Multi-source priori gated enhanced threat intrusion detection and correlation analysis method and system

Abstract

The application relates to the technical fields of network security, Internet of Things security, computing power network security and artificial intelligence, and discloses a multi-source priori gated enhanced threat intrusion detection and correlation analysis method and system. In the offline stage, three types of priori knowledge are constructed, and then the three types of priori knowledge are dimensionally aligned and fused to form a fused priori representation. In the online detection stage, the fused priori is input into a knowledge enhanced gated adapter, so that the fused priori participates in gated value calculation, and real-time traffic features are dynamically enhanced or inhibited. Finally, a light time sequence detection model is used to extract local burst mode and long-range dependence features, and normal traffic or attack traffic categories are output. The application constructs attack-related multi-source priori knowledge offline, and dynamically modulates the knowledge enhanced gated adapter mechanism based on the online detection stage, so that fine-grained identification of normal traffic, abnormal traffic, botnet traffic, scanning attacks, denial-of-service attacks and other network intrusion behaviors is realized.

Description

Technical Field

[0001] This invention relates to the fields of network security, Internet of Things security, computing power network security and artificial intelligence technology, and specifically to a method and system for multi-source prior gating enhanced threat intrusion detection and correlation analysis. Background Technology

[0002] With the development of cloud computing, edge computing, artificial intelligence, and the Internet of Things (IoT) technologies, computing networks are gradually becoming a crucial infrastructure supporting the digital economy, intelligent manufacturing, smart cities, the industrial internet, and AI applications. Computing network hubs typically handle functions such as computing resource aggregation, task scheduling, data forwarding, edge collaboration, cloud-edge interconnection, and multi-tenant service provisioning. In these scenarios, a large number of IoT terminals, edge gateways, industrial control equipment, cameras, sensors, computing nodes, storage nodes, and network forwarding devices continuously connect to the network, generating massive, complex, and dynamically changing network traffic.

[0003] In computing infrastructure and computing network hubs, intrusion detection systems need to rapidly analyze massive amounts of real-time traffic to promptly identify normal traffic, abnormal traffic, and different types of attack traffic. Especially with the large-scale access of IoT terminals, botnet attacks such as Mirai and Bashilite, and their variants, may exhibit similar traffic statistical characteristics, making it difficult for detection models to accurately distinguish between different attack types. Meanwhile, edge nodes, gateway devices, and scheduling nodes typically require detection models with low inference latency and low resource consumption, making it difficult to simply rely on large-scale, complex deep models for detection. Furthermore, if single-point detection results lack cross-device, cross-link, and cross-time window correlation analysis mechanisms, they are also insufficient to support attack path reconstruction, risk level assessment, and security response decisions.

[0004] Similar existing technologies to this invention involve extracting traffic statistical features in IoT or network intrusion detection, and then inputting these features into machine learning or deep learning models for classification. Some solutions further introduce graph structures, feature selection, ensemble learning, or loss function reweighting mechanisms to enhance detection performance. For example, existing solutions typically use tree models such as XGBoost and Random Forest to classify traffic, or use neural networks such as CNN, LSTM, GRU, and TCN to extract temporal features. Some solutions also use loss functions such as Focal Loss to handle class imbalance. Existing research shows that in IoT intrusion detection and computing power network security monitoring scenarios, there is a common problem of balancing low inference latency and strong detection robustness, and the high similarity between fine-grained botnet variants can reduce the detection performance of lightweight models.

[0005] However, the aforementioned similar solutions typically use feature selection, tree models, neural networks, or class reweighting as relatively independent modules. They fail to construct a multi-source prior knowledge system oriented towards attack behavior in the context of computing power network hubs, nor do they inject multi-source priors as gating control signals into online lightweight detection models. Therefore, existing solutions still have room for improvement when facing complex heterogeneous traffic, similar attack variants, class imbalance, and real-time edge detection constraints in computing power network hubs. Summary of the Invention

[0006] Based on the potential shortcomings of existing technologies, the technical problems to be solved by the present invention include at least one of the following:

[0007] First, how to construct structured prior knowledge that reflects the correlation of traffic characteristics under attack conditions in a multi-source heterogeneous traffic environment of computing infrastructure and computing network hubs, so as to make up for the problem that traditional lightweight detection models have difficulty modeling feature co-anomalies.

[0008] Second, how to construct a class conditional statistical prior that can characterize the differences in feature distribution between different attack categories and normal categories, so as to improve the model's ability to distinguish between highly similar attack variants, minority class attacks, and difficult-to-classify samples with fine granularity.

[0009] Third, how to obtain prior information on the importance of features that can characterize the global contribution of flow features, so as to reduce the interference of irrelevant features, redundant features and noisy features on the detection results.

[0010] Fourth, how to unify and effectively integrate structural priors, category conditional statistical priors, and global feature importance priors so that they can directly participate in the feature modulation process during online detection, rather than being used merely as ordinary spliced ​​features or post-processing interpretation information.

[0011] Fifth, how to design a knowledge-enhanced gating adaptation mechanism so that fused priors can participate in the calculation of gating values, dynamically enhance or suppress real-time traffic characteristics, thereby improving the response strength of attack-related features and reducing the impact of background noise.

[0012] Sixth, how to reduce online inference overhead while ensuring detection accuracy, robustness, and interpretability, so that the detection method can be deployed in resource-constrained environments such as edge gateways, IoT access nodes, industrial internet security gateways, computing power scheduling nodes, or embedded security devices.

[0013] Seventh, how to improve the model's ability to detect minority class attacks, covert attacks, and similar attack variants, and reduce false positive and false negative rates, in the presence of class imbalance and hard-to-classify attack samples.

[0014] Eighth, how to perform correlation analysis on detection results, attack categories, key characteristics, traffic subjects, access links, and alarm events to achieve abnormal traffic aggregation, attack link reconstruction, threat intent assessment, and security response support.

[0015] Based on a first key aspect of the present invention, a method for multi-source prior gating enhanced threat intrusion detection and correlation analysis is provided, the method comprising:

[0016] Step S100: Collect historical traffic data from the computing power network hub, and preprocess and prepare for prior injection of the historical traffic data; specifically, collect historical traffic data, log data and context information from the computing power network hub, perform label encoding, data cleaning, feature extraction and standardization on the historical traffic data, train the tree model classifier to output category soft probability vectors, and concatenate the category soft probability vectors with the standardized traffic features to form an enhanced traffic feature sequence to complete the preprocessing and prior injection preparation;

[0017] Step S200: Construct multi-source prior knowledge offline based on historical training samples. The multi-source prior knowledge includes structural prior, class conditional statistical prior, and global feature importance prior. Furthermore, the structural prior, class conditional statistical prior, and global feature importance prior are dimensionally aligned and uniformly fused to obtain a fused prior representation.

[0018] Step S300: The fused prior representation is input into the knowledge enhancement gating adapter online, so that the fused prior representation participates in the gating value calculation, and the traffic features to be detected are dynamically enhanced, suppressed or reweighted to obtain the knowledge-enhanced traffic feature representation.

[0019] Step S400: Input the knowledge-enhanced traffic feature representation into the lightweight temporal detection model, extract local burst patterns and long-range temporal dependency features, and obtain a sequence-level representation that integrates local burst features and long-range dependency features as the output feature representation;

[0020] Step S500: Input the feature representation output by the lightweight temporal detection model into the classification output layer to obtain the probability distribution of the traffic to be detected belonging to each category, and output the final detection result according to the probability distribution. Based on the detection result, analyze the attack source, target and behavior chain of the threat event.

[0021] The attack source, target, and behavioral chain of the threat event based on the correlation analysis of the detection results include:

[0022] Each detection result is constructed as a threat event tuple, which includes source address, destination address, source port, destination port, protocol, device identifier, computing power task identifier, attack type, detection confidence level, timestamp, and key contribution features.

[0023] Aggregate data according to source address, target asset, attack type, computing power task identifier, or access link identifier within a preset sliding time window;

[0024] Construct a threat correlation graph based on the aggregated threat events;

[0025] Calculate graph edge weights based on time interval, risk probability, attack type transfer weight, and key contribution feature similarity.

[0026] The system searches and sorts paths that meet preset weight conditions, and outputs attack chains, threat stages, and associated alarm results.

[0027] In this invention, complex prior knowledge is constructed offline, while only fused priors are invoked online for lightweight gating modulation and lightweight temporal inference. Therefore, it can improve detection accuracy, robustness, and the ability to distinguish similar attack variants while reducing online inference overhead. It is suitable for deployment in computing power network hubs, IoT security gateways, industrial internet edge nodes, and cloud-edge collaborative security nodes.

[0028] Preferably, the knowledge-enhanced gating adapter includes an input branch, a value branch, a gating branch, and a residual branch;

[0029] The input branch is used to receive enhanced traffic features, the value branch is used to generate candidate feature representations, the gating branch is used to calculate gating weights by combining fusion priors, and the residual branch is used to preserve the original input features.

[0030] Optionally, the structural prior is obtained by constructing a feature-attack correlation graph and includes:

[0031] Initialize a co-occurrence matrix with the same dimension as the number of traffic features from the attack sample set of historical traffic data;

[0032] Iterate through each attack sample and set an anomaly threshold for each feature dimension. When the values, absolute values, deviations from the class statistical baseline, or anomaly scores of two feature dimensions exceed the corresponding anomaly thresholds, it is determined that the two features have a co-activation relationship, and the corresponding elements in the co-occurrence matrix are accumulated and counted.

