A network security situation awareness system based on a graph neural network

Abstract

The application discloses a network security situation awareness system based on a graph neural network, comprising the following modules: a data acquisition and preprocessing module, which acquires data and outputs a standardized node feature vector and an initial topology matrix; a dynamic hypergraph structure construction module, which constructs a dynamic hypergraph by using a dynamic space-time hypergraph convolution network and outputs a dynamic network topology snapshot sequence; a spatial feature extraction module, which aggregates neighbor features and outputs a spatial topology feature matrix; a time series evolution modeling module, which uses an improved MTGNN model, introduces a dynamic hypergraph prior constraint to capture an evolution trend, and outputs a time series evolution feature vector; a space-time feature fusion module, which constructs a space-time second-order interaction tensor to extract deep correlation features; and a situation assessment and prediction module, which outputs a situation quantitative assessment value and a future prediction result. The application improves the situation awareness precision and realizes active defense against network threats.

Description

Technical Field

[0001] This invention relates to the intersection of network security situation awareness and artificial intelligence, and in particular to a network security situation awareness system based on graph neural networks. Background Technology

[0002] Graph neural network-based cybersecurity situational awareness technology has been widely applied in recent years in fields such as industrial control, cloud computing, and the Internet of Things due to its powerful relationship modeling and feature extraction capabilities in complex network environments, becoming an important development direction for the construction of cybersecurity defense systems. However, in practical applications, network attack methods are becoming increasingly covert and collaborative, and the deployment effectiveness of situational awareness systems is still constrained by many factors.

[0003] Most current situational awareness methods rely on a single physical topology or static graph model, making it difficult to fully utilize multi-source heterogeneous data such as node attribute features, semantic association information, and dynamic evolutionary dependencies. This results in a lack of comprehensiveness in modeling network threats. Some systems use fixed-weight aggregation or simple graph convolution operations during feature extraction, ignoring the differences in threat levels of neighboring nodes and the dynamic changes in the topology over time, limiting the model's ability to capture high-order correlation features and temporal evolution trends. Furthermore, existing technologies often use simple vector concatenation or weighted summation in the feature fusion stage, failing to construct a spatiotemporal second-order interaction tensor to mine deep correlation features, thus affecting the accuracy of situational awareness.

[0004] Furthermore, most existing temporal modeling methods are based on static adjacency matrices and fail to introduce dynamic hypergraph structures as prior constraints and adaptively learn hidden dependencies between nodes. As a result, when faced with scenarios of rapid changes in network topology and dynamic switching of attack paths, the models are unable to capture the dynamic evolution trend of the network situation in real time, which seriously affects the practical value and robustness of the models in real network attack and defense scenarios.

[0005] Therefore, how to provide a network security situation awareness system based on graph neural networks is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0006] One objective of this invention is to propose a network security situation awareness system based on graph neural networks. This invention fully integrates key steps such as multi-source heterogeneous data preprocessing, construction of a dynamic spatiotemporal hypergraph convolutional network, spatial attention feature extraction, temporal evolution modeling, and spatiotemporal feature fusion. It constructs an intelligent perception process capable of dynamic hypergraph high-order association mining, spatiotemporal second-order interaction feature reconstruction, threat situation quantitative assessment, and future state trajectory prediction. This invention uses a dynamic spatiotemporal hypergraph convolutional network to dynamically capture high-order semantic associations and structural mutations in the network topology. It introduces an improved MTGNN model, using the dynamic hypergraph structure as a prior constraint for the adjacency matrix. Through an adaptive graph structure learning layer, it accurately mines implicit dependencies between nodes and effectively captures the dynamic evolution trend of the network situation by combining a gated temporal convolution mechanism. This invention possesses advantages such as strong high-order association modeling capabilities, accurate implicit dependency mining, deep spatiotemporal feature fusion, and high situation prediction accuracy. It can significantly improve the comprehensiveness of situation awareness and dynamic early warning capabilities in complex network environments, thereby effectively solving the problems of limited spatial feature expression, insufficient temporal dependency capture, and difficulty in identifying implicit threats in existing methods.

[0007] A network security situation awareness system based on a graph neural network according to an embodiment of the present invention includes the following modules: The data acquisition and preprocessing module is used to acquire multi-source heterogeneous data in the network environment in real time, preprocess the multi-source heterogeneous data, and output standardized node feature vectors and initial topology connection matrix. The dynamic hypergraph structure construction module is used to construct a dynamic hypergraph structure based on the normalized node feature vectors and the initial topology connection matrix using a dynamic spatiotemporal hypergraph convolutional network, update the dynamic hypergraph structure, and output a dynamic network topology snapshot sequence. The spatial feature extraction module is used to extract spatial features of the dynamic hypergraph structure at each time step in the dynamic network topology snapshot sequence, calculate the threat weight of neighboring nodes, aggregate the feature information of neighboring nodes and update the current node representation, and output the spatial topology feature matrix. The temporal evolution modeling module is used to perform sequential modeling of the spatial topological feature matrix in the time dimension using an improved MTGNN model. It learns through an adaptive graph structure layer and introduces and integrates a dynamic hypergraph structure as a prior constraint on the adjacency matrix to capture the hidden dependencies and dynamic evolution trends in multivariate time series data and outputs temporal evolution feature vectors. The spatiotemporal feature fusion module is used to perform an outer product operation on the spatial topological feature matrix and the temporal evolution feature vector to construct a spatiotemporal second-order interaction tensor. The interaction tensor is then reconstructed, mapped, and nonlinearly transformed to extract deep correlation features and output a high-dimensional spatiotemporal situation feature vector. The situation assessment and prediction module is used to calculate the probability distribution of each category using high-dimensional spatiotemporal situation feature vectors and select the maximum probability value as the quantitative assessment value of network security situation. At the same time, it performs time-series recursive calculations on the high-dimensional spatiotemporal situation feature vectors to predict the future state evolution trajectory and output the future situation prediction results.

[0008] Optionally, the data acquisition and preprocessing module specifically includes: The system captures the attribute characteristics of network device nodes, communication traffic logs between nodes, alarm event records, and network topology connections in real time and stores them in a temporary database. Missing value imputation and outlier removal are performed on the multi-source heterogeneous data in the temporary database. Discrete categorical data are transformed into numerical vectors using one-hot encoding. Continuous numerical data are mapped to the range of 0 to 1 using the max-min normalization method, and feature alignment and dimension unification are performed. All feature vectors of each network device node are concatenated and combined to generate standardized node feature vectors. Parse the network topology connection data, construct an adjacency matrix and record the physical connection status between nodes. If there is a physical link between two nodes, set the corresponding position to 1; if there is no physical link between two nodes, set the corresponding position to 0. At the same time, set the self-loop connection of all isolated nodes to 1, and output the initial topology connection matrix.

