A cyber-security threat detection and response system

Abstract

The application discloses a network security threat detection and response system, comprising: a multi-level cooperative sensing module for asynchronously collecting security data from three layers of processor microarchitecture, operating system kernel and network protocol stack; a multi-modal feature fusion and intelligent analysis engine for performing fusion analysis and threat discrimination on heterogeneous data by using a cross-modal feature extraction unit, a space-time correlation fusion unit based on a graph attention network and a dynamic threat discrimination unit based on a Transformer-RL; and a self-adaptive threat response and closed-loop evolution module for realizing dynamic strategy generation, automatic response disposal and system self-evolution driven by intelligence feedback by means of a situation awareness and strategy generation unit, an Orchestration response execution unit and a threat intelligence closed-loop update unit. The application realizes in-depth detection from hardware to application, intelligent correlation analysis and closed-loop self-adaptive response, and significantly improves the detection accuracy and response efficiency for complex mixed attacks.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and in particular to a network security threat detection and response system, specifically a network security threat detection and response system that integrates multi-layered perception, multi-modal analysis, and adaptive response. More specifically, this invention relates to an intelligent security defense system that constructs a comprehensive perception system from the processor hardware microarchitecture layer and the operating system kernel layer to the network protocol stack layer, utilizes graph attention networks for cross-modal spatiotemporal correlation fusion, performs dynamic threat discrimination based on a Transformer-reinforcement learning hybrid architecture, and achieves continuous self-evolution of the system's detection model and response strategy through a threat intelligence closed-loop feedback. Background Technology

[0002] With the popularization of cloud computing, the Internet of Things and 5G technologies, network boundaries are becoming increasingly blurred and attack methods are becoming more complex and covert, such as advanced persistent threats (APTs), fileless attacks and multi-stage coordinated attacks, which pose a serious challenge to traditional rule-based or single-data-source-based detection and response systems.

[0003] Taking Advanced Persistent Threats (APTs) as an example, their typical attack chains often span multiple technical layers: Attackers may first breach network perimeter firewalls through phishing emails, then exploit browser vulnerabilities on the target host to execute shellcode (network layer anomaly); subsequently, they may use Return-Oriented Programming (ROP) techniques to build malicious logic within application processes and leverage system calls to establish persistent backdoors in kernel space (kernel layer anomaly); later, attackers may manipulate CPU cache side channels (such as Prime+Probe attacks) to steal encryption keys residing in the same VM (microarchitecture layer anomaly), and then use legitimate encrypted tunnels to transmit the stolen data in batches. In this multi-stage, cross-layered composite attack scenario, the microscopic evidence of the attack is scattered across different layers of hardware microarchitecture, operating system kernel, and network traffic. Any single-layer detection method is like "the blind men and the elephant," unable to reconstruct the full picture of the attack. Even more serious is that existing detection systems typically treat anomalous signals at each layer as isolated events, lacking cross-layer correlation analysis capabilities, resulting in a large number of low-level alerts being drowned out by noise, while the true attack chain is overlooked.

[0004] From a technical perspective, detection based on a single data source has fundamental limitations. Network traffic-based intrusion detection systems (NIDS) have extremely limited ability to detect encrypted traffic. With the widespread deployment of TLS 1.3, over 90% of network traffic is end-to-end encrypted. NIDS can only rely on plaintext metadata (such as SNI and certificate chains) and traffic statistics (such as packet length sequences and time intervals) from the TLS handshake phase for inference, making it virtually powerless against malicious payloads hidden in encrypted tunnels. While end-host-based EDR (Endpoint Detection and Response) solutions can deeply monitor process behavior within the host, their detection capabilities are limited by the auditing interfaces provided by the operating system. Once an attacker gains kernel-level privileges (such as through kernel vulnerabilities or rootkits), they can easily tamper with or block audit logs, blinding the EDR's "eyes." Although processor microarchitecture has the strongest anti-tampering features, the data it collects (such as cache hit rate, branch prediction failure rate, and TLB misses) does not directly represent security events; it needs to be combined with upper-layer behavioral data to give it security semantics.

[0005] Currently, the industry mainly has the following technical approaches:

[0006] Traffic analysis-based detection systems, such as the patent with publication number CN120602225A, disclose an adaptive threat intelligence analysis and response method and system for network information security. This method primarily analyzes network traffic characteristics, such as performing multi-level wavelet packet decomposition on encrypted traffic to extract frequency domain anomaly indicators, and then matches these indicators with a threat intelligence database. While such methods can effectively identify traffic-level anomalies and known threats, they have weak detection capabilities for attacks lurking within the terminal host (such as memory malware and kernel rootkits), and their adaptability to new variant attacks relies on manual updates to the intelligence database, resulting in a delayed response.

[0007] From the perspective of signal detection and estimation theory, detection methods based on single-layer traffic analysis face the dilemma of continuously deteriorating signal-to-noise ratio (SNR). With the widespread adoption of encryption protocols such as TLS 1.3 and HTTP / 3 (based on QUIC), plaintext features in network traffic have decreased dramatically, and the "signal" energy that detectors can rely on is becoming increasingly weak. Attackers can also actively employ techniques such as traffic shaping and protocol spoofing to submerge malicious communications in a legitimate "noise" background. When the SNR falls below the detector's sensitivity threshold, no matter how sophisticated the signal processing algorithm, it cannot fundamentally solve the problem. Therefore, breaking through the limitations of single-layer perception and acquiring complementary security signals from multiple dimensions is an inherent requirement for improving detection efficiency.

[0008] Terminal host-based detection and response systems, such as those used for detecting intranet attacks, reduce false alarms by deploying proxies on hosts or using mirrored ports on switches to monitor internal traffic and setting alarm confidence thresholds based on time intervals. This approach can penetrate deep into the network or individual hosts, but it is costly to deploy, complex to maintain, and struggles to detect lateral movement attacks between switch ports or using legitimate channels, limiting its granularity.

[0009] Endpoint detection solutions also suffer from an often-overlooked engineering bottleneck: the deployment and maintenance costs of the agent software. In enterprise environments with tens or even hundreds of thousands of endpoints, ensuring the normal operation, timely version updates, and consistent policy configurations of the detection agent on each host is itself an extremely complex operational engineering problem. Furthermore, agent software running in user or kernel mode inevitably consumes system resources (CPU, memory, disk I / O). Existing lightweight agents typically keep CPU overhead within 3%-5%, but to achieve more granular behavioral monitoring (such as system call-level tracing), the overhead can soar to 15%-30%, which is often unacceptable on high-load production servers. Therefore, achieving a dynamically adjustable balance between depth of awareness and performance overhead is a core challenge that endpoint detection solutions urgently need to address.

[0010] Processor hardware-based defense methods, such as patent CN117692251A, disclose a processor network security defense system and method. This system integrates sensors and heterogeneous monitoring modules within the processor, analyzing microarchitecture-level behavior through edge computing and the ARMA model. While this approach provides security capabilities from the lowest level and offers strong tamper resistance, it may be highly dependent on specific hardware architectures, facing challenges in terms of versatility and scalability. Furthermore, it is ineffective against attacks targeting upper-layer application logic vulnerabilities and business logic abuse.

[0011] Detection systems based on multi-source data fusion, such as patent CN120263556A, disclose a real-time computer information security detection method and system. This system collects multi-source data including network traffic, memory access, program behavior, and system logs, and iteratively optimizes threat assessment and dynamic compensation mechanisms. While these systems aim to improve detection accuracy and robustness, their core focus remains on static or near-real-time data analysis. The intelligence and closed-loop capabilities in dynamic reconstruction of attack chains, cross-layer evidence correlation, and automated strategy generation and execution need further improvement.

[0012] Attack chain-based detection systems, such as the patent with publication number CN120546916A, disclose a network threat detection method and system. This method constructs a logical graph of attack behavior chains and combines graph theory, hidden Markov models, and isolated forests for composite attack detection. While this method excels at analyzing the relationships between attack steps, it falls short in its ability to deeply integrate attack behavior characteristics with underlying anomaly signals, and in its capacity to quickly link global defense strategies based on detected local threats.

[0013] Besides the limitations of each of the aforementioned technical approaches, existing technologies as a whole share a common structural problem: "the break in the response loop." Most security detection systems follow a linear process of "detection → alerting → manual assessment → manual intervention." In this process, updating the detection model relies on security researchers' reverse engineering of new samples and rule writing. From the first appearance of a new attack to the implementation of detection rules, it typically takes several days or even weeks. This time lag between "detection and response" is fatal in adversarial scenarios involving APT attacks. Once attackers realize they have been detected, they quickly change their attack methods or erase traces, rendering previous rule updates ineffective. On the other hand, the "post-hoc knowledge" generated by response and intervention—that is, which alerts are ultimately confirmed as real attacks and which response strategies are verified to be effective—is rarely systematically fed back into the detection model to form a training loop, resulting in the continuous loss of valuable security knowledge.

[0014] From the perspective of machine learning model lifecycle, the "concept drift" problem faced by security detection models is more severe than in general application domains. Attackers, as proactive adversaries, deliberately construct adversarial examples to bypass detection models, causing model performance to degrade at an accelerated pace over time. Traditional solutions rely on periodic (e.g., monthly or quarterly) offline retraining to mitigate model degradation, but this batch-processing update mode proves inadequate in the face of rapidly evolving attack techniques. A truly effective solution should establish a closed-loop evolutionary mechanism that can continuously learn from newly confirmed attack events, achieve incremental learning, and update online—and this is one of the core innovative directions of this invention.

