Multimodal network security log correlation analysis method based on time-series causal attention

Abstract

The present application relates to a multi-modal network security log correlation analysis method based on time-series causal attention, belonging to the technical field of network security. The present application comprises: collecting and standardizing preprocessing of multi-source heterogeneous network security logs, constructing a multi-modal log time-series causal graph, and calculating the causal strength between nodes through a PC causal inference algorithm; designing an improved multi-head time-series causal attention module, dynamically calculating the time-series causal attention weight, and fusing the log semantic features, traffic statistical features and time-series causal graph topological features; calculating the node anomaly score through the time-series causal attention weighted time-series graph neural network, realizing security event correlation analysis and real-time alarm. The present application solves the technical problems of the prior art, such as the lack of causal relationship modeling, the inability to balance real-time and accuracy, and high false alarm rate, and has the advantages of high attack recognition accuracy, strong real-time performance and good interpretability, and is suitable for security log correlation analysis and threat detection in various network environments.

Description

Technical Field

[0001] This invention relates to a multimodal network security log correlation analysis method based on temporal causal attention, belonging to the field of network security technology. Background Technology

[0002] Against the backdrop of an increasingly complex network environment, complex network security threats such as APT attacks, lateral movement within internal networks, and distributed denial-of-service attacks are frequently occurring. These attacks are characterized by being multi-stage, cross-device, and highly covert. Logs from a single security device can only record partial behaviors and cannot fully reconstruct the attack chain. Therefore, correlation analysis of multi-source heterogeneous network security logs has become a core aspect of network security situation awareness.

[0003] Existing network security log correlation analysis technologies have the following main technical shortcomings:

[0004] First, the ability to integrate multi-source heterogeneous logs is insufficient. Most current technologies only perform simple format unification and field matching on logs, without deeply exploring the inherent relationship between log text semantics, traffic characteristics, and behavioral timing. This makes it difficult to achieve effective linkage between logs across devices and types, resulting in fragmented attack behavior and an inability to identify complete attack paths.

[0005] Second, there is a lack of time-series causal relationship modeling. Traditional analysis methods based on rule matching, statistical analysis, and conventional graph neural networks only focus on the topological relationship between log entities and do not distinguish between the sequential causal relationship and accidental concurrent relationship of attack events. This makes it easy to misjudge normal business interactions as attack behaviors, resulting in a high false alarm rate.

[0006] Third, it is difficult to balance real-time performance with the ability to identify complex threats. While lightweight analysis models can meet the needs of real-time alerts, their accuracy in identifying complex and covert attacks is extremely low. High-precision deep models, on the other hand, are too computationally complex to be suitable for real-time processing of massive logs, resulting in delayed threat detection and an inability to prevent security risks in a timely manner.

[0007] Fourth, the association weight allocation is static. Existing technologies mostly use fixed weights to calculate the association degree of log entities, which cannot dynamically adjust the association weights according to changes in network traffic and the evolution of attack behavior. This makes it difficult to adapt to the dynamically changing network environment, resulting in a significant decrease in the accuracy of threat detection.

[0008] To address the aforementioned technical challenges, existing technologies have yet to develop a systematic solution that balances real-time performance with causal modeling. Therefore, developing a network security log analysis method that can balance real-time performance and accuracy, integrate multimodal log features, and achieve time-series causal correlation analysis has become a pressing technical problem for those skilled in the art. Summary of the Invention

[0009] To address the shortcomings of existing network security log correlation analysis technologies, such as insufficient multimodal log fusion, lack of temporal causal relationship modeling, inability to balance real-time performance and accuracy, and static correlation weights, this invention provides a multimodal network security log correlation analysis method based on temporal causal attention. By constructing a temporal causal attention graph model, this invention achieves deep fusion of multi-source heterogeneous logs, causal correlation mining of attack behaviors, and real-time threat detection. This solves the technical problems of high false alarm rate, weak ability to identify complex threats, and poor real-time performance in existing technologies, thereby improving the accuracy and response efficiency of network security situation awareness.

[0010] The technical solution of this invention is: a multimodal network security log correlation analysis method based on temporal causal attention, the method comprising the following:

[0011] Collect and standardize multi-source heterogeneous network security logs, construct a multimodal log time-series causal graph, and calculate the causal strength between nodes using a PC causal inference algorithm;

[0012] Design an improved multi-head temporal causal attention module, dynamically calculate temporal causal attention weights, and integrate log semantic features, traffic statistics features, and temporal causal graph topology features;

[0013] The node anomaly score is calculated by using a temporal graph neural network with temporal causal attention weighting, and then security event correlation analysis and real-time alarms are performed based on the node anomaly score.