[0009] Optionally, the dynamic hypergraph structure construction module specifically includes: Read the standardized node feature vectors and the initial topology connection matrix, map the network device nodes as hypergraph vertices, initialize an empty dynamic hyperedge set, and set the size and sliding step of the dynamic time window; A learnable hypergraph structure generator is constructed. The standardized node feature vectors are input into the generator, and the L2 norm of the standardized node feature vectors is calculated. The cosine similarity is obtained by calculating the ratio of the dot product of any two standardized node feature vectors to the L2 norm product. If the cosine similarity value is greater than the preset semantic association threshold, the two nodes are judged to have a higher-order semantic association. Traverse the non-zero elements in the initial topology connection matrix to obtain the node pairs with physical link connections. Combine the semantic association judgment results to generate dynamic hyperedges by combining the nodes that simultaneously satisfy physical connection and semantic association with their corresponding one-hop neighbor nodes. Add the dynamic hyperedges to the dynamic hyperedge set to complete the construction of the dynamic hypergraph structure. By introducing time-dimensional modeling, the dynamic time window is moved according to a set sliding step size. The standardized node feature vector of the next time step is read, and the cosine similarity calculation and dynamic hyperedge generation operations are repeatedly performed to capture the dynamic changes in the network topology at different time steps and update the dynamic hyperedge set. The time dimension features of the hypergraph structure at multiple moments within the dynamic time window are aggregated. The difference matrix of the dynamic hypergraph structure at adjacent moments within the dynamic time window is calculated. The adjacency matrix at the current moment is subtracted from the adjacency matrix at the previous moment. The difference matrix and the hypergraph vertex feature vector at the current moment are weighted and summed with preset weights. The hypergraph vertex feature vector at the current moment is then updated. The updated hypergraph vertex feature vectors and the corresponding dynamic hyperedge sets are arranged in chronological order to output a dynamic network topology snapshot sequence.

[0010] Optionally, the spatial feature extraction module specifically includes: Read the dynamic hypergraph structure and hypergraph vertex feature vectors at the current moment from the dynamic network topology snapshot sequence, traverse each hyperedge in the dynamic hypergraph structure, and obtain the set of all hypergraph vertices connected to each hyperedge; For each hypergraph vertex, its own feature vector is multiplied by the feature vector of each neighboring vertex within its hyperedge. The dot product result is divided by the square root of the feature dimension to calculate the original attention score of each neighboring vertex to the corresponding hypergraph vertex. Perform exponential normalization on the original attention scores of all neighbor vertices within the same hyperedge, calculate the ratio of the exponential value of each neighbor vertex to the sum of the exponential values ​​of all vertices within its hyperedge, and use this ratio as the threat weight of the corresponding neighbor vertex. Multiply the feature vector of each neighboring vertex by the corresponding threat weight, and sum the weighted feature vectors of all neighboring vertices within the same hyperedge to obtain the aggregated feature vector of the corresponding hypergraph vertex under the current hyperedge. The aggregated feature vectors of the hypergraph vertices under all relevant hyperedges are concatenated. The concatenated feature vectors are then mapped to the original feature dimension through a preset linear transformation matrix. The updated representation of the current node is obtained after processing with the Leaky ReLU activation function. Repeat the above feature extraction operation for all moments in the dynamic network topology snapshot sequence, arrange all updated current node representations in node number order, and output the spatial topology feature matrix.

[0011] Optionally, the time-series evolution modeling module specifically includes: Read the spatial topology feature matrix and the dynamic network topology snapshot sequence, extract the dynamic hypergraph structure at the current time from the dynamic network topology snapshot sequence, traverse all hyperedges in the dynamic hypergraph structure, map the node relationships contained in the hyperedges into a sparse adjacency matrix, perform row normalization on the sparse adjacency matrix, and output the topological prior constraint matrix as the graph convolution operation. An adaptive graph structure learning layer is constructed. A learnable adaptive adjacency matrix parameter is randomly initialized. Softmax normalization is performed on the adaptive adjacency matrix parameter. The normalized adaptive adjacency matrix parameter is added element-wise to the topological prior constraint matrix to obtain an enhanced adjacency matrix that integrates prior constraints. Row normalization is then performed on the enhanced adjacency matrix. Obtain the hidden state vector passed from the previous time step, concatenate the spatial topological feature matrix of the current time step with the hidden state vector passed from the previous time step in the feature dimension to obtain the concatenated feature matrix, input the concatenated feature matrix into the preset fully connected layer for linear transformation, multiply by the preset weight matrix and add the bias vector, and output the transformed input feature matrix. The transformed input feature matrix is ​​multiplied with the enhanced adjacency matrix, and the feature information of neighboring nodes is aggregated according to the connection weights in the enhanced adjacency matrix to obtain a graph convolution feature matrix that aggregates spatial dependencies. Multiply the graph convolution feature matrix by the preset reset gate weight matrix and add the reset gate bias vector. Input the calculation result into the Sigmoid activation function and map the output value between 0 and 1 to generate the reset gate coefficient vector. By performing gated temporal convolution with the reset gating coefficient vector and the hidden state vector of the previous time step, the updated hidden state vector of the current time step is output. Read the spatial topological feature matrix and dynamic hypergraph structure of the next time step in sequence, repeat the above graph convolution operation and gated temporal convolution operation steps, capture the dynamic evolution trend of the network situation, and output the updated hidden state vector of the final time step as the temporal evolution feature vector.

[0012] Optionally, the step of performing gated temporal convolution with the reset gating coefficient vector and the hidden state vector from the previous time step to output the updated hidden state vector at the current time step specifically includes: The filtered historical state is obtained by multiplying the reset gating coefficient vector element-wise with the hidden state vector of the previous time step. The filtered historical state is then concatenated with the spatial topological feature matrix of the current time step. The concatenation result is multiplied by the preset candidate state weight matrix and the candidate state bias vector is added. The result is then input into the Tanh activation function and output as a candidate hidden state vector. Calculate the update gate vector by multiplying the graph convolution feature matrix by the preset update gate weight matrix and adding the update gate bias vector. Input the calculation result into the Sigmoid activation function and map the output value to between 0 and 1 to generate the update gate coefficient vector. Calculate the difference vector between the value 1 and the updated gating coefficient vector. Multiply the difference vector element-wise with the hidden state vector of the previous time step to obtain the historical retained component. Multiply the updated gating coefficient vector element-wise with the candidate hidden state vector to obtain the current updated component. Add the historical retained component element-wise with the current updated component and output the updated hidden state vector of the current time step.