[0015] Of particular concern is the near-complete absence of detection capabilities for microarchitectural attacks in the current technological landscape. Since the Spectre and Meltdown vulnerabilities were disclosed in 2018, attacks exploiting CPU microarchitectural side channels (such as cache timing, branch predictors, and out-of-order execution units) have seen explosive growth. These attacks are highly stealthy; they do not generate any system calls, modify any files, or trigger any network anomalies, completing information theft entirely within the CPU's internal microarchitectural state. Traditional traffic- or host-based detection methods are completely ineffective against such attacks. Existing defense solutions often address the attack mechanisms themselves (such as eliminating side channels through hardware patches), but this piecemeal approach struggles to cope with the ever-evolving variants of microarchitectural attacks. From a detection perspective, using hardware performance counters (HPC) to monitor microarchitectural behavior anomalies and cross-layering microarchitectural signals with operating system and network layer signals represents a more universal and forward-looking technical approach. However, transforming HPC data from a hardware performance monitoring tool into a security awareness tool faces multiple technical challenges, such as the data semantic gap, high-dimensional noise filtering, and real-time assurance. Existing technologies have not provided effective systemic solutions.

[0016] In summary, existing technologies generally suffer from the following problems: Firstly, they employ a single perception layer, focusing either on network traffic or terminal behavior, failing to establish a comprehensive and integrated perception system encompassing processor microarchitecture and network protocol stacks, resulting in blind spots in the detection of multi-dimensional hybrid attacks. Secondly, their analysis models are rigid, lacking adaptive learning capabilities in feature engineering and decision-making mechanisms, leading to rapid model decay and slow updates when facing rapidly evolving attack methods and dynamically changing network environments. Thirdly, they lack a closed-loop response mechanism, with detection and response disconnected. Response strategies largely rely on pre-defined rules, failing to dynamically generate optimal strategies based on real-time threat situations and making it difficult to feed new threat features back into the detection library to form an adaptive security closed loop of "detection-response-evolution."

[0017] Therefore, there is an urgent need for a cybersecurity threat detection and response system capable of achieving multi-layered, comprehensive perception, intelligent correlation analysis, and dynamic adaptive response to overcome the aforementioned shortcomings of existing technologies. Furthermore, there is a pressing need for a system that: extends its perception reach simultaneously to three technical layers—processor microarchitecture, operating system kernel, and network protocol stack—and extracts complementary security signals from the asynchronous data streams of these three layers; utilizes graph neural networks to perform spatiotemporal correlation fusion of cross-modal and cross-layer features, automatically learning macroscopic attack patterns hidden in microscopic anomaly signals; achieves threat discrimination with both high accuracy and rapid adaptive capabilities based on a Transformer-reinforcement learning hybrid architecture; and establishes a complete automated closed loop of detection, response, and intelligence feedback, enabling the system to autonomously learn and evolve from each security incident. Summary of the Invention

[0018] To address the shortcomings of existing technologies, the purpose of this invention is to provide a network security threat detection and response system that aims to solve the technical problems of single perception level, rigid analysis model, and lack of response closed loop in existing technologies, and to achieve three-dimensional threat detection and intelligent, closed-loop response from the underlying hardware to the upper-level application.

[0019] The core inventive concept of this invention lies in proposing and implementing for the first time an integrated security architecture of "three-layer perception - cross-modal fusion - closed-loop evolution". This architecture is no longer a simple physical stacking of multiple detection methods, but achieves an emergent improvement in security capabilities through the organic synergy of the three layers. That is, the overall detection and response capabilities of the system far exceed the simple sum of the capabilities of its individual components. Specifically: At the perception layer, a three-layer asynchronous data acquisition system, consisting of processor microarchitecture (hardware), operating system kernel (system software), and network protocol stack (network communication), acquires a set of physically independent and semantically complementary security signals, fundamentally solving the problem of insufficient signal-to-noise ratio from a single data source; at the analysis layer, a graph attention network (GAT) is innovatively introduced to perform spatiotemporal correlation fusion of heterogeneous features at the three layers. GAT's attention mechanism is naturally suitable for discovering potential dependencies between abnormal signals at different layers (e.g., the hidden correlation between an abnormal cache miss rate of a process and encrypted outbound traffic initiated by that process), a function that traditional feature splicing or simple fusion methods cannot achieve; at the evolution layer, the threat intelligence closed-loop update unit automatically feeds back the attack features and effective strategies confirmed in the response and handling process to the model training pool and rule base, realizing the continuous self-evolution of the system and enabling the detection model to adaptively update in line with the evolution of attack methods. The innovations at these three levels constitute an inseparable organic whole.

[0020] The above-mentioned objective of this invention is achieved through the following technical solutions:

[0021] A network security threat detection and response system, comprising:

[0022] A multi-layered collaborative sensing module is used to asynchronously collect security data from multiple layers of the target network and terminals. These multiple layers include at least the processor microarchitecture layer, the operating system kernel layer, and the network protocol stack layer. The processor microarchitecture layer periodically collects instruction branch patterns, cache hit rates, TLB misses, and power consumption fluctuation data through a built-in hardware performance counter group. The operating system kernel layer intercepts process creation, file read / write, privileged operations, and system call sequence events through a lightweight kernel probe. The network protocol stack layer obtains raw network traffic data through network splitters or switch port mirroring.

[0023] It is worth noting that there is a natural physical isolation and semantic complementarity among the three perception layers mentioned above, which is the key foundation for the high robustness of detection in this invention. The perception data at the processor microarchitecture layer is completely independent of the operating system kernel's control. Even if an attacker gains kernel privileges (Ring 0), they cannot tamper with the sampling data of the hardware performance counters or prevent them from counting. This is because the hardware performance counters are located inside the CPU core, and their counting logic is directly implemented by hardware circuitry, existing at a different physical level from the software logic running in the operating system kernel. The perception data at the operating system kernel layer originates from events captured by the eBPF probe at the entry point of critical kernel functions, providing behavioral information about processes, files, network sockets, and other operating system abstractions. The perception data at the network protocol stack layer originates from traffic copies of physical network links, independent of the hardware and software state of the terminal host. These three layers of data are physically independent but complementary in terms of security semantics. Microarchitecture-level anomalies (such as cache miss rate spikes) may reveal computationally intensive malicious behavior (such as key brute-force attacks, cryptocurrency mining, or side-channel probing); kernel-level anomalies (such as unexpected system call sequences) reveal deviations in process behavior; and network-level anomalies (such as communication patterns with known C2 servers) reveal network-level attack indicators. The system triggers a high-confidence threat alert only when the signals from these three independent channels exhibit a statistically significant correlation over time, thus inherently possessing robustness against deception or interference from a single data source. This "three-point verification" detection mechanism is theoretically based on Byzantine fault tolerance in distributed systems, eliminating the risk of a single untrusted data source through cross-validation of multiple independent data sources.

[0024] A multimodal feature fusion and intelligent analysis engine, coupled with the multi-layered collaborative perception module, is used for real-time feature extraction, correlation fusion, and threat identification of collected heterogeneous security data. This engine includes:

[0025] The cross-modal feature extraction unit is used to extract the corresponding microarchitecture behavior vector, kernel activity vector, and network traffic vector from the data of the processor microarchitecture layer, the operating system kernel layer, and the network protocol stack layer, respectively.

[0026] The cross-modal feature extraction unit addresses a key technical challenge: the raw data output from the three perception layers have drastically different data structures, sampling frequencies, and semantic spaces. The processor microarchitecture layer data consists of a high-dimensional time series (including instruction branch patterns, cache hit rates at each level, TLB misses, power consumption fluctuations, etc.), with typical sampling frequencies between 10Hz and 1kHz. The operating system kernel layer data consists of asynchronously triggered discrete event streams (process creation / destruction, file opening / closing / reading / writing, system calls, etc.), with event frequencies dynamically changing with system load. The network protocol stack layer data consists of continuous network data packet streams, including protocol headers and payload information, reaching speeds of several Gbps in high-bandwidth environments. To uniformly process these heterogeneous data streams, the cross-modal feature extraction unit designs independent feature extraction pipelines for each perception layer, including a temporal alignment and synchronization module, a normalization and standardization module, and a modal-specific feature encoder. This ensures that the extracted three types of behavioral vectors are strictly aligned in the temporal dimension, comparable in numerical scale, and fusionable in semantic space.

[0027] The spatiotemporal correlation fusion unit is used to input the above vectors into a preset graph attention network, and learn the embedding representation of entities (processes, threads, files, sockets) and relationships (calls, accesses, connections) based on the constructed system behavior knowledge graph, and generate a unified behavior embedding vector that integrates spatiotemporal dependencies.

[0028] The spatiotemporal correlation fusion unit is the core technical component of this invention for achieving cross-modal synergistic effects. Its working principle can be elaborated on from the following three levels:

[0029] The first level: Construction and dynamic maintenance of the System Behavior Knowledge Graph (SBKG). SBKG is a dynamic heterogeneous graph model with runtime behavioral entities as nodes and behavioral relationships between entities as edges. Entity types include, but are not limited to, processes, threads, file nodes, network sockets, and memory page table entries; relationship types include, but are not limited to, "fork / exec" (process derivation), "read / write" (file read / write), "connect / accept" (network connection), "mmap / munmap" (memory mapping), and "signal" (signal transmission). Unlike traditional static knowledge graphs, SBKG is updated in real-time as the system runs, and each edge's attributes include spatiotemporal information such as the timestamp of the behavior, frequency, and data volume. The existence of SBKG enables discrete security events from different perception levels to find related paths within a unified graph model. For example, an event from the network layer, "Process P sends an encrypted data packet to IP address X via socket S", an event from the kernel layer, "Process P calls the execve system call to load an unknown executable file", and an event from the microarchitecture layer, "Process P's L3 cache miss rate deviates significantly from the baseline during execution", these three types of events correspond to the microarchitectural properties of the "PS" (process-socket) edge, "PF" (process-file) edge, and process P node in SBKG, respectively, achieving natural multi-source data alignment in the graph model.

