Network group intention variational inference prediction method and device based on prior constraint

Abstract

The application relates to the technical field of network security, and specifically discloses a network group intention variational inference prediction method and device based on prior constraints, which comprises the following steps: acquiring multi-source network security space-time data of multiple historical time slices, constructing an adjacent matrix and a node feature matrix of a space-time interaction graph under each historical time slice based on the multi-source network security space-time data; for each historical time slice, generating a prior information matrix according to a network security knowledge base, fusing the prior information matrix and the corresponding node feature matrix to obtain an enhanced node feature matrix; based on the enhanced node feature matrix and the adjacent matrix of each historical time slice, outputting the probability distribution of each node through a space-time graph variational inference model, and sampling the potential feature representation of the node from the probability distribution; constructing all potential feature representations under all historical time slices into a space-time feature sequence, and outputting a group intention prediction result after aggregating global space-time dependence through a self-attention mechanism and performing pooling and classification.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a method and apparatus for variational reasoning prediction of network group intentions based on prior constraints. Background Technology

[0002] As cyberattack methods continue to evolve, detection methods based on single attack sources and single points in time are no longer sufficient to meet the security needs of today's complex network environments. Modern cyberattacks often exhibit characteristics of multi-source collaboration, phased attacks, and cross-temporal and spatial dissemination. For example, multiple controlled hosts may coordinate to execute malicious operations under the instructions of a control server, forming a botnet; multiple machines may simultaneously launch a large number of requests to a target, forming a distributed denial-of-service (DDoS) attack; attackers may gradually infiltrate through multiple stages and entry points, involving complex interactions among multiple entities, forming advanced persistent threats (APTs). These attack behaviors are essentially manifestations of collective intent, that is, multiple network entities acting collaboratively in time and space to achieve a common malicious goal. Therefore, how to accurately identify and predict the attack intent of network groups from multi-source spatiotemporal data has become an important research direction in the field of cybersecurity.

[0003] Existing technologies have proposed methods to detect anomalous behavior by constructing network interaction graphs and using graph neural networks for node representation learning. However, these methods still have the following shortcomings in practical applications: First, they do not fully utilize the rich expert knowledge and experience rules in the field of cybersecurity, resulting in a significant decrease in detection accuracy when data is sparse or attack behavior is deliberately disguised; second, for complex collaborative attack behaviors that span multiple time steps and involve multiple different entities, existing methods struggle to effectively capture the connections, thus limiting their ability to identify group intent. Summary of the Invention

[0004] In view of this, this application provides a method, apparatus, storage medium, and computer device for predicting network group intent based on prior constraints using variational inference. By obtaining the prior feature vectors of each node from a network security knowledge base and constructing a prior information matrix, which is then fused with the node feature matrix, the model can still accurately represent nodes with the help of expert knowledge even when data is sparse or attack behavior is deliberately disguised, significantly improving detection accuracy and anti-disguise capability. By generating a probability distribution for each node through a spatiotemporal graph variational inference model and sampling to obtain a latent feature representation, this representation not only integrates local graph structure information but also maintains the regularity of the distribution and noise resistance through KL divergence regularization constraints. This provides a stable and information-rich feature foundation for subsequent cross-time-slice and cross-entity group intent identification, effectively improving the ability to identify complex collaborative attack behaviors. By determining the latent feature representations of each node under each historical time slice, the group intent is determined, realizing the effective identification of group intent in multi-stage collaborative attacks across time and entities.

[0005] According to one aspect of this application, a variational reasoning prediction method for network group intentions based on prior constraints is provided, comprising: Acquire multi-source network security spatiotemporal data from multiple historical time slices, and construct an adjacency matrix of the spatiotemporal interaction graph under each historical time slice, as well as a node feature matrix containing the feature information of each node in the spatiotemporal interaction graph based on the multi-source network security spatiotemporal data of each historical time slice. For each historical time slice, the prior feature vectors corresponding to each node in the historical time slice are obtained from the network security knowledge base. Based on the prior feature vectors of each node, a prior information matrix is ​​constructed. The prior information matrix is ​​then fused with the corresponding node feature matrix to obtain the enhanced node feature matrix. Based on the enhanced node feature matrix and adjacency matrix of each historical time slice, a pre-defined spatiotemporal graph variational inference model is used to determine the neighboring nodes of each node from the adjacency matrix, extract the enhanced feature vectors of each node and its neighboring nodes from the enhanced node feature matrix, and perform graph convolution aggregation on the enhanced feature vectors of each node and its neighboring nodes for each node to output the probability distribution corresponding to the node. The latent feature representation of the node is sampled from the probability distribution. In the training phase, the spatiotemporal graph variational inference model introduces a KL divergence regularization term as a training constraint to minimize the KL divergence between the output probability distribution and the standard normal distribution, which is the prior distribution. The potential feature representations of each node under all historical time slices are constructed into a spatiotemporal feature sequence with position encoding. Based on the spatiotemporal feature sequence, the global spatiotemporal dependencies are aggregated through a self-attention mechanism, and then the group intention prediction result is output after pooling and classification.

[0006] According to another aspect of this application, a variational reasoning prediction device for network group intentions based on prior constraints is provided, comprising: The data acquisition module is used to acquire multi-source network security spatiotemporal data from multiple historical time slices, and to construct an adjacency matrix of the spatiotemporal interaction graph under each historical time slice, as well as a node feature matrix containing the feature information of each node in the spatiotemporal interaction graph, based on the multi-source network security spatiotemporal data of each historical time slice. The feature enhancement module is used to obtain the prior feature vectors corresponding to each node in the historical time slice from the network security knowledge base for each historical time slice, and construct a prior information matrix based on the prior feature vectors of each node. The prior information matrix is ​​then fused with the corresponding node feature matrix to obtain the enhanced node feature matrix. The inference module is used to determine the neighboring nodes of each node from the adjacency matrix based on the enhanced node feature matrix and adjacency matrix of each historical time slice, through a preset spatiotemporal graph variational inference model, extract the enhanced feature vectors of each node and its neighboring nodes from the enhanced node feature matrix, perform graph convolution aggregation on the enhanced feature vectors of the node and its neighboring nodes for each node, output the probability distribution corresponding to the node, and sample the latent feature representation of the node from the probability distribution. The spatiotemporal graph variational inference model introduces a KL divergence regularization term as a training constraint during the training phase to minimize the KL divergence between the output probability distribution and the standard normal distribution as the prior distribution. The result determination module is used to construct a spatiotemporal feature sequence with position encoding from the potential feature representations of each node under all historical time slices. Based on the spatiotemporal feature sequence, the global spatiotemporal dependencies are aggregated through a self-attention mechanism, and then the group intention prediction result is output after pooling and classification.

[0007] According to another aspect of this application, a storage medium is provided that stores a computer program thereon, which, when executed by a processor, implements the above-described variational inference prediction method for network group intentions based on prior constraints.

[0008] According to another aspect of this application, a computer device is provided, including a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, wherein the processor executes the program to implement the above-described variational reasoning prediction method for network group intentions based on prior constraints.

[0009] By employing the aforementioned technical solutions, this application provides a network group intent variational inference prediction method and apparatus, storage medium, and computer equipment based on prior constraints. This method obtains prior feature vectors of each node from a network security knowledge base and constructs a prior information matrix, which is then fused with the node feature matrix. This allows the model to accurately represent nodes using expert knowledge even when data is sparse or attack behavior is deliberately disguised, significantly improving detection accuracy and anti-disguise capabilities. A spatiotemporal graph variational inference model generates probability distributions for each node and samples latent feature representations. These representations not only integrate local graph structure information but also maintain the regularity and noise resistance of the distribution through KL divergence regularization constraints. This provides a stable and information-rich feature foundation for subsequent cross-time-slice and cross-entity group intent identification, effectively improving the ability to identify complex collaborative attack behaviors. By determining the latent feature representations of each node in each historical time slice, the group intent is determined, achieving effective identification of group intent in multi-stage collaborative attacks across time and entities.

[0010] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0011] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings: Figure 1 The illustration shows a flowchart of a variational reasoning prediction method for network group intentions based on prior constraints, provided in an embodiment of this application. Figure 2 This illustration shows a schematic diagram of a network group intent variational reasoning prediction device based on prior constraints provided in an embodiment of this application. Figure 3 A schematic diagram of the device structure of a computer device provided in an embodiment of this application is shown. Detailed Implementation

[0012] The present application will be described in detail below with reference to the accompanying drawings and embodiments. It should be noted that, unless otherwise specified, the embodiments and features described in the embodiments of the present application can be combined with each other.