[0014] Furthermore, the method includes the following steps:

[0015] S1. Multi-source heterogeneous network security log collection and standardized preprocessing: Real-time collection of multimodal log data from firewalls, intrusion detection systems, servers, and terminals; cleaning, deduplication, and desensitization processing; unified log format; extraction of core log fields; formation of structured log data.

[0016] S2. Construction of Temporal Causal Graph for Multimodal Logs: Transform structured log data into entity-event-timestamp triples, construct an initial log topology graph, use the PC causal inference algorithm to calculate the causal strength between nodes, and construct a temporal causal graph with temporal attributes and causal weights.

[0017] S3. Dynamic Calculation of Temporal Causal Attention Weights: An improved multi-head temporal causal attention module is designed, which combines causal strength, temporal decay factor, and semantic similarity to dynamically calculate temporal causal attention weights through a preset formula.

[0018] S4. Multimodal feature fusion and threat association calculation: Extract log semantic features and traffic statistics features, fuse them with temporal causal graph topological features, input temporal causal attention-weighted temporal graph neural network to calculate node anomaly scores, and accumulate and judge abnormal behavior through sliding time windows;

[0019] S5. Security Incident Correlation Analysis and Alarm Output: Based on time-series causal attention weights, trace the correlation path of abnormal nodes, restore the attack chain, generate analysis reports and provide real-time alarms.

[0020] Furthermore, in S1, the core log fields include entity information, behavioral events, timestamps, and traffic parameters. Entity information includes IP address, process ID, and user account. Behavioral events include network connection, process creation, and file modification.

[0021] Furthermore, S2 includes:

[0022] Apply temporal causal order constraints to the initial log topology graph, only for those that satisfy the temporal order. < entity pairs Perform PC conditional independence tests, construct a directed causal subgraph with temporal sequence, and transform the traditional undirected association into a directional causal relationship in the attack chain. For entity nodes The timestamp of the corresponding log occurrence. Adjacent entity nodes The timestamp of the corresponding log occurrence;

[0023] Calculate the causal strength between events of each node in the initial log topology graph. ,in , These represent two related entity nodes in the initial log topology graph, with causal strength... The value range is [0,1];

[0024] The causal skeleton and conditional independence test statistic output by the PC causal inference algorithm are transformed into continuous causal strength values, normalized and mapped to the [0,1] interval as dynamic weights of graph edges, and weak causal association edges are removed according to a preset causal strength threshold to form a temporal causal graph with temporal attributes and causal weights.

[0025] Furthermore, in S3, the improved multi-head temporal causal attention module includes a causal attention head, a temporal attention head, a semantic attention head, and a topological attention head, which are used to extract four types of features: causal strength, temporal decay, log semantics, and graph topology, respectively, and adopt adaptive gating fusion.

[0026] Causality strength obtained by the PC causality inference algorithm The calculation process of embedding temporal causal attention weights as attention priors;

[0027] Set up an independent time-series attention head, dynamically weight log events in different time windows based on the time-series decay factor, and enhance the attention to key events;

[0028] An adaptive gating fusion mechanism is adopted to automatically learn the weights of each attention head; the adaptive gating fusion uses a learnable weight vector to weight the output of each attention head, and the weights are generated by the fully connected layer and Softmax.

[0029] The scope of attention calculation is constrained to the effective edges of the temporal causal graph.

[0030] Furthermore, in S3, the formula for calculating the temporal causal attention weight is:

[0031] ; in:

[0032] express Time-based entity nodes For entity nodes The temporal causal attention weights; λ is the causal weight coefficient, with a value range of [0.5, 1.5], used to adjust the degree of influence of causal strength on attention weights; For entity nodes and The strength of causality between them; For the current analysis time window, For entity nodes The timestamp of the corresponding log occurrence. Adjacent nodes The timestamp of the corresponding log occurrence; τ is the time decay constant, which is dynamically adjusted according to the log type; For entity nodes The set of all adjacent nodes.

[0033] Furthermore, in S4, a pre-trained BERT model is used to extract log semantic features, and a one-dimensional CNN convolutional neural network is used to extract traffic statistical features;

[0034] The extracted log semantic features, traffic statistics features, and topological features of the time-series causal graph are gated and weighted and fused to form a multimodal fusion feature vector;

[0035] The multimodal fusion feature vector is input into the temporal graph neural network with temporal causal attention weighting. The temporal causal attention weights are used as the dynamic adjacency weights of graph convolution to perform causal perception aggregation of node neighbor information.

[0036] After aggregation, a multimodal feature gating fusion layer is introduced to adaptively learn the weight coefficients of three types of features: log semantic features, traffic statistics features, and temporal causal graph topology features. The multimodal fusion feature vector is then weighted and compressed. The node output is then mapped to the [0,1] interval through the Sigmoid activation function to obtain the standardized node anomaly score.