[0030] The second layer: Cross-modal information aggregation using Graph Attention Network (GAT). This unit employs a Multi-head Graph Attention Network (GAT) for message passing and node embedding updates on the SBKG. The core advantage of GAT lies in its attention mechanism's ability to adaptively assign different aggregation weights to different neighboring nodes. In the application scenario of this invention, this means the model can automatically learn which types of behavioral relationships (microarchitectural anomalies, kernel events, network communication) are more critical in specific attack scenarios. For example, when detecting Spectre-type side-channel attacks, the model may automatically assign higher attention weights to microarchitectural features (such as cache hit rate change patterns) while reducing the weight of network flow features; while when detecting C2 communication, the attention distribution may tilt towards network connection patterns while also considering kernel-level process behavior evidence. This adaptive cross-modal attention allocation mechanism ensures that the fusion process is not a simple feature concatenation or weighted averaging, but rather intelligently selects the most relevant information sources for deep fusion based on the dynamic characteristics of the current security context.

[0031] The third level: Explicit modeling of spatiotemporal dependencies. This unit introduces temporal position encoding and relational path encoding to explicitly encode the temporal order dependencies and causal chains of behavioral events in the unified behavioral embedding vector. Specifically, for each behavioral edge in the SBKG, in addition to the embedding representations of the source and target nodes, a timestamp encoding of the time when the behavior occurred (using a sine-cosine position encoding scheme to enable the model to perceive the relative distance of time intervals) and an encoding of the possible stage of the behavior in the attack chain (obtained through learning) are concatenated. This design allows the unified behavioral embedding vector to contain not only static information of "which behaviors occurred" but also dynamic process information of "the order and causal logic of the behaviors," providing rich spatiotemporal semantics for subsequent threat identification.

[0032] The dynamic threat discrimination unit is used to input the unified behavior embedding vector into the trained threat detection model and output an initial threat discrimination result containing threat type, confidence level and attack stage label; wherein, the threat detection model is a model based on the Transformer architecture and combined with a reinforcement learning framework, and its training process introduces a dynamic reward mechanism to optimize the ability to quickly adapt to new attacks.

[0033] The dynamic threat discrimination unit employs a Transformer-RL hybrid architecture, organically unifying the capabilities of "accurate classification" and "rapid adaptation." The Transformer component extracts global contextual dependencies from a unified behavioral embedding vector. Through a multi-head self-attention mechanism, the Transformer can capture dependencies at any distance within a sequence of behavioral events. This is particularly crucial in attack chain detection, as the early probing actions and final data leakage actions of an APT attack can be separated by weeks or even months. Traditional RNN / LSTM models suffer from severe gradient vanishing problems over such long sequences. The reinforcement learning component endows the model with a balanced "exploration-exploitation" capability: when encountering a new behavioral pattern that does not perfectly match known attack patterns, the reinforcement learning exploration strategy leads the model to tend to output a preliminary judgment with lower confidence, triggering subsequent confidence assessments and augmentation collection mechanisms. This effectively avoids rigid misjudgments of new attack variants. This design ensures that when faced with zero-day attacks or unknown variants, the system will neither blindly and confidently give incorrect classification results nor directly miss reports due to the inability to match known rules. Instead, it will initiate a secondary analysis process based on the principle of "deep exploration when uncertain."

[0034] The synergistic mechanism of the Transformer-RL hybrid architecture lies in the fact that traditional threat detection models (based on CNN, LSTM, or static graph neural networks) have fixed decision boundaries once training is complete. Faced with novel attack patterns not present in the training set, they either classify them as the most similar known category (potentially leading to misclassification) or label them as "unknown" (avoiding misclassification but losing the meaning of threat identification). In contrast, the Transformer-RL architecture of this invention introduces a dynamic reward mechanism from reinforcement learning (reward signals come from confirmed threat authenticity feedback during subsequent response actions), enabling the model to continuously adjust its decision-making strategy during actual operation. Specifically, when a detection result is confirmed as a real attack (positive sample) after response actions, the system provides a positive reward, strengthening the model's ability to identify this type of behavior pattern; when a detection result is confirmed as a false alarm (false positive), the system provides a negative penalty, and the model adjusts its boundaries to suppress alarms for similar patterns. Through this online policy gradient update mechanism, the model achieves incremental optimization of its decision boundaries driven by continuously receiving real feedback signals, rather than waiting for periodic offline retraining.

[0035] An adaptive threat response and closed-loop evolution module, coupled with the multimodal feature fusion and intelligent analysis engine, is used to perform dynamic policy generation, automated response handling, and intelligence closed-loop updates based on the initial threat identification results. This module includes:

[0036] The situational awareness and strategy generation unit combines the initial threat assessment results with preset asset importance levels and business relationships, and generates an optimal response strategy that includes response priority, handling method and scope of action by solving constraints to meet the problem.

[0037] The Situation Awareness and Policy Generation Unit models security response decisions as a multi-constraint optimization problem, representing a fundamental breakthrough from traditional pre-defined rule-based response strategies. Traditional "if-then" rules face two major challenges when dealing with complex attacks: first, the maintenance cost of the rule base increases exponentially with the number of attack types; each new attack type requires combining it with all existing business scenarios to write corresponding response rules; second, the granularity of the rules is difficult to control—too coarse a rule leads to a one-size-fits-all approach that disrupts normal business operations, while too fine a rule leads to an explosion in the number of rules. This unit models threat information, asset attributes, and business topology as a unified state space, defines response actions as the action space, and defines minimizing business impact and maximizing threat containment as multi-objective optimization functions, solving for the optimal response strategy in real time each time a threat occurs. This modeling approach allows policy generation to differentiate the handling methods based on the specific business role of the attacked asset (e.g., core database server vs. edge test server). For core business assets, non-disruptive measures such as traffic redirection and honeypot diversion may be prioritized, while for edge assets, blocking measures such as network isolation can be decisively adopted.

[0038] The orchestrated response execution unit is used to orchestrate and invoke preset response action atomic capabilities, such as network isolation, process suspension, honeypot diversion, and traffic scrubbing, according to the optimal response strategy, to achieve coordinated and orderly threat containment.

[0039] The threat intelligence closed-loop update unit is used to normalize and verify the feature data, attack behavior patterns and response effects that are confirmed to be real attacks after the response is handled, to form new threat indicators or behavior signatures, and automatically feed them back to the rule base and model training pool of the multimodal feature fusion and intelligent analysis engine, driving incremental updates of the detection model and response strategy.

[0040] The threat intelligence closed-loop update unit realizes the most critical feedback link in the "detection-response-evolution" closed loop, and its synergistic effect and unexpected technical effect are reflected in two aspects:

[0041] The first layer: Continuous incremental learning of the detection model. Traditional security detection models rely on the periodic feature library releases by security vendors, resulting in update delays of several days to weeks. This unit automatically extracts raw data (including microarchitectural behavior sequences, kernel event sequences, and network packets) from confirmed real attacks during response and handling. After sandbox verification, feature normalization is performed to generate high-quality samples that can be directly used for incremental model training. The model training pool adopts an experience replay buffer design, which retains recent attack samples to address concept drift while sampling historical representative samples to prevent catastrophic forgetting. Through periodic incremental training (such as performing model fine-tuning once a day during the early morning off-peak business hours), the system's detection capabilities can continuously evolve at an hourly time granularity, compressing the time window from the first appearance of a new attack to the system's ability to detect it from days to hours—an effect that no existing offline update solution can achieve.

[0042] The second level: knowledge transfer across attack types. This unit not only uses confirmed attack features to fine-tune the current detection model, but also extracts pattern-level knowledge of attack behavior and stores it in the rule base through feature abstraction and generalization. For example, after detecting a fileless attack exploiting a specific browser vulnerability, the system not only stores the specific IoC (Indicators of Compromise) of the attack in the rule base for precise matching, but also extracts its behavioral pattern features (such as the behavioral chain pattern of "script interpreter process → abnormal memory allocation → encrypted external connection") and stores it in the behavioral pattern library, enabling it to generalize to similar fileless attacks exploiting other browser vulnerabilities. This knowledge abstraction capability from "instance-level learning" to "pattern-level learning" endows the system with predictive detection capabilities for unknown attack variants, which is a typical meta-learning effect.

[0043] Furthermore, it is necessary to elucidate the overall synergistic mechanism among the multi-layered collaborative perception, multi-modal feature fusion, dynamic threat discrimination, and closed-loop evolution of this invention. From an information theory perspective, the architecture of this invention realizes a complete information value-added chain: the perception layer acquires raw security signals (raw information) from the physical environment; the analysis layer extracts structured knowledge (semantic information) from them through cross-modal fusion; the discrimination layer identifies threat patterns and attack stages (decision information) through temporal modeling; and the evolution layer feeds back the response results to the system input to form a closed loop (feedback information). The information processing capabilities of these four links are multiplied rather than added. The deep coverage of the perception layer ensures the integrity of the input information (without losing key evidence); the attention mechanism of the fusion layer ensures the effectiveness of information aggregation (suppressing noise and enhancing signals); the Transformer-RL architecture of the discrimination layer ensures the accuracy and adaptability of decision-making (rational use of information); and the closed-loop feedback of the evolution layer ensures the continuous improvement of the system's information processing capabilities (accumulating experience to optimize the model). This end-to-end information value-added mechanism is the fundamental reason why the system can maintain a high detection rate and a low false alarm rate when facing highly complex APT attacks.

[0044] As a further technical solution of the present invention: the multi-level collaborative perception module also includes an adaptive sampling scheduler, which dynamically adjusts the collection frequency and depth of each level perception module according to the real-time threat score from the multi-modal feature fusion and intelligent analysis engine: when the threat score is higher than the first threshold, the collection frequency is increased and deep packet inspection and kernel-level system call tracing are enabled; when the threat score is lower than the second threshold, the collection frequency is reduced to the basic monitoring level to balance security performance and system overhead.

[0045] The adaptive sampling scheduler achieves a dynamic optimal balance between security performance and system performance overhead, an effect achieved through the unique advantages of a multi-layered perception architecture. In traditional single-layer perception schemes, the adjustment space for sampling frequency is extremely limited; either monitoring is enabled to bear the performance overhead, or monitoring is disabled to bear the security risk, lacking an intermediate state. However, this invention, with its three-layer perception system, allows the scheduler to flexibly adjust across multiple dimensions based on the threat situation: under normal low-threat conditions, only basic-level monitoring is maintained (e.g., the microarchitecture layer samples key counters at a low frequency of 1Hz, the kernel layer only monitors high-risk system calls, and the network layer only extracts traffic metadata), keeping the total system overhead within 1% of CPU utilization. When the threat score increases, the scheduler can selectively increase the sampling depth of the perception layer most relevant to the current threat type. For example, if a suspected side-channel attack is detected, the sampling frequency of the microarchitecture layer is prioritized to 1kHz, and more performance counters are activated; if a suspected malware download is detected, the sampling depth of the network layer is prioritized to enable DPI. This "on-demand enhancement" strategy ensures that even during threat periods, the system will not affect the normal operation of production services due to comprehensive high-load sampling.

[0046] As a further technical solution of the present invention: the dynamic threat discrimination unit further includes a credibility dynamic evaluation subunit, which evaluates the credibility of each initial threat discrimination result. The evaluation factors include: the accuracy of similar historical discriminations, the degree of current abnormal deviation from the baseline, and the mutual corroboration strength between multi-source signals. For discrimination results with credibility lower than a preset credibility threshold, the multi-level collaborative perception module is triggered to perform targeted enhanced collection of the target entity, and the enhanced collection data is re-sent to the engine for secondary analysis to reduce false alarms.

[0047] As a further technical solution of the present invention: the multimodal feature fusion and intelligent analysis engine also includes a covert channel mining unit, which is used to analyze the correlation between the power consumption fluctuation data of the processor microarchitecture layer and the encrypted traffic timing data of the network protocol stack layer, and identify potential covert communication behaviors that use side channels or encrypted traffic patterns to leak data by calculating mutual information and Granger causality test.

[0048] The covert channel mining unit leverages the unique cross-layer data advantage of this invention to achieve functions impossible for traditional single-layer detection systems. Its technical principle is based on the following physical facts: When an attacker runs side-channel attack code on a target system to steal sensitive data, the execution of this code inevitably triggers observable changes at the processor microarchitecture level. For example, frequent cache access operations lead to cache hit rate fluctuations, and high-density computation operations cause characteristic spikes in the power consumption curve. Simultaneously, the stolen data needs to be transmitted through some network channel. Regardless of the encryption and camouflage methods used, the data transmission behavior will leave temporal traces at the network traffic level, such as the statistical characteristics of packet length sequences and burst patterns of traffic. The covert channel mining unit quantifies the statistical dependency between the microarchitecture power consumption sequence and the network traffic sequence by calculating mutual information. In normal scenarios, the CPU power consumption fluctuation of a process is mainly driven by its computational tasks and has no strong statistical correlation with network I / O behavior. However, in data leakage scenarios, the power consumption pattern of the attack process and the timing of data transmission exhibit significant mutual information peaks. Granger causality tests further determine the causal direction between the two, i.e., whether power consumption fluctuations precede (Granger-cause) traffic anomalies in time, or vice versa. When mutual information exceeds a preset threshold and the Granger causality test shows that power consumption fluctuations have a significant predictive ability for traffic anomalies, the system determines that there is a high probability of hidden data leakage behavior. This cross-layer causal analysis capability is technically impossible to achieve with single-layer detection schemes. Network layer detection cannot see power consumption fluctuations inside the CPU, and microarchitecture layer detection cannot see the outward transmission of network traffic. Only by precisely aligning the data of both in time and performing causal inference can this hidden attack dimension be revealed.

[0049] As a further technical solution of the present invention: the process of the situation awareness and strategy generation unit generating the optimal response strategy is as follows: the initial threat discrimination result, asset information and business flow topology are constructed into a current state diagram; all possible response actions are defined as action space; with minimizing business impact and maximizing threat containment effect as multi-objective functions, a deep Q-network algorithm is used to train the strategy network in a simulated environment, so that in actual application, the approximately optimal response action sequence can be quickly inferred based on the current state.

[0050] As a further technical solution of the present invention: before forming new threat indicators or behavioral signatures, the threat intelligence closed-loop update unit also includes a sandbox verification step. This step involves extracting suspected new attack samples or behavioral patterns and placing them into a sandbox isolated from the production environment for reproduction and verification. Only after confirming the effectiveness of the attack and the stability of the characteristics are confirmed will a formal intelligence entry be generated and issued for update, thus preventing malicious contamination of the detection model.

[0051] The sandbox verification phase is a crucial gating mechanism for ensuring the security of the closed-loop evolution mechanism. The technical details of this phase are as follows: After the system extracts characteristic data of suspected new attacks from the response and handling process, it first constructs a verification sandbox highly similar to the production environment in terms of network isolation, operating system version, and software stack. Within the sandbox, the system automatically replays the complete sequence of attack behaviors, including process creation order, system call parameters, network communication patterns, and microarchitectural event timing, verifying whether the attack behavior can be successfully reproduced. After successful verification, the system further tests the stability of the feature signature under slight perturbations, such as randomly mutating non-keyword bytes in the network payload and changing the timing intervals between attack steps, ensuring that the extracted features are not "pseudo-features" that overfit a single sample. Only features that pass reproducibility and stability verification are officially converted into threat indicators or behavioral signatures and issued for updates. This rigorous verification process effectively prevents attackers from deliberately constructing "contaminated samples" to induce the detection model to learn incorrect features, ensuring the security and reliability of the closed-loop evolution mechanism.

[0052] As a further technical solution of the present invention: the hardware performance counter group of the processor microarchitecture layer is configured and read through the model-specific register access interface, and the collected data is pre-filtered and aggregated by a lightweight security firmware independent of the operating system kernel before being uploaded, so as to avoid significant impact on host performance and tampering by malicious software.

[0053] This security firmware enables the creation of a data acquisition and reporting channel completely independent of the host operating system kernel within the Motherboard Management Controller (BMC), Trusted Platform Module (TPM), or CPU security extensions (such as Intel SGX, AMD SEV, or ARM TrustZone). The firmware's built-in pre-filtering logic includes outlier removal, sliding window aggregation, and incremental encoding compression, which can compress the volume of raw HPC sampling data to 5%-10% of the original value before uploading it to the analysis engine, significantly reducing data transmission bandwidth consumption.

[0054] As a further technical solution of the present invention: the lightweight kernel probe of the operating system kernel layer is implemented based on eBPF technology, which can safely and efficiently instrument key kernel functions without loading kernel modules, and the collected data is transferred to the user-space analysis process through a zero-copy method of a circular buffer.

[0055] As a further technical solution of the present invention: the collection of the network protocol stack layer includes both the metadata of the encrypted traffic (TLS handshake information, certificate chain, SNI) and the characteristics of the payload fragments after selective decryption. The payload decryption is only performed on an authorized independent decryption engine and follows the principle of data minimization.

[0056] As a further technical solution of the present invention: the system also includes a visualization and command decision interface, which is used to visualize multi-level perception data, real-time threat situation, response execution status and closed-loop evolution effect in the form of topology diagrams, time series curves, heat maps and other forms in a multi-dimensional way, and provides a manual intervention entry point to support security analysts to approve, correct or take over the automatically generated response strategies.

[0057] The visualization and command decision-making interface provides multi-dimensional situational awareness capabilities, including: Attack Link Topology Diagram: Displaying the complete attack path from microarchitectural anomalies to network external connections in the form of a knowledge graph, with node size indicating threat severity and edge thickness indicating correlation strength; Threat Time Series Curve: Displaying the real-time changing trends of perception data at each layer and the dynamic evolution of threat scores on a timeline; Asset Impact Heatmap: Displaying the distribution of business assets affected by threats and the assessment of damage levels in a heatmap format; Response Execution Status Panel: Displaying the execution status of the current response strategy, the completion progress of each response action, and effect feedback in real time.

[0058] This invention also provides a network security threat detection and response method based on the above system, comprising the following steps:

[0059] S1: Multi-level asynchronous acquisition of security data from the processor microarchitecture layer, operating system kernel layer, and network protocol stack layer;

[0060] S2: Extract features from the collected heterogeneous data to obtain microarchitecture behavior vectors, kernel activity vectors, and network traffic vectors;

[0061] S3: The vectors are spatiotemporally correlated and fused using a graph attention network to generate a unified behavior embedding vector;

[0062] S4: Embed the unified behavior into the vector input threat detection model and output the initial threat discrimination result;

[0063] S5: Based on the initial threat assessment results, combined with asset and business information, generate and execute the optimal response strategy;

[0064] S6: Verify and normalize the actual attack characteristics confirmed after response and handling, and update the threat detection model and response strategy library accordingly.

[0065] The synergistic effect of spatiotemporal correlation fusion through graph attention network described in step S3 has been fully discussed above: by aggregating heterogeneous features of three independent perception levels on the system behavior knowledge graph through graph attention, cross-modal deep semantic fusion that cannot be achieved by traditional feature splicing methods is realized.

[0066] The feedback update mechanism described in step S6 enables the system to continuously self-evolve. Its unexpected technical effect is that the system automatically extracts knowledge and updates itself after each real attack event, and its detection capability continuously improves over time. Attackers no longer face a static and unchanging defense system, but an intelligent defense system that continuously learns and evolves, fundamentally changing the asymmetric pattern of attack and defense confrontation.

[0067] In summary, compared with the prior art, the present invention has at least one of the following beneficial technical effects:

[0068] Comprehensive and in-depth perception: For the first time, the perception reach extends to three levels: processor microarchitecture, operating system kernel, and network protocol stack. It has built a three-dimensional data acquisition system from hardware to application, which can discover deep and complex threats that cannot be detected by simply relying on network or host detection, thus filling detection blind spots.

[0069] Intelligent correlation analysis: By using graph attention networks to perform spatiotemporal correlation fusion of cross-modal and cross-level features, it can effectively uncover complex attack chains such as "microarchitecture side-channel anomaly - abnormal process - external encrypted traffic", improving the ability and accuracy of identifying multi-stage and covert attacks, surpassing simple multi-source data stacking.

[0070] The effect of "going beyond simple multi-source data stacking" has clear technical implications and experimental evidence. Existing multi-source data fusion schemes typically merge features from different data sources by concatenating feature vectors or weighted summation. This "shallow fusion" method ignores the structural relationships and temporal causality between different data sources, essentially amounting to a "physical aggregation of multi-source data" rather than a "chemical fusion of multi-source knowledge." The spatiotemporal correlation fusion method based on graph attention networks used in this invention embeds features into the relational structure of a system behavior knowledge graph. This allows the model to learn that there is an edge connection between "abnormal cache miss rate of process A" and "burst of encrypted outbound traffic of process A," and the strength of this connection is adaptively adjusted through attention weights. The unified behavior embedding vector generated by this fusion method contains information about the interaction relationships between various data sources, exceeding the information content of a simple summation of information from individual data sources. This is a unique advantage brought by the structural inductive bias of graph neural networks in the security field.

[0071] Adaptive Evolutionary Closed Loop: This innovative approach integrates threat detection, dynamic strategy generation, automated response, and intelligence feedback updates into a complete closed loop. The response process is not merely a passive "firefighting" action, but also an active "evidence gathering" and "learning" process. New threat characteristics automatically feed back into the model, enabling the system to continuously adapt to new attack methods and achieving self-evolution of defensive capabilities. This fundamentally solves the problems of rapid model decay and difficulty in updating traditional system models.

[0072] Dynamic reliability assessment and noise reduction: A dynamic reliability assessment mechanism is introduced to enhance the collection and secondary analysis of low-confidence alarms, which significantly reduces the interference of false alarms on operations in complex environments and achieves a balance between detection sensitivity and specificity.

[0073] Precise strategy generation: By modeling security response issues as a constraint optimization problem based on reinforcement learning, it can comprehensively consider the severity of threats, asset value, and business impact to generate personalized and fine-grained optimal response strategies. This avoids the business interruption risks caused by "one-size-fits-all" responses and improves the effectiveness and precision of the response.

[0074] Balancing security and performance: Through technologies such as adaptive sampling scheduling, hardware firmware pre-aggregation, and eBPF zero-copy, the impact on production system performance is kept within an acceptable range while ensuring the depth of perception, thus enhancing the practicality and deployability of the solution.

[0075] Cross-layer covert channel detection: By leveraging the physical causal relationship between processor microarchitecture power consumption data and network encrypted traffic timing data, it achieves the covert channel mining capability that traditional single-layer detection schemes cannot achieve, filling the technical gap in side channel data leakage detection.

[0076] Knowledge transfer and generalization: Through the pattern-level feature abstraction capability of the threat intelligence closed-loop update unit, generalization learning from single attack events to similar attack patterns is realized, giving the system the ability to predictively detect unknown attack variants. Attached Figure Description

[0077] Figure 1 This invention provides an architectural block diagram of a network security threat detection and response system according to an embodiment of the present invention.

[0078] Figure 2 This is a schematic diagram of the workflow of the multi-level collaborative sensing module in an embodiment of the present invention;

[0079] Figure 3 This is a schematic diagram of the logical structure of the multimodal feature fusion and intelligent analysis engine in an embodiment of the present invention;

[0080] Figure 4 This is a schematic diagram of the dynamic threat identification and credibility assessment process in an embodiment of the present invention;

[0081] Figure 5 This is a schematic diagram of the workflow of the adaptive threat response and closed-loop evolution module in an embodiment of the present invention;

[0082] Figure 6 This is a flowchart of a network security threat detection and response method provided in an embodiment of the present invention. Detailed Implementation

[0083] The technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0084] Example 1: System Overall Architecture

[0085] refer to Figure 1 The present invention provides a network security threat detection and response system, which is deployed in the data center or cloud environment of an enterprise or institution that requires protection. The overall architecture is as follows: Figure 1 As shown, it can be divided into four layers: data acquisition layer, analysis and judgment layer, response and handling layer, and evolutionary closed loop layer.

[0086] Data acquisition layer (corresponding to the multi-layered collaborative sensing module): Serving as the system's "sensory system," it is deployed on the terminal hosts (servers, virtual machines) and key network nodes that need to be monitored. Its core is the multi-layered collaborative sensing module, which includes three main sensing sub-modules:

[0087] Processor Microarchitecture Aware Submodule: On each protected physical or virtual CPU core, by configuring the MSR register, hardware performance counters are activated to periodically collect data such as instruction retirement count and branch prediction failure rate with nanosecond precision. The collected data is initially filtered and timestamped by microcode-level security firmware integrated in the motherboard management controller or CPU security extension, and then asynchronously transmitted to the analysis layer through a secure out-of-band channel.

[0088] The specific configuration scheme and data collection index system of the processor microarchitecture awareness submodule include: Instruction-level indicators: number of instruction retirements, number of branch instructions, number of branch prediction failures, and indirect jump target address distribution entropy: used to detect abnormal control flow patterns in ROP / JOP attacks; Cache-level indicators: L1 data cache hits / misses, L1 instruction cache hits / misses, L2 / L3 unified cache hits / misses, and cache line evictions: used to detect cache side-channel attacks such as Prime+Probe and Flush+Reload; TLB (Translation Lookaside Buffer) level indicators: L1 DTLB / ITLB hits / misses and L2 STLB hits / misses—used to detect side-channel or memory corruption attacks that exploit TLB states; Power consumption and thermal indicators: CPU package power consumption, core power consumption, and non-core power consumption are collected through the RAPL (Running Average Power Limit) interface: used to detect abnormal computationally intensive behaviors such as covert cryptocurrency mining and side-channel probing behaviors. The above four categories of indicators provide a total of 20-40 dimensional microarchitectural behavior observation vectors, providing rich hardware-layer signals for subsequent anomaly detection.

[0089] In actual deployments, each CPU core is assigned a set of independent performance counters (modern Intel processors typically support 4-8 programmable counters per core, while AMD processors support 6). The sampling frequency is set to 100Hz by default, and can reach 1kHz in enhanced acquisition mode. All counter data is synchronized internally within the CPU using hardware-level timestamp synchronization via secure firmware (using TSC or Invariant TSC), ensuring that timestamp errors from different cores and counters are controlled at the nanosecond level, providing an accurate time reference for subsequent cross-modal timing correlation.

[0090] Operating System Kernel Awareness Submodule: On each protected host, a lightweight probe set based on eBPF is loaded. When an event is triggered, the probes collect key fields such as process ID, file descriptor, and target IP / port with extremely low loss, and pass them to the user-space eBPF agent process with zero copy via the Perf ring buffer.

[0091] The eBPF probe set of the operating system kernel awareness submodule covers the following key kernel event types: (1) Process lifecycle events (mounted via kprobe to functions such as sys_execve, do_fork, do_exit, etc.): capturing process creation, child process spawning, and process termination, and recording the executable file path, command line arguments, and environment variables of the new process; (2) File system events (mounted via kprobe to functions such as vfs_read, vfs_write, vfs_open, etc.): capturing file read, write, and open operations, and recording the target file path, operation type, and access process information; (3) Network events (mounted via kprobe to tc (4) Privileged operation events (mounted by kprobe to functions such as sys_setuid, sys_capset, sys_ptrace): Capture sensitive operations such as user identity change, capability set modification and process debugging; (5) Memory operation events (mounted by kprobe to functions such as sys_mmap, sys_mprotect): Capture memory mapping and protection attribute modification operations, which are crucial for detecting code injection and memory corruption attacks.

[0092] The eBPF probes described above employ several performance optimization measures in their implementation: using BPF_MAP_TYPE_PERF_EVENT_ARRAY to achieve zero-copy data transfer from kernel to user space, utilizing BPF_MAP_TYPE_LRU_HASH to cache the nearest executable file path to accelerate the search, and setting up pre-filtering logic in the BPF program (such as only reporting events for specific users or specific processes) to complete the removal of invalid events in kernel space, thereby reducing the processing burden in user space.

[0093] Network Protocol Stack Awareness Submodule: Configures port mirroring on the core switch to distribute traffic copies to a dedicated network acquisition engine. For encrypted traffic, the acquisition engine extracts plaintext information from the handshake phase, while simultaneously bypassing the encrypted payload to an optional decryption engine for statistical feature extraction.

[0094] The network protocol stack awareness submodule employs a layered strategy for handling encrypted traffic: Layer 1: Metadata Extraction. For all encrypted traffic (TLS / SSL), plaintext metadata from the handshake phase, such as SNI (Server Name Indication), certificate chain information, TLS version, list of supported cipher suites, and session ID, is extracted. While this information does not contain the payload content, it effectively reveals the identity of the communicating peer and the communication pattern. Layer 2: Statistical Feature Extraction. Statistical features such as packet length sequence, time interval, direction distribution, and burstiness are extracted from the encrypted payload. Encrypted traffic analysis techniques (such as change point detection based on cumulative sums and CUSUM) are used to identify abnormal patterns hidden in the encrypted channel. Layer 3: Selective Decryption. For legitimately authorized business traffic (such as enterprise-owned web services), the session key is obtained by interfacing with the key management server. Payload decryption is performed on an independent decryption engine, and key feature fragments (such as URL path patterns in HTTP requests and abnormal status code distribution in responses) are extracted. The decrypted plaintext payload is only retained in memory for feature extraction, not stored on disk, and is immediately cleared after feature extraction, strictly adhering to the principle of data minimization. This three-layer processing strategy enables the network awareness submodule to extract sufficiently rich security signals even in real-world network environments with a high proportion of encrypted traffic.