[0013] This embodiment provides a variational reasoning prediction method for network group intentions based on prior constraints, such as... Figure 1 As shown, the method includes: Step 101: Obtain multi-source network security spatiotemporal data from multiple historical time slices; based on the multi-source network security spatiotemporal data from each historical time slice, construct the adjacency matrix of the spatiotemporal interaction graph under the historical time slice, and the node feature matrix containing the feature information of each node in the spatiotemporal interaction graph.

[0014] Step 102: For each historical time slice, obtain the prior feature vectors corresponding to each node in the historical time slice from the network security knowledge base, and construct a prior information matrix based on the prior feature vectors of each node. Then, fuse the prior information matrix with the corresponding node feature matrix to obtain the enhanced node feature matrix.

[0015] Step 103: Based on the enhanced node feature matrix and adjacency matrix of each historical time slice, the neighboring nodes of each node are determined from the adjacency matrix through a preset spatiotemporal graph variational inference model. The enhanced feature vectors of each node and its neighboring nodes are extracted from the enhanced node feature matrix. For each node, the enhanced feature vectors of the node and its neighboring nodes are aggregated by graph convolution to output the probability distribution corresponding to the node. The latent feature representation of the node is sampled from the probability distribution. In the training phase, the spatiotemporal graph variational inference model introduces a KL divergence regularization term as a training constraint to minimize the KL divergence between the output probability distribution and the standard normal distribution as the prior distribution.

[0016] Step 104: Construct the potential feature representations of each node under all historical time slices into a spatiotemporal feature sequence with position encoding. Based on the spatiotemporal feature sequence, aggregate the global spatiotemporal dependencies through a self-attention mechanism, and then output the group intention prediction result after pooling and classification.

[0017] This application provides a variational reasoning prediction method for network group intent based on prior constraints. First, network security spatiotemporal data from multiple historical time segments can be obtained from various data sources such as firewalls and DNS logs. This data includes interaction records between network entities (such as IP addresses, hostnames, and user accounts) (e.g., network connections, file transfers, login behaviors) and behavioral statistics for each entity (e.g., packet count, connection frequency). For each historical time segment, a spatiotemporal interaction graph is constructed based on all interaction records within that time segment. Each node in this graph represents a network entity, and each edge represents an interaction between entities. Simultaneously, an adjacency matrix can be generated to digitally describe which nodes are connected by edges, and a node feature matrix can be generated to record the attribute information of each node, such as how much data the node sent and how many different targets it connected to within that historical time segment. In a specific embodiment, to ensure data quality, the acquired data can be cleaned. Specifically, invalid records containing missing key fields (such as IP addresses, account IDs, device numbers, etc.) can be removed. Next, regular expressions are used to filter and normalize non-standard characters, such as converting all English letters to lowercase and removing spaces and special symbols. The cleaned data can then be used to construct spatiotemporal interaction graphs, node feature matrices, and so on.

[0018] After obtaining the node feature matrix for each historical time slice, expert knowledge accumulated in the cybersecurity field is further incorporated. This knowledge can include threat intelligence blacklists indicating whether an IP is a known malicious IP, attack chain stage tags indicating whether a node is currently in the reconnaissance, exploitation, or command and control stage, and historical malicious behavior statistics. For each node, its corresponding prior knowledge is retrieved from the cybersecurity knowledge base and encoded into a fixed-length prior feature vector. Then, the prior feature vectors of all nodes are stacked row-wise to form a prior information matrix with the same number of rows as the node feature matrix. Finally, this prior information matrix is ​​fused row-by-row with the node feature matrix of the same historical time slice to obtain an enhanced node feature matrix. In this way, each node not only possesses behavioral characteristics statistically derived from the raw data but also background attributes assigned by expert knowledge, thereby greatly improving the information content and interpretability of the node representation. The fusion can be either concatenation fusion or weighted fusion.

[0019] Then, for each historical time slice, the enhanced node feature matrix and adjacency matrix obtained in the previous step are input into a pre-trained spatiotemporal graph variational inference model. This model first finds all neighboring nodes of each node based on the adjacency matrix, then extracts the enhanced feature vectors of the node and its neighbors from the enhanced node feature matrix, and aggregates these features through graph convolution. The aggregation result is not a direct output of a fixed value, but rather generates a probability distribution for each node. Specifically, this can be a Gaussian distribution described by a mean vector and a variance vector, where the mean vector represents the best estimate of the latent feature representation of the node by the spatiotemporal graph variational inference model, and the variance vector reflects the uncertainty of the estimate; the larger the variance, the more uncertain the spatiotemporal graph variational inference model is about the current judgment. The final latent feature representation is then sampled from this probability distribution. It is important to note that a KL divergence regularization term is also introduced during the training of the spatiotemporal graph variational inference model to force the output Gaussian distribution of each node not to deviate too far from the standard normal distribution used as the prior distribution. This constraint prevents the spatiotemporal graph variational inference model from compressing the variance to zero and degenerating into a deterministic model, and also prevents the mean from being overestimated, effectively preventing overfitting to noisy training data. This significantly improves the stability and robustness of the spatiotemporal graph variational inference model when facing spoofed traffic or missing data. It is important to note that because the spatiotemporal graph variational inference model learns a probability distribution rather than a deterministic output, even with slight perturbations in the input data, the latent feature representation of the output will only change within the range of this distribution, without drastic jumps. This smoothness allows the spatiotemporal graph variational inference model to output stable inference results even in environments with incomplete data collection, network latency, or packet loss.

[0020] Finally, based on the latent feature representations of all nodes across all historical time slices, the probabilities of various group intentions are determined. Group intentions can include: an ongoing DDoS attack, botnet activity, or an APT attack entering the command and control phase. Specifically, the latent feature representations of each node across all historical time slices are arranged chronologically and positional encoding is added to construct a spatiotemporal feature sequence. This sequence is then processed using a multi-head self-attention mechanism to aggregate global spatiotemporal dependencies. Finally, after global pooling and a classification layer, the predicted group intention is output.

[0021] By applying the technical solution of this embodiment, prior feature vectors of each node are obtained from the network security knowledge base and a prior information matrix is ​​constructed and fused with the node feature matrix. This enables the model to accurately represent nodes with the help of expert knowledge even when data is sparse or attack behavior is deliberately disguised, significantly improving detection accuracy and anti-disguise capability. A spatiotemporal graph variational inference model is used to generate probability distributions for each node and sample to obtain latent feature representations. These representations not only integrate local graph structure information but also maintain the regularity and noise resistance of the distribution through KL divergence regularization constraints. This provides a stable and information-rich feature foundation for subsequent cross-time-slice and cross-entity group intent recognition, effectively improving the ability to identify complex collaborative attack behaviors. By determining the latent feature representations of each node under each historical time slice, the group intent is determined, achieving effective identification of group intent in multi-stage collaborative attacks across time and entities. Therefore, the embodiments of this application outperform existing technologies in terms of accuracy, robustness, and adaptability to multi-stage collaborative attacks, and are particularly suitable for modern network attack scenarios involving multi-entity collaboration, such as APTs, DDoS attacks, and botnets.

[0022] Optionally, in this embodiment, step 103, "sampling the latent feature representation of the node from the probability distribution," includes: for each node, determining a mean vector and a variance vector based on the probability distribution of the node; independently and identically sampling a noise vector with the same dimension as the mean vector from a standard normal distribution that serves as a prior distribution; taking the square root of each component in the variance vector to obtain a standard deviation vector, and multiplying the standard deviation vector element-wise with the noise vector to obtain a perturbation vector; and adding the mean vector and the perturbation vector element-wise to obtain the latent feature representation of the node.

[0023] In this embodiment, firstly, for each node (e.g., an IP address or host), after generating the corresponding probability distribution, in order to sample a specific latent feature vector from this distribution, it is necessary to define two key parameters of the distribution: the mean vector and the variance vector. With these two vectors, the probability distribution of the node is completely determined.

[0024] Next, to generate a random sample conforming to this probability distribution, randomness can be introduced from a known simple distribution. Specifically, the standard normal distribution, a Gaussian distribution with a mean of zero and a variance of one, is chosen as the prior distribution. A noise vector with the same dimension as the mean vector is sampled independently and identically distributed from this standard normal distribution. This sampling operation can be purely forward random number generation, without involving any gradient calculation or parameter updates. Each element of the noise vector is a random number following a standard normal distribution, independent of each other, providing a random source for subsequent sample construction.

[0025] Then, this noise vector is transformed into a perturbation that reflects the discreteness of the aforementioned output probability distribution. Specifically, first, the square root of each component in the variance vector is taken to obtain the standard deviation vector. The standard deviation is the square root of the variance, which intuitively describes the degree of diffusion of the output probability distribution across each feature dimension. Next, the standard deviation vector is multiplied element-wise with the previously sampled noise vector, that is, the standard deviation in each dimension is multiplied by the noise value in that dimension, thus obtaining a perturbation vector. This operation is equivalent to scaling the standard normal noise; after scaling, the distribution of the perturbation vector is consistent with the variance of the output probability distribution.

[0026] Finally, the mean vector is added element-wise to the perturbation vector obtained in the previous step to obtain the latent feature representation of the node. The addition operation shifts the scaled noise to the position of the mean vector, ensuring that the final vector distribution is exactly equal to the initial output probability distribution. Through a series of calculations, a specific latent feature representation can be successfully extracted from the probability distribution of the node. This latent feature representation reflects both the best estimate of the spatiotemporal graph variational inference model (determined by the mean) and introduces random fluctuations (determined by variance and noise) that match the confidence level of the spatiotemporal graph variational inference model, thus preserving the quantitative information of uncertainty in the spatiotemporal graph variational inference model.

[0027] It is important to note that during the model training phase of the spatiotemporal graph variational inference model, for each historical time slice, the enhanced node feature matrix and adjacency matrix are also input into the spatiotemporal graph variational inference model, outputting the mean vector and variance vector of each node, thereby defining a Gaussian distribution for each node. During training, this distribution is constrained to approximate a standard normal distribution through a KL divergence regularization term, and latent feature representations are obtained from this distribution using the same sampling method as described above, which are used to calculate the reconstruction loss and update the model parameters. That is, the spatiotemporal graph variational inference model of this application outputs the same form of probability distribution during both the training and inference phases, thereby ensuring the consistency of model behavior.

[0028] This application's embodiments transform the inference result from a single, deterministic value into a random sample reflecting the confidence level of the spatiotemporal graph variational inference model. This is particularly useful for scenarios requiring multiple sampling and averaging or uncertainty estimation. Furthermore, it maintains a computational path consistent with the training phase, avoiding biases introduced by inconsistencies between training and inference logic. Through this sampling operation, the latent feature representation of each node incorporates both local graph structure information and the spatiotemporal graph variational inference model's confidence level in its judgments. This provides richer and more robust input features for subsequently capturing global spatiotemporal dependencies, thereby improving the accuracy and reliability of group intent prediction.

[0029] In this embodiment, optionally, the group intent prediction result is output through a preset self-attention mechanism model based on the following processing steps: The latent feature representations of each node in each historical time slice are arranged according to time order and node order to construct a spatiotemporal feature sequence; a time position code is added to each position in the spatiotemporal feature sequence to obtain a spatiotemporal feature sequence with time position information; the spatiotemporal feature sequence with time position information is input into the self-attention mechanism module to calculate the attention weight of each node at different time steps and with other nodes at all time steps, wherein the attention weight is used to characterize the cooperative attack relationship between nodes, and the cooperative attack relationship includes... The system identifies the behavioral associations of a node at different time steps, the synchronous behavioral associations of different nodes at the same time step, and the attack chain stage associations of different nodes at different time steps. Based on the attention weights and the spatiotemporal feature sequence with time and location information, an enhanced feature sequence that integrates global spatiotemporal dependencies is obtained. The enhanced feature sequence is then subjected to global pooling to obtain a fixed-length group intent feature vector. This group intent feature vector is input into a classification layer to output a group intent prediction result. The group intent includes at least one of the following: DDoS attack intent, botnet activity intent, APT attack intent, insider threat intent, virus infection intent, or mining botnet intent.

[0030] In this embodiment, firstly, the latent feature representations of all nodes across all historical time slices are organized into an ordered sequence. The latent feature representation is a low-dimensional vector obtained through variational inference sampling, capable of summarizing the state of each node within a specific time slice. To preserve information in both the temporal and node dimensions, these vectors are arranged sequentially according to chronological order and a fixed node order within each historical time slice, forming a long sequence called the spatiotemporal feature sequence. The chronological order can be: arranging all nodes in the first historical time slice, then all nodes in the second historical time slice, and so on; the node order can be determined by node ID. In this way, each position in the spatiotemporal feature sequence uniquely corresponds to the latent feature representation of a specific node in a specific historical time slice, preserving both the temporal evolution and the spatial structure between nodes.

[0031] Since the self-attention mechanism itself lacks the ability to perceive the positional order of a sequence, if the aforementioned spatiotemporal feature sequence is directly input into the self-attention mechanism module, the module cannot distinguish the latent feature vectors of the same node at different time steps, nor can it distinguish the latent feature vectors of different nodes at the same time step. To solve this problem, a temporal position code is added to each position in the spatiotemporal feature sequence. The position code is a vector with the same dimension as the latent feature vector, typically using a sine or cosine function or a learnable embedding vector to represent the absolute or relative position of that position within the entire sequence. After adding the latent feature vectors in the spatiotemporal feature sequence to the corresponding position codes, the resulting spatiotemporal feature sequence with temporal position information can clearly indicate which historical time slice and node each latent feature vector originates from, laying the foundation for subsequent capture of spatiotemporal dependencies.

[0032] Then, the spatiotemporal feature sequence with location encoding is input into the self-attention mechanism module. The core idea of ​​the self-attention mechanism is that each element in the spatiotemporal feature sequence can calculate an attention weight with all other elements in the sequence, and the weight indicates the degree of correlation between them. Specifically, each element generates three vectors: Query, Key, and Value. The attention weight of that element with respect to each other element is obtained by taking the dot product of the query and all keys, followed by normalization. In this embodiment, these attention weights are given explicit network security semantics: they can characterize whether the behavior of the same node at different time steps is persistent (e.g., an IP continuously scans ports), whether different nodes exhibit synchronous behavior at the same time step (e.g., multiple IPs simultaneously send requests to the same target), and whether different nodes constitute upstream and downstream stages of an attack chain at different time steps (e.g., one IP conducts reconnaissance in historical time slice t1, and another IP exploits it in historical time slice t2). This design can automatically focus on spatiotemporal locations that truly have an attack collaboration relationship.

[0033] Furthermore, the calculated attention weights are used to perform weighted aggregation on the value vectors in the spatiotemporal feature sequence. Specifically, for each position in the spatiotemporal feature sequence, its attention weights for all positions are used as coefficients, and the value vectors of all positions are summed in a weighted manner to obtain a new feature representation for that position. Since information from all global positions is incorporated during the aggregation process, the new feature representation for each position contains the contextual information related to it in the entire spatiotemporal feature sequence, hence it is called an enhanced feature sequence. For example, the reconnaissance behavior features of an IP in an early time slice can be aggregated into the exploitation behavior features of another IP in a later time slice, so that the latter's representation carries traces of the former. After this operation, the entire spatiotemporal feature sequence still maintains its original length and order, but the features of each element have become an enhanced version after incorporating global spatiotemporal dependencies.

[0034] Finally, the enhanced feature sequence is converted into a fixed-length vector for input into the classification layer for group intent recognition. To achieve this, global pooling is used to compress the entire enhanced feature sequence into a fixed-dimensional group intent feature vector, which integrates information from all historical time slices and all nodes. This group intent feature vector is then input into a fully connected classification layer, which outputs the probability of various group intents through a Softmax function. These intents can specifically include DDoS attack intent (a large number of entities collaboratively launching a traffic flood), botnet activity intent (controlled hosts accepting external commands), APT attack intent (multi-stage, multi-entity advanced persistent threats), insider threat intent (abnormal privilege escalation or data theft of internal users), virus infection intent (malware spreading within the network), and mining botnet intent (illegally occupying computing power), etc. The final prediction result is given based on the probability of each group intent.

[0035] In a specific implementation, such as in DDoS detection, the self-attention mechanism module can focus on calculating the following types of associations: The behavior of the same bot at different times is correlated. For example, the self-attention mechanism module may find that the vectors of bot A at times t1, t2, and t3 are very similar, indicating that it has been continuously sending traffic, forming a behavior trajectory on a timeline.

[0036] Association of different puppet machines at the same time: For example, at time t5, the vectors of puppet machines A, B, C, and D all have high attention weights with the vector of the target server S, indicating that they are communicating with S at the same time, exhibiting group synchronization.

[0037] The collaborative relationship between different bots at different times: For example, the vector of bot A at t1 and the vector of bot B at t2 may also be associated. If they exhibit similar communication patterns or common C2 server characteristics, it indicates that they may be directed by the same controller.

[0038] Through this global attention calculation, the pre-defined self-attention mechanism model can integrate fragmented information scattered across multiple time slices and multiple IPs into a global perspective.

[0039] In another specific embodiment, the pre-defined self-attention mechanism model can employ a stack of four encoder layers, with eight multi-head self-attention heads per layer, and a hidden layer dimension of 256. The input is the latent feature representation output by the spatiotemporal graph variational inference module, i.e., the latent feature representation of all nodes under each historical time slice. To preserve temporal order information, the pre-defined self-attention mechanism model introduces learnable positional encoding, which is added to the input features and then fed into the encoder.

[0040] The encoder internally employs residual connections and layer normalization, expanding the intermediate dimension of the feedforward network to 1024. The enhanced feature sequence output by the encoder is then compressed into a fixed-length group intent vector by global max pooling, compressing information from different historical time slices and nodes. This vector is then passed through a fully connected classification layer, ultimately outputting the probability distribution of various group intents.

[0041] The pre-defined self-attention mechanism model uses the cross-entropy loss function during training, and the optimizer is Adam. During the inference phase, a sliding window mechanism is supported: whenever a preset number of historical time slices of information are added, the pre-defined self-attention mechanism model can update the latent feature representation within the window and output the prediction result of the current group's intent in real time, meeting the needs of online streaming detection.

[0042] This application's embodiments achieve end-to-end modeling of cross-temporal and cross-entity collaborative attack behaviors by serializing spatiotemporal features, adding positional encoding, calculating attention weights with cybersecurity semantics using a self-attention mechanism, weighted aggregation to obtain an enhanced feature sequence, and finally outputting the collective intent through global pooling and classification. Compared with traditional methods, the self-attention mechanism in this application's embodiments can directly capture spatiotemporal dependencies over arbitrarily long distances without needing to progressively transmit information through a recursive network, thus avoiding long-distance information attenuation; the calculated explicit attention weights have stronger semantic interpretability, helping users understand the model's decision-making basis; the fixed-length vector after global pooling allows the classification layer to flexibly handle input sequences of arbitrary time lengths and supports online streaming updates (sliding window).

[0043] In this embodiment of the application, optionally, the step 102 of "obtaining the prior feature vectors corresponding to each node in the historical time slice from the network security knowledge base" includes: for each node in each historical time slice, retrieving the prior knowledge corresponding to the node from the network security knowledge base; if prior knowledge is retrieved, encoding the prior knowledge to generate a preset fixed-dimensional prior feature vector, wherein the prior knowledge includes at least one of threat intelligence blacklist matching results, attack chain stage labels, and historical malicious behavior statistics results; if no prior knowledge is retrieved, setting the prior feature vector of the node to an all-zero vector.

[0044] In this embodiment, firstly, before obtaining prior feature vectors from the cybersecurity knowledge base, a retrieval operation is performed on each node within each historical time slice. Specifically, the unique identifier of the node (such as IP address, domain name, user account, etc.) is used as the query key to perform a matching search in the pre-built cybersecurity knowledge base. This knowledge base integrates expert knowledge from multiple sources, including threat intelligence platforms, blacklists, and historical attack records, such as whether an IP address is marked as malicious, whether a domain name is associated with a known botnet family, and whether a user account exhibits abnormal login behavior. For each node, an attempt is made to retrieve its corresponding prior knowledge. If a relevant record is found, the subsequent coding steps are performed; otherwise, the default value processing steps are performed.

[0045] If prior knowledge of a node is successfully retrieved, this knowledge is numerically encoded to generate a predefined, fixed-dimensional prior feature vector. The encoding method can vary depending on the type of knowledge: for threat intelligence blacklist matching results, such as whether a node is on the blacklist, it can be encoded as a binary value, where 1 indicates it is on the blacklist and 0 indicates it is not; for attack chain stage tags, such as reconnaissance, exploitation, command and control, and target actions, one-hot encoding or ordinal encoding can be used to convert them into numerical values; for historical malicious behavior statistics, such as the number of days an IP has appeared in the intelligence database or the number of historical attacks, normalization is used to map it to the [0,1] interval. Different types of information are encoded and concatenated in a predefined order to form a predefined, fixed-dimensional prior feature vector. The dimension of this vector is determined during the design phase to ensure that the prior feature vectors of all nodes have the same length. This prior feature vector contains the static background information obtained by the node from the network security knowledge base.

[0046] If no prior knowledge of a node is found in the cybersecurity knowledge base—for example, a completely new IP address never recorded by any threat intelligence—meaningless prior features cannot be generated for it. To ensure consistency in feature dimensions across all nodes and avoid gaps in the matrix, the prior feature vector for that node can be set to an all-zero vector. An all-zero vector represents "no prior knowledge" or "neutral information," and will not have a biased impact on the original node features during subsequent fusion; it is equivalent to the node having missing prior knowledge. This approach ensures the integrity of the data structure without introducing false or misleading information.

[0047] This application's embodiments achieve structured utilization of expert knowledge in the cybersecurity field through three steps: retrieval, encoding, and default value filling. Its advantages are twofold: firstly, it uniformly encodes discrete and heterogeneous prior knowledge into pre-defined fixed-dimensional numerical vectors, facilitating fusion with node feature matrices; secondly, through the default processing of all-zero vectors, nodes not present in the cybersecurity knowledge base can participate in computation normally, avoiding computational anomalies caused by missing information.

[0048] In this embodiment of the application, optionally, step 102, "constructing a prior information matrix based on the prior feature vectors of each node," includes: for each historical time slice, determining the node feature matrix and adjacency matrix of the historical time slice; calculating the degree centrality of each node based on the adjacency matrix as a first structural constraint feature, and calculating the clustering coefficient of each node as a second structural constraint feature; obtaining the attack chain stage determination rules for each node within the historical time slice from the network security knowledge base, and identifying the attack chain stage of each node based on the attack chain stage determination rules and the node feature matrix as a third structural constraint feature; numerically encoding and concatenating the first structural constraint feature, the second structural constraint feature, and the third structural constraint feature to generate a structural constraint feature vector for each node; fusing the structural constraint feature vector of each node with the corresponding prior feature vector to generate the final prior feature vector of the node; and constructing a prior information matrix based on the final prior feature vectors of each node.

[0049] In this embodiment, firstly, for each historical time slice, the node feature matrix and adjacency matrix for that historical time slice need to be determined. The node feature matrix records the behavioral statistical characteristics of each node within that historical time slice, such as the number of packets sent, the number of connections, and port distribution, while the adjacency matrix describes the interaction relationships between nodes, i.e., which nodes are connected by edges. Next, the degree centrality and clustering coefficient of each node are calculated based on the adjacency matrix, serving as the first and second structural constraint features, respectively. The degree centrality measures the breadth of a node's connections in the spatiotemporal interaction graph. Specifically, it is calculated by dividing the number of the node's neighboring nodes by the total number of nodes in the spatiotemporal interaction graph and then subtracting one. A larger value indicates that the node is more active or more central in the network. The clustering coefficient measures the degree of clustering among a node's neighbors. It is calculated by dividing the actual number of edges between a node's neighbors by the maximum possible number of edges between those neighbors. A larger value indicates that the connections between the node's neighbors are closer. These two features can reflect the role of a node in the network. For example, a node with high connectivity may be the initiator or hub of an attack, while a node with a high clustering coefficient may belong to a closely cooperating attack group.

[0050] Furthermore, attack chain stage determination rules for each node within this historical time slice are obtained from the cybersecurity knowledge base, and combined with the node feature matrix to identify the current attack chain stage of each node, serving as the third structural constraint feature. The attack chain stage determination rules are a set of conditional logic based on expert knowledge, such as "if a node initiates connections to a large number of different IPs within a short period using the ICMP protocol, it is determined to be in the reconnaissance stage." Behavioral features from the node feature matrix (such as connection mode, protocol type, data flow, etc.) are input into these rules for matching, thereby inferring the possible attack chain stage the node is in, such as the reconnaissance stage, exploitation stage, installation stage, command and control stage, target action stage, etc. This stage label reflects the node's progress in the attack process and is crucial for identifying group intent.

[0051] Subsequently, the three structural constraint features are numerically encoded and concatenated to generate a structural constraint feature vector for each node. Degree centrality and clustering coefficients are numerical values ​​and can be used directly; attack chain stage labels belong to discrete categories and can be converted to numerical representations, for example, by using one-hot encoding to map each stage to an independent binary bit, or by using sequence number encoding (e.g., reconnaissance = 1, exploit = ​​2, etc.). The three encoded features are concatenated in a preset order into a fixed-length vector. This vector fully describes the node's local position and role in the graph structure and the attack progress status, effectively supplementing the original node features.

[0052] Next, the structural constraint feature vector of each node is fused with the previously obtained prior feature vector of that node to generate the final prior feature vector of that node. The prior feature vector comes from a static knowledge base (such as threat intelligence blacklists, historical malicious statistics, etc.), while the structural constraint feature vector comes from the graph structure and behavioral patterns of the current historical time slice. The fusion can be achieved by vector concatenation or weighted summation. The final fused prior feature vector contains both the inherent background knowledge of the node and the structural role information in the current context, making it more expressive than purely static prior or dynamic features.

[0053] Finally, based on the final prior feature vector of each node, a prior information matrix is ​​constructed by stacking rows. The number of rows in this matrix equals the total number of nodes in the current historical time slice, and the number of columns equals the dimension of the final prior feature vector. This prior information matrix will be used to fuse with the original node feature matrix, thereby enhancing the node representation. Through the above process, static expert knowledge, graph structure statistical features, and attack chain stage information are uniformly integrated into a structured prior information matrix, providing rich input features for subsequent variational inference.

[0054] This application's embodiments integrate graph structure constraints such as degree centrality and clustering coefficients with attack chain stage identification results and static prior knowledge to generate a more comprehensive prior feature vector. Degree centrality and clustering coefficients can characterize the importance of a node's role from a network topology perspective, while attack chain stage identification reveals the attack process from a temporal evolution perspective. These two complement knowledge such as static blacklists, making it difficult to forge a node's graph structure role and attack stage label even if its original behavioral characteristics are deliberately disguised. This enhances the ability to detect disguised attacks and significantly improves the accuracy and robustness of group intent reasoning in complex attack scenarios.

[0055] In this embodiment of the application, optionally, step 101, "constructing an adjacency matrix of the spatiotemporal interaction graph under the historical time slice based on the multi-source network security spatiotemporal data of each historical time slice, and a node feature matrix containing the feature information of each node in the spatiotemporal interaction graph," includes: for each historical time slice, extracting all entities and the static attributes corresponding to each entity from the multi-source network security spatiotemporal data of the historical time slice, and converting the static attributes of each entity into an attribute vector; calculating the attribute similarity between two entities based on the attribute vectors of each pair of entities, and marking two entities with an attribute similarity greater than a preset similarity threshold as the same entity, so as to align the same entity in different data sources; extracting the interaction relationships between entities from the multi-source network security spatiotemporal data of the historical time slice based on the aligned entities, constructing a spatiotemporal interaction graph with entities as nodes and interaction relationships as edges, and generating a corresponding adjacency matrix; for each node in the spatiotemporal interaction graph, extracting the behavioral features and interaction features of the node from the multi-source network security spatiotemporal data of the historical time slice, and generating a node feature vector of the node based on the behavioral features and interaction features; and combining the node feature vectors of all nodes into the node feature matrix.

[0056] In this embodiment, firstly, for each historical time slice, all network entities (e.g., IP addresses, domain names, user accounts, device IDs, etc.) and the static attributes associated with each entity are extracted from the multi-source network security spatiotemporal data collected within that historical time slice. Here, static attributes refer to inherent characteristics of the entity that do not change rapidly over time, such as the network segment or AS number to which the IP address belongs, the registrar and registration time of the domain name, and the department to which the user account belongs. These attributes typically exist in the form of strings or categorical values ​​and cannot be directly used for numerical calculations. Therefore, these static attributes are further converted into numerical attribute vectors, for example, converting IP addresses to integers, encoding network segments as hash values, and mapping department names to category indices. Each dimension of the attribute vector corresponds to a static attribute, thus providing a computable basis for subsequent entity similarity comparisons.

[0057] Since the same entity in multi-source network security spatio-temporal data may appear with different identifiers. For example, the IP "192.168.1.1" in firewall logs and the IP "192.168.1.1" in threat intelligence, although the strings are the same, different data sources may use different naming formats; a more complex situation is that a user is recorded as "zhangsan" and "张三" in different systems respectively. Therefore, it is necessary to align these records from different sources to the same entity. For this purpose, for every two entities, calculate the attribute similarity according to their respective attribute vectors, and the commonly used calculation method is cosine similarity. If the calculated attribute similarity is greater than the preset similarity threshold, mark these two entities as the same entity and assign them a globally unique identifier. This alignment process enables all interaction information of the same entity from different data sources to be correctly merged together when constructing the graph subsequently.

[0058] Then, after all entities are aligned and have globally unique identifiers, start constructing the spatio-temporal interaction graph within this historical time slice. Specifically, extract all the interaction relationships between the entities recorded in the multi-source network security spatio-temporal data, such as a network connection (source IP to destination IP), a file transfer (source host to target host), a login attempt (user account to server), etc. Each interaction relationship corresponds to a directed or undirected edge in the graph. Taking the aligned entities as nodes and these interaction relationships as edges, construct a spatio-temporal interaction graph. At the same time, generate the adjacency matrix of this graph. The adjacency matrix can be an N×N square matrix (N is the number of nodes), where the element in the i-th row and j-th column represents whether there is an interaction between node i and node j.

[0059] Next, generate the node feature vector for each node in the graph, that is, each row of the node feature matrix. The node feature vector is extracted based on the behavior features and interaction features of the node within this historical time slice. The behavior features include the activity statistics of the node itself, such as the total number of sent and received data packets, the number of different IPs connected, the types of ports accessed, the protocol distribution used, etc.; the interaction features focus on the interaction patterns of the node with other nodes, such as whether it actively initiates a connection or passively accepts a connection, the average degree of its neighbor nodes, etc. These features are statistically calculated from the original logs and are normalized to form a numerical vector with a fixed dimension. Each node corresponds to such a node feature vector, reflecting the behavior portrait of the node within this historical time slice.

[0060] Finally, the node feature vectors of all nodes are stacked in a uniform node order to form a matrix, namely the node feature matrix. The number of rows in this matrix equals the total number of nodes in the current historical time slice, and the number of columns equals the dimension of each node's feature vector. The node feature matrix, together with the previously generated adjacency matrix, constitutes the complete data representation of the spatiotemporal interaction graph for this historical time slice.

[0061] In one specific embodiment, to accelerate the construction and query efficiency of the spatiotemporal interaction graph, a hash index technique can be used to calculate the hash value of the global ID for each entity and establish a hash table to map the entity ID to the storage location. The hash table allows the data of a node to be located in constant time (O(1)) when querying the neighbors of a node.

[0062] This application's embodiments transform raw, multi-source, heterogeneous network security data into a structured spatiotemporal interactive graph representation through three core steps: entity alignment, graph construction, and feature extraction. The entity alignment step addresses the issue of inconsistent identifiers for the same entity across multiple data sources, ensuring the integrity and consistency of the graph data. The separate design of the adjacency matrix and node feature matrix preserves both graph topology information and node attribute information, facilitating subsequent information aggregation. This construction process provides a standardized and rich data foundation for subsequent prior knowledge fusion and group intent reasoning.

[0063] Optionally, after "outputting the group intent prediction result", the method further includes: generating the user's initial preference vector in response to the user's selection instruction for any one of a variety of preset scenario templates, or in response to the attention weights of each group intent submitted by the user, wherein the preset scenario templates include at least one of a high-sensitivity isolation zone mode template, an internet boundary mode template, and a daily operation and maintenance mode template, and each preset scenario template is set with attention weights for each group intent; obtaining current network security environment information, and correcting the initial preference vector according to the current network security environment information to obtain a corrected preference vector; weighting and summing the predicted probabilities of each group intent output by the preset self-attention mechanism model with the corresponding corrected preference vector to calculate the overall network threat level; and determining the risk level corresponding to the overall network threat level according to a preset threat level threshold.

[0064] In this embodiment, after outputting the predicted probabilities of each group's intent, the user can first select a preset scenario template or directly set attention weights based on their own security operation and maintenance needs. The preset scenario templates can include high-sensitivity isolation zone mode, internet boundary mode, and routine operation and maintenance mode, etc. Each preset scenario template is pre-configured with attention weights for different group intents (such as DDoS attacks, APT attacks, insider threats, etc.). For example, in high-sensitivity isolation zone mode, the weight of insider threat intent is set very high, while the weight of external scanning and probing is lower; in internet boundary mode, the weight of intent related to external attacks is even higher. Users can also choose not to select a preset scenario template and instead manually score each group intent to form personalized attention weights. Based on the user's selection or input, an initial preference vector can be generated. Each component of this vector corresponds to the attention weight of a type of group intent, with values ​​typically ranging from 1 to 10. A higher value indicates greater sensitivity to that type of group intent.

[0065] Next, the current network security environment information is obtained, and the initial preference vector is corrected accordingly to obtain a revised preference vector. Here, network security environment information includes the real-time operating context, such as whether the current time is during peak business hours (peak hours may be more sensitive to service availability attacks), and whether the currently protected asset is a core database (core assets require higher weighting for data theft intent). The correction method can be weighted adjustment: for example, during peak business hours, the weight of DDoS attack intent is automatically increased by a certain percentage; when the core database is protected, the weight of APT attacks and insider threats is increased. The revised preference vector is more adaptable to the current actual risk situation, avoiding false positives or false negatives caused by fixed weights.

[0066] Then, the predicted probabilities of each group's intent output by the pre-defined self-attention mechanism model are weighted and summed with the corrected preference vectors to calculate the overall network threat level. The predicted probability is an objective estimate of the likelihood of each group's intent occurring; for example, the probability of a DDoS attack is 0.8, and the probability of an APT attack is 0.3. The corrected preference vector reflects the degree of importance attached to these group intents. The weighted summation can be calculated as: Overall Network Threat Level = Σ(Predicted Probability i × Corrected Weight i). For example, if the predicted probability of a DDoS attack is 0.8 and the corrected weight is 10, and the predicted probability of an APT attack is 0.3 and the weight is 9, then the overall threat level is 0.8 × 10 + 0.3 × 9 = 8 + 2.7 = 10.7. This value comprehensively considers both the objective threat probability and the user's subjective attention; a higher value indicates a greater overall risk.

[0067] Finally, according to the preset threat level threshold, map the calculated comprehensive threat degree to the corresponding risk level. For example, set the low-risk interval as 1 ≤ T < 4, the medium-risk interval as 4 ≤ T < 7, and the high-risk interval as T ≥ 7. If the comprehensive threat degree is 10.7, it falls into the high-risk level. The output of the risk level facilitates the rapid decision-making of security operation and maintenance personnel: low risks can be temporarily not processed, medium risks need attention, and high risks need immediate response. In addition, the risk level can also be visually displayed on the interface in ways such as colors (green, yellow, red) or text prompts to assist manual judgment.

[0068] In the embodiment of this application, by introducing a user preference and scenario adaptation mechanism after outputting the prediction result, the objective intention probability is transformed into a risk level that meets the actual operation and maintenance requirements. Among them, the preset scenario template reduces the user configuration threshold, and different network environments can be adapted by a single click; the correction of network security environment information enables the attention weight to dynamically respond to real-time factors such as business peaks and asset importance, avoiding the limitations of static weights. This application significantly improves the practicality of the system and the user experience, making the group intention prediction result not only stay at the probability level, but also directly guide security decisions.

[0069] In the embodiment of this application, optionally, the method further includes: dynamically maintaining multiple historical time slices using a sliding time window of a fixed size, where the window size is denoted as W, the sliding step size is denoted as S, and S is a preset number of time slices; when receiving new multi-source network security spatio-temporal data of S time slices, add the new S time slices to the sliding time window, and at the same time remove the S historical time slices with the earliest time in the sliding time window to obtain W updated historical time slices; based on the W updated historical time slices, re-perform group intention prediction and output the group intention prediction result in a real-time streaming manner.

[0070] In this embodiment, the window size is denoted as W, that is, W consecutive historical time slices are retained at the same time; the value of S is: 1 ≤ S < W. It should be noted that in the initial state, the sliding time window accumulates the first W time slices before the first sliding output can be performed.

[0071] This application provides a variational reasoning prediction method for network swarm intent based on prior constraints, which has streaming processing capabilities. Dynamic streaming processing and adaptive graph construction are important mechanisms for this method to cope with massive real-time network data. It abandons the lag of traditional static graph analysis, cuts continuous network traffic into discrete time slices, and dynamically generates a spatiotemporal interaction graph in each time slice. It uses technologies such as hash indexing to align entities (such as IPs and domain names) in multi-source heterogeneous data in real time, and adaptively updates node connection relationships (adjacency matrix) based on the current interaction behavior. This allows the graph structure to change instantly with the evolution of the attack situation, thereby accurately capturing the ever-changing collaborative patterns and spatiotemporal dependencies in swarm attacks while ensuring low latency.

[0072] Furthermore, as a refinement and extension of the specific implementation of the above embodiments, in order to fully illustrate the specific implementation process of this embodiment, another internal processing flow of the spatiotemporal graph variational inference model is provided.

[0073] Taking a DDoS attack as an example, a spatiotemporal interaction graph can be generated every minute. The nodes of the graph are each IP address, and the edges represent the communication relationships between IPs. As time progresses, multiple spatiotemporal interaction graphs can be generated. The spatiotemporal graph variational inference model does not just look at each IP in isolation, but allows each IP to check the situation of its neighbors through the connections on the graph. Information flows along the edges, allowing individuals to obtain information about the group. For example, botnet A may not have particularly high traffic in the current minute, but the spatiotemporal graph variational inference model finds that its target server S is being connected to by a large number of IPs it has never seen before in this minute. At the same time, it also finds botnets B and C with similar connection patterns that are also connected to server S. By aggregating the information of these "suspicious neighbors," the spatiotemporal graph variational inference model's judgment of botnet A will be revised. Although A's data performance may appear normal, it can still be marked as a risky botnet node by the spatiotemporal graph variational inference model.

[0074] The specific execution steps of the spatiotemporal graph variational inference model are as follows: First, enhance the node feature matrix X t and adjacency matrix A t The data is fed into a spatiotemporal graph variational inference model. The goal of this model is to compute the latent feature representation of each node and obtain the posterior distribution of the nodes through variational inference. The model aggregates neighborhood information through a graph convolutional network (GCN).

[0075] In variational inference, a Gaussian distribution is used as an approximate distribution for the latent feature representation. The mean and log-variance of the latent feature representation of a node are calculated through graph convolution operations, and are expressed as follows: ; Among them, fμ and f σ μ is the mapping function for graph convolution operations. t and σ t Let represent the mean and logarithmic variance of the nodes, respectively.

[0076] Next, a reparameterization technique is employed to sample the latent feature representations to enable end-to-end training. The goal of the reparameterization technique is to sample the latent feature representations of nodes from the latent space while ensuring that gradients can be propagated through backpropagation. This process is calculated using the following formula: ; in, This represents the latent feature representation of the i-th node. Let be random noise from the i-th node of a standard normal distribution, and ⊙ denote the element-wise multiplication operation. Let be the standard deviation of the latent feature representation of the i-th node. Let be the mean of the latent feature representation of the i-th node.

[0077] Furthermore, to improve the stability of the spatiotemporal graph variational inference model, a KL divergence regularization term is added during the variational inference process. KL divergence measures the difference between the posterior and prior distributions, and the goal is to minimize the KL divergence to ensure that the posterior and prior distributions are as similar as possible, thereby enhancing the model's generalization ability. This regularization term is minimized through the optimization process, making the latent feature representations generated by the spatiotemporal graph variational inference model more stable.

[0078] Furthermore, as Figure 1 In terms of specific implementation, this application provides a variational reasoning and prediction device for network group intentions based on prior constraints, such as... Figure 2 As shown, the device includes: The data acquisition module is used to acquire multi-source network security spatiotemporal data from multiple historical time slices, and to construct an adjacency matrix of the spatiotemporal interaction graph under each historical time slice, as well as a node feature matrix containing the feature information of each node in the spatiotemporal interaction graph, based on the multi-source network security spatiotemporal data of each historical time slice. The feature enhancement module is used to obtain the prior feature vectors corresponding to each node in the historical time slice from the network security knowledge base for each historical time slice, and construct a prior information matrix based on the prior feature vectors of each node. The prior information matrix is ​​then fused with the corresponding node feature matrix to obtain the enhanced node feature matrix. The inference module is used to determine the neighboring nodes of each node from the adjacency matrix based on the enhanced node feature matrix and adjacency matrix of each historical time slice, through a preset spatiotemporal graph variational inference model, extract the enhanced feature vectors of each node and its neighboring nodes from the enhanced node feature matrix, perform graph convolution aggregation on the enhanced feature vectors of the node and its neighboring nodes for each node, output the probability distribution corresponding to the node, and sample the latent feature representation of the node from the probability distribution. The spatiotemporal graph variational inference model introduces a KL divergence regularization term as a training constraint during the training phase to minimize the KL divergence between the output probability distribution and the standard normal distribution as the prior distribution. The result determination module is used to construct a spatiotemporal feature sequence with position encoding from the potential feature representations of each node under all historical time slices. Based on the spatiotemporal feature sequence, the global spatiotemporal dependencies are aggregated through a self-attention mechanism, and then the group intention prediction result is output after pooling and classification.

[0079] Optionally, the inference module is used for: For each node, the mean vector and variance vector are determined based on the probability distribution of the node; A noise vector with the same dimension as the mean vector is sampled independently and identically distributed from the standard normal distribution, which is the prior distribution; Take the square root of each component in the variance vector to obtain the standard deviation vector, and multiply the standard deviation vector element-wise with the noise vector to obtain the disturbance vector; The latent feature representation of the node is obtained by adding the mean vector to the perturbation vector element by element.

[0080] Optionally, the group intention prediction result is output through a preset self-attention mechanism model based on the following processing steps: The potential features of each node in each historical time slice are represented and arranged in chronological and node order to construct a spatiotemporal feature sequence. Add a time location code to each position in the spatiotemporal feature sequence to obtain a spatiotemporal feature sequence with time location information; The spatiotemporal feature sequence with time location information is input into the self-attention mechanism module to calculate the attention weight of each node at different time steps and other nodes at all time steps. The attention weight is used to characterize the cooperative attack relationship between nodes. The cooperative attack relationship includes the behavioral association of the same node at different time steps, the synchronous behavioral association of different nodes at the same time step, and the attack chain stage association of different nodes at different time steps. Based on the attention weights and the spatiotemporal feature sequence with temporal location information, an enhanced feature sequence that integrates global spatiotemporal dependencies is obtained. The enhanced feature sequence is subjected to global pooling to obtain a fixed-length group intent feature vector. The group intent feature vector is then input into the classification layer to output the group intent prediction result. The group intent includes at least one of the following: DDoS attack intent, botnet activity intent, APT attack intent, insider threat intent, virus infection intent, or mining botnet intent.

[0081] Optionally, the feature enhancement module is used to: For each node in each historical time slice, retrieve the prior knowledge corresponding to the node from the network security knowledge base; If prior knowledge is retrieved, the prior knowledge is encoded to generate a preset fixed-dimensional prior feature vector, wherein the prior knowledge includes at least one of threat intelligence blacklist matching results, attack chain stage tags, and historical malicious behavior statistics. If no prior knowledge is found, the prior feature vector of the node is set to an all-zero vector. Accordingly, the feature enhancement module is further configured to: For each historical time slice, determine the node feature matrix and adjacency matrix of the historical time slice; Based on the adjacency matrix, the degree centrality of each node is calculated as the first structural constraint feature, and the clustering coefficient of each node is calculated as the second structural constraint feature. The attack chain stage determination rules for each node within the historical time slice are obtained from the network security knowledge base. Based on the attack chain stage determination rules and the node feature matrix, the attack chain stage of each node is identified as the third structural constraint feature. The first structural constraint feature, the second structural constraint feature, and the third structural constraint feature are numerically encoded and concatenated to generate a structural constraint feature vector for each node. The structural constraint feature vector of each node is fused with the corresponding prior feature vector to generate the final prior feature vector of the node. A prior information matrix is ​​constructed based on the final prior feature vectors of each node.

[0082] Optionally, the data acquisition module is used for: For each historical time slice, extract all entities and the static attributes corresponding to each entity from the multi-source network security spatiotemporal data of the historical time slice, and convert the static attributes of each entity into an attribute vector. Based on the attribute vectors of each pair of entities, the attribute similarity between the two entities is calculated, and two entities with an attribute similarity greater than a preset similarity threshold are marked as the same entity, so as to align the same entity in different data sources; Based on the aligned entities, the interaction relationships between entities are extracted from the multi-source network security spatiotemporal data of the historical time slice, a spatiotemporal interaction graph with entities as nodes and interaction relationships as edges is constructed, and the corresponding adjacency matrix is ​​generated. For each node in the spatiotemporal interaction graph, behavioral features and interaction features of the node are extracted from the multi-source network security spatiotemporal data of the historical time slice, and a node feature vector of the node is generated based on the behavioral features and interaction features. The node feature vectors of all nodes are combined into the node feature matrix.

[0083] Optionally, the device further includes a risk level determination module; the risk level determination module is used for: After the output of the group intent prediction result, in response to the user's selection instruction of any one of the multiple preset scenario templates, or in response to the attention weight of each group intent submitted by the user, the user's initial preference vector is generated. The preset scenario templates include at least one of the high-sensitivity isolation zone mode template, the Internet boundary mode template, and the daily operation and maintenance mode template. Each preset scenario template is set with attention weight of each group intent. Obtain current network security environment information, and modify the initial preference vector based on the current network security environment information to obtain a modified preference vector; The predicted probabilities of each group's intentions output by the preset self-attention mechanism model are weighted and summed with the corresponding modified preference vectors to calculate the overall network threat level. The risk level corresponding to the overall network threat level is determined based on a preset threat level threshold.

[0084] Optionally, the apparatus further includes a streaming processing module; the streaming processing module is used for: Multiple historical time slices are dynamically maintained using a fixed-size sliding time window. The window size is denoted as W, the sliding step size is denoted as S, and S is a preset number of time slices. When new S time slices of multi-source network security spatiotemporal data are received, the new S time slices are added to the sliding time window, and the S earliest historical time slices in the sliding time window are removed to obtain updated W historical time slices. Based on the updated W historical time slices, the group intent prediction is re-performed, and the group intent prediction results are output in real-time streaming.

[0085] It should be noted that other corresponding descriptions of the functional units involved in the variational reasoning prediction device for network group intentions based on prior constraints provided in this application embodiment can be found in the following references. Figure 1 The corresponding descriptions in the method will not be repeated here.

[0086] This application also provides a computer device, which may specifically be a personal computer, a server, a network device, etc. Figure 3 As shown, the computer device includes a bus, a processor, memory, and a communication interface, and may also include an input / output interface and a display device. The processor provides computing and control capabilities. The memory includes a non-volatile storage medium and internal memory. The non-volatile storage medium stores an operating system, computer programs, and a database. The internal memory provides an environment for the operation of the operating system and computer programs in the non-volatile storage medium. The database stores location information. The network interface allows communication with external terminals via a network connection. When the computer program is executed by the processor, it implements the steps in the various method embodiments.

[0087] Those skilled in the art will understand that Figure 3 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0088] In one embodiment, a computer-readable storage medium is provided, which may be non-volatile or volatile, having stored thereon a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0089] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0090] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties.

[0091] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When executed, the computer program can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0092] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0093] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A variational reasoning prediction method for network group intentions based on prior constraints, characterized in that, include: Acquire multi-source network security spatiotemporal data from multiple historical time slices, and construct an adjacency matrix of the spatiotemporal interaction graph under each historical time slice, as well as a node feature matrix containing the feature information of each node in the spatiotemporal interaction graph based on the multi-source network security spatiotemporal data of each historical time slice. For each historical time slice, the prior feature vectors corresponding to each node in the historical time slice are obtained from the network security knowledge base. Based on the prior feature vectors of each node, a prior information matrix is ​​constructed. The prior information matrix is ​​then fused with the corresponding node feature matrix to obtain the enhanced node feature matrix. Based on the enhanced node feature matrix and adjacency matrix of each historical time slice, a pre-defined spatiotemporal graph variational inference model is used to determine the neighboring nodes of each node from the adjacency matrix, extract the enhanced feature vectors of each node and its neighboring nodes from the enhanced node feature matrix, and perform graph convolution aggregation on the enhanced feature vectors of each node and its neighboring nodes for each node to output the probability distribution corresponding to the node. The latent feature representation of the node is sampled from the probability distribution. In the training phase, the spatiotemporal graph variational inference model introduces a KL divergence regularization term as a training constraint to minimize the KL divergence between the output probability distribution and the standard normal distribution, which is the prior distribution. The potential feature representations of each node under all historical time slices are constructed into a spatiotemporal feature sequence with position encoding. Based on the spatiotemporal feature sequence, the global spatiotemporal dependencies are aggregated through a self-attention mechanism, and then the group intention prediction result is output after pooling and classification.

2. The method according to claim 1, characterized in that, The process of sampling the latent feature representation of the node from the probability distribution includes: For each node, the mean vector and variance vector are determined based on the probability distribution of the node; A noise vector with the same dimension as the mean vector is sampled independently and identically distributed from the standard normal distribution, which is the prior distribution. Take the square root of each component in the variance vector to obtain the standard deviation vector, and multiply the standard deviation vector element-wise with the noise vector to obtain the disturbance vector; The latent feature representation of the node is obtained by adding the mean vector to the perturbation vector element by element.

3. The method according to claim 1, characterized in that, The group intention prediction result is output through a preset self-attention mechanism model based on the following processing steps: The potential features of each node in each historical time slice are represented and arranged in chronological and node order to construct a spatiotemporal feature sequence. Add a time location code to each position in the spatiotemporal feature sequence to obtain a spatiotemporal feature sequence with time location information; The spatiotemporal feature sequence with time location information is input into the self-attention mechanism module to calculate the attention weight of each node at different time steps and other nodes at all time steps. The attention weight is used to characterize the cooperative attack relationship between nodes. The cooperative attack relationship includes the behavioral association of the same node at different time steps, the synchronous behavioral association of different nodes at the same time step, and the attack chain stage association of different nodes at different time steps. Based on the attention weights and the spatiotemporal feature sequence with temporal location information, an enhanced feature sequence that integrates global spatiotemporal dependencies is obtained. The enhanced feature sequence is subjected to global pooling to obtain a fixed-length group intent feature vector. The group intent feature vector is then input into the classification layer to output the group intent prediction result.

4. The method according to claim 1, characterized in that, The step of obtaining the prior feature vectors corresponding to each node within the historical time slice from the network security knowledge base includes: For each node in each historical time slice, retrieve the prior knowledge corresponding to the node from the network security knowledge base; If prior knowledge is retrieved, the prior knowledge is encoded to generate a preset fixed-dimensional prior feature vector, wherein the prior knowledge includes at least one of threat intelligence blacklist matching results, attack chain stage tags, and historical malicious behavior statistics. If no prior knowledge is found, the prior feature vector of the node is set to an all-zero vector. Accordingly, the construction of the prior information matrix based on the prior feature vectors of each node includes: For each historical time slice, determine the node feature matrix and adjacency matrix of the historical time slice; Based on the adjacency matrix, the degree centrality of each node is calculated as the first structural constraint feature, and the clustering coefficient of each node is calculated as the second structural constraint feature. The attack chain stage determination rules for each node within the historical time slice are obtained from the network security knowledge base. Based on the attack chain stage determination rules and the node feature matrix, the attack chain stage of each node is identified as the third structural constraint feature. The first structural constraint feature, the second structural constraint feature, and the third structural constraint feature are numerically encoded and concatenated to generate a structural constraint feature vector for each node. The structural constraint feature vector of each node is fused with the corresponding prior feature vector to generate the final prior feature vector of the node. A prior information matrix is ​​constructed based on the final prior feature vectors of each node.

5. The method according to claim 1, characterized in that, The method for constructing an adjacency matrix of the spatiotemporal interaction graph under each historical time slice based on multi-source network security spatiotemporal data of each historical time slice, and a node feature matrix containing feature information of each node in the spatiotemporal interaction graph, includes: For each historical time slice, extract all entities and the static attributes corresponding to each entity from the multi-source network security spatiotemporal data of the historical time slice, and convert the static attributes of each entity into an attribute vector. Based on the attribute vectors of each pair of entities, the attribute similarity between the two entities is calculated, and two entities with an attribute similarity greater than a preset similarity threshold are marked as the same entity, so as to align the same entity in different data sources; Based on the aligned entities, the interaction relationships between entities are extracted from the multi-source network security spatiotemporal data of the historical time slice, a spatiotemporal interaction graph with entities as nodes and interaction relationships as edges is constructed, and the corresponding adjacency matrix is ​​generated. For each node in the spatiotemporal interaction graph, behavioral features and interaction features of the node are extracted from the multi-source network security spatiotemporal data of the historical time slice, and a node feature vector of the node is generated based on the behavioral features and interaction features. The node feature vectors of all nodes are combined into the node feature matrix.

6. The method according to claim 3, characterized in that, After outputting the group intent prediction result, the method further includes: In response to the user's selection instruction from any of a variety of preset scenario templates, or in response to the attention weights of various group intentions submitted by the user, an initial preference vector of the user is generated. The preset scenario templates include at least one of a high-sensitivity isolation zone mode template, an internet boundary mode template, and a daily operation and maintenance mode template. Each preset scenario template is set with attention weights of various group intentions. Obtain current network security environment information, and modify the initial preference vector based on the current network security environment information to obtain a modified preference vector; The predicted probabilities of each group's intentions output by the preset self-attention mechanism model are weighted and summed with the corresponding modified preference vectors to calculate the overall network threat level. The risk level corresponding to the overall network threat level is determined based on a preset threat level threshold.

7. The method according to claim 1, characterized in that, The method further includes: Multiple historical time slices are dynamically maintained using a fixed-size sliding time window. The window size is denoted as W, the sliding step size is denoted as S, and S is a preset number of time slices. When new S time slices of multi-source network security spatiotemporal data are received, the new S time slices are added to the sliding time window, and the S earliest historical time slices in the sliding time window are removed to obtain updated W historical time slices. Based on the updated W historical time slices, the group intent prediction is re-performed, and the group intent prediction results are output in real-time streaming.

8. A variational reasoning and prediction device for network group intentions based on prior constraints, characterized in that, include: The data acquisition module is used to acquire multi-source network security spatiotemporal data from multiple historical time slices, and to construct an adjacency matrix of the spatiotemporal interaction graph under each historical time slice, as well as a node feature matrix containing the feature information of each node in the spatiotemporal interaction graph, based on the multi-source network security spatiotemporal data of each historical time slice. The feature enhancement module is used to obtain the prior feature vectors corresponding to each node in the historical time slice from the network security knowledge base for each historical time slice, and construct a prior information matrix based on the prior feature vectors of each node. The prior information matrix is ​​then fused with the corresponding node feature matrix to obtain the enhanced node feature matrix. The inference module is used to determine the neighboring nodes of each node from the adjacency matrix based on the enhanced node feature matrix and adjacency matrix of each historical time slice, through a preset spatiotemporal graph variational inference model, extract the enhanced feature vectors of each node and its neighboring nodes from the enhanced node feature matrix, perform graph convolution aggregation on the enhanced feature vectors of the node and its neighboring nodes for each node, output the probability distribution corresponding to the node, and sample the latent feature representation of the node from the probability distribution. The spatiotemporal graph variational inference model introduces a KL divergence regularization term as a training constraint during the training phase to minimize the KL divergence between the output probability distribution and the standard normal distribution as the prior distribution. The result determination module is used to construct a spatiotemporal feature sequence with position encoding from the potential feature representations of each node under all historical time slices. Based on the spatiotemporal feature sequence, the global spatiotemporal dependencies are aggregated through a self-attention mechanism, and then the group intention prediction result is output after pooling and classification.

9. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method of any one of claims 1 to 7.

10. A computer device, comprising a storage medium, a processor, and a computer program stored on the storage medium and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 7.

Images