[0037] A sliding time window is set up, and a time-series cumulative anomaly scoring mechanism is constructed. The anomaly scores of nodes in the sliding time window are accumulated in a time-series weighted manner. The cumulative node anomaly score is used as the final judgment criterion. If the cumulative score exceeds the preset anomaly threshold, it is determined that the nodes in the sliding time window have abnormal security behavior, and the correlation analysis mechanism is triggered.

[0038] The present invention also provides a multimodal network security log correlation analysis system based on temporal causal attention, the system comprising: a module for executing the multimodal network security log correlation analysis method based on temporal causal attention.

[0039] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the multimodal network security log correlation analysis method based on temporal causal attention.

[0040] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the multimodal network security log correlation analysis method based on temporal causal attention.

[0041] The beneficial effects of this invention are:

[0042] This invention constructs a multimodal log time-series causal graph, combining a PC causal inference algorithm with graph topology, to achieve deep fusion and causal association modeling of multi-source heterogeneous logs. It effectively distinguishes between causal relationships and accidental concurrent relationships of attack behaviors. Compared with traditional graph neural network analysis methods, it improves the accuracy of complex attack path identification and reduces the false positive rate, significantly improving the accuracy of threat detection.

[0043] An improved temporal causal attention module was designed, which adopts a dynamic weight allocation mechanism. It combines causal strength and temporal decay factor to dynamically calculate the attention weight of nodes. This ensures that the focus of analysis is on recent highly correlated log events, while reducing the interference of invalid historical data. The single time window analysis latency is ≤300ms, and it supports the processing capacity of massive logs at 100,000 levels / second. It significantly improves the ability to identify complex threats while ensuring real-time performance.

[0044] By integrating log semantic features, traffic statistics features, and topology features, it achieves deep linkage of multimodal features, breaks through the limitations of single feature analysis, and can accurately identify multi-stage covert attacks such as APT attacks and lateral movement within the intranet, fully reconstruct the attack chain, and improve the comprehensiveness of network security situation awareness.

[0045] The technical solution of this invention reduces the inference latency compared with the traditional GNN method under the same computing power conditions. It can be deployed on conventional network security servers without the need for ultra-high computing power. At the same time, it supports dynamic adjustment of model parameters to adapt to the log analysis needs of different network environments, and has strong practicality and scalability.

[0046] It can output attack correlation paths with causal strength, enabling interpretability analysis of security incidents, facilitating threat tracing and handling by security operations and maintenance personnel, and improving the efficiency of network security emergency response. Attached Figure Description

[0047] Figure 1 This is a flowchart from the present invention. Detailed Implementation

[0048] Example 1: The implementation environment of the present invention includes:

[0049] Hardware environment: Mainstream network security server, configured with Intel Xeon E5-2680 v4 processor, 32GB RAM, and 1TB SSD;

[0050] Software environment: The operating system is CentOS 7.6, the programming language is Python 3.8, the PyTorch deep learning framework is used, the causal inference uses the pcalg package of R language, and the log collection uses the Flume distributed log collection system;

[0051] Dataset: The dataset combines the publicly available network security dataset CIC-IDS-2017 with real internal network business logs, including a total of 500,000 normal traffic logs and various attack logs;

[0052] like Figure 1 As shown, the multimodal network security log correlation analysis method based on temporal causal attention includes the following specific implementation steps:

[0053] S1. Multi-source heterogeneous network security log collection and standardized preprocessing: Real-time collection of multimodal log data from firewalls, intrusion detection systems, servers, and terminals; cleaning, deduplication, and data anonymization; standardization of log format; extraction of core log fields; forming structured log data; specifically including:

[0054] The Flume log collection system collects multimodal network security log data generated by various devices in the network environment in real time, including firewall logs, intrusion detection system (IDS) logs, intrusion prevention system (IPS) logs, server operation logs, terminal process logs, and network traffic logs. The collected raw logs are cleaned, deduplicated, and anonymized to remove invalid garbled characters, duplicate entries, and private information. The log timestamp format and field encoding format are standardized, and the field encoding adopts UTF-8 format. The unstructured log text is transformed into structured log data, and the core fields of the logs are extracted.

[0055] The core fields of the log include entity information, behavioral events, timestamps, and traffic parameters. Entity information includes IP address, process ID, user account, file name, and port number; behavioral events include network connection, process creation, file modification, data transmission, and login / logout; and traffic parameters include data packet size, transmission rate, and access frequency.

[0056] S2. Construction of a Temporal Cause-and-Effect Graph for Multimodal Logs: Structured log data is transformed into entity-event-timestamp triples to construct an initial log topology graph. The PC causal inference algorithm is used to calculate the causal strength between nodes, and a temporal cause-and-effect graph with temporal attributes and causal weights is constructed. Specifically, this includes:

[0057] The preprocessed structured log data is transformed into entity-event-timestamp triples. The log entities are used as graph nodes, the behavioral events between entities are used as graph edges, and the event timestamps are used as time-series attributes to construct an initial log topology graph.