[0033] After completing the statistics of all attack samples, the co-occurrence matrix is ​​normalized to obtain a weighted adjacency matrix with values ​​ranging from 0 to 1.

[0034] The weighted adjacency matrix is ​​then pruned using a preset sparsity threshold, setting matrix elements below the sparsity threshold to zero. The resulting sparse weighted adjacency matrix serves as the structural prior.

[0035] Optionally, the categorical conditional statistical prior is constructed through the following steps:

[0036] Based on the traffic category labels of all training samples in the historical traffic data, all training samples are divided into normal category and different attack categories;

[0037] For each category, calculate the arithmetic mean and variance of all samples in that category across each feature dimension.

[0038] The mean vector of all feature dimensions under each category is concatenated with the variance vector of that category to form a statistical profile of that category.

[0039] The statistical profiles of all categories are vertically stacked and aggregated to form a statistical baseline matrix as a category-conditional statistical prior. The number of rows in this matrix is ​​equal to the total number of categories, and the number of columns is equal to twice the feature dimension.

[0040] Optionally, the global feature importance prior is constructed through the following steps:

[0041] Based on all training samples, construct feature matrix and target label matrix, train regularized classification model, multi-output ridge regression model, one-to-many ridge classifier or linear discriminant model with regularization term, sort all features using feature coefficient matrix, coefficient norm or importance score output by model, select a few features with the highest scores to form feature subset based on importance coefficient;

[0042] A forward sequence feature selection is adopted, starting from an empty feature set or an initial feature set and gradually adding candidate features. After each feature is added, the detection performance is evaluated. If the performance is improved, the feature is retained to form a forward sequence feature subset.

[0043] The backward sequence feature selection method is adopted, which gradually removes features starting from the complete feature set or a large candidate feature set. After each feature is removed, the detection performance is evaluated. If the performance does not decrease or even improves, the feature is removed to form a backward sequence feature subset.

[0044] Calculate the correlation statistics between each feature and the target category, and select features according to the correlation scores to form a feature subset based on the correlation coefficient;

[0045] The feature subsets based on importance coefficients, forward sequence features, backward sequence features, and feature subsets based on correlation coefficients are combined to obtain a globally important feature set. The feature coefficients output by the regression model are then converted into global importance weights for each feature.

[0046] The set of globally important features, the global importance weights, or their embedded representations are used as priors for global feature importance.

[0047] Furthermore, the calculation process of the knowledge-enhanced gating adapter is as follows:

[0048] The calculation process of the knowledge-enhanced gating adapter is as follows:

[0049] Let the current time-time feature vector in the enhanced flow feature sequence be... , fusion of prior representations as The fused prior representations will be projected through the prior matrix. The mapping is to a prior modulation vector with the same dimension as the output of the gated branch, and the gated vector is calculated as follows:

[0050] ;

[0051] in, For trainable gated weight matrix, For gated bias terms, Using the Sigmoid activation function, fused with prior representations Direct additive injection into gated computation;

[0052] Candidate enhancement features are calculated as follows:

[0053] ;

[0054] in, The output weight matrix is ​​trainable. The output bias term; the knowledge-enhanced flow characteristics are represented as follows:

[0055] ;

[0056] in, This represents element-wise multiplication. Retain the original information as a residual join term; is the prior projection matrix, used to map the fused prior representation to the same dimension as the gated branch output; The residual projection matrix is ​​used when the input feature dimension and the candidate enhancement feature dimension are the same. Unit mapping.

[0057] Optionally, the knowledge-enhanced gating adapter may also employ the following gated linear unit structures: Sigmoid gated network, Tanh gated network, feature-level attention mechanism, channel attention mechanism, Squeeze-and-Excitation feature recalibration module, FiLM feature scaling and translation module, residual adapter, TabNet-style feature selection mask, expert hybrid gating network, prior-based dynamic feature mask, prior-based feature reweighting layer, prior-based input gate, forget gate, or update gate modulation structure.

[0058] Optionally, the method also includes a step of training the entire intrusion detection model using a focus loss function. The entire intrusion detection model includes a knowledge-enhanced gating adapter and a lightweight temporal detection model. During the training phase, the focus loss function is used to jointly optimize the knowledge-enhanced gating adapter, the lightweight temporal detection model, and the classification output layer, so that the model reduces the loss contribution of easily classified samples and increases the loss weights of minority attack samples, hard-to-classify samples, and similar attack variant samples.

[0059] During the training phase, the predicted probability distribution of the lightweight temporal detection model for the training samples is obtained; a focus loss function is constructed as the optimization objective, and the mathematical form of the focus loss function is:

[0060] ;

[0061] in, Represents the focus loss function. It is the probability that the model predicts the true class. To focus parameters, This is the category balance coefficient;

[0062] By using the focus loss function, the model automatically reduces the loss contribution of easily classified samples that have been correctly classified during training, and relatively increases the loss weight of difficult-to-classify samples, minority class attack samples, and easily confused attack variant samples. This drives the model to pay more attention to the discriminative feature learning in complex attack scenarios and improves the robustness of detection of imbalanced data.

[0063] Optionally, the method also includes a federated prior update mechanism for multiple edge nodes:

[0064] Intrusion detection systems deployed on different edge nodes maintain their own offline prior knowledge bases locally; each edge node periodically uses local incremental traffic data to independently update its local structural priors, category condition statistical priors, and global feature importance priors.

[0065] Each edge node uploads the updated prior parameters, statistical summary information or model gradients to the central server after desensitizing them; the central server securely aggregates the information received from different edge nodes to generate an updated global prior representation.

[0066] The central server distributes the aggregated global prior representation to each edge node to replace or merge with the local prior, so that the prior knowledge of each edge node can adapt to the overall evolution trend of network attack behavior and the global drift characteristics of traffic.

[0067] Based on a second key aspect of the present invention, a multi-source prior gating enhanced threat intrusion detection and correlation analysis system for implementing the aforementioned method is provided, the system comprising:

[0068] The data acquisition module is used to collect network traffic, log data, session records, or security event data in the computing power network hub.

[0069] The preprocessing module is used to perform label encoding, data cleaning, feature extraction, standardization, tree model soft probability injection, and sequence construction on the collected data to obtain enhanced traffic feature sequences.

[0070] The structure prior construction module is used to statistically analyze the co-activation relationships between traffic features from historical attack samples, construct a feature-attack correlation graph, and obtain the structure prior representation.

[0071] The statistical prior construction module is used to divide the training samples according to the categories and calculate the statistics of each category on each feature dimension to form the category conditional statistical prior.

[0072] The global feature importance prior construction module is used to train regularized classification models, multi-output ridge regression models, or one-to-many ridge classifiers, and combines importance coefficient feature selection, forward sequence feature selection, backward sequence feature selection, and correlation coefficient feature selection to obtain the global feature importance prior;

[0073] The prior fusion module is used to align and fuse structural priors, category conditional statistical priors, and global feature importance priors in order to obtain a fused prior representation.

[0074] The knowledge-enhanced gating adaptation module is used to use fused priors as control signals to participate in the calculation of gating values, and to dynamically enhance, suppress or reweight the traffic features to be detected, so as to obtain the knowledge-enhanced traffic feature representation.

[0075] A lightweight temporal detection module is used to perform temporal modeling on the knowledge-enhanced traffic feature representation and extract local burst patterns and long-range dependency features.

[0076] The classification output module is used to calculate the probability of the traffic to be detected belonging to each category based on the feature representation output by the lightweight time-series detection module, and output the final detection result.

[0077] The prior update module is used to periodically or triggerally update the structural prior, category condition statistical prior, and global feature importance prior based on new traffic samples, detection feedback, or security operation results.

[0078] Based on a third key aspect of the present invention, an electronic device is provided, comprising one or more processors;

[0079] Storage device for storing one or more programs;

[0080] When one or more programs are executed by one or more processors, the one or more processors implement the aforementioned multi-source prior gating enhanced threat intrusion detection and correlation analysis method.

[0081] Based on a fourth key aspect of the present invention, a computer-readable storage medium is provided having a computer program stored thereon, characterized in that, when the computer program is executed, it implements the aforementioned multi-source prior gating enhanced threat intrusion detection and correlation analysis method.

[0082] Compared to existing technologies, in this invention, the three types of prior knowledge—structural prior, category conditional statistical prior, and global feature importance prior—are all constructed offline. This process leverages the computing resources of high-performance training servers to fully statistically analyze, model, and filter massive historical traffic data. During the online detection phase, only the pre-constructed fusion prior representation needs to be invoked and injected as a control signal into the lightweight gating adapter, eliminating the need for complex graph computations, matrix factorization, or large-scale feature retraining. Furthermore, the lightweight temporal detection model employs a cascaded structure of temporal convolutional networks and bidirectional gated recurrent units, avoiding the quadratic computational complexity of self-attention models such as Transformers. This design enables the invention to be deployed in resource-constrained environments such as edge gateways, IoT access nodes, and industrial internet security devices, handling large-scale real-time traffic while maintaining millisecond-level detection latency.

[0083] On the other hand, this invention simultaneously introduces three types of positively complementary priors. The structural prior explicitly models the co-activation relationships of multiple traffic features under attack conditions through a feature-attack correlation graph, enabling the model to perceive which features will simultaneously exhibit abnormalities during an attack. The categorical conditional statistical prior establishes an independent mean-variance statistical baseline for each attack category, allowing attack variants with similar statistical features but different behaviors to be effectively distinguished at the statistical profiling level. The global feature importance prior selects the most discriminative features based on overall contribution, suppressing business fluctuation features unrelated to the attack. These three priors complement each other, jointly guiding the detection model to focus on the most fundamental attack patterns.

[0084] In traditional methods, prior knowledge is often incorporated into the model through feature concatenation, rule post-processing, or static feature selection, which has limited guiding effect. This invention injects fused prior representations into the computation of the gating branch, so that the gating vector depends not only on the current input features but also on offline prior knowledge.

[0085] Specifically, when a traffic feature is marked as highly correlated with a certain attack in the structural prior, its current value deviates from the normal distribution of its category in the statistical prior, and it has a high weight in the global importance prior, the gating value corresponding to that feature will be automatically increased, resulting in a stronger response after weighted modulation. Conversely, features unrelated to attacks or significantly affected by business load fluctuations are suppressed. This dynamic modulation mechanism allows the model to adaptively adjust its focus when facing different attack scenarios without the need for manually setting fixed thresholds or rules.

[0086] Considering that the "category" is unknown before the online detection phase, one implementation method is as follows:

[0087] The soft probability vector of the category output by the tree model We perform weighted aggregation on the statistical profiles based on category conditions to obtain the statistical prior representations related to the current sample:

[0088]

[0089] The statistical prior representation is then fused with the structural prior and the global prior and input into the gating adapter.

[0090] in, For statistical prior representation, This is the feature vector of a single input sample. The total number of categories, The first output of the tree model The soft probability of a class For category The conditional statistical mean, For category Conditional statistical variance is an optional transformation function used to map the weighted aggregated vector to a unified representation space.

[0091] This invention employs a Temporal Convolutional Network (TCN) to extract local patterns within a short time window. Its dilated convolutional structure can exponentially expand the receptive field without increasing the number of layers, efficiently capturing rapid fluctuations in sudden attacks. Subsequently, a Bidirectional Gated Recurrent Unit (Bi-GRU) is used to model the sequence context from both forward and reverse directions, capturing dependencies across time lengths.

[0092] The solution of this invention can be widely applied to various heterogeneous computing scenarios such as computing power networks, the Internet of Things, and the Industrial Internet, and has good scalability and deployment flexibility. Because offline prior construction and online detection are decoupled, different scenarios can independently build prior knowledge bases adapted to local traffic characteristics, while the online detection model adopts a unified lightweight architecture, facilitating distributed deployment across the cloud, edge nodes, and terminal devices. Simultaneously, this invention also provides a federated prior update mechanism. After each edge node updates its prior locally, it only uploads anonymized statistical summaries or gradients. The central server aggregates and generates a global prior and distributes it, protecting data privacy while enabling the model to adapt to the overall evolution of attack behavior.

[0093] Therefore, this invention is not only applicable to large-scale infrastructure such as computing network hubs and East-West computing nodes, but can also be embedded in more resource-constrained devices such as IoT security gateways, industrial internet edge gateways, and vehicle network gateways, and has broad application prospects. Attached Figure Description

[0094] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, obtaining other drawings based on these drawings without creative effort still falls within the scope of the present invention.

[0095] Figure 1 The following is a flowchart illustrating the execution of a multi-source prior gating enhanced threat intrusion detection and correlation analysis method according to an embodiment of the present invention;

[0096] Figure 2 This diagram illustrates an overall architecture diagram of a multi-source prior gating enhanced threat intrusion detection and correlation analysis according to one embodiment of the present invention.

[0097] Figure 3 This diagram illustrates a pseudo-algorithm for constructing a Feature-Attack Correlation Graph (FACG) structure prior, according to one embodiment of the present invention.

[0098] Figure 4 This diagram illustrates a pseudo-algorithm for constructing category conditional statistical priors in one embodiment of the present invention.

[0099] Figure 5 The diagram illustrates a flowchart of a global feature importance prior construction method based on ridge regression and multi-path feature selection in one embodiment of the present invention. Detailed Implementation

[0100] The preferred embodiments of the present invention will be described in detail below to provide a clearer understanding of the purpose, features, and advantages of the invention. It should be understood that the following embodiments are not intended to limit the scope of the invention, but are merely illustrative of the essential spirit of the technical solution of the invention.

[0101] The following is a description of the specific meanings of technical terms, English abbreviations, and formula parameters that may be used in this invention:

[0102] Computing infrastructure: The basic software and hardware system used to support the supply, scheduling, storage, transmission and collaborative operation of computing resources, typically including data centers, servers, network equipment, storage systems, cloud platforms, edge nodes and computing scheduling and management platforms.

[0103] Multi-source prior knowledge: Information extracted from historical traffic, statistical distribution, feature correlation, or feature contribution that can guide the detection model before online detection.

[0104] Structural priors: Prior knowledge used to describe the structural relationships between multiple traffic characteristics, devices, behaviors, or network entities under attack conditions.

[0105] Feature-Attack Correlation Graph (FACG): A graph structure with traffic features as nodes and anomalies in attack samples as edges.

[0106] Category-based statistical priors: Statistical profiles calculated separately for normal categories and different attack categories, used to characterize differences in category distribution.

[0107] Global feature importance prior: a set of weights or features that reflects the overall contribution of each traffic feature to the intrusion detection task.

[0108] Knowledge-enhanced gating adapter: A module that enables fusion priors to participate in the calculation of gating values, feature masks, or reweighting coefficients to dynamically enhance or suppress real-time traffic characteristics.

[0109] TCN: Temporal Convolutional Network, used to extract local burst patterns in temporal or sequential features.

[0110] Bi-GRU: Bidirectional gated cyclic unit, used to model bidirectional temporal dependencies and form sequence-level representations.

[0111] Focal Loss: This loss reduces the impact of easily classified samples on training, allowing the model to focus more on minority and difficult-to-classify samples.

[0112] like Figure 1As shown, in one embodiment, the present invention provides a multi-source prior gating enhanced threat intrusion detection and correlation analysis method for computing infrastructure and computing network hub scenarios. This method can be deployed in computing network hubs, East-West computing nodes, cloud-edge collaboration platforms, IoT security gateways, industrial internet edge nodes, data center entry gateways, computing scheduling nodes, or multi-tenant computing resource scheduling environments. It is used to detect normal traffic, abnormal traffic, scanning attacks, denial-of-service attacks, botnet attacks, backdoor attacks, lateral movement attacks, and other network intrusion behaviors, and further performs correlation analysis on the detection results, traffic subjects, attack categories, key characteristics, time series, and alarm events.

[0113] The method includes the following steps S100-S500 performed by a computer system:

[0114] Step S100: Collect historical traffic data in the computing power network hub, and preprocess and prepare for prior injection of the historical traffic data;

[0115] Step S200: Construct multi-source prior knowledge offline based on historical training samples. The multi-source prior knowledge includes structural prior, class conditional statistical prior, and global feature importance prior. Furthermore, the structural prior, class conditional statistical prior, and global feature importance prior are dimensionally aligned and uniformly fused to obtain a fused prior representation.

[0116] Step S300: The fused prior representation is input into the knowledge enhancement gating adapter online, so that the fused prior representation participates in the gating value calculation, and the traffic features to be detected are dynamically enhanced, suppressed or reweighted to obtain the knowledge-enhanced traffic feature representation.

[0117] Step S400: Input the knowledge-enhanced traffic feature representation into the lightweight temporal detection model, extract local burst patterns and long-range temporal dependency features, and obtain a sequence-level representation that integrates local burst features and long-range dependency features as the output feature representation;

[0118] Step S500: Input the feature representation output by the lightweight temporal detection model into the classification output layer to obtain the probability distribution of the traffic to be detected belonging to each category, and output the final detection result according to the probability distribution. Based on the detection result, analyze the attack source, target and behavior chain of the threat event.

[0119] In a preferred embodiment, the method includes the following steps.

[0120] S101: Collect historical traffic data from the computing power network hub.

[0121] Historical traffic data is collected from IoT terminals, edge gateways, cloud-edge collaborative links, computing scheduling nodes, industrial internet control devices, data center ingress gateways, network forwarding devices, or security devices within computing infrastructure and computing network hubs. This historical traffic data may include raw data packets, 5-tuple flow records, NetFlow flow logs, sFlow flow logs, IPFIX flow logs, firewall logs, intrusion detection logs, terminal operation logs, computing task scheduling logs, or cloud-edge collaborative access logs.

[0122] S102: Preprocessing and preparing prior injection for historical traffic data

[0123] The collected raw traffic data undergoes label encoding, data cleaning, feature extraction, standardization, soft probability injection into a tree model, and sequence construction to form a labeled, structured training sample set, i.e., historical training samples, and to obtain enhanced traffic feature sequences for subsequent detection model input. Simultaneously, contextual information for correlation analysis is extracted, including one or more of the following: source address, destination address, port, protocol, access time, session identifier, device identifier, asset type, computing task identifier, and security log identifier.

[0124] S201: Offline Construction of Multi-Source Prior Knowledge

[0125] Multi-source prior knowledge is constructed based on historical training samples. This multi-source prior knowledge includes at least: structural priors, used to characterize the correlation between multiple traffic features under attack conditions; categorical conditional statistical priors, used to characterize the differences in feature distribution among different traffic categories; and global feature importance priors, used to characterize the overall contribution of each traffic feature to the intrusion detection task.

[0126] S202: Integrating Multi-Source Prior Knowledge

[0127] By dimensionally aligning and unifying the structural prior, the categorical conditional statistical prior, and the global feature importance prior, a fused prior representation is obtained.

[0128] S300: Online Enhancement of Gated Modulation Using Fusion Prior Execution Knowledge

[0129] By integrating prior input knowledge into a gating adapter, the fused priors are used to participate in the calculation of gating values, dynamically enhancing, suppressing, or reweighting the traffic features to be detected, thus obtaining a knowledge-enhanced representation of the traffic features.

[0130] S400: Perform lightweight timing detection

[0131] The knowledge-enhanced traffic feature representation is input into a lightweight temporal detection model to extract local burst patterns and long-range temporal dependency features.

[0132] In this embodiment, the lightweight temporal detection model includes a cascaded temporal convolutional network (TCN) and a bidirectional gated recurrent unit (Bi-GRU). The TCN extracts local burst patterns from the knowledge-enhanced traffic feature sequence and outputs a temporal feature map. The Bi-GRU performs bidirectional context modeling on the temporal feature map, captures long-range temporal dependency features, and outputs a sequence-level representation that integrates local burst features and long-range dependency features by concatenating the final hidden states of the forward and backward directions. This sequence-level representation is the feature representation output by the lightweight temporal detection model and is fed into the classification output layer for final category determination.

[0133] S501: Output detection results

[0134] The feature representation output by the lightweight temporal detection model is input into the classification output layer to obtain the probability distribution of the traffic to be detected belonging to each category, and the final detection result is output based on the probability distribution. The detection result can include normal traffic categories and one or more attack categories. The system can also trigger alarms, blocking, isolation, logging, risk scoring, or security policy linkage based on the detection result.

[0135] S502: Perform correlation analysis of detection results

[0136] Based on detection results, traffic context information, key contribution characteristics, historical alarms, asset information, and access link information, the system aggregates and correlates abnormal events within the same source address, target asset, attack category, time window, or computing power task link to identify continuous attack behaviors across terminals, nodes, and links. Furthermore, the system can generate attack link reconstruction results, threat intent judgment results, and associated alarm results based on attack category transfer relationships, temporal sequences, access path relationships, and changes in risk scores.

[0137] Based on the correlation analysis of the detection results, the attack source, target, and behavioral chain of the threat event can be identified. One possible specific implementation method is as follows:

[0138] Each detection result is constructed as a threat event tuple:

[0139] ;

[0140] Indicates the source IP address, the address of the terminal that initiated the network communication; Indicates the target IP address, the address of the terminal receiving network communication; Indicates the source port number, the port used for communication at the source; Indicates the target port number, the service port that is open at the destination; Indicates the transport layer protocol type; The device identifier that indicates the detection of the threat; This indicates the identifier of the analysis task or detector instance that generated the detection result; Indicates the attack type label; Indicates the confidence level of the detection; Indicates the timestamp of when the event occurred or was detected; This represents the set of key features.

[0141] Aggregation is performed within a sliding time window by source address, target asset, attack type, and computing power task chain.

[0142] Construct a threat association graph:

[0143] The nodes include attack sources, target assets, edge nodes, computing power tasks, and alarm events;

[0144] Edges represent access relationships, temporal relationships, same-origin relationships, same-target relationships, or attack phase transition relationships.

[0145] The associated edge weights are calculated based on time interval, risk probability, attack type transfer weights, and key feature similarity.

[0146] Output attack chain, threat stage, and handling recommendations for high-weight paths.

[0147] The following embodiments provide a detailed description of the implementation process of preprocessing historical traffic data and preparing for prior injection in step S102.

[0148] like Figure 2 As shown, in this invention, before the raw traffic enters the multi-source prior construction module and the online detection model, it needs to undergo data preprocessing and prior injection preparation. This part is used to convert heterogeneous, unstructured, or semi-structured network traffic into a feature representation that the model can process. It includes the following implementation process:

[0149] (1) Label encoding

[0150] For historical traffic data during the training phase, labels are encoded based on the business status or attack status corresponding to the traffic. Label encoding can be performed using a binary classification method or a multi-class classification method.

[0151] In a preferred embodiment, a multi-class labeling method is employed to enhance the ability to identify similar attack variants with finer granularity. Specifically, normal traffic is encoded as a normal category, and different attack families, different attack stages, or different attack variants are encoded as different attack categories. For example, normal traffic, botnet attacks, scanning attacks, denial-of-service attacks, and backdoor attacks can be encoded as different categories; furthermore, different variants within the same attack family can be encoded as different categories.

[0152] It should be noted that the Mirai family, Bashilite family, and other attack types shown in the diagram are merely examples. This invention is not limited to the aforementioned attack categories and can also be applied to other types of network attacks or business anomalies.

[0153] (2) Data cleaning

[0154] The raw traffic data is cleaned, including but not limited to: deleting duplicate samples; deleting or correcting illegal fields; filling or removing missing values; standardizing field formats; numerically encoding categorical fields; and truncating or smoothing out abnormal collected values.

[0155] Data cleaning can reduce the impact of collection noise, format errors, and abnormal records on subsequent prior construction and model training.

[0156] (3) Feature extraction

[0157] Traffic features are extracted from the cleaned traffic data. These features may include packet count, byte count, connection duration, port access, protocol type, uplink / downlink traffic ratio, time window statistics, session-level behavior, device-level access behavior, computing power task link access, and cloud-edge collaborative traffic interaction.

[0158] Let the extracted feature vector of a single sample be: ,in, Indicates the feature dimension.

[0159] (4) Standardization process

[0160] Since different traffic characteristics have different numerical ranges and units, such as packet count, byte count, connection duration, and port access count, there may be large scale differences between these characteristics. Therefore, it is preferable to standardize the characteristics.

[0161] In a preferred embodiment, Z-Score normalization is used to normalize the score of the first-order Z-score. Each feature is standardized as follows:

[0162] ;in, Indicates the first training set The mean of each feature, Indicates the first training set The standard deviation of each feature. Indicates the first before standardization Feature vectors of each feature Represents the standardized first The feature vector of each feature.

[0163] The standardized feature vector of a single sample is denoted as: Of course, this invention is not limited to the Z-Score normalization method; it can also employ max-min normalization, robust scaling, quantile normalization, logarithmic transformation, or adaptive normalization.

[0164] (5) Soft probabilistic injection of tree model

[0165] To enhance the neural network's ability to discriminate tabular traffic features, this invention preferably introduces a tree model soft probability injection mechanism. Specifically, a tree model classifier is first trained based on preprocessed training data, and this classifier is used to output soft probability vectors of which the sample to be detected belongs to each category.

[0166] In a preferred embodiment, the tree model employs the XGBoost model. For a single input sample feature vector... The XGBoost model outputs a soft probability vector for each class: ,in, For the number of categories, Indicates that the sample belongs to the first The probability of each category.

[0167] Then, the soft probability vector Compared with the standardized original individual sample feature vectors By concatenating the features, we obtain the enhanced feature vector: ,in," " indicates a splicing operation.

[0168] Through this step, the nonlinear decision boundary learned by the tree model is injected as an auxiliary discriminant prior into the subsequent neural detection model, which helps improve the model's ability to distinguish complex attack categories and similar attack variants. As an alternative implementation, the tree model can also employ LightGBM, CatBoost, Random Forest, Gradient Boosting Decision Tree, Extremely Random Tree, Support Vector Machine Probabilistic Output Model, Logistic Regression Probabilistic Output Model, or Rule Engine Risk Scoring Model.

[0169] (6) Sequence construction

[0170] To adapt to the subsequent lightweight temporal detection model, the enhanced feature vectors are constructed as serialized inputs to obtain the enhanced traffic feature sequence.

[0171] In one embodiment, a sliding time window approach can be used to divide the continuous a moment or a series Each flow record is constructed as an input sequence, namely, an enhanced flow feature sequence: ,in, , Indicates the enhanced feature dimension. express OK A column of real numbers.

[0172] In another embodiment, if the input sample itself is composed of time decay statistics or window statistics and already contains historical context information, the single-sample enhancement features can also be converted into input tensors suitable for temporal convolutional networks and recurrent neural networks through dimensionality expansion, channel mapping, or feature grouping.

[0173] After the above processing, a labeled, structured set of training samples is formed, i.e., the training dataset. They were used as historical training samples.

[0174] The following possible embodiments illustrate the specific implementation process of offline construction of multi-source prior knowledge in step S201.

[0175] One of the core aspects of this invention lies in the offline construction of multi-source prior knowledge. This multi-source prior knowledge includes structural priors, category conditional statistical priors, and global feature importance priors. These three types of priors describe attack traffic characteristics from the perspectives of feature association, category distribution, and global contribution, respectively, providing a basis for knowledge-enhanced gating modulation in the online detection phase.

[0176] S2011, Implementation Method of Structure Prior Construction

[0177] Structural priors are used to characterize the collaborative anomaly relationships among multiple traffic features under attack conditions. In a preferred embodiment of the invention, the structural prior is constructed using a feature-attack correlation graph. The feature-attack correlation graph can be denoted as FACG, or Feature-Attack Correlation Graph.

[0178] In FACG, graph nodes represent traffic features, graph edges represent two features that are simultaneously abnormally activated or have a strong correlation in the attack sample, and edge weights represent the strength of the correlation.

[0179] Let the training dataset be... ,in, Indicates the first Traffic characteristics of each training sample Let the sample label be . Let the feature set be . ,in, Representing feature dimension, Represents a single feature. Feature set This refers to the set of names or indexes of all possible traffic features. The structure prior construction process is as follows:

[0180] (1) Initialize the co-occurrence matrix

[0181] Build a co-occurrence matrix And initialize all elements in the matrix to 0: In this co-occurrence matrix middle, Used for statistics The first feature and the first The number of times each feature is simultaneously abnormally activated in the attack sample.

[0182] (2) Filtering the attack sample set

[0183] By filtering out attack samples whose labels do not belong to the normal category from the training dataset, we obtain the set of attack samples, or attack subset: ,in, This indicates the normal traffic category.

[0184] (3) Set an abnormal threshold

[0185] Set an anomaly threshold for each feature. The threshold can be a uniform threshold, or it can be a threshold set separately for different features. In one embodiment, the threshold can be determined based on the mean, standard deviation, quantiles, or expert experience of the training samples.

[0186] (4) Statistical co-activation relationship

[0187] For the attack sample set Each sample feature vector traverse the first one in turn The first feature and the first There are two features. When the values, absolute values, deviations from the class statistical baseline, or anomaly scores of two feature dimensions exceed their respective anomaly thresholds, it is determined that the two features have a co-activation relationship. That is: when... and At that time, it was believed that the first The first feature and the first If all features are anomalously activated in the attack sample, the following update will be performed: .in, express The Each feature can take a value. express The Each feature can take a value. To reduce redundant statistics, only the upper triangular part of the matrix can be traversed, i.e. from Begin traversing and update the symmetrical positions synchronously. .

[0188] (5) Normalization

[0189] After completing the co-activation statistics for all attack samples, the co-occurrence matrix was analyzed. Normalization is performed to obtain the weighted adjacency matrix. Preferably, normalization can be performed in the following manner: .in, Represents the co-occurrence matrix The maximum value in the normalized range. Indicates the first The first feature and the first The relative co-activation intensity of each feature in the attack sample.

[0190] (6) Sparsification treatment

[0191] To reduce the impact of noise correlation on subsequent models, a sparsity threshold can be set. .when When this happens, the corresponding edge weight is set to zero. Through sparsification, more attack-related feature associations can be preserved, while random co-occurrences or weak correlations can be suppressed.

[0192] (7) Forming a priori representations of the structure

[0193] The sparsed weighted adjacency matrix As a structural prior, it can also be further improved through graph embedding, graph convolution, matrix factorization, or linear mapping. Convert to structural prior This prior structure is used for subsequent prior fusion and knowledge-enhanced gating modulation, enabling the model to focus on the collaborative anomaly relationships between multiple features under attack conditions, rather than relying solely on a single feature for judgment.

[0194] One of the FACG algorithm implementations is as follows: Figure 3 As shown.

[0195] The structural prior constructed in the above manner can explicitly express the feature collaboration anomaly relationship in the attack scenario, which helps to improve the model's ability to identify complex attacks, covert attacks and similar attack variants.

[0196] S2012, Implementation method for constructing prior knowledge of category conditions statistics

[0197] Categorical conditional statistical priors are used to characterize the distribution differences of different categories of traffic across various feature dimensions. This prior provides a category-level statistical baseline for the model, enabling it to identify similar attack variants by referencing not only the immediate features of a single sample but also historical category distribution characteristics.

[0198] Let the training dataset be... .in, Indicates the first The feature vectors of each training sample Let the feature dimension be 1. The category space is ,in, This represents the total number of categories. The prior construction process for category condition statistics is as follows.

[0199] (1) Initialize the statistical matrix

[0200] Initialize the mean matrix sum and variance matrix : , In the matrix above, with Indicates the first The categories in the The mean of each feature dimension Indicates the first The categories in the The variance is stored in each feature dimension. In this invention, the mean matrix stores the arithmetic mean of each category in each feature dimension. The variance matrix stores the variance of each category in each feature dimension.

[0201] (2) Divide the training samples by category

[0202] For category space Each category Select a set of samples belonging to this category from the training dataset: And calculate the number of samples in that category. .

[0203] (3) Calculate the feature mean for each category.

[0204] For the The first category Given a feature, calculate the mean of all samples in that category along that feature dimension: .in, Indicates sample The Each feature can take a value.

[0205] (4) Calculate the characteristic variance for each category.

[0206] For the The first category Given a feature, calculate the variance of all samples in that category along that feature dimension: This variance is used to describe the category. In the The degree of dispersion in each feature dimension.

[0207] (5) Aggregate to form category statistical profiles

[0208] For each category , its mean vector Sum of variance vectors By splicing the data, we can obtain the categories. Statistical profile: ,in, This indicates vector concatenation.

[0209] (6) Forming a statistical prior matrix

[0210] Aggregate the statistical profiles of all categories to form a statistical baseline matrix: This statistical baseline matrix This is the category-conditional statistical prior, which can be further converted into a category-conditional statistical prior representation through linear mapping, embedding layers, or multilayer perceptrons. .

[0211] One example is the implementation of a category-based statistical profile generation algorithm. Figure 4 As shown.

[0212] The category-conditional statistical priors obtained through the above methods can reflect the distributional differences between different traffic categories, and are particularly suitable for distinguishing attack variants with similar statistical characteristics but different attack behaviors. It should be noted that the statistics are not limited to the mean and variance, but may also include the median, maximum, minimum, quantiles, skewness, kurtosis, covariance matrix, category prototype vector, Gaussian distribution parameters, Gaussian mixture model parameters, kernel density estimation results, or category center distance distribution.

[0213] S2013, Implementation Method for Constructing Priors of Global Feature Importance

[0214] The global feature importance prior is used to characterize the overall contribution of each traffic feature to the intrusion detection task. This prior allows for increased weighting of important features and reduced impact from irrelevant, redundant, and noisy features during subsequent gating and modulation processes.

[0215] like Figure 5 As shown, in a preferred embodiment, the global feature importance prior is constructed through a ridge regression model and a multi-path feature selection method.

[0216] (1) Construct the training feature matrix and target vector

[0217] The preprocessed training samples are used to construct a feature matrix. and target vector .in, This represents the traffic feature matrix of the training samples. This indicates the corresponding label or target output.

[0218] (2) Training Ridge Regression Model

[0219] Based on feature matrix and target vector Training a ridge regression model. Ridge regression, by introducing an L2 regularization term, can stably estimate the contribution coefficients of each feature when there are multiple correlations among features. In one embodiment, the optimal regularization parameter can be determined through grid search and cross-validation to obtain the optimal ridge regression model. .

[0220] (3) Feature selection based on importance coefficient

[0221] Based on all training samples, a feature matrix and a target label matrix are constructed. A regularized classification model, a multi-output ridge regression model, a one-to-many ridge classifier, or a linear discriminant model with a regularization term is trained. All features are ranked using the model's output feature coefficient matrix, coefficient norm, or importance score. The top-scoring features are selected to form a feature subset based on importance coefficients. .

[0222] (4) Forward sequence feature selection

[0223] Starting with an empty or initial feature set, candidate features are gradually added. After each candidate feature is added, the model performance is evaluated using a validation set or cross-validation. If adding a feature improves performance, it is retained. By gradually adding features, a subset of the forward sequence features is formed. .

[0224] (5) Feature selection of backward sequence

[0225] Starting with the complete feature set or a large candidate feature set, progressively attempt to remove features one by one. Evaluate model performance after each feature removal. If removing a feature does not degrade performance or even improves performance, then remove that feature. By progressively removing redundant features, a backward sequence feature subset is formed. .

[0226] (6) Feature selection based on correlation coefficient

[0227] Calculate the correlation or significance level between each feature and the target label, and select features based on correlation scores or significance ranking to form a feature subset based on correlation coefficients. Correlation indicators can be Pearson correlation coefficient, Spearman correlation coefficient, mutual information, chi-square test score, or other indicators that can measure the degree of correlation between features and targets.

[0228] (7) Feature subset fusion

[0229] By fusing the above subsets of features, we obtain the final global feature importance prior: in, This represents the union operation. Additionally, it allows converting the feature coefficients output by a ridge regression model into a feature weight vector. ,in, Indicates the first Global importance weights for each feature.

[0230] (8) Forming a priori representation of the importance of global features

[0231] The final feature set Feature weight vector Or its embedding representation can be used as a prior for global feature importance. This prior can be used for feature scaling, feature reweighting, gating bias, or prior fusion in subsequent gating adapters. It should be noted that the prior for global feature importance is not limited to ridge regression; it can also be obtained using Lasso regression, ElasticNet regression, logistic regression weights, random forest feature importance, gradient boosting tree feature importance, permutation importance, SHAP feature contribution, attention weight statistics, principal component analysis, autoencoder reconstruction error, or causal contribution, etc.

[0232] The following embodiments illustrate the specific implementation process of fusing multi-source prior knowledge in step S202.

[0233] Obtaining structural priors Category conditional statistical prior Priors on the importance of global features Subsequently, the three types of priors need to be uniformly represented and fused so that they can participate in knowledge-enhanced gating modulation during the online detection phase.

[0234] S2021, Prior Dimension Alignment

[0235] Since the three types of priors come from different sources and have different dimensions, dimension alignment is preferred as the first step. Specifically, linear mapping, embedding layers, multilayer perceptrons, graph embedding networks, or normalized mapping methods can be used to map the three types of priors to the same or compatible latent space dimensions. For example: , , .in, This indicates structural prior embedding. This represents statistical prior embedding. This represents the prior embedding of global feature importance.

[0236] S2022, A priori fusion

[0237] The three priors after dimension alignment are fused to obtain the fused prior representation. In a preferred embodiment, the fusion prior can be expressed as: ,in, This represents the fusion function.

[0238] The fusion function can be additive fusion, concatenation fusion, weighted fusion, attention fusion, gating fusion, multilayer perceptron fusion, expert hybrid fusion, or hierarchical fusion. In one embodiment, the following weighted fusion method can be used: ,in, , , These are preset weights or learnable weights. In another embodiment, structural priors and statistical priors can be fused first, and then fused with global feature importance priors to form a hierarchical fusion structure.

[0239] The following embodiments illustrate the implementation process of enhancing gating modulation online using fused prior execution knowledge in step S300.

[0240] By integrating prior input knowledge into a gating adapter, the fused priors are used to participate in the calculation of gating values, dynamically enhancing, suppressing, or reweighting the traffic features to be detected, thus obtaining a knowledge-enhanced representation of the traffic features.

[0241] One of the key innovations of this invention is that the multi-source prior is not simply concatenated with the input flow as a normal feature, but participates in the calculation of the gate value as a gate control signal, thereby dynamically determining which features should be enhanced and which features should be suppressed.

[0242] In this embodiment, the following knowledge-enhanced gating adapter structure is adopted:

[0243] The knowledge-enhanced gating adapter includes an input branch, a value branch, a gating branch, and a residual branch. The input branch receives enhanced traffic features, the value branch generates candidate feature representations, the gating branch calculates gating weights by incorporating prior information, and the residual branch preserves the original input features to prevent the loss of crucial information.

[0244] The calculation process of the knowledge-enhanced gating adapter is as follows:

[0245] Let the current time-time feature vector in the enhanced flow feature sequence be... , fusion of prior representations as The fused prior representations will be projected through the prior matrix. The mapping is to a prior modulation vector with the same dimension as the output of the gated branch, and the gated vector is calculated as follows:

[0246] ;

[0247] in, For trainable gated weight matrix, For gated bias terms, Using the Sigmoid activation function, fused with prior representations Direct additive injection into gated computation;

[0248] Candidate enhancement features are calculated as follows:

[0249] ;

[0250] in, The output weight matrix is ​​trainable. The output bias term; the knowledge-enhanced flow characteristics are represented as follows:

[0251] ;

[0252] in, This represents element-wise multiplication. Retain the original information as a residual join term; is the prior projection matrix, used to map the fused prior representation to the same dimension as the gated branch output; The residual projection matrix is ​​used when the input feature dimension and the candidate enhancement feature dimension are the same. Unit mapping.

[0253] In the above structure, prior representations are fused. Directly involved in gating vectors The calculation is as follows. Therefore, when certain features are attack-related features in the structural prior, have class discrimination ability in the statistical prior, or have a high contribution in the global importance prior, the corresponding gate value of the feature can be increased, thereby enhancing its role in the subsequent detection model.

[0254] Conversely, for features that are irrelevant to attacks, susceptible to fluctuations in workload, or have a low contribution, their gate values ​​can be reduced, thereby minimizing the interference of noisy features on the classification results. Through this knowledge-enhanced gating modulation mechanism, this invention achieves the technical effect of multi-source prior participation in online feature modulation, enabling the model to dynamically highlight attack-related features while suppressing background noise.

[0255] The knowledge-enhanced gating adapter in this invention is not limited to the above-described gated linear unit structure. Alternatively, it may employ Sigmoid gating networks, Tanh gating networks, feature-level attention mechanisms, channel attention mechanisms, Squeeze-and-Excitation feature recalibration modules, FiLM feature scaling and translation modules, residual adapters, TabNet-style feature selection masks, expert hybrid gating networks, prior-based dynamic feature masks, prior-based feature reweighting layers, prior-based input gates, forget gates, or update gate modulation structures.

[0256] Any fusion prior that can participate in the calculation of gating values, attention weights, feature masks, scaling factors, or offset factors, and thereby enhance or suppress real-time traffic features, can be used as an equivalent alternative implementation of the present invention.

[0257] The specific implementation process of lightweight timing detection in step S501 is described in the following possible embodiments. After knowledge-enhanced gating modulation, the obtained flow feature representation is input into the lightweight timing detection model for further extraction of local burst patterns and long-range timing dependency features.

[0258] (1) Temporal convolutional network feature extraction

[0259] In a preferred embodiment, the lightweight temporal detection model first employs a temporal convolutional network (TCN) to process the knowledge-enhanced traffic sequence.

[0260] TCN comprises one or more dilated residual blocks. Each dilated residual block may include dilated convolutional layers, pruning layers, activation layers, dropout layers, 1×1 convolutional layers, and residual connections.

[0261] The purpose of dilated convolution is to expand the model's temporal receptive field, enabling it to capture local burst patterns in traffic sequences with lower computational complexity. For example, scanning attacks, denial-of-service attacks, and botnet communications may manifest as rapid changes in packet count, connection count, or access frequency within a short time window; TCN can effectively capture such short-term anomalous patterns. In one embodiment, the dilation coefficient can be set to 1, 2, or 4, or it can be set to other values ​​based on the actual length of the traffic sequence.

[0262] (2) Modeling of bidirectional gated loop unit

[0263] The timing characteristics output by the TCN are further input into the Bi-GRU (Bidirectional Gated Recurrent Unit). The Bi-GRU models the contextual dependencies of the traffic sequence in both forward and reverse directions, thereby capturing persistent attacks, multi-stage attacks, or periodic anomalous behavior.

[0264] Let the TCN output be Then, Bi-GRU obtains a sequence-level representation after performing sequence modeling on it. This representation includes local burst features and long-range dependency features, which can be used for subsequent classification output. In a preferred embodiment, Bi-GRU can employ a two-layer stacked structure. Its output features can be concatenated with the forward and backward hidden states to obtain a sequence-level feature representation: .

[0265] in, This represents the hidden state vector output by the forward gated recurrent unit in the Bi-GRU at the last time step. This represents the hidden state vector output by the reverse-gated recurrent unit in the bidirectional gated recurrent unit at the last time step. " indicates a vector concatenation operation.

[0266] This invention employs a combination of TCN and Bi-GRU for temporal modeling. Compared to complex self-attention models or online graph inference models, it can reduce online inference overhead while maintaining strong temporal modeling capabilities. Especially in resource-constrained devices such as edge gateways, IoT access nodes, and computing power scheduling nodes, this lightweight temporal detection structure is more conducive to real-time deployment.

[0267] It should be noted that the lightweight temporal detection model of the present invention is not limited to the combination of TCN and Bi-GRU, but can also employ one-dimensional convolutional neural networks, deep separable convolutional networks, gated recurrent units, long short-term memory networks, bidirectional long short-term memory networks, lightweight Transformers, state-space models, distillation models, pruning models, quantization models, or combinations thereof.

[0268] The following possible embodiments illustrate the implementation of the multi-category detection result output in step S502.

[0269] After completing lightweight temporal detection, the sequence-level feature representation will be... Input the multi-class output layer to obtain the probability distribution of the traffic to be detected belonging to each category.

[0270] In one embodiment, the classification output layer can be represented as: ,in, For classification layer weights, For classification layer bias, Represents the probability distribution of categories. This is the activation function. The final predicted category can be determined as follows: ,in, Indicates the detection category output by the model. This represents the function with the maximum value of the independent variable.

[0271] In one embodiment, the detection category may include a normal category and multiple attack categories. For example, attack categories may include botnet attacks, scanning attacks, denial-of-service attacks, backdoor attacks, abnormal access, lateral movement attacks, etc. For scenarios with attack families and attack variants, a hierarchical classification approach can also be used, that is, first determine the attack family, and then determine the specific attack variant.

[0272] After the detection results are output, the system can perform one or more of the following operations based on the detection results: generate security alarms; record detection logs; output risk scores; report attack traffic to the security operations platform; trigger access control policies; block or rate-limit abnormal connections; isolate relevant terminals or edge nodes; and coordinate with firewalls, intrusion prevention systems, or zero-trust gateways to implement handling policies.

[0273] The complete model training implementation of the present invention will be described in one of the following embodiments.

[0274] The model training of this invention is preferably performed on an offline training server, a central security platform, a cloud node, or an edge node with training capabilities. The training phase includes multi-source prior construction, model parameter optimization, and hard example-aware training.

[0275] The training inputs include: preprocessed training traffic features; corresponding labels; soft probability vectors output by the tree model; offline constructed structural priors; offline constructed class conditional statistical priors; and offline constructed global feature importance priors.

[0276] In a preferred embodiment, the training process includes: initializing the model parameters of the knowledge-enhanced gating adapter, TCN, Bi-GRU, and classification output layer; inputting training samples into a preprocessing module to obtain enhanced traffic features; invoking structural priors, class conditional statistical priors, and global feature importance priors; obtaining a fused prior representation through a prior fusion module; inputting the fused prior into the knowledge-enhanced gating adapter to perform gating modulation on the training sample features; inputting the gating-modulated features into a lightweight temporal detection model; obtaining the prediction probability through the classification output layer; calculating the error between the prediction result and the true label based on the loss function; updating the model parameters through backpropagation; and repeating the above steps until a preset number of training rounds is reached or the convergence condition is met.

[0277] To improve the model's ability to identify imbalanced samples, minority class attack samples, and similar attack variants, this invention preferably uses a focus loss function for training. The focus loss function can be expressed as:

[0278] ;

[0279] in, Represents the focus loss function. It is the probability that the model predicts the true class. To focus parameters, This is the category balance coefficient;

[0280] This loss function reduces the contribution of easily classified samples to the training gradient, while relatively increasing the training weights of hard-class samples, minority class samples, and easily confused attack variants, thereby improving the model's robustness to complex attack scenarios. Alternatively, weighted cross-entropy loss, class balancing loss, hard example mining loss, large-margin classification loss, contrastive learning loss, triplet loss, center loss, dynamic weighted loss based on the confusion matrix, minority class resampling, hard example resampling, oversampling, undersampling, or synthetic minority class sample generation methods can be used.

[0281] The following embodiments illustrate the implementation of the complete system of the present invention for online threat reasoning and correlation analysis.

[0282] The online inference phase can be deployed in edge gateways, IoT access nodes, computing power scheduling nodes, industrial internet security gateways, or data center entry security devices to perform lightweight detection, risk identification, and correlation analysis of real-time traffic.

[0283] The online inference process includes: acquiring real-time traffic data; performing data cleaning, feature extraction, and standardization; acquiring the soft probability output of the tree model and concatenating it with the standardized features; constructing the traffic sequence to be detected; calling the offline-built and saved structural priors, category conditional statistical priors, and global feature importance priors; fusing the multi-source priors to obtain a fused prior representation; inputting the fused priors into a knowledge-enhanced gating adapter to obtain knowledge-enhanced traffic features; inputting the knowledge-enhanced traffic features into a lightweight temporal detection model; and outputting the detection category, risk probability, confidence level, and key contribution features.

[0284] After outputting the detection results, the system further performs correlation analysis. Specifically, based on detection category, risk probability, source address, destination address, port, protocol, access time, session identifier, device identifier, asset information, computing power task identifier, and historical alarm information, the system aggregates and correlates abnormal events in the same attack source, the same target asset, the same time window, the same access link, or the same computing power task link, identifying continuous attack behaviors across terminals, nodes, and links. Furthermore, the system can generate correlated alarms, attack link reconstruction results, threat intent analysis results, and risk handling suggestions based on attack category transfer relationships, time sequence relationships, access path relationships, and changes in risk scores.

[0285] Based on the detection and correlation analysis results, the system can perform alerts, blocking, isolation, logging, risk scoring, access control adjustments, or security policy linkage. For high-risk abnormal traffic, persistent attack behavior, or multi-node coordinated attack events, the system can synchronize the correlation analysis results to the security operations platform, situational awareness platform, or computing power network security management platform to support subsequent threat assessment and security response.

[0286] Since structural priors, statistical priors, and global feature importance priors can all be pre-built and stored in the offline stage, the online stage only needs to call these priors and perform lightweight gating modulation, lightweight temporal reasoning, and association rule matching. Therefore, it is possible to achieve rapid detection of real-time traffic, correlation of abnormal events, and security linkage while maintaining low computational overhead and response latency.

[0287] In real-world computing network hub scenarios, service traffic patterns and attack behaviors may change over time. To adapt to traffic distribution shifts and attack variant evolution, this invention can also set up a priori update mechanism.

[0288] In one embodiment, the system can update the multi-source priors according to a preset period. For example, at certain time windows or when a significant change in traffic distribution is detected, the structural priors, category conditional statistical priors, and global feature importance priors are updated again based on new samples.

[0289] In another embodiment, multiple edge nodes can each construct local priors based on local traffic and upload anonymized prior parameters, statistical summaries, or model gradients to the central node. The central node aggregates the prior information uploaded by each edge node to obtain a global prior and distributes the updated global prior to each edge node. Through this prior update mechanism, the model's adaptability to new attacks and scenario changes can be improved without directly uploading the original traffic data.

[0290] This invention also provides a multi-source prior gating enhanced intrusion detection system for computing power network hub scenarios. This system can be used to implement any of the above-described method embodiments. The system includes the following modules.

[0291] (1) Data acquisition module

[0292] The data acquisition module is used to collect network traffic, log data, session records, or security event data in the computing power network hub. The data can come from IoT terminals, edge gateways, computing power scheduling nodes, industrial internet devices, cloud-edge collaboration links, data center ingress gateways, or security devices.

[0293] (2) Preprocessing module

[0294] The preprocessing module is used to perform label encoding, data cleaning, feature extraction, standardization, tree model soft probability injection, and sequence construction on the collected data to obtain enhanced traffic feature sequences.

[0295] (3) Structural Prior Construction Module

[0296] The structure prior construction module is used to statistically analyze the co-activation relationships between traffic features from historical attack samples, construct a feature-attack correlation graph, and obtain the structure prior representation.

[0297] (4) Statistical Prior Construction Module

[0298] The statistical prior construction module is used to divide the training samples according to the categories and calculate the statistics of each category on each feature dimension to form the category-conditional statistical prior.

[0299] (5) Global Feature Importance Prior Construction Module

[0300] The global feature importance prior construction module is used to train regularized classification models, multi-output ridge regression models, or one-to-many ridge classifiers, and combines importance coefficient feature selection, forward sequence feature selection, backward sequence feature selection, and correlation coefficient feature selection to obtain the global feature importance prior.

[0301] (6) Prior Fusion Module

[0302] The prior fusion module is used to align and fuse structural priors, category conditional statistical priors, and global feature importance priors in terms of dimensions to obtain a fused prior representation.

[0303] (7) Knowledge-enhanced gating adaptation module

[0304] The knowledge-enhanced gating adaptation module is used to incorporate fused priors as control signals into the gating value calculation, dynamically enhancing, suppressing, or reweighting the traffic features to be detected, thereby obtaining a knowledge-enhanced representation of the traffic features.

[0305] (8) Lightweight timing detection module

[0306] The lightweight temporal detection module is used to perform temporal modeling on the knowledge-enhanced traffic feature representation, extracting local burst patterns and long-range dependency features. The lightweight temporal detection module may include a temporal convolutional network and a bidirectional gated recurrent unit.

[0307] (9) Classification output module

[0308] The classification output module is used to calculate the probability of the traffic to be detected belonging to each category based on the feature representation output by the lightweight time-series detection module, and output the final detection result.

[0309] (10) Prior update module

[0310] The prior update module is used to periodically or triggerally update the structural prior, category condition statistical prior, and global feature importance prior based on new traffic samples, detection feedback, or security operation results.

[0311] The modules described above can be implemented in software, hardware, or a combination of both. They can be deployed on the same device or distributed across the cloud, edge nodes, and terminal devices.

[0312] In computing power network hub scenarios, in addition to collecting five-tuple traffic characteristics, the system also collects computing power task identifiers, tenant identifiers, edge node identifiers, computing power node identifiers, link identifiers, and scheduling log identifiers. After the detection model outputs the attack category, the correlation analysis module uses the computing power task identifier and access link identifier as the aggregation key to map abnormal traffic events occurring on different edge nodes to the same computing power task link, thereby identifying cross-node attack behaviors targeting the same task, the same tenant, or the same target asset.

[0313] The present invention also provides an electronic device. The electronic device includes a processor, a memory, and a computer program stored in the memory and executable by the processor. The electronic device may be a server, an edge gateway, an IoT security gateway, an industrial internet security device, a computing power scheduling node, a data center entry security device, an embedded security device, or other computing devices with network traffic processing capabilities.

[0314] The present invention also provides a computer-readable storage medium. The computer-readable storage medium stores a computer program and may include a read-only memory, a random access memory, a solid-state drive, a hard disk drive, a flash memory, a memory card, an optical disk, or other tangible media capable of storing program code.

[0315] It should be noted that the scope of protection of this invention should not be limited to the specific models or algorithm names mentioned above.

[0316] In this invention, structural priors are not limited to feature-attack correlation graphs, but can also be feature correlation matrices, attack behavior co-occurrence matrices, causal relationship graphs, heterogeneous graphs, hypergraphs, attack family graphs, or dynamic correlation graphs.

[0317] In this invention, the statistical prior for category conditions is not limited to the mean and variance, but can also be the median, quantiles, skewness, kurtosis, covariance matrix, category prototype, Gaussian distribution parameters, Gaussian mixture model parameters, kernel density estimation results, or category center distance distribution.

[0318] In this invention, the prior of global feature importance is not limited to ridge regression, but can also be Lasso regression, ElasticNet regression, logistic regression weights, random forest feature importance, gradient boosting tree feature importance, mutual information, chi-square test, permutation importance, SHAP feature contribution, attention weight statistics, or causal contribution.

[0319] In this invention, the knowledge-enhanced gating adapter is not limited to the gating linear unit structure, but can also employ attention mechanisms, feature reweighting mechanisms, dynamic feature masking mechanisms, feature scaling and offset mechanisms, residual adapters, or other structures that enable the fusion prior to participate in online feature modulation.

[0320] In this invention, the lightweight temporal detection network is not limited to temporal convolutional networks and bidirectional gated recurrent units, but can also employ convolutional neural networks, recurrent neural networks, lightweight Transformers, state-space models, pruning models, quantization models, distillation models, or combinations thereof.

[0321] The core protection point of this invention lies in offline construction of multi-source prior knowledge capable of characterizing attack structure relationships, category distribution differences, and global feature contributions. This fused multi-source prior knowledge then participates in feature gating, feature selection, feature reweighting, or feature modulation processes during the online detection phase, ultimately outputting intrusion detection results through a lightweight detection model. Any solution employing the above core technical ideas to implement intrusion detection in computing power network hubs, the Internet of Things, edge networks, or cloud-edge collaborative environments should fall within the protection scope of this invention.

Claims

1. A method for multi-source prior gating enhanced threat intrusion detection and correlation analysis, characterized in that, The method includes: Step S100: Collect historical traffic data, log data and context information in the computing power network hub, perform label encoding, data cleaning, feature extraction and standardization on the historical traffic data, train the tree model classifier to output category soft probability vectors, and concatenate the category soft probability vectors with the standardized traffic features to form an enhanced traffic feature sequence to complete the preprocessing and prior injection preparation. Step S200: Construct multi-source prior knowledge offline based on historical training samples. The multi-source prior knowledge includes structural prior, class conditional statistical prior, and global feature importance prior. Furthermore, the structural prior, class conditional statistical prior, and global feature importance prior are dimensionally aligned and uniformly fused to obtain a fused prior representation. Step S300: The fused prior representation is input into the knowledge enhancement gating adapter online, so that the fused prior representation participates in the gating value calculation, and the traffic features to be detected are dynamically enhanced, suppressed or reweighted to obtain the knowledge-enhanced traffic feature representation. Step S400: Input the knowledge-enhanced traffic feature representation into the lightweight temporal detection model, extract local burst patterns and long-range temporal dependency features, and obtain a sequence-level representation that integrates local burst features and long-range dependency features as the output feature representation; Step S500: Input the feature representation output by the lightweight temporal detection model into the classification output layer to obtain the probability distribution of the traffic to be detected belonging to each category, and output the final detection result according to the probability distribution. Based on the detection result, analyze the attack source, target and behavior chain of the threat event. The lightweight temporal detection model adopts a cascaded structure of temporal convolutional networks and bidirectional gated recurrent units; Temporal convolutional networks are used to extract local burst patterns from the knowledge-enhanced traffic feature sequence and output a temporal feature map. Bidirectional gated recurrent units are used to perform bidirectional context modeling on the temporal feature map, capture long-range temporal dependency features, and output a sequence-level representation that integrates local burst features and long-range dependency features by concatenating the final hidden states of the forward and backward directions. This sequence-level representation is the feature representation output by the lightweight temporal detection model and is fed into the classification output layer for final category determination. The correlation analysis is a process by which the system aggregates and correlates abnormal events in the same attack source, the same target asset, the same time window, the same access link, or the same computing power task link based on detection category, risk probability, source address, destination address, port, protocol, access time, session identifier, device identifier, asset information, computing power task identifier, and historical alarm information, thereby identifying continuous attack behaviors across terminals, nodes, and links.

2. The method for multi-source prior gating enhanced threat intrusion detection and correlation analysis according to claim 1, characterized in that, The knowledge-enhanced gating adapter includes input branches, value branches, gating branches, and residual branches; The input branch is used to receive enhanced traffic features, the value branch is used to generate candidate feature representations, the gating branch is used to calculate gating weights by combining fusion priors, and the residual branch is used to preserve the original input features.

3. The method for multi-source prior gating enhanced threat intrusion detection and correlation analysis according to claim 2, characterized in that, The structural prior is obtained by constructing a feature-attack correlation graph, and includes: Initialize a co-occurrence matrix with the same dimension as the number of traffic features from the attack sample set of historical traffic data; Iterate through each attack sample and set an anomaly threshold for each feature dimension. When the values, absolute values, deviations from the class statistical baseline, or anomaly scores of two feature dimensions exceed the corresponding anomaly thresholds, it is determined that the two features have a co-activation relationship, and the corresponding elements in the co-occurrence matrix are accumulated and counted. After completing the statistics of all attack samples, the co-occurrence matrix is ​​normalized to obtain a weighted adjacency matrix with values ​​ranging from 0 to 1. The weighted adjacency matrix is ​​then pruned using a preset sparsity threshold, setting matrix elements below the sparsity threshold to zero. The resulting sparse weighted adjacency matrix serves as the structural prior.

4. The method for multi-source prior gating enhanced threat intrusion detection and correlation analysis according to claim 2, characterized in that, The category conditional statistical prior is constructed through the following steps: Based on the traffic category labels of all training samples in the historical traffic data, all training samples are divided into normal category and different attack categories; For each category, calculate the arithmetic mean and variance of all samples in that category across each feature dimension. The mean vector of all feature dimensions under each category is concatenated with the variance vector of that category to form a statistical profile of that category. The statistical profiles of all categories are vertically stacked and aggregated to form a statistical baseline matrix as a category-conditional statistical prior. The number of rows in this matrix is ​​equal to the total number of categories, and the number of columns is equal to twice the feature dimension.

5. The method for multi-source prior gating enhanced threat intrusion detection and correlation analysis according to claim 2, characterized in that, The global feature importance prior is constructed through the following steps: Based on all training samples, construct feature matrix and target label matrix, train regularized classification model, multi-output ridge regression model, one-to-many ridge classifier or linear discriminant model with regularization term, sort all features using feature coefficient matrix, coefficient norm or importance score output by model, select a few features with the highest scores to form feature subset based on importance coefficient; A forward sequence feature selection is adopted, starting from an empty feature set and gradually adding candidate features. After each feature is added, the detection performance is evaluated. If the performance is improved, the feature is retained, forming a forward sequence feature subset. The backward sequence feature selection method is adopted, which gradually deletes features starting from the complete feature set. After each feature is deleted, the detection performance is evaluated. If the performance does not decrease or even improves, the feature is removed, forming a backward sequence feature subset. Calculate the correlation statistics between each feature and the target category, and select features according to the correlation scores to form a feature subset based on the correlation coefficient; The feature subsets based on importance coefficients, forward sequence features, backward sequence features, and feature subsets based on correlation coefficients are combined to obtain a globally important feature set. The feature coefficients output by the regression model are then converted into global importance weights for each feature. The set of globally important features and the global importance weights are used as the priors for the global feature importance.

6. The method for multi-source prior gating enhanced threat intrusion detection and correlation analysis according to any one of claims 1-5, characterized in that, The calculation process of the knowledge-enhanced gating adapter is as follows: Let the current time-time feature vector in the enhanced flow feature sequence be... The fusion of prior representations is The fused prior representations will be projected through the prior matrix. The mapping is to a prior modulation vector with the same dimension as the output of the gated branch, and the gated vector is calculated as follows: ; in, For trainable gated weight matrix, For gated bias terms, Using the Sigmoid activation function, fused with prior representations Direct additive injection into gated computation; Candidate enhancement features are calculated as follows: ; in, The output weight matrix is ​​trainable. The output bias term; the knowledge-enhanced flow characteristics are represented as follows: ; in, This represents element-wise multiplication. Retain the original information as a residual join term; is the prior projection matrix, used to map the fused prior representation to the same dimension as the gated branch output; This is the residual projection matrix.

7. The method for multi-source prior gating enhanced threat intrusion detection and correlation analysis according to claim 5, characterized in that, During the training phase, a focus loss function is used to jointly optimize the knowledge-enhanced gating adapter, the lightweight temporal detection model, and the classification output layer. This reduces the loss contribution of easily classified samples and increases the loss weights of minority attack samples, hard-to-classify samples, and similar attack variant samples.

8. A multi-source prior gating enhanced threat intrusion detection and correlation analysis system for implementing the method of claim 1, characterized in that the system include: The data acquisition module is used to collect network traffic, log data, session records, or security event data in the computing power network hub. The preprocessing module is used to perform label encoding, data cleaning, feature extraction, standardization, tree model soft probability injection, and sequence construction on the collected data to obtain enhanced traffic feature sequences. The structure prior construction module is used to statistically analyze the co-activation relationships between traffic features from historical attack samples, construct a feature-attack correlation graph, and obtain the structure prior representation. The statistical prior construction module is used to divide the training samples according to the categories and calculate the statistics of each category on each feature dimension to form the category conditional statistical prior. The global feature importance prior construction module is used to train regularized classification models, multi-output ridge regression models, or one-to-many ridge classifiers, and combines importance coefficient feature selection, forward sequence feature selection, backward sequence feature selection, and correlation coefficient feature selection to obtain the global feature importance prior; The prior fusion module is used to align and fuse structural priors, category conditional statistical priors, and global feature importance priors in order to obtain a fused prior representation. The knowledge-enhanced gating adaptation module is used to use fused priors as control signals to participate in the calculation of gating values, and to dynamically enhance, suppress or reweight the traffic features to be detected, so as to obtain the knowledge-enhanced traffic feature representation. A lightweight temporal detection module is used to perform temporal modeling on the knowledge-enhanced traffic feature representation and extract local burst patterns and long-range dependency features. The classification output module is used to calculate the probability of the traffic to be detected belonging to each category based on the feature representation output by the lightweight time-series detection module, and output the final detection result. The prior update module is used to periodically or triggerally update the structural prior, category condition statistical prior, and global feature importance prior based on new traffic samples, detection feedback, or security operation results.

9. An electronic device, characterized in that, Includes one or more processors; Storage device for storing one or more programs; When one or more programs are executed by one or more processors, the one or more processors implement the multi-source prior gating enhanced threat intrusion detection and correlation analysis method as described in claim 1.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed, it implements the multi-source prior gating enhanced threat intrusion detection and correlation analysis method as described in claim 1.

Images