[0013] Optionally, the spatiotemporal feature fusion module specifically includes: Read the spatial topology feature matrix and the temporal evolution feature vector, traverse the feature vector of each node in the spatial topology feature matrix, and perform an outer product operation between each node feature vector and the temporal evolution feature vector to generate a two-dimensional interaction matrix corresponding to each node. All the two-dimensional interaction matrices corresponding to the nodes are concatenated in the order of node numbers to construct a spatiotemporal second-order interaction tensor containing interaction information in the spatial and temporal dimensions. Tensor flattening operation is performed on the spatiotemporal second-order interaction tensor, and all the elements in the spatiotemporal second-order interaction tensor are rearranged according to the preset dimensional order and stretched into a one-dimensional flattened feature vector. Construct a feature reconstruction mapping layer, randomly initialize a weight matrix and a bias vector, calculate the matrix multiplication of the flattened feature vector and the weight matrix, add the product result to the bias vector to obtain the linearly mapped feature vector; The linear mapping feature vector is input into the ReLU activation function. The value of each element in the linear mapping feature vector is checked to see if it is greater than zero, and the nonlinear transformation feature vector is obtained. The L2 norm of the nonlinear transformation feature vector is calculated. Each element in the nonlinear transformation feature vector is divided by the L2 norm to obtain a feature vector of unit length, which is then output as a high-dimensional spatiotemporal situation feature vector.

[0014] Optionally, the situation assessment and prediction module specifically includes: Read the high-dimensional spatiotemporal situation feature vector, construct a situation classification fully connected layer, randomly initialize a classification weight matrix and a classification bias vector, calculate the matrix multiplication between the high-dimensional spatiotemporal situation feature vector and the classification weight matrix, add the product result to the classification bias vector to obtain the classification score vector; The classification score vector is input into the Softmax activation function, and the ratio of the exponent value of each element to the sum of the exponent values ​​of all elements is calculated. The ratio is used as the predicted probability of the corresponding category to generate the probability distribution for each category. Iterate through the probability distributions corresponding to each category, compare the predicted probability values ​​of all categories one by one, select the predicted probability value with the largest value, extract the corresponding category label, and use the value corresponding to the category label as the quantitative assessment value of network security situation. Construct a fully connected layer for time-series prediction, randomly initialize a prediction weight matrix and a prediction bias vector, calculate the matrix multiplication of the high-dimensional spatiotemporal situation feature vector and the prediction weight matrix, add the product result to the prediction bias vector to obtain the feature prediction vector for future time moments. The high-dimensional spatiotemporal situation feature vector is subjected to time-series recursive operation. The feature prediction vector of the future time at the current time is used as the input feature of the next time. The above linear transformation operation is repeated a preset number of times to generate a sequence of predicted features for multiple future times, forming the trajectory of future state evolution. By combining and encapsulating quantitative assessments of cybersecurity situation with future evolution trajectories, the resulting predictions of future situations are output, thus completing cybersecurity situation awareness.

[0015] The beneficial effects of this invention are: This invention addresses the challenges of multi-source heterogeneity, high-order topological associations, and strong time-varying nature of network security data by constructing a data preprocessing mechanism and a dynamic hypergraph structure generator. It employs a dynamic spatiotemporal hypergraph convolutional network to perform high-order semantic association mining and topological snapshot sequence generation, combined with an adaptive graph structure learning layer to fuse prior constraints and implicit dependencies, outputting a dynamic network topological snapshot sequence. A spatial feature extraction module calculates the threat weights of neighbor nodes and aggregates feature information to generate a spatial topological feature matrix. This spatial topological feature matrix is ​​then input into an improved MTGNN model. By introducing a dynamic hypergraph structure as a prior constraint on the adjacency matrix, gated temporal convolution operations and hidden state updates are performed to capture the dynamic evolution trend of multivariate time series, outputting a temporal evolution feature vector. In the spatiotemporal fusion stage, the spatial topological feature matrix and the temporal evolution feature vector are combined to perform outer product operations and tensor reconstruction mapping, extracting deep association features and outputting a high-dimensional spatiotemporal situation feature vector. Furthermore, a situation assessment and prediction module performs probability distribution calculations and temporal recursion operations, outputting a quantitative assessment value of the network security situation and the trajectory of future state evolution. Ultimately, it achieves closed-loop intelligent analysis of comprehensive situational awareness, accurate threat quantification, and future trend prediction in complex network environments, effectively improving the feature expression depth of situational awareness, the accuracy of implicit threat identification, and the ability to predict dynamic evolution. Attached Figure Description

[0016] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings: Figure 1 This is a structural diagram of a network security situation awareness system based on graph neural networks proposed in this invention. Figure 2 This is a flowchart of the dynamic hypergraph structure construction and topology snapshot sequence generation based on dynamic spatiotemporal hypergraph convolutional network proposed in this invention; Figure 3 This is a flowchart illustrating the construction and temporal evolution feature extraction of the improved MTGNN model proposed in this invention. Detailed Implementation

[0017] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0018] refer to Figures 1-3 A network security situation awareness system based on graph neural networks includes the following modules: The data acquisition and preprocessing module is used to acquire multi-source heterogeneous data in the network environment in real time, preprocess the multi-source heterogeneous data, and output standardized node feature vectors and initial topology connection matrix. The dynamic hypergraph structure construction module is used to construct a dynamic hypergraph structure based on standardized node feature vectors and an initial topological connection matrix using a dynamic spatiotemporal hypergraph convolutional network. It jointly models the spatial higher-order associations and temporal evolution dependencies between nodes to generate dynamic hyperedges, maps network device nodes to hypergraph vertices, updates the dynamic hypergraph structure, and outputs a dynamic network topology snapshot sequence. The spatial feature extraction module is used to extract spatial features of the dynamic hypergraph structure at each time step in the dynamic network topology snapshot sequence, calculate the threat weight of neighboring nodes, aggregate the feature information of neighboring nodes and update the current node representation, and output the spatial topology feature matrix. The temporal evolution modeling module is used to perform sequential modeling of the spatial topological feature matrix in the time dimension using an improved MTGNN model. It learns through an adaptive graph structure layer and introduces and integrates a dynamic hypergraph structure as a prior constraint on the adjacency matrix to capture the hidden dependencies and dynamic evolution trends in multivariate time series data and outputs temporal evolution feature vectors. The spatiotemporal feature fusion module is used to perform an outer product operation on the spatial topological feature matrix and the temporal evolution feature vector to construct a spatiotemporal second-order interaction tensor. The interaction tensor is then reconstructed, mapped, and nonlinearly transformed to extract deep correlation features and output a high-dimensional spatiotemporal situation feature vector. The situation assessment and prediction module is used to perform dimensionality reduction mapping and probability transformation on high-dimensional spatiotemporal situation feature vectors, calculate the probability distribution corresponding to each category and select the maximum probability value as the quantitative assessment value of network security situation. At the same time, it performs time-series recursive calculation on high-dimensional spatiotemporal situation feature vectors to predict the future state evolution trajectory and output the future situation prediction results.

[0019] This implementation significantly improves the comprehensiveness and prediction accuracy of network security situation awareness. By constructing a dynamic hypergraph structure through a dynamic spatiotemporal hypergraph convolutional network, it overcomes the limitations of traditional simple graphs, accurately capturing high-order semantic relationships between nodes and temporal evolution dependencies of the topology, effectively solving the problem of modeling hidden threats in complex network environments. In the spatial feature extraction stage, a threat weight aggregation mechanism is used to focus the model on high-risk neighbor nodes, enhancing the extraction capability of key threat features. An improved MTGNN model is introduced for temporal evolution modeling. By using the dynamic hypergraph structure as a prior constraint on the adjacency matrix, it not only uncovers hidden dependencies in multivariate time series but also ensures the physical interpretability of graph structure learning, significantly improving the quality of temporal feature representation. The spatiotemporal feature fusion module uses outer product operations to construct a spatiotemporal second-order interaction tensor, deeply coupling spatial topology and temporal evolution features to extract more discriminative high-dimensional situation features. Ultimately, the situation assessment and prediction module achieves a quantitative assessment of the current security level and a trajectory prediction of the future state, providing intuitive numerical basis and trend prediction for security decisions, and significantly enhancing the system's ability to detect network attacks early and its proactive defense capabilities.

[0020] In this embodiment, the data acquisition and preprocessing module specifically includes: The system captures the attribute characteristics of network device nodes, communication traffic logs between nodes, alarm event records, and network topology connections in real time and stores them in a temporary database. Missing value imputation and outlier removal are performed on the multi-source heterogeneous data in the temporary database. Discrete categorical data are transformed into numerical vectors using one-hot encoding. Continuous numerical data are mapped to the range of 0 to 1 using the max-min normalization method, and feature alignment and dimension unification are performed. All feature vectors of each network device node are concatenated and combined to generate standardized node feature vectors. Parse the network topology connection data, construct an adjacency matrix and record the physical connection status between nodes. If there is a physical link between two nodes, set the corresponding position to 1; if there is no physical link between two nodes, set the corresponding position to 0. At the same time, set the self-loop connection of all isolated nodes to 1, and output the initial topology connection matrix.

[0021] In this embodiment, the dynamic hypergraph structure construction module specifically includes: Read the standardized node feature vectors and the initial topology connection matrix, map the network device nodes as hypergraph vertices, initialize an empty dynamic hyperedge set, and set the size and sliding step of the dynamic time window; A learnable hypergraph structure generator is constructed. The standardized node feature vectors are input into the generator, and the L2 norm of the standardized node feature vectors is calculated. The cosine similarity is obtained by calculating the ratio of the dot product of any two standardized node feature vectors to the L2 norm product. If the cosine similarity value is greater than the preset semantic association threshold, the two nodes are judged to have a higher-order semantic association. Traverse the non-zero elements in the initial topology connection matrix to obtain the node pairs with physical link connections. Combine the semantic association judgment results to generate dynamic hyperedges by combining the nodes that simultaneously satisfy physical connection and semantic association with their corresponding one-hop neighbor nodes. Add the dynamic hyperedges to the dynamic hyperedge set to complete the construction of the dynamic hypergraph structure. By introducing time-dimensional modeling, the dynamic time window is moved according to a set sliding step size. The standardized node feature vector of the next time step is read, and the cosine similarity calculation and dynamic hyperedge generation operations are repeatedly performed to capture the dynamic changes in the network topology at different time steps and update the dynamic hyperedge set. The time dimension features of the hypergraph structure at multiple moments within the dynamic time window are aggregated. The difference matrix of the dynamic hypergraph structure at adjacent moments within the dynamic time window is calculated. The adjacency matrix at the current moment is subtracted from the adjacency matrix at the previous moment. The difference matrix and the hypergraph vertex feature vector at the current moment are weighted and summed with preset weights. The hypergraph vertex feature vector at the current moment is then updated. The updated hypergraph vertex feature vectors and the corresponding dynamic hyperedge sets are arranged in chronological order to output a dynamic network topology snapshot sequence.

[0022] This implementation introduces a dynamic hypergraph structure construction mechanism as its core innovation, which has significant differences and advantages compared to traditional static graph modeling and ordinary dynamic graph neural network technology. Traditional static graph models struggle to capture the dynamic evolution of network topology over time, leading to a lag in the perception of sudden attacks and latent threats; while existing ordinary dynamic graphs are often simply based on snapshot stacking, ignoring the deep attack semantics implied by topological changes, and also incurring significant computational overhead.

[0023] This invention constructs a learnable hypergraph structure generator, utilizes cosine similarity to mine higher-order semantic relationships between nodes, and combines physical connections to generate dynamic hyperedges. This overcomes the limitation of traditional simple graphs, which can only express "point-to-point" relationships, and can accurately model "many-to-many" collaborative attack patterns such as botnets. Particularly in temporal modeling, by calculating the difference matrix of the dynamic hypergraph structure at adjacent time points, it can keenly capture subtle changes and structural oscillations in network topology, effectively extracting key features at the time of an attack. This construction method, which integrates physical connections, semantic relationships, and temporal evolution dependencies, significantly improves the model's ability to represent complex network attacks while significantly enhancing the system's ability to detect hidden threats and its sensitivity to topological changes, providing a high-quality structural foundation for subsequent feature extraction.

[0024] In this embodiment, the spatial feature extraction module specifically includes: Read the dynamic hypergraph structure and hypergraph vertex feature vectors at the current moment from the dynamic network topology snapshot sequence, traverse each hyperedge in the dynamic hypergraph structure, and obtain the set of all hypergraph vertices connected to each hyperedge; For each hypergraph vertex, its own feature vector is multiplied by the feature vector of each neighboring vertex within its hyperedge. The dot product result is divided by the square root of the feature dimension to calculate the original attention score of each neighboring vertex to the corresponding hypergraph vertex. Perform exponential normalization on the original attention scores of all neighbor vertices within the same hyperedge, calculate the ratio of the exponential value of each neighbor vertex to the sum of the exponential values ​​of all vertices within its hyperedge, and use this ratio as the threat weight of the corresponding neighbor vertex. Multiply the feature vector of each neighboring vertex by the corresponding threat weight, and sum the weighted feature vectors of all neighboring vertices within the same hyperedge to obtain the aggregated feature vector of the corresponding hypergraph vertex under the current hyperedge. The aggregated feature vectors of the hypergraph vertices under all relevant hyperedges are concatenated. The concatenated feature vectors are then mapped to the original feature dimension through a preset linear transformation matrix. The updated representation of the current node is obtained after processing with the Leaky ReLU activation function. Repeat the above feature extraction operation for all moments in the dynamic network topology snapshot sequence, arrange all updated current node representations in node number order, and output the spatial topology feature matrix.