[0058] Apply temporal causal order constraints to the initial log topology graph, only for those that satisfy the temporal order. < entity pairs Perform PC conditional independence tests to construct a directed causal subgraph with temporal sequence, transforming traditional undirected associations into directional causal relationships within the attack chain, thus reducing false positives at the source. Calculate the causal strength between events at each node in the initial log topology graph. ,in , These represent two related entity nodes in the initial log topology graph, with causal strength... The value ranges from [0,1]. A larger value indicates a higher causal correlation between the attack behaviors of the two entity nodes. The causal strength threshold is set to 0.7, and invalid correlation edges below the causal strength threshold are removed. For entity nodes The timestamp of the corresponding log occurrence. Adjacent entity nodes The timestamp of the corresponding log occurrence.

[0059] The causal skeleton and conditional independence test statistics output by the PC causal inference algorithm are transformed into continuous causal strength values, normalized and mapped to the [0,1] interval as dynamic weights of graph edges, and weak causal association edges are removed according to the preset causal strength threshold to form a lightweight, highly reliable temporal causal graph with time-series attributes and causal weights, realizing the fusion modeling of log entity topological relationships and causal relationships.

[0060] For the heterogeneous characteristics of multimodal logs, the PC conditional independence test method is as follows: kernel density estimation is used for continuous features such as traffic, and mutual information measurement is used for discrete / text features such as behavioral events. This achieves unified quantification of nonlinear causal strength between cross-type entities, and solves the limitation that traditional PC is only applicable to linear Gaussian data.

[0061] Furthermore, a temporal causal order constraint is imposed on the initial log topology graph, only for logs that satisfy the temporal order. < The entity pairs are subjected to conditional independence tests. For heterogeneous features such as log text semantics, traffic values, and behavior categories, a hybrid independence test (continuous feature kernel density estimation and discrete feature mutual information measurement) is adopted to overcome the limitation that traditional PC causal inference algorithms are only applicable to linear Gaussian data. The test statistics are then normalized by mapping the condition set depth to obtain the causal strength in the interval [0,1]. Based on the calculated causal strength, dynamic causal weights are assigned to the edges of the initial log topology graph, and invalid association edges with causal strength below a preset threshold of 0.7 are removed, forming a multimodal log time-series causal graph with temporal attributes and causal weights.

[0062] S3. Dynamic Calculation of Temporal Causal Attention Weights: An improved multi-head temporal causal attention module is designed, which combines causal strength, temporal decay factor, and semantic similarity to dynamically calculate temporal causal attention weights using a preset formula; specifically including:

[0063] For the temporal causal graph with temporal attributes and causal weights constructed in step S2, an improved multi-head temporal causal attention module is designed. This module makes five key improvements on the traditional multi-head attention mechanism:

[0064] The general feature multi-head is reconstructed into a time-series-causal-specific multi-head, which is divided into causal attention head, time-series attention head, semantic attention head and topological attention head. Four types of features are extracted respectively: causal strength, time-series decay, log semantics and graph topology, and adaptive gating fusion is adopted.

[0065] Causality strength obtained by the PC causality inference algorithm Embedded into the computational process as an attention prior, the model acquires the ability to perceive the causal chain of attacks.

[0066] Set up an independent time-series attention head, dynamically weight log events in different time windows based on the time-series decay factor, and enhance the attention to recent key events;

[0067] An adaptive gating fusion mechanism is adopted to replace the traditional splicing or average fusion, which automatically learns the weights of each attention head to adapt to diverse attack scenarios. The adaptive gating fusion uses a learnable weight vector to weight the output of each attention head, and the weights are generated by the fully connected layer and Softmax.

[0068] The attention calculation scope is strictly constrained to the effective edges of the temporal causal graph, and weakly correlated edges are eliminated to reduce computational overhead and improve detection accuracy.

[0069] The improved multi-head temporal causal attention module abandons the traditional static weight allocation mode of graph neural networks. Instead, it combines causal strength, temporal decay factor, and semantic similarity to dynamically calculate the attention weights between nodes, which are the temporal causal attention weights. The specific formula for calculating the temporal causal attention weights is as follows:

[0070] ; In the formula:

[0071] express Time-based entity nodes For entity nodes The temporal causal attention weight; λ is the causal weight coefficient, with a value range of [0.5, 1.5], used to adjust the influence of causal strength on the attention weight. In this embodiment, λ is taken as 1.0; For entity nodes and The strength of causality between them; For the current analysis time window, