure, the higher the prediction entropy, the more uncertain the model's prediction of the node's state, and the more valuable information the node may contain. Let $\frac{ ... In this embodiment, prediction entropy is used to quantify the model's uncertainty about the current state of a node (whether it has been compromised or is abnormal): Where Ks is the number of node status categories (in this embodiment, there are 3 categories: normal / abnormal / suspicious); The model predicts the probability that a node belongs to the ks-th class; This is the representation vector of the existing node v in the model.

[0032] Calculate and dynamically select the top-K information value nodes; for the top-K information value nodes, determine whether their probability of deviating from the expected behavior is greater than a threshold; if it is greater than the threshold, issue a deviation warning for the corresponding high-risk financial business node.

[0033] In this embodiment, the threshold for the probability of deviation from expected behavior is set by the maximum value of the probability of deviation from expected behavior when no network security failure occurs in the statistical historical data.

[0034] In one embodiment of the present invention, the attacker's implicit parameters are modeled as latent variables using a Bayesian deep inference engine, and the posterior distribution is updated to quantify the risk of information asymmetry, including the following steps: Model the defender's implicit parameters (capabilities, resources, targets) against the attacker as latent variables. The implicit parameters include: capabilities, resources, and objectives. The posterior distribution is updated in real time using variational inference. in, For a given observation sequence In this context, the posterior probability distribution of the latent variable θ reflects the latest understanding of the attacker's latent parameters after observing a series of data, including capabilities, resources, and objectives. By continuously updating this distribution, changes in the attacker's intent can be tracked in real time. θ is a latent variable representing the defender's latent parameters of the attacker. The attacker's capability parameters include attack skill level and available tools; resource parameters include available computing resources and network bandwidth; and objective parameters include the purpose the attack aims to achieve. The observation sequence consists of a series of observation data from time step 1 to time step t. This data can include alarm information generated by the system and abnormal network traffic, serving as a source for the defender to obtain attack-related information. Let be the likelihood function, representing the observed sequence given the attacker's parameter θ. The probability, It describes the correlation between attacker parameters and observed data, that is, the probability of specific observed data appearing under different combinations of attacker parameters; Let be the prior probability distribution under the attacker's parameters θ, reflecting the defender's initial understanding of the attacker's parameters θ before any observation data is available. Based on the defender's experience, historical data, or domain knowledge, a starting point is provided for subsequent inferences; By using a Bayesian neural network to output the joint distribution of action intent, information asymmetry is transformed into probabilistic risk, thus quantifying the risk of information asymmetry. The formula is as follows: in, Let be the information asymmetry risk value at time t, used to measure the potential risk caused by information asymmetry at the current moment. By transforming the information asymmetry problem into probabilistic risk, the security situation faced by the system can be assessed more intuitively; E is the expectation operator, which indicates that the expectation calculation is performed on the following expression. Here, it is used to calculate the average damage value under different attacker parameters θ. It indicates that θ is derived from the posterior probability distribution. The data was obtained through sampling, which means that when calculating the risk, all possible combinations of attacker parameters and their corresponding probabilities were considered. The damage function is defined to calculate the attack on the attacker's parameter θ. The extent of damage suffered by the system in interaction with the current defense measures (Defense) can be quantified in various forms, such as the amount of data breaches, system downtime, and economic losses. = ,in, The information value of nodes, Let t be the probability that a network node deviates from its expected behavior at time t.

[0035] In one embodiment of the present invention, collaborative decision-making among multi-subdomain agents is achieved through a value decomposition network, and a global policy is trained by combining a proximal policy optimization algorithm, including the following steps: The smart park is divided into N defense subdomains according to functional boundaries, including: office area, server area, and entrance / exit. Each subdomain deploys an R-Agent to execute intelligent agents, and each R-Agent only observes the local state of its own subdomain. This includes traffic characteristics, asset status, and alarm information corresponding to the subdomain; and outputs local defense actions. This includes updating access control for the corresponding subdomain, deploying honeypots, and scrubbing traffic. All R-Agents share a single C-Agent global decision-making agent, which is responsible for summarizing global information and learning the joint value function; By using Value Decomposition Network (VDN) to model the joint Q-value : in, For residual collaborative terms, local Q value Each R-Agent learns independently, representing the expected reward of a subdomain agent taking an action in a local state; In this embodiment, the local Q value Relying solely on observations and actions within this subdomain ensures the distributed nature of the execution phase. Residual cooperability term. C-Agent learning models the interaction effects between agents in different subdomains, such as: After deploying a honeypot in subdomain A, the false alarm rate in subdomain B decreased. The overall defense benefits brought by cross-subdomain access control linkage.

[0036] It is the core of achieving cross-subdomain collaboration, so that the global Q value is no longer a simple sum of local Q values, but can capture the cooperation / conflict between agents.

[0037] The C-Agent global decision-making agent aggregates the local observation states of all subdomains. With action Update the joint Q function; each R-Agent outputs local actions based on local observations. ; C-Agent calculates the joint Q-value. It also updates the local Q network and residual cooperative terms of all R-Agents through backpropagation of TD error; and uses the global reward signal for credit allocation so that action combinations with high cooperativeness can obtain higher Q values.

[0038] During the execution phase, R-Agent uses local observations... and its own local Q-network output action Without needing to communicate with other subdomains, the effects of residual collaboration terms have been internalized into local policies through learning during the training phase, significantly reducing communication overhead while ensuring implicit collaboration between subdomains.

[0039] The entire defense system is modeled as a partially observable Markov decision process (POMDP), and the global policy is trained through PPO proximal policy optimization. Among them, observation This includes: graph embeddings from TGAT output, Bayesian risk posterior, resource status; and defensive actions. High-dimensional combinations include: MTD type, access control list updates, and honeypot deployment location; In this embodiment, the defense system modeling based on POMDP is used to model the entire defense system as a partially observable Markov decision process using POMDP, which is suitable for the characteristics of attacker types and states that are not fully observable in real environments. Observation It contains three types of information: the network traffic graph embedded from TGAT output (reflecting the overall attack situation); Bayesian risk posterior (based on attacker type priors); and more. Calculated attack intent probability); resource status of each subdomain (remaining defense resources, number of honeypots, bandwidth usage).

[0040] action High-dimensional combined actions, including proactive defense elements: MTD (Moving Target Defense) type selection; access control list update; honeypot deployment location selection; Attacker types This includes: script kiddies, APT groups, and insider malicious actors; Attacker type is estimated based on Bayesian game theory, and a global policy is trained using a function containing active deterrence effect as the reward signal.

[0041] The core of this embodiment is: dynamically estimating the current attacker type based on the prior distribution of attacker types; By combining psychological deterrence with the benefits and costs of defense, a quantifiable defense utility function is formed. This utility function is then used as a reward function, and a global defense strategy is trained using PPO+GAE to guide the agent to learn proactive defense.

[0042] Rewards or benefits obtained when an attack is successfully intercepted The meaning is: the reward value obtained by the system when the defensive action successfully prevents the attacker from achieving the goal.

[0043] Assign values ​​based on the importance of the protected assets, and set... for: The core server is protected, and the benefit of intercepting an attack is set to 100. Ordinary office terminals are protected, and the revenue is set to 20.

[0044] Assign values ​​based on the threat level of the attack, and set... for: Intercept high-risk APT attacks: Rewards set to 100; Intercept regular script scans: Reward set to 10.

[0045] In a simulation environment, security event logs are used to determine whether an attack has been blocked. Based on the event type and asset level, the corresponding settings are retrieved from a table. .

[0046] Let P(attack failure|δ) represent the probability of attack failure given an attacker type δ: the probability that the defensive action ad will cause the current attacker type (e.g., script kiddie / APT group / insider malware) to fail.

[0047] The P(attack failed | δ) setting method is as follows: Through Bayesian dynamic estimation, an initial distribution P(δ) is defined for different attacker types based on historical data in the prior process; based on the attack behavior characteristics observed in real time (such as attack path, toolset, and time pattern), the posterior probability P(δ|observation) is updated using Bayes' theorem to dynamically estimate the current attacker type.

[0048] Based on historical attack and defense drills / real attack data, the failure rates of different attacker types under different defense strategies were statistically analyzed. Specifically, the failure rates were set as follows: 0.9% for script kiddies encountering basic access control and 0.7% for APT groups encountering honeypots and fake path redirection.

[0049] By training a probabilistic model (such as logistic regression or Bayesian network), inputting attacker type and defense action, the output is P(attack failed | δ).

[0050] The cost or price of taking defensive action (AD) The meaning is: the resources consumed by the system or the negative impacts caused when performing defensive actions, such as bandwidth usage, business interruption risk, and computing resource consumption.

[0051] The method of obtaining it is: Deploying honeypots consumes server resources, and the cost is calculated as the number of honeypots deployed multiplied by the cost per node. Performing ACL updates increases network latency; the cost is assigned based on the amount of latency increase or the degree of business impact. The MTD action randomizes the operation and maintenance costs associated with IP / port, assigning values ​​based on configuration complexity and business interruption risk.

[0052] Defense actions on critical business paths have a higher cost weight; for example, adjusting access control for the core database has a cost of 50. Defense actions on non-critical paths have a lower cost weight; for example, traffic scrubbing for ordinary terminals has a cost of 5.

[0053] By defining a preset cost for each defensive action, inputting the action type and execution scope, the corresponding output is generated. .

[0054] The meaning of the weight parameter λ for adjusting the deterrence effect is: to balance the weight of direct defense benefits (intercepting attacks) and long-term deterrence effects (reducing the probability of subsequent attacks).

[0055] The setting method for Λ is as follows: In the simulation environment, λ is found to maximize the long-term benefit of the defense strategy through grid search / Bayesian optimization. If the current goal is to quickly stop losses, λ can be reduced by 0.1 at a time, so that the strategy prioritizes actions that can directly intercept attacks. If the current goal is long-term security, λ can be increased by 1.0 at a time, so that the strategy prioritizes actions that can improve the deterrent effect.

[0056] In this embodiment, the initial value can be set to an empirical value of 0.5, and then dynamically adjusted according to the performance of the strategy during training.

[0057] In one embodiment of the present invention, the attacker type is estimated based on Bayesian game theory, and a global policy is trained through PPO using a function containing active deterrence utility as the reward signal, including the following steps: The defender performs a Bayesian update based on the prior distribution of attacker types to dynamically estimate the current attacker type. Active deterrence utility function in Bayesian game theory As the reward function, guiding the policy to learn proactive defense, the reward function is set as follows: in, Local state Below, adopt defensive actions. The return of the reward function at that time; The reward or benefit obtained when an attack is successfully intercepted; Given attacker type In the case of an attack failure, the defender performs a Bayesian update based on the prior distribution of the attacker type to dynamically estimate the current attacker type and thus calculate this probability. In order to take defensive action The cost or price paid; λ is a weighting parameter for adjusting the deterrence effect, used to balance the relationship between the benefits of direct defense and the long-term deterrence effect; Deterrence factors are directly related to the effectiveness of active defense and include: Among them, α, β, and γ are the weighting coefficients for the proportion of honeypots, the efficiency of false path guidance, and the probability of anti-detection exposure, respectively, reflecting the degree of contribution of each factor to the deterrence effect. The number of honeypots; This refers to the total number of nodes or systems. Based on the set reward function, the global policy is trained by optimizing the PPO proximal policy. .

[0058] In this embodiment, the active deterrence utility function is used in reinforcement learning. As an immediate reward, the strategy should consider the following when optimizing: direct defense benefits (attack interception rate); defense cost control (avoiding resource waste); and long-term deterrent effect (increasing the cost to attackers and reducing the probability of subsequent attacks).

[0059] In this embodiment, an end-to-end training closed loop is adopted, including: Each subdomain R-Agent executes local actions, generating defensive interactions; Instant rewards for environmental feedback (Active deterrence effectiveness) and the next observation ; C-Agent aggregates global trajectory data and updates the PPO policy network and GAE value network; Simultaneously, the local Q-values ​​and residual collaborative terms of each R-Agent are updated through the value decomposition network, thereby achieving collaborative transmission of the global policy to local subdomains.

[0060] In this embodiment, the weighting coefficients α, β, and γ of the deterrence factor represent the contribution of the honeypot quantity ratio, false path guidance efficiency, and anti-detection exposure probability to the deterrence effect, respectively.

[0061] The weighting coefficients α, β, and γ can be set in the following ways: By analyzing historical data, we can determine the impact of different defensive actions on the attacker's subsequent behavior. For example: For every 10% increase in the proportion of honeypots, the probability of an attacker abandoning the attack increases by [amount missing]. For every 10% increase in the efficiency of fake path guidance, the probability of an attacker misjudging the target increases by [amount missing]. For every 10% increase in the anti-detection exposure probability, the probability of an attacker stopping the attack increases by [amount missing]. Based on these statistical results, weight coefficients α, β, and γ are obtained through normalization.

[0062] Alternatively, values ​​can be assigned based on expert experience: if the honeypot is considered to have the greatest deterrent effect, α=0.5, β=0.3, γ=0.2 can be set; if the false path guidance is considered to be the core, β=0.5, α=0.3, γ=0.2 can be set.

[0063] Number of honey pots This represents the total number of honeypot nodes currently deployed in the system. The number of activated honeypot nodes is obtained by directly reading the status of the honeypot management module in the defense system. In the action space of reinforcement learning, honeypot deployment location and number are learnable actions, therefore... It is also the result of the current strategy's execution action.

[0064] In one embodiment of the present invention, IP hopping defense actions, port randomization defense actions, or path spoofing defense actions are dynamically selected based on a deep Q network. By combining the probability of network nodes deviating from expected behavior with information value, and a global strategy, flexible defense actions that satisfy multi-objective constraints are generated, including the following steps: Obtain the information value of each node And the probability that a network node deviates from its expected behavior at time t. And perform normalization processing; The normalized node information value and the probability of a network node deviating from the expected behavior are weighted and summed to obtain the node's comprehensive risk score. In this embodiment, the weights of the node information value and the probability of a network node deviating from the expected behavior are set to 0.4 and 0.6, respectively. The risk will be divided into three levels based on the node's overall risk score (RiskScore). In this embodiment, if This is considered low risk. like It is classified as medium risk; like This is considered high-risk. Maintain an independent DQN agent for each subdomain, and set its state to... The action is ; The reward function is set by combining security gains and resource costs as follows: in, For the reward function's return, The amount by which the node's overall risk score (RiskScore) is reduced; CPU / bandwidth consumption, To perform the action Increased service latency; In this embodiment, different MTD (Moving Target Defense) actions have different characteristics in their impact on CPU and bandwidth. For example, a lightweight IP hopping action mainly involves switching network layer IP addresses, consuming relatively little CPU and primarily using network bandwidth to notify relevant nodes of address change information. Theoretical calculations can be performed based on the specific operation steps and the amount of data involved, combined with hardware performance parameters (such as CPU processing time for a single network packet, data transmission volume per unit bandwidth, etc.). Built-in system monitoring tools, such as the `top` and `htop` commands in Linux systems, can monitor CPU usage in real time; tools like `iftop` and `nload` can monitor network bandwidth usage. Construct a test environment similar to the actual production environment, including the same network topology, server configuration, and business applications. Perform MTD (Multi-Target Demand) actions, such as "Dynamic Path Spoofing," in this test environment. By simulating a large number of business requests, use performance testing tools (such as Apache JMeter and LoadRunner) to record the response times of these requests. Compare the response times before and after the actions are executed to calculate the increase in business latency. Reference values.

[0065] The DQN agent dynamically selects MTD actions based on a reward function and through a deep Q-network. In the historical data, feature data corresponding to nodes that were successfully defended using different flexible defense actions, as well as feature data corresponding to nodes that were not successfully defended, are selected. The feature data corresponding to the selected nodes are labeled as successfully defended and unsuccessfully defended. Based on the risk level, MTD action and global strategy obtained from the analysis of the feature data corresponding to the nodes, an AI large model is trained to output the corresponding flexible defense action.

[0066] In one embodiment of the present invention, based on the results of information asymmetry risk analysis, risk crisis nodes are screened, and a decoy node chain is set for the risk crisis nodes using a deep Q-network, including the following steps: Based on the results of the information asymmetry risk analysis, the information asymmetry risk value at the node. When the threshold is exceeded, a decoy node chain is designed to be used when the corresponding node is attacked. Multiple decoy services are inserted into the real topology. For nodes in the decoy node chain, a deep Q-network agent dynamically determines which decoy node to expose to the virtual attacker. The decoy node's state includes the virtual attacker's most recently visited node sequence, triggered alarms, and response history. The action is to select the next decoy ID to expose, and the reward function is set as follows: in, The instantaneous feedback score obtained by the DQN agent after it performs the action of exposing the decoy node in the current state; This is an indicator function that signals when a virtual attacker enters the decoy node. When the virtual attacker has not entered the decoy node, Benefits of delaying time = Where, kn is the gain weight for delay per unit time, with 1 point awarded for every 1 second of delay; Δtn is the time the attacker stays in the bait chain; λ is the detection penalty coefficient; The flag indicating whether the attacker has identified the currently exposed node as a decoy indicates that the attacker has detected the decoy. =1; Based on the set reward function, the next exposed decoy ID is output by the virtual attacker after training the deep Q network agent. Based on the output of the next exposed decoy ID, a decoy node chain of risk crisis nodes is formed.

[0067] In this embodiment, the time delay benefit is the reward value for a successful homing, that is, the quantified benefit the system obtains after the attacker enters the decoy chain. In this embodiment, it can also be defined as a fixed value, directly set as a constant, for example, a benefit of 10 for each successful homing.

[0068] In one embodiment of the present invention, de-identified threat intelligence is shared within a smart park alliance, and joint defense of the smart park alliance is carried out based on the flexible defense actions of nodes in different smart parks and the decoy node chain, including the following steps: Each smart park node collects threat intelligence, including the attack source IP, attack type, attack time, and affected nodes; The collected intelligence is categorized according to the type of attack, including malicious scanning, vulnerability exploitation, and data breach. Sensitive information involving the park's internal areas is masked or replaced with virtual information, and the de-identified intelligence is encrypted. An intelligence-sharing platform is built within the alliance. Encrypted data is uploaded to the intelligence-sharing platform, which uses a large language model to generate joint defense suggestions for smart parks based on the flexible defense actions and decoy node chains of nodes in different smart parks.

[0069] In another embodiment of the present invention, a network security situation intelligent perception and dynamic defense system for smart parks is disclosed, characterized in that the system adopts the network security situation intelligent perception and dynamic defense method for smart parks as described above to realize network security situation intelligent perception and dynamic defense for smart parks.

[0070] The above embodiments are only used to illustrate the technical methods of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical methods of the present invention without departing from the spirit and scope of the technical methods of the present invention.

Claims

1. A method for intelligent situational awareness and dynamic defense in cybersecurity for smart parks, characterized in that: Includes the following steps: The campus network is modeled as a dynamic heterogeneous graph. By deploying distributed probes and graph neural networks, multi-source logs, network traffic and terminal behavior data are collected in real time. Spatiotemporal features are extracted through a time-series graph attention network to calculate the probability of each node deviating from the expected behavior and the information value. By using a Bayesian deep inference engine, the attacker's implicit parameters are modeled as latent variables, and the posterior distribution is updated to quantify the risk of information asymmetry. A collaborative decision-making mechanism for multi-subdomain agents is achieved through value decomposition networks, and a global policy is trained by combining a proximal policy optimization algorithm. Based on the deep Q network, the defense actions are dynamically selected from IP hopping defense actions, port randomization defense actions, or path deception defense actions. By combining the probability of network nodes deviating from expected behavior and information value with global strategies, flexible defense actions that meet multi-objective constraints are generated. Based on the results of information asymmetry risk analysis, risk crisis nodes are screened, and decoy node chains are set up for the risk crisis nodes by using a deep Q network. Within the smart park alliance, de-identified threat intelligence is shared, and joint defense within the smart park alliance is carried out based on flexible defense actions and decoy node chains of nodes in different smart parks.

2. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 1, characterized in that, The campus network is modeled as a dynamic heterogeneous graph. By deploying distributed probes and graph neural networks, multi-source logs, network traffic, and terminal behavior data are collected in real time, including the following steps: The campus network is modeled as a dynamic heterogeneous graph. Host nodes, server nodes, and user nodes are grouped into a node set. Edges are established based on the communication and access relationships between nodes in the node set. A graph snapshot is constructed for each preset time window. The graph snapshot is input into the TGAT temporal graph attention network. Through the TGAT temporal graph attention network, spatial adjacency relationships and temporal evolution patterns are captured simultaneously. A low-dimensional representation vector is generated for each node. The representation vector of each node is calculated in the TGAT temporal graph attention network through aggregation functions and attention mechanisms. Output the representation vector of each node, and collect multi-source logs, network traffic and terminal behavior data of nodes in the node cluster in real time through deployed distributed probes.

3. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 1, characterized in that, The temporal and spatiotemporal features are extracted using a temporal graph attention network, and the probability of deviation from the expected behavior and information value of each node are calculated, including the following steps: Spatiotemporal features are extracted using a temporal graph attention network, and the probability of deviation from the expected behavior for each node is calculated using the following formula: in, Let be the probability that a network node deviates from its expected behavior at time t; d is the activation function; d is the scaling factor; Let be the query vector for the current observation at time t; Let be the key vector in the past window at time t; This is the transpose of the key vector at time t; Let be the value vector at time t; By actively requesting high-precision logs from key nodes, and using an information value function, the information value of the nodes is analyzed. The formula is as follows: in, The information value of nodes; To address the uncertainty of nodes, entropy is predicted using a model. To measure; Let $\frac{ ... Calculate and dynamically select the top-K information value nodes; for the top-K information value nodes, determine whether their probability of deviating from the expected behavior is greater than a threshold; if it is greater than the threshold, issue a deviation warning for the corresponding high-risk financial business node.

4. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 1, characterized in that, By using a Bayesian deep inference engine to model the attacker's latent parameters as latent variables and updating the posterior distribution to quantify the risk of information asymmetry, the following steps are included: Model the defender's implicit parameters (capabilities, resources, targets) against the attacker as latent variables. The implicit parameters include: capabilities, resources, and objectives. The posterior distribution is updated in real time using variational inference. in, For a given observation sequence When, the posterior probability distribution of the latent variable θ; θ is a latent variable, representing the implicit parameters of the defender against the attacker. The attacker's capability parameters include: attack skill level and available tools; resource parameters include: available computing resources and network bandwidth; and target parameters include: the purpose the attack wants to achieve. For observation sequence; Let be the likelihood function, representing the observed sequence given the attacker's parameter θ. The probability of; Let θ be the prior probability distribution for the attacker. By using a Bayesian neural network to output the joint distribution of action intent, information asymmetry is transformed into probabilistic risk, thus quantifying the risk of information asymmetry. The formula is as follows: in, Let E be the risk value of information asymmetry at time t; E is the expectation operator. It indicates that θ is derived from the posterior probability distribution. Obtained by sampling from the middle; The damage function is defined to calculate the attack on the attacker's parameter θ. The extent of damage suffered by the system in interaction with the current defense measure, Defense; = ,in, The information value of nodes, Let t be the probability that a network node deviates from its expected behavior at time t.

5. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 1, characterized in that, The collaborative decision-making of multi-subdomain agents is achieved through value decomposition networks, and the global policy is trained by combining the proximal policy optimization algorithm, including the following steps: The smart park is divided into N defense subdomains according to functional boundaries, including: office area, server area, and entrance / exit. Each subdomain deploys an R-Agent to execute intelligent agents, and each R-Agent only observes the local state of its own subdomain. This includes traffic characteristics, asset status, and alarm information corresponding to the subdomain; and outputs local defense actions. This includes updating access control for the corresponding subdomain, deploying honeypots, and scrubbing traffic. All R-Agents share a single C-Agent global decision-making agent, which is responsible for summarizing global information and learning the joint value function; By using Value Decomposition Network (VDN) to model the joint Q-value : in, For residual collaborative terms, local Q value Each R-Agent learns independently, representing the expected reward of a subdomain agent taking an action in a local state; Set the local observation state of the subdomain as follows: The action is ; The joint Q-value is calculated by the C-Agent global decision-making agent, and backpropagation of the TD error is used to update the local Q-network and residual cooperative terms of all R-Agents simultaneously; during the execution phase, the R-Agents update the local Q-network and residual cooperative terms based on local observations. and local Q value Output Action ; Based on local observation Local Q value and the output action The entire defense system is modeled as a partially observable Markov decision process (POMDP), where, in each decision cycle, the observation... This includes: graph embeddings from TGAT output, Bayesian risk posterior, resource status; and defensive actions. High-dimensional combinations include: MTD type, access control list updates, honeypot deployment location; attacker type. This includes: script kiddies, APT groups, and insider malicious actors; Attacker type is estimated based on Bayesian game theory, and a global policy is trained using a function containing active deterrence effect as the reward signal.

6. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 5, characterized in that, Attacker type estimation based on Bayesian game theory, reward signal using a function containing active deterrence effect, and global policy training via PPO include the following steps: The defender performs a Bayesian update based on the prior distribution of attacker types to dynamically estimate the current attacker type. Active deterrence utility function in Bayesian game theory As the reward function, guiding the policy to learn proactive defense, the reward function is set as follows: in, Local state Below, adopt defensive actions. The return of the reward function at that time; The reward or benefit obtained when an attack is successfully intercepted; For a given attacker type In this case, the probability of the attack failing; In order to take defensive action The cost or price paid; λ is a weighting parameter for adjusting the deterrence effect, used to balance the relationship between the benefits of direct defense and the long-term deterrence effect; Deterrence factors are directly related to the effectiveness of active defense and include: Among them, α, β, and γ are the weighting coefficients for the proportion of honeypots, the efficiency of false path guidance, and the probability of anti-detection exposure, respectively. The number of honeypots; This refers to the total number of nodes or systems. Based on the set reward function, the global policy is trained by optimizing the PPO proximal policy. .

7. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 1, characterized in that, Based on a deep Q-network, the system dynamically selects IP hopping defense actions, port randomization defense actions, or path spoofing defense actions. It then uses the probability of network nodes deviating from expected behavior and the information value, combined with a global strategy, to generate flexible defense actions that satisfy multi-objective constraints. This includes the following steps: Obtain the information value of each node And the probability that a network node deviates from its expected behavior at time t. And perform normalization processing; The value of the normalized node information and the probability of the network node deviating from the expected behavior are weighted and summed to obtain the node's comprehensive risk score. The risk will be divided into three levels based on the node's overall risk score (RiskScore). Maintain an independent DQN agent for each subdomain, and set its state to... The action is ; The reward function is set by combining security gains and resource costs as follows: in, For the reward function's return, The amount by which the node's overall risk score (RiskScore) is reduced; CPU / bandwidth consumption, To perform the action Increased service latency; The DQN agent dynamically selects MTD actions based on a reward function and through a deep Q-network. In the historical data, feature data corresponding to nodes that were successfully defended using different flexible defense actions, as well as feature data corresponding to nodes that were not successfully defended, are selected. The feature data corresponding to the selected nodes are labeled as successfully defended and unsuccessfully defended. Based on the risk level, MTD action and global strategy obtained from the analysis of the feature data corresponding to the nodes, an AI large model is trained to output the corresponding flexible defense action.

8. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 1, characterized in that, Based on the results of the information asymmetry risk analysis, risk crisis nodes are screened, and a decoy node chain is set up for the risk crisis nodes using a deep Q-network, including the following steps: Based on the results of the information asymmetry risk analysis, the information asymmetry risk value at the node. When the threshold is exceeded, a decoy node chain is designed to be used when the corresponding node is attacked. Multiple decoy services are inserted into the real topology. For nodes in the decoy node chain, a deep Q-network agent dynamically determines which decoy node to expose to the virtual attacker. The decoy node's state includes the virtual attacker's most recently visited node sequence, triggered alarms, and response history. The action is to select the next decoy ID to expose, and the reward function is set as follows: in, The instantaneous feedback score obtained by the DQN agent after it performs the action of exposing the decoy node in the current state; This is an indicator function that signals when a virtual attacker enters the decoy node. When the virtual attacker has not entered the decoy node, Benefits of delaying time = Where, kn is the gain weight for delay per unit time, with 1 point awarded for every 1 second of delay; Δtn is the time the attacker stays in the bait chain; λ is the detection penalty coefficient; The flag indicating whether the attacker has identified the currently exposed node as a decoy indicates that the attacker has detected the decoy. =1; Based on the set reward function, the next exposed decoy ID is output by the virtual attacker after training the deep Q network agent. Based on the output of the next exposed decoy ID, a decoy node chain of risk crisis nodes is formed.

9. The method for intelligent perception and dynamic defense of network security situation in smart parks according to claim 1, characterized in that, Sharing de-identified threat intelligence within the smart park alliance, and conducting joint defense within the smart park alliance based on flexible defense actions and decoy node chains of different nodes within the smart park, includes the following steps: Each smart park node collects threat intelligence, including the attack source IP, attack type, attack time, and affected nodes; The collected intelligence is categorized according to the type of attack, including malicious scanning, vulnerability exploitation, and data breach. Sensitive information involving the park's internal areas is masked or replaced with virtual information, and the de-identified intelligence is encrypted. An intelligence-sharing platform is built within the alliance. Encrypted data is uploaded to the intelligence-sharing platform, which uses a large language model to generate joint defense suggestions for smart parks based on the flexible defense actions and decoy node chains of nodes in different smart parks.

10. A network security situational awareness and dynamic defense system for smart parks, characterized in that: The system employs the intelligent perception and dynamic defense method for network security situation in smart parks as described in any one of claims 1-9 to achieve intelligent perception and dynamic defense for network security situation in smart parks.

Images