[0025] In this embodiment, the time-series evolution modeling module specifically includes: Read the spatial topology feature matrix and the dynamic network topology snapshot sequence, extract the dynamic hypergraph structure at the current time from the dynamic network topology snapshot sequence, traverse all hyperedges in the dynamic hypergraph structure, map the node relationships contained in the hyperedges into a sparse adjacency matrix, perform row normalization on the sparse adjacency matrix, and output the topological prior constraint matrix as the graph convolution operation. An adaptive graph structure learning layer is constructed. A learnable adaptive adjacency matrix parameter is randomly initialized. Softmax normalization is performed on the adaptive adjacency matrix parameter. The normalized adaptive adjacency matrix parameter is added element-wise to the topological prior constraint matrix to obtain an enhanced adjacency matrix that integrates prior constraints. Row normalization is then performed on the enhanced adjacency matrix. Obtain the hidden state vector passed from the previous time step, concatenate the spatial topological feature matrix of the current time step with the hidden state vector passed from the previous time step in the feature dimension to obtain the concatenated feature matrix, input the concatenated feature matrix into the preset fully connected layer for linear transformation, multiply by the preset weight matrix and add the bias vector, and output the transformed input feature matrix. The transformed input feature matrix is ​​multiplied with the enhanced adjacency matrix, and the feature information of neighboring nodes is aggregated according to the connection weights in the enhanced adjacency matrix to obtain a graph convolution feature matrix that aggregates spatial dependencies. Multiply the graph convolution feature matrix by the preset reset gate weight matrix and add the reset gate bias vector. Input the calculation result into the Sigmoid activation function and map the output value between 0 and 1 to generate the reset gate coefficient vector. By performing gated temporal convolution with the reset gating coefficient vector and the hidden state vector of the previous time step, the updated hidden state vector of the current time step is output. Read the spatial topological feature matrix and dynamic hypergraph structure of the next time step in sequence, repeat the above graph convolution operation and gated temporal convolution operation steps, capture the dynamic evolution trend of the network situation, and output the updated hidden state vector of the final time step as the temporal evolution feature vector.

[0026] This invention introduces an improved MTGNN model combined with a gated temporal convolution mechanism to achieve dynamic evolution modeling and hidden dependency capture of network situation features. The spatial topological feature matrix is ​​mapped to the dynamic hypergraph structure as topological prior constraints. An adaptive graph structure learning layer fuses learnable parameters with the prior matrix to construct an enhanced adjacency matrix, thereby accurately mining implicit associations between nodes based on the physical topology. A reset gate and update gate mechanism are used to perform gated temporal convolution operations, filtering historical states and fusing them with current graph convolutional features to generate a temporal evolution feature vector. This invention can accurately capture the dynamic evolution trend of topology and situation status under complex conditions such as drastic network traffic fluctuations or concealed attack paths. The feature sequence processed by the gated mechanism significantly suppresses noise interference, improving the ability to capture long-term dependencies and the accuracy of situation prediction.

[0027] The improved MTGNN model of this invention shares similarities with the original MTGNN model in that both retain the core architecture of a multivariate time-series graph neural network: implicit dependencies between nodes are mined through adaptive graph structure learning layers, and neighbor features are aggregated using graph convolution modules. Both employ learnable adaptive adjacency matrix parameters, which are transformed into non-negative connection weights through Softmax normalization. Furthermore, both enhance feature propagation by fusing the learned implicit graph structure with the prior graph structure to ensure the model's ability to capture spatial dependencies.

[0028] The difference lies in that this invention breaks the limitation of the original MTGNN model, which typically relies solely on random initialization or simple statistical construction of the prior graph structure, and introduces a dynamic hypergraph structure as a prior constraint for the adjacency matrix. While the original model directly generates the graph structure using learnable parameters or only uses static physical topology, this invention performs a mapping and processing operation on the dynamic hypergraph structure before constructing the adaptive graph structure learning layer. This maps the higher-order node relationships contained in the hyperedges into a sparse adjacency matrix and performs row normalization, outputting a topological prior constraint matrix. Subsequently, the parameters of the normalized adaptive adjacency matrix are added element-wise to this topological prior constraint matrix, rather than through simple concatenation or random learning without prior constraints as in the original model. Furthermore, in terms of temporal modeling, this invention combines gated temporal convolution operations, utilizing reset and update gate mechanisms to finely filter and retain historical states, enhancing the model's ability to capture temporal evolution trends.

[0029] The beneficial effects of the improvements are that, by introducing a dynamic hypergraph structure as a prior constraint, the improved MTGNN model can inject the high-order semantic associations and physical connection information mined by the dynamic spatiotemporal hypergraph convolutional network as prior knowledge into graph structure learning. This effectively solves the problem that the original MTGNN may learn irrelevant or incorrect connections in network security scenarios, and significantly improves the physical interpretability and accuracy of graph structure learning. This fusion mechanism enables the model to not only mine data-driven implicit dependencies, but also faithfully reflect the real evolution of network topology, achieving a deep combination of data-driven and knowledge-guided approaches. The introduction of the gated temporal convolution mechanism further enhances the model's ability to capture long-term dependencies, significantly improving the robustness and accuracy of the system in predicting the trend of situational evolution in complex dynamic network environments.

[0030] In this embodiment, a gated temporal convolution operation is performed using the reset gating coefficient vector and the hidden state vector from the previous time step to output the updated hidden state vector at the current time step. Specifically, this includes: The filtered historical state is obtained by multiplying the reset gating coefficient vector element-wise with the hidden state vector of the previous time step. The filtered historical state is then concatenated with the spatial topological feature matrix of the current time step. The concatenation result is multiplied by the preset candidate state weight matrix and the candidate state bias vector is added. The result is then input into the Tanh activation function and output as a candidate hidden state vector. Calculate the update gate vector by multiplying the graph convolution feature matrix by the preset update gate weight matrix and adding the update gate bias vector. Input the calculation result into the Sigmoid activation function and map the output value to between 0 and 1 to generate the update gate coefficient vector. Calculate the difference vector between the value 1 and the updated gating coefficient vector. Multiply the difference vector element-wise with the hidden state vector of the previous time step to obtain the historical retained component. Multiply the updated gating coefficient vector element-wise with the candidate hidden state vector to obtain the current updated component. Add the historical retained component element-wise with the current updated component and output the updated hidden state vector of the current time step.

[0031] In this embodiment, the spatiotemporal feature fusion module specifically includes: Read the spatial topology feature matrix and the temporal evolution feature vector, traverse the feature vector of each node in the spatial topology feature matrix, and perform an outer product operation between each node feature vector and the temporal evolution feature vector to generate a two-dimensional interaction matrix corresponding to each node. All the two-dimensional interaction matrices corresponding to the nodes are concatenated in the order of node numbers to construct a spatiotemporal second-order interaction tensor containing interaction information in the spatial and temporal dimensions. Tensor flattening operation is performed on the spatiotemporal second-order interaction tensor, and all the elements in the spatiotemporal second-order interaction tensor are rearranged according to the preset dimensional order and stretched into a one-dimensional flattened feature vector. Construct a feature reconstruction mapping layer, randomly initialize a weight matrix and a bias vector, calculate the matrix multiplication of the flattened feature vector and the weight matrix, add the product result to the bias vector to obtain the linearly mapped feature vector; The linear mapping feature vector is input into the ReLU activation function. The value of each element in the linear mapping feature vector is checked to see if it is greater than zero, and the nonlinear transformation feature vector is obtained. The L2 norm of the nonlinear transformation feature vector is calculated. Each element in the nonlinear transformation feature vector is divided by the L2 norm to obtain a feature vector of unit length, which is then output as a high-dimensional spatiotemporal situation feature vector.

[0032] In this embodiment, the situation assessment and prediction module specifically includes: Read the high-dimensional spatiotemporal situation feature vector, construct a situation classification fully connected layer, randomly initialize a classification weight matrix and a classification bias vector, calculate the matrix multiplication between the high-dimensional spatiotemporal situation feature vector and the classification weight matrix, add the product result to the classification bias vector to obtain the classification score vector; The classification score vector is input into the Softmax activation function, and the ratio of the exponent value of each element to the sum of the exponent values ​​of all elements is calculated. The ratio is used as the predicted probability of the corresponding category to generate the probability distribution for each category. Iterate through the probability distributions corresponding to each category, compare the predicted probability values ​​of all categories one by one, select the predicted probability value with the largest value, extract the corresponding category label, and use the value corresponding to the category label as the quantitative assessment value of network security situation. Construct a fully connected layer for time-series prediction, randomly initialize a prediction weight matrix and a prediction bias vector, calculate the matrix multiplication of the high-dimensional spatiotemporal situation feature vector and the prediction weight matrix, add the product result to the prediction bias vector to obtain the feature prediction vector for future time moments. The high-dimensional spatiotemporal situation feature vector is subjected to time-series recursive operation. The feature prediction vector of the future time at the current time is used as the input feature of the next time. The above linear transformation operation is repeated a preset number of times to generate a sequence of predicted features for multiple future times, forming the trajectory of future state evolution. By combining and encapsulating quantitative assessments of cybersecurity situation with future evolution trajectories, the resulting predictions of future situations are output, thus completing cybersecurity situation awareness.

[0033] Example 1: To verify the feasibility of this invention in the field of network security situation awareness, it was deployed in the core network security protection platform of a large-scale e-government cloud data center in a certain province. This data center carries the key functions of the province's government extranet, public service systems, and data exchange hub, covering more than 1,200 provincial departments and their subordinate municipal branches. The core network equipment includes firewalls, intrusion detection systems, core switches, server clusters, and more than 3,500 units in total, handling more than 1.5 billion cross-departmental data exchange requests daily, with peak network traffic reaching 480 Gbps. Due to the open architecture, diverse access subjects, and strong heterogeneity of business systems in government networks, network security situation awareness faces significant challenges. Typical threat scenarios include: distributed denial-of-service attacks, advanced persistent threats (APPS) infiltration, lateral movement attacks, abnormal data leakage, and internal unauthorized operations.

[0034] The platform receives over 2.8TB of heterogeneous data daily from multiple sources, including NetFlow traffic data, Syslog logs, IDS alert records, Web Application Firewall logs, and host security audit logs. Traditional network security situation awareness systems primarily rely on threshold alerts and rule matching technologies, which suffer from severe data silos, weak correlation analysis capabilities, and a lack of awareness of unknown threats. Especially when facing multi-stage combined attacks, traditional systems often can only trigger isolated single-point alerts, failing to reconstruct the attack chain from a global perspective. This results in a large number of low-risk alerts overwhelming critical threat information, requiring security operations personnel to process an average of over 5,000 alerts per day, with a persistently high false positive rate, severely impacting the accuracy and timeliness of situation assessment.

[0035] In practical deployment, the method of this invention first standardizes the aforementioned multi-source heterogeneous data through a data acquisition and preprocessing module. This normalizes and aligns network device node attributes, communication session quintuples, and alarm feature vectors, constructing a standardized dataset containing node feature vectors and an initial topology connection matrix. Subsequently, a dynamic hypergraph structure is constructed using a dynamic spatiotemporal hypergraph convolutional network. This combines explicit link connections in the physical network topology with implicit semantic associations in traffic behavior, generating a dynamic network topology snapshot sequence. For example, when detecting lateral movement attacks, the system not only relies on physical connections but also calculates the cosine similarity of traffic feature vectors between nodes to uncover "logical hyperedges" with highly similar IP address behavior patterns but separate physical locations, effectively identifying covert lateral movements by attackers using jump servers. In the temporal evolution modeling stage, the improved MTGNN model plays a crucial role. By introducing the dynamic hypergraph structure as a prior constraint on the adjacency matrix, the model can adaptively learn the hidden dependencies between nodes that evolve over time. In a simulated APT attack exercise, attackers attempted unauthorized access to the core database via a compromised host during a low-traffic period at night. Traditional systems, due to the extremely low traffic and compliant ports, did not trigger alarms. However, the model of this invention, through temporal recursion of historical normal access patterns and gating feature updates, accurately detected anomalies in the access time window and deviations in the behavioral sequence, successfully predicting potential data theft trajectories and triggering blocking strategies in advance. Ultimately, the situation assessment and prediction modules output a quantitative assessment value of the network security situation and the future situation evolution trajectory in parallel, achieving accurate assessment of the current security level and scientific prediction of future threat trends. Table 1 below shows the comparison data between the method of this invention and the traditional situation awareness system in typical network threat scenario identification and situation assessment tasks during a three-month trial period: Table 1. Performance Comparison of the Invention and Traditional Methods in Network Security Situation Awareness

[0036] Based on the comparative data shown in Table 1, it can be seen that the network security situation awareness system based on graph neural networks proposed in this invention shows significant performance advantages over traditional methods in the identification of various complex threat scenarios, especially in key indicators such as situation assessment accuracy, situation prediction capability, response timeliness, and false alarm control.

[0037] In terms of situation assessment accuracy, this invention maintains a high level of over 92% in all five typical threat scenarios, far exceeding the average accuracy of traditional systems (approximately 64%). For example, in the "APT stealth infiltration" scenario, traditional systems rely on single feature matching and static rules, making it difficult to capture covert long-term stealth behavior, achieving only 55.3% accuracy. In contrast, this invention achieves 94.7% assessment accuracy by jointly modeling high-order semantic relationships between nodes using a dynamic spatiotemporal hypergraph convolutional network, effectively improving the precise identification capability of advanced stealth threats.

[0038] In terms of situational prediction capabilities, this invention fills the gap in traditional methods that lack a prediction mechanism, achieving a prediction accuracy of close to or exceeding 90% in various scenarios. Particularly in the "DDoS attack" scenario, this invention achieved 43 correct predictions with an accuracy rate of 95.6%, enabling early prediction of attack peaks and impact ranges, thus buying valuable time for defense. Regarding response timeliness, this invention utilizes an improved MTGNN model to capture dynamic evolution trends, significantly shortening response time. The average response time is drastically reduced from over 49 seconds using traditional methods to approximately 11.5 seconds, a more than fourfold increase in response speed, ensuring rapid intervention in sudden security incidents.

[0039] In terms of false alarm rate control, this invention demonstrates significant advantages, with an average false alarm rate of approximately 4.5%, compared to the traditional method's average false alarm rate of over 25%, significantly reducing the interference of redundant alarms on operations and maintenance personnel. Overall, this invention, by constructing a dynamic hypergraph structure and fusing spatiotemporal features, achieves efficient, accurate, and proactive network security situational awareness, demonstrating outstanding practical value and promising prospects, especially in complex scenarios such as APT attacks and lateral movement.

[0040] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A network security situation awareness system based on graph neural networks, characterized in that, Includes the following modules: The data acquisition and preprocessing module is used to acquire multi-source heterogeneous data in the network environment in real time, preprocess the multi-source heterogeneous data, and output standardized node feature vectors and initial topology connection matrix. The dynamic hypergraph structure construction module is used to construct a dynamic hypergraph structure based on the normalized node feature vectors and the initial topology connection matrix using a dynamic spatiotemporal hypergraph convolutional network, update the dynamic hypergraph structure, and output a dynamic network topology snapshot sequence. The spatial feature extraction module is used to extract spatial features of the dynamic hypergraph structure at each time step in the dynamic network topology snapshot sequence, calculate the threat weight of neighboring nodes, aggregate the feature information of neighboring nodes and update the current node representation, and output the spatial topology feature matrix. The temporal evolution modeling module is used to perform sequential modeling of the spatial topological feature matrix in the time dimension using an improved MTGNN model. It learns through an adaptive graph structure layer and introduces and integrates a dynamic hypergraph structure as a prior constraint on the adjacency matrix to capture the hidden dependencies and dynamic evolution trends in multivariate time series data and outputs temporal evolution feature vectors. The spatiotemporal feature fusion module is used to perform an outer product operation on the spatial topological feature matrix and the temporal evolution feature vector to construct a spatiotemporal second-order interaction tensor. The interaction tensor is then reconstructed, mapped, and nonlinearly transformed to extract deep correlation features and output a high-dimensional spatiotemporal situation feature vector. The situation assessment and prediction module is used to calculate the probability distribution of each category using high-dimensional spatiotemporal situation feature vectors and select the maximum probability value as the quantitative assessment value of network security situation. At the same time, it performs time-series recursive calculations on the high-dimensional spatiotemporal situation feature vectors to predict the future state evolution trajectory and output the future situation prediction results.

2. The network security situation awareness system based on graph neural networks according to claim 1, characterized in that, The data acquisition and preprocessing module specifically includes: The system captures the attribute characteristics of network device nodes, communication traffic logs between nodes, alarm event records, and network topology connections in real time and stores them in a temporary database. Missing value imputation and outlier removal are performed on the multi-source heterogeneous data in the temporary database. Discrete categorical data are transformed into numerical vectors using one-hot encoding. Continuous numerical data are mapped to the range of 0 to 1 using the max-min normalization method, and feature alignment and dimension unification are performed. All feature vectors of each network device node are concatenated and combined to generate standardized node feature vectors. Parse the network topology connection data, construct an adjacency matrix and record the physical connection status between nodes. If there is a physical link between two nodes, set the corresponding position to 1; if there is no physical link between two nodes, set the corresponding position to 0. At the same time, set the self-loop connection of all isolated nodes to 1, and output the initial topology connection matrix.

3. The network security situation awareness system based on graph neural networks according to claim 1, characterized in that, The dynamic hypergraph structure construction module specifically includes: Read the standardized node feature vectors and the initial topology connection matrix, map the network device nodes as hypergraph vertices, initialize an empty dynamic hyperedge set, and set the size and sliding step of the dynamic time window; A learnable hypergraph structure generator is constructed. The standardized node feature vectors are input into the generator, and the L2 norm of the standardized node feature vectors is calculated. The cosine similarity is obtained by calculating the ratio of the dot product of any two standardized node feature vectors to the L2 norm product. If the cosine similarity value is greater than the preset semantic association threshold, the two nodes are judged to have a higher-order semantic association. Traverse the non-zero elements in the initial topology connection matrix to obtain the node pairs with physical link connections. Combine the semantic association judgment results to generate dynamic hyperedges by combining the nodes that simultaneously satisfy physical connection and semantic association with their corresponding one-hop neighbor nodes. Add the dynamic hyperedges to the dynamic hyperedge set to complete the construction of the dynamic hypergraph structure. By introducing time-dimensional modeling, the dynamic time window is moved according to a set sliding step size. The standardized node feature vector of the next time step is read, and the cosine similarity calculation and dynamic hyperedge generation operations are repeatedly performed to capture the dynamic changes in the network topology at different time steps and update the dynamic hyperedge set. The time dimension features of the hypergraph structure at multiple moments within the dynamic time window are aggregated. The difference matrix of the dynamic hypergraph structure at adjacent moments within the dynamic time window is calculated. The adjacency matrix at the current moment is subtracted from the adjacency matrix at the previous moment. The difference matrix and the hypergraph vertex feature vector at the current moment are weighted and summed with preset weights. The hypergraph vertex feature vector at the current moment is then updated. The updated hypergraph vertex feature vectors and the corresponding dynamic hyperedge sets are arranged in chronological order to output a dynamic network topology snapshot sequence.

4. A network security situation awareness system based on graph neural networks according to claim 1, characterized in that, The spatial feature extraction module specifically includes: Read the dynamic hypergraph structure and hypergraph vertex feature vectors at the current moment from the dynamic network topology snapshot sequence, traverse each hyperedge in the dynamic hypergraph structure, and obtain the set of all hypergraph vertices connected to each hyperedge; For each hypergraph vertex, its own feature vector is multiplied by the feature vector of each neighboring vertex within its hyperedge. The dot product result is divided by the square root of the feature dimension to calculate the original attention score of each neighboring vertex to the corresponding hypergraph vertex. Perform exponential normalization on the original attention scores of all neighbor vertices within the same hyperedge, calculate the ratio of the exponential value of each neighbor vertex to the sum of the exponential values ​​of all vertices within its hyperedge, and use this ratio as the threat weight of the corresponding neighbor vertex. Multiply the feature vector of each neighboring vertex by the corresponding threat weight, and sum the weighted feature vectors of all neighboring vertices within the same hyperedge to obtain the aggregated feature vector of the corresponding hypergraph vertex under the current hyperedge. The aggregated feature vectors of the hypergraph vertices under all relevant hyperedges are concatenated. The concatenated feature vectors are then mapped to the original feature dimension through a preset linear transformation matrix. The updated representation of the current node is obtained after processing with the Leaky ReLU activation function. Repeat the above feature extraction operation for all moments in the dynamic network topology snapshot sequence, arrange all updated current node representations in node number order, and output the spatial topology feature matrix.

5. A network security situation awareness system based on graph neural networks according to claim 1, characterized in that, The temporal evolution modeling module specifically includes: Read the spatial topology feature matrix and the dynamic network topology snapshot sequence, extract the dynamic hypergraph structure at the current time from the dynamic network topology snapshot sequence, traverse all hyperedges in the dynamic hypergraph structure, map the node relationships contained in the hyperedges into a sparse adjacency matrix, perform row normalization on the sparse adjacency matrix, and output the topological prior constraint matrix as the graph convolution operation. An adaptive graph structure learning layer is constructed. A learnable adaptive adjacency matrix parameter is randomly initialized. Softmax normalization is performed on the adaptive adjacency matrix parameter. The normalized adaptive adjacency matrix parameter is added element-wise to the topological prior constraint matrix to obtain an enhanced adjacency matrix that integrates prior constraints. Row normalization is then performed on the enhanced adjacency matrix. Obtain the hidden state vector passed from the previous time step, concatenate the spatial topological feature matrix of the current time step with the hidden state vector passed from the previous time step in the feature dimension to obtain the concatenated feature matrix, input the concatenated feature matrix into the preset fully connected layer for linear transformation, multiply by the preset weight matrix and add the bias vector, and output the transformed input feature matrix. The transformed input feature matrix is ​​multiplied with the enhanced adjacency matrix, and the feature information of neighboring nodes is aggregated according to the connection weights in the enhanced adjacency matrix to obtain a graph convolution feature matrix that aggregates spatial dependencies. Multiply the graph convolution feature matrix by the preset reset gate weight matrix and add the reset gate bias vector. Input the calculation result into the Sigmoid activation function and map the output value between 0 and 1 to generate the reset gate coefficient vector. By performing gated temporal convolution with the reset gating coefficient vector and the hidden state vector of the previous time step, the updated hidden state vector of the current time step is output. Read the spatial topological feature matrix and dynamic hypergraph structure of the next time step in sequence, repeat the above graph convolution operation and gated temporal convolution operation steps, capture the dynamic evolution trend of the network situation, and output the updated hidden state vector of the final time step as the temporal evolution feature vector.

6. A network security situation awareness system based on graph neural networks according to claim 1, characterized in that, The step of performing gated temporal convolution with the reset gating coefficient vector and the hidden state vector from the previous time step to output the updated hidden state vector at the current time step specifically includes: The filtered historical state is obtained by multiplying the reset gating coefficient vector element-wise with the hidden state vector of the previous time step. The filtered historical state is then concatenated with the spatial topological feature matrix of the current time step. The concatenation result is multiplied by the preset candidate state weight matrix and the candidate state bias vector is added. The result is then input into the Tanh activation function and output as a candidate hidden state vector. Calculate the update gate vector by multiplying the graph convolution feature matrix by the preset update gate weight matrix and adding the update gate bias vector. Input the calculation result into the Sigmoid activation function and map the output value to between 0 and 1 to generate the update gate coefficient vector. Calculate the difference vector between the value 1 and the updated gating coefficient vector. Multiply the difference vector element-wise with the hidden state vector of the previous time step to obtain the historical retained component. Multiply the updated gating coefficient vector element-wise with the candidate hidden state vector to obtain the current updated component. Add the historical retained component element-wise with the current updated component and output the updated hidden state vector of the current time step.

7. A network security situation awareness system based on graph neural networks according to claim 1, characterized in that, The spatiotemporal feature fusion module specifically includes: Read the spatial topology feature matrix and the temporal evolution feature vector, traverse the feature vector of each node in the spatial topology feature matrix, and perform an outer product operation between each node feature vector and the temporal evolution feature vector to generate a two-dimensional interaction matrix corresponding to each node. All the two-dimensional interaction matrices corresponding to the nodes are concatenated in the order of node numbers to construct a spatiotemporal second-order interaction tensor containing interaction information in the spatial and temporal dimensions. Tensor flattening operation is performed on the spatiotemporal second-order interaction tensor, and all the elements in the spatiotemporal second-order interaction tensor are rearranged according to the preset dimensional order and stretched into a one-dimensional flattened feature vector. Construct a feature reconstruction mapping layer, randomly initialize a weight matrix and a bias vector, calculate the matrix multiplication of the flattened feature vector and the weight matrix, add the product result to the bias vector to obtain the linearly mapped feature vector; The linear mapping feature vector is input into the ReLU activation function. The value of each element in the linear mapping feature vector is checked to see if it is greater than zero, and the nonlinear transformation feature vector is obtained. The L2 norm of the nonlinear transformation feature vector is calculated. Each element in the nonlinear transformation feature vector is divided by the L2 norm to obtain a feature vector of unit length, which is then output as a high-dimensional spatiotemporal situation feature vector.

8. A network security situation awareness system based on graph neural networks according to claim 1, characterized in that, The situation assessment and prediction module specifically includes: Read the high-dimensional spatiotemporal situation feature vector, construct a situation classification fully connected layer, randomly initialize a classification weight matrix and a classification bias vector, calculate the matrix multiplication between the high-dimensional spatiotemporal situation feature vector and the classification weight matrix, add the product result to the classification bias vector to obtain the classification score vector; The classification score vector is input into the Softmax activation function, and the ratio of the exponent value of each element to the sum of the exponent values ​​of all elements is calculated. The ratio is used as the predicted probability of the corresponding category to generate the probability distribution for each category. Iterate through the probability distributions corresponding to each category, compare the predicted probability values ​​of all categories one by one, select the predicted probability value with the largest value, extract the corresponding category label, and use the value corresponding to the category label as the quantitative assessment value of network security situation. Construct a fully connected layer for time-series prediction, randomly initialize a prediction weight matrix and a prediction bias vector, calculate the matrix multiplication of the high-dimensional spatiotemporal situation feature vector and the prediction weight matrix, add the product result to the prediction bias vector to obtain the feature prediction vector for future time moments. The high-dimensional spatiotemporal situation feature vector is subjected to time-series recursive operation. The feature prediction vector of the future time at the current time is used as the input feature of the next time. The above linear transformation operation is repeated a preset number of times to generate a sequence of predicted features for multiple future times, forming the trajectory of future state evolution. By combining and encapsulating quantitative assessments of cybersecurity situation with future evolution trajectories, the resulting predictions of future situations are output, thus completing cybersecurity situation awareness.

Images