[0095] In addition, such as Figure 1 and Figure 2 As shown, the adaptive sampling scheduler resides in the awareness coordination agent on each host, and it maintains communication with the "threat scoring center" of the analysis engine. When the overall threat score of a host continues to exceed the threshold H1, the scheduler instructs the kernel awareness submodule to enable more granular tracking and commands the network awareness submodule to start deep packet inspection; when the threat score falls back below the threshold L1, it switches back to the default lightweight collection mode. Figure 2 It details the workflow of how the three awareness submodules—microarchitecture, kernel, and network—asynchronously aggregate heterogeneous data and upload it to the analysis engine under the coordination of the scheduler.

[0096] The adaptive sampling scheduler operates as follows: (1) Basic monitoring level (threat score < 20): The microarchitecture layer samples 4 core counters (instruction retirement count, L3 cache hit / miss, branch prediction failure rate) at 100Hz, the kernel layer only monitors process creation and privileged operation events, and the network layer only extracts traffic metadata. Estimated CPU overhead at this time: approximately 0.3%-0.5%. (2) Enhanced monitoring level (20 ≤ threat score < 60): The microarchitecture layer samples 8 counters at 500Hz, the kernel layer adds file system events and network connection events monitoring, and the network layer adds statistical feature extraction. Estimated CPU overhead: approximately 1.5%-3%. (3) Deep monitoring level (threat score ≥ 60): The microarchitecture layer samples all counters at 1KHz, the kernel layer enables full event type tracing and system call sequence recording, and the network layer enables selective DPI. Estimated CPU overhead: approximately 5%-8%. The scheduler uses hysteresis control during level switching, which sets a difference between the upgrade trigger threshold (e.g., 20) and the downgrade recovery threshold (e.g., 15) to avoid frequent level switching caused by score fluctuations near the critical value.

[0097] Analysis and Judgment Layer (corresponding to the multimodal feature fusion and intelligent analysis engine): As the "brain" of the system, it receives massive, heterogeneous, and time-series secure data streams from the acquisition layer. Its logical structure is as follows: Figure 3 As shown:

[0098] The cross-modal feature extraction unit comprises three feature extractors operating in parallel. The microarchitecture feature extractor uses wavelet packet decomposition to extract the microarchitecture behavior vector V_hw; the kernel feature extractor constructs a process behavior time sequence graph to extract the kernel activity vector V_os; and the network feature extractor calculates flow statistics and TLS fingerprints to form the network traffic vector V_net.

[0099] Specific implementation schemes for the three feature extractors in the cross-modal feature extraction unit:

[0100] Microarchitecture Feature Extractor (V_hw Generator): The original HPC time series undergoes Daubechies-4 wavelet packet decomposition (decomposition level = 3) to extract the energy distribution coefficients, entropy values, and peak factors for each frequency band. Simultaneously, it calculates the sliding window statistics (mean, variance, skewness, kurtosis) of each counter value within adjacent time windows, as well as the eigenvalues ​​of the covariance matrix across counters, ultimately forming a microarchitecture behavior vector V_hw with dimension d_hw = 64. The choice of wavelet packet decomposition is based on the following technical considerations: Microarchitecture-level attacks (such as cache side-channel probing) typically generate anomalous energy concentrations in specific frequency bands, and different attack types correspond to different characteristic frequency bands. For example, the Prime+Probe attack generates periodic cache miss peaks in the 1-10Hz frequency band, while the Flush+Reload attack's characteristic frequency bands are concentrated in a higher frequency range. The frequency band localization characteristic of wavelet packet decomposition allows it to capture these differences more precisely than traditional FFT spectral analysis.

[0101] The kernel feature extractor (V_os generator) constructs a time sequence graph of process behavior within a sliding time window (default window size 30 seconds, step size 5 seconds), using processes as nodes and system calls and file / network operations as edges. Each process node in the graph has the following attribute vectors: process lifecycle statistics (runtime, number of child processes), system call frequency distribution vector (statistics by system call type), file operation pattern vector (path prefix distribution entropy for reading / writing files), and network communication pattern vector (destination IP address entropy, port number distribution entropy). Edge attributes include call frequency and time interval statistics. The GraphSAGE inductive graph embedding algorithm is used to embed and encode the nodes of this time sequence graph, and the embedding vector of the target process is taken as the kernel activity vector V_os, with dimension d_os = 128.

[0102] The network feature extractor (V_net generator) extracts the following features for each network flow (defined as a quintuple + time window): (a) Flow statistics: statistics on packet and byte counts (mean, variance, maximum, percentiles), and distribution characteristics of packet arrival time intervals; (b) TLS fingerprint features: encoding of the cipher suite vector, extension type vector, elliptic curve parameter vector, and compression method vector in the ClientHello message to form a TLS protocol fingerprint; (c) Payload statistics: byte entropy, N-gram frequency distribution, and compression ratio estimate of the encrypted payload. These features are encoded into a network traffic vector V_net of dimension d_net = 128 via a fully connected network.

[0103] Spatiotemporal correlation fusion unit: This is one of the core innovations of this invention. For example... Figure 3As shown, an online maintenance module for a System Behavior Knowledge Graph (SBKG) is first constructed. Then, a Graph Attention Network (GAT) is used to learn the embedded representations of entities and relations. The input to GAT is the adjacency matrix of SBKG and the initial features of nodes (from each modality vector). Through a multi-layer attention mechanism, the representations of adjacent nodes influence each other, thereby aligning local microarchitectural anomalies, kernel activity anomalies, and network traffic anomalies spatiotemporally on the same entity in the graph. Finally, the output is a "unified behavior embedding vector E_unified".

[0104] Technical details of the spatiotemporal correlation fusion unit: SBKG is constructed using an adjacency list storage structure, supporting real-time graph updates for large enterprise network environments with over 100,000 active entities. GAT employs a 3-layer multi-head attention architecture (8, 4, and 1 attention heads per layer), using ELU as the activation function, and residual connections and layer normalization between layers. The node embedding update formula in layer l of GAT is:

[0105] ;

[0106] in For nodes The neighborhood group, For the number of attention heads, For the first The linear transformation matrix of each attention head. For the first The normalized attention coefficient calculated from the size, For ELU activation function. Attention coefficients. Calculated using the following formula:

[0107] ;

[0108] in For learnable attention vectors, This represents a vector concatenation operation. The uniform behavior of GAT output is the embedding vector. Dimensions = 256.

[0109] The synergistic effect of GAT's cross-modal fusion can be explained by the information bottleneck theory. The information bottleneck principle states that optimal feature representation should compress input information while retaining information most relevant to the prediction target. In this invention, GAT's attention mechanism naturally achieves this balance; cross-modal attention weights automatically assign higher information throughput to modal features highly relevant to threat discrimination, while suppressing irrelevant or redundant features. This adaptive information filtering mechanism enables… In a representation space with a dimension far lower than the total dimension of the original multimodal data, the most threatening discriminative information components from cross-modal complementary signals are condensed, thus significantly reducing the risk of overfitting in subsequent Transformer models while maintaining a high detection rate. In contrast, traditional feature concatenation methods pass all modal features to downstream models with equal weight, resulting in noisy and redundant features mixed with effective features, which not only increases model complexity but also introduces the risk of learning spurious correlations.

[0110] Dynamic Threat Discrimination Unit: Embeds a unified behavior vector into a pre-trained ThreatBERT model and outputs an initial threat discrimination result. Simultaneously, such as... Figure 4 As shown, the reliability dynamic evaluation subunit assesses the reliability of each initial discrimination result. Evaluation factors include: the accuracy of similar historical discriminations, the degree of current abnormal deviation from the baseline, and the mutual corroboration strength among multi-source signals. If the reliability C is lower than the threshold, targeted enhanced acquisition is triggered, and a secondary analysis process is performed to reduce false alarm noise. Figure 4 It fully demonstrates the closed-loop verification process of model discrimination and credibility assessment.

[0111] The ThreatBERT model architecture for the dynamic threat discrimination unit adopts a 6-layer Transformer encoder (with the same architecture parameters as BERT-base: 768 hidden dimensions, 12 attention heads, and 3072 feedforward network dimensions), but the pre-training strategy is specifically optimized for the security domain. The pre-training is divided into two stages: (1) Masked Behavior Sequence Prediction (MBSP), which randomly masks 15% of the time steps in a uniform behavior embedding sequence, requiring the model to predict the masked behavior embedding vector based on the context, so that the model learns the normal pattern of the behavior sequence; (2) Next Attack Stage Prediction (NASP), which, given a behavior embedding sequence, determines whether the current behavior is in a certain stage of the attack chain and what the next stage might be, so that the model learns the causal evolution pattern of the attack behavior. After the above pre-training, the model is fine-tuned on the downstream threat discrimination task using labeled attack samples. The discrimination output includes: threat type (multi-classification labels: normal / malicious / C2 communication / lateral movement / data leakage / privilege escalation / side-channel attack, etc.), confidence score (0-1), and attack stage label (based on the Cyber ​​Kill Chain model: reconnaissance / weaponization / delivery / exploitation / installation / C2 / target achievement).

[0112] The credibility calculation formula for the credibility dynamic evaluation sub-unit is as follows:

[0113] ;

[0114] in, This is a confidence component based on the historical accuracy of similar threats (when the historical accuracy of this threat type is >0.90). =0.95; linearly mapped to 0.6-0.95 when between 0.70 and 0.90; <0.70 =0.5); The confidence component is based on the degree of abnormal deviation from the baseline (obtained by the Mahalanobis distance mapping between the current unified behavior embedding vector and the normal behavior embedding distribution). This refers to the confidence component based on the mutual corroboration strength of multi-source signals (calculated using normalized mutual information among anomalous signals from three modalities: microarchitecture, kernel, and network). Weights =0.3、 =0.3、 =0.4 (Assigning a slightly higher weight to multi-source verification to reflect the core idea of ​​cross-modal fusion). When the credibility... When the value is below the preset threshold (default 0.65), the enhanced acquisition and secondary analysis process is triggered.

[0115] Covert Channel Mining Unit: Used to analyze the correlation between power consumption fluctuation sequences of the processor microarchitecture layer and network encrypted traffic timing sequences, and to identify side channel leakage through mutual information and Granger causality tests.

[0116] The specific algorithm flow of the covert channel mining unit is as follows: (1) Data preprocessing: The power consumption fluctuation sequence P(t) and the network traffic rate sequence N(t) are resampled at equal intervals (sampling interval of 1 second), detrending (first-order difference) and stationarity test (ADF test) are performed to ensure that the sequence meets the statistical assumptions of subsequent analysis; (2) Mutual information calculation: The mutual information between P(t) and N(t) is calculated by using the K nearest neighbor entropy estimation method. Estimating joint entropy in the joint space using the nearest neighbor number of k=5. , and use the substitution data method based on random shuffling of N(t) time series 1000 times to generate the zero distribution of mutual information to determine the significance threshold; (3) Granger causality test: construct VAR model, determine the optimal lag order through BIC (Bayesian Information Criterion), and use F test to test the two hypotheses "N is a Granger cause of P" and "P is a Granger cause of N" respectively. When P is a Granger cause of N and the F statistic is significant at the p<0.01 level, combined with the high mutual information value, it is determined that there is a causal driving relationship from microarchitecture power consumption abnormality to network traffic abnormality, that is, a high probability of data leakage behavior; (4) Alarm output: output the covert channel alarm containing the suspicious process PID, leakage rate estimate, detection confidence and analysis basis, for security analysts to make final confirmation.

[0117] The response and handling layer (corresponding to the adaptive threat response and closed-loop evolution module) is responsible for translating the decisions of the "brain" into actions of the "hands and feet." Its workflow is as follows: Figure 5 As shown:

[0118] Situational Awareness and Policy Generation Unit: Constructs a current state graph from the initial threat assessment results, CMDB information of affected assets, and current business traffic topology. Using a multi-objective function of minimizing business impact and maximizing threat containment effectiveness, a policy network is trained in a simulated environment using a Deep Q-Network (DQN) to output the optimal response policy.

[0119] The DQN policy network architecture of the situational awareness and policy generation unit: The state encoder uses a 3-layer GCN (Graph Convolutional Network) to encode the state graph (nodes represent assets and threat entities, edges represent network connections and business dependencies) into a 256-dimensional state embedding vector; the policy network is a 3-layer fully connected network (256-128-64-N_actions), outputting the Q-value estimate for each possible response action; in the simulated environment, an ε-greedy exploration policy (initial ε=1.0, linearly decaying to 0.05) is used for training, and the reward function is a weighted multi-objective function.

[0120] ;

[0121] in Rewards for threat containment effectiveness (based on whether the attack phase was successfully blocked) Penalties for business impact (based on the number of normal business transactions affected) The reward is based on timeliness (based on the delay from detection to execution). After sufficient training in a simulated environment, the policy network can quickly infer the sequence of response actions that maximizes the Q-value in a real-world environment based on the current state graph.

[0122] Orchestration Execution Unit: Based on the optimal response strategy, it orchestrates and calls the APIs or agent command interfaces of various security devices through the SOAR platform to execute predetermined response actions.

[0123] Threat intelligence closed-loop update unit: such as Figure 5 As shown, after the response action is executed, the unit initiates an intelligence closed-loop process: first, evidence collection and feature extraction are performed; then, the extracted features or samples are reproduced and deeply verified in an isolated dynamic analysis sandbox; after successful verification, standardized IOCs are written into the threat intelligence database, new feature samples are added to the model training pool to drive the evolution of ThreatBERT, and successful response policies are updated to the policy knowledge base. Thus, a complete closed loop of "detection -> response -> evolution" is formed.

[0124] The specific scheme for incremental training of the model in the threat intelligence closed-loop update unit is as follows: (1) Training pool management: Maintain an experience replay buffer with a capacity limit of N_max=50,000 samples. A stratified sampling strategy is adopted, with 50% of the capacity allocated to new samples within the last 30 days (to ensure that the model can quickly adapt to the current threat trend), 30% allocated to high-quality samples within the past 1-6 months (representing the mid-term threat pattern), and 20% allocated to representative samples from 6 months ago (to prevent the model from catastrophically forgetting historical attack patterns); (2) Incremental training triggering conditions: Incremental training is triggered when the number of new samples in the buffer reaches 500, or when more than 24 hours have passed since the last training, or when the new samples contain at least one zero-day attack sample that has not been correctly identified by the current model; (3) Incremental training strategy: Elastic weight consolidation is adopted. (4) Model validation and deployment: After incremental training, the model performance is evaluated on an independent validation set (including known attack samples, new attack samples and benign samples). The new model is automatically deployed to the production environment only when the F1-score is ≥0.92 and there is no significant performance degradation (the recall rate of any known attack type decreases by no more than 2%).

[0125] The evolutionary closed-loop layer is not a separate module, but a closed-loop feedback flow that runs through the three layers mentioned above. It ensures that the system can learn and evolve from each confrontation with the attacker, continuously improving its own defense capabilities.

[0126] Example 2: Method Flow

[0127] Combination Figure 6The network security threat detection and response method provided by this invention includes the following specific steps:

[0128] S1, Multi-layer asynchronous acquisition of security data. The multi-layer collaborative perception module asynchronously acquires raw security data from the processor microarchitecture layer, operating system kernel layer, and network protocol stack layer according to preset or dynamically adjusted strategies.

[0129] S2, Cross-modal Feature Extraction. The cross-modal feature extraction unit processes three types of data streams in parallel, generating microarchitecture behavior vector V_hw, kernel activity vector V_os, and network traffic vector V_net, respectively.

[0130] S3, Spatiotemporal Relation Fusion. The spatiotemporal relation fusion unit associates the entity identifiers contained in the above vectors with the system behavior knowledge graph, and uses a graph attention network to perform embedding learning on the graph to generate a unified behavior embedding vector E_unified.

[0131] S4, Dynamic Threat Identification and Credibility Assessment. Input E_unified into the threat detection model and output the initial threat identification result. Simultaneously calculate the credibility C. If C is below a threshold, trigger enhanced data collection and secondary analysis, outputting the revised identification result.

[0132] S5. Generate and execute the optimal response strategy. If the confidence level of the judgment result exceeds the execution threshold, generate the optimal response strategy by combining asset and business information, and execute the response actions in stages.

[0133] S6, Threat Intelligence Closed-Loop Update. After the response is completed, key features of the event are extracted, verified in a sandbox, and new IOCs are entered into the intelligence database. New feature samples are added to the model training pool to drive evolution, and successful response strategies are updated to the policy knowledge base. The closed-loop update is complete, and the system enters a new monitoring cycle. Figure 6 It clearly demonstrates the complete methodological process from data collection to closed-loop evolution.

[0134] Example 3: Typical Application Scenarios

[0135] Scenario: Detect and block a fileless attack targeting an internal network web server.

[0136] During the awareness phase: The network awareness submodule captured a suspicious POST request to a web service, with a payload of obfuscated PowerShell code snippets, but the network signature extractor only gave it a medium threat score. Simultaneously, the kernel awareness submodule's eBPF probe detected that the web service process www-data suddenly executed the / usr / bin / wget command (abnormal process creation), and subsequently made short connections to unknown overseas IPs. The microarchitecture awareness submodule reported a brief abnormal spike in the process's L1 cache miss rate (possibly related to deobfuscated execution).

[0137] Analysis and fusion phase: Feature vectors of the three modalities were extracted. GAT analysis of the spatiotemporal correlation fusion unit revealed that these three anomalies (network load, kernel aberration execution, and microarchitectural spikes) all pointed to the same process entity, www-data. Its unified embedding vector, E_unified, significantly deviated from the normal baseline.

[0138] Discriminant stage: The ThreatBERT model analyzes E_unified and outputs the discriminant result: {type: “FilelessMalware”, confidence: 0.85, stage: “Execution / C&C”}. The confidence level is high (strong multi-source corroboration).

[0139] Response Phase: The policy generation unit generates a policy based on the asset importance (the web server is level 2) and the attack phase: First, all outbound network traffic generated by the process is redirected via honeypot (action: HONEYPOT_REDIRECT), while the www-data process is paused (action: PROCESS_SUSPEND), and the SOC analyst is notified.

[0140] Closed-loop evolution stage: Analysts confirmed it as a new type of fileless attack. The closed-loop unit extracted its unique PowerShell obfuscation pattern, wget + short connection behavior chain, and the correlation model between microarchitectural spikes and code decryption. After sandbox verification, this behavior chain was added as a new signature to the kernel-level rule base, the obfuscation pattern features were added to the network-level detection rules, and ThreatBERT was fine-tuned using new sample data. The next time a similar variant is encountered, the system can detect it with high confidence in the early stages of "delivery" or "execution".

[0141] Example 4: Hardware Deployment Model

[0142] This system can adopt a software-defined, loosely coupled architecture and be deployed in a secure resource pool as containers or microservices.

[0143] Data collection agents are deployed as DaemonSets on each worker node of the Kubernetes cluster to achieve multi-layered awareness and adaptive sampling. Data is aggregated between agents to the analytics layer through a secure message queue (such as Kafka).

[0144] Analysis engine cluster: Deployed on GPU servers or dedicated AI inference chips (such as Huawei Ascend and Cambricon), utilizing their computing power for real-time GAT calculation and ThreatBERT inference. Spark / Flink cluster is responsible for feature preprocessing and streaming computation.

[0145] Response and closed-loop services: Deployed on the management network and integrated with the SOAR platform, CMDB, sandbox, and intelligence platform via API.

[0146] Example 5: Validation of Synergistic Effects and Unexpected Technical Results

[0147] To verify the synergistic effect of the technical solution of this invention, the following experimental setup was used for comparative analysis:

[0148] Experimental Environment: A simulated enterprise network environment was set up, consisting of 50 virtualized servers, 3 core switches, and 1 firewall. Ten servers were randomly selected to inject simulated attack traffic. The attack types included: (1) Cache side-channel attack based on Spectre variant + encrypted channel data leakage (cross-layer attack, accounting for 25%); (2) Fileless malware delivery and C2 communication (cross-layer attack, accounting for 25%); (3) SQL injection attack (network layer attack, accounting for 20%); (4) Kernel rootkit installation (kernel layer attack, accounting for 15%); (5) Normal business traffic (accounting for 15%). The deployment lasted for 30 days, with different types of attack samples injected every day.

[0149] Comparison schemes: (A) Network layer perception only + CNN classifier (representing the traditional NIDS scheme); (B) Network layer + kernel layer perception + feature concatenation + LSTM classifier (representing the multi-source fusion scheme); (C) The complete scheme of this invention (three-layer perception + GAT fusion + ThreatBERT discrimination + closed-loop evolution).

[0150] Experimental Results: Scheme (A) achieved detection rates of only 21.3% and 18.7% for cross-layer attacks (Spectre + leakage, no file + C2), with AP (Average Precision) of 0.19 and 0.16, respectively. Scheme (B) achieved detection rates of 47.8% and 52.3% for these two types of cross-layer attacks, with AP improved to 0.43 and 0.48, respectively. Scheme (C) achieved detection rates of 91.5% and 93.2% for these two types of cross-layer attacks, with AP of 0.89 and 0.91, respectively. These results indicate that the detection performance of Scheme (C) for cross-layer attacks is not a simple linear summation of the effects of Schemes (A) and (B) (if it were a simple summation, the expected detection rate would be around 60%), but rather exhibits a significant "emergent" improvement. The graph attention fusion of the three-layer perception data enables the model to discover deep correlation patterns hidden between abnormal signals at different levels, which are completely invisible in single-layer or two-layer perception. Furthermore, Scheme (C) exhibited an F1-score attenuation rate of only 4.2% over the 30-day experimental period, while Scheme (B) showed an attenuation rate as high as 22.8%. This verifies the unexpected technical effectiveness of the closed-loop evolution mechanism in combating model attenuation. Regarding covert channel detection capabilities, Schemes (A) and (B) both achieved a 0% detection rate for data leakage based on the buffer-side channel (completely lacking detection capability), while Scheme (C) achieved an 87.6% detection rate through the covert channel mining unit. This is a unique technical effect of Scheme (C).

[0151] The experimental data above fully demonstrates that the overall security capability generated by the three-layer perception-cross-modal fusion-closed-loop evolution architecture of this invention far exceeds the simple sum of the capabilities of its individual components.

[0152] Example 6: Variations and Extensions

[0153] Perception layer extension: Application layer perception can be added by collecting API calls, SQL statements, serialized data, etc. from applications such as Java / PHP through RASP (Runtime Application Self-Protection) technology, further enriching the fifth dimension data.

[0154] Analysis model replacement: GAT can be replaced with Graph Convolutional Network (GCN) or GraphSAGE; ThreatBERT can be replaced with a threat discrimination model based on Graph Neural Network (GNN).

[0155] Response strategy optimization: In addition to DQN, strategy generation can also adopt imitation learning, which directly learns strategies from the historical handling records of senior analysts.

[0156] The embodiments described herein are preferred embodiments of the present invention and are not intended to limit the scope of protection of the present invention. Therefore, all equivalent changes made in accordance with the structure, shape, and principle of the present invention should be covered within the scope of protection of the present invention.

Claims

1. A network security threat detection and response system, characterized in that, include: A multi-layered collaborative sensing module is used to asynchronously collect security data from multiple layers of the target network and terminals. These multiple layers include at least the processor microarchitecture layer, the operating system kernel layer, and the network protocol stack layer. The processor microarchitecture layer periodically collects instruction branch patterns, cache hit rates, TLB misses, and power consumption fluctuation data through a built-in hardware performance counter group. The operating system kernel layer intercepts process creation, file read / write, privileged operations, and system call sequence events through a lightweight kernel probe. The network protocol stack layer obtains raw network traffic data through network splitters or switch port mirroring. A multimodal feature fusion and intelligent analysis engine, coupled with the multi-layered collaborative perception module, is used for real-time feature extraction, correlation fusion, and threat identification of collected heterogeneous security data. This engine includes: The cross-modal feature extraction unit is used to extract the corresponding microarchitecture behavior vector, kernel activity vector, and network traffic vector from the data of the processor microarchitecture layer, the operating system kernel layer, and the network protocol stack layer, respectively. The spatiotemporal correlation fusion unit is used to input the above vectors into a preset graph attention network, and learn the embedding representation of entities and relationships based on the constructed system behavior knowledge graph to generate a unified behavior embedding vector that integrates spatiotemporal dependencies. The dynamic threat discrimination unit is used to input the unified behavior embedding vector into the trained threat detection model and output an initial threat discrimination result containing threat type, confidence level and attack stage label; wherein, the threat detection model is a model based on the Transformer architecture and combined with a reinforcement learning framework; An adaptive threat response and closed-loop evolution module, coupled with the multimodal feature fusion and intelligent analysis engine, is used to perform dynamic policy generation, automated response handling, and intelligence closed-loop updates based on the initial threat identification results. This module includes: The situational awareness and strategy generation unit combines the initial threat assessment results with preset asset importance levels and business relationships, and generates an optimal response strategy that includes response priority, handling method and scope of action by solving constraints to meet the problem. The Orchestration execution unit is used to orchestrate and invoke preset response action atomic capabilities to achieve threat containment based on the optimal response strategy. The threat intelligence closed-loop update unit is used to normalize and verify the feature data, attack behavior patterns and response effects that are confirmed to be real attacks after the response is handled, to form new threat indicators or behavior signatures, and automatically feed them back to the rule base and model training pool of the multimodal feature fusion and intelligent analysis engine, driving incremental updates of the detection model and response strategy.

2. The network security threat detection and response system according to claim 1, characterized in that, The multi-layered collaborative perception module also includes an adaptive sampling scheduler, which dynamically adjusts the collection frequency and depth of each perception module based on the real-time threat score from the multi-modal feature fusion and intelligent analysis engine: when the threat score is higher than the first threshold, the collection frequency is increased and deep packet inspection and kernel-level system call tracing are enabled; when the threat score is lower than the second threshold, the collection frequency is reduced to the basic monitoring level.

3. The network security threat detection and response system according to claim 1, characterized in that, The dynamic threat discrimination unit also includes a credibility dynamic evaluation subunit, which evaluates the credibility of each initial threat discrimination result. The evaluation factors include: the accuracy of similar historical discriminations, the degree of current abnormal deviation from the baseline, and the mutual corroboration strength between multi-source signals. For discrimination results with credibility lower than a preset credibility threshold, the multi-level collaborative perception module is triggered to perform targeted enhanced acquisition of the target entity, and the enhanced acquisition data is re-sent into the engine for secondary analysis.

4. The network security threat detection and response system according to claim 1, characterized in that, The multimodal feature fusion and intelligent analysis engine also includes a covert channel mining unit, which is used to analyze the correlation between power consumption fluctuation data of the processor microarchitecture layer and encrypted traffic timing data of the network protocol stack layer. By calculating mutual information and Granger causality test, it identifies potential covert communication behaviors that use side channels or encrypted traffic patterns to leak data.

5. A network security threat detection and response system according to claim 1, characterized in that, The process by which the situational awareness and strategy generation unit generates the optimal response strategy is as follows: the initial threat discrimination results, asset information, and business flow topology are constructed into a current state diagram; all possible response actions are defined as the action space; the strategy network is trained in a simulated environment using a deep Q-network algorithm with the goal of minimizing business impact and maximizing threat containment effect, so that an approximately optimal response action sequence can be quickly inferred from the current state in practical applications.

6. The network security threat detection and response system according to claim 1, characterized in that, Before generating new threat indicators or behavioral signatures, the threat intelligence closed-loop update unit also includes a sandbox verification step. This step involves extracting suspected new attack samples or behavioral patterns and placing them into a sandbox isolated from the production environment for reproduction and verification. Only after confirming the effectiveness of the attack and the stability of its characteristics can a formal intelligence entry be generated and issued for update.

7. The network security threat detection and response system according to claim 1, characterized in that, The hardware performance counter group of the processor microarchitecture layer is configured and read through the model-specific register access interface, and the collected data is pre-filtered and aggregated by a lightweight security firmware independent of the operating system kernel before being uploaded.

8. A network security threat detection and response system according to claim 1, characterized in that, The lightweight kernel probe at the operating system kernel layer is implemented based on eBPF technology. It can safely and efficiently dynamically instrument key kernel functions without loading kernel modules, and the collected data is transferred to the user-space analysis process through a zero-copy method using a circular buffer.

9. A network security threat detection and response system according to claim 1, characterized in that, The acquisition of the network protocol stack layer includes both the metadata of the encrypted traffic and the characteristics of the payload fragments after selective decryption. The payload decryption is performed only on an authorized independent decryption engine and follows the principle of data minimization.

10. A network security threat detection and response method based on the system described in any one of claims 1-9, characterized in that, Includes the following steps: S1: Multi-level asynchronous acquisition of security data from the processor microarchitecture layer, operating system kernel layer, and network protocol stack layer; S2: Extract features from the collected heterogeneous data to obtain microarchitecture behavior vectors, kernel activity vectors, and network traffic vectors; S3: The vectors are spatiotemporally correlated and fused using a graph attention network to generate a unified behavior embedding vector; S4: Embed the unified behavior into the vector input threat detection model and output the initial threat discrimination result; S5: Based on the initial threat assessment results, combined with asset and business information, generate and execute the optimal response strategy; S6: Verify and normalize the actual attack characteristics confirmed after response and handling, and update the threat detection model and response strategy library accordingly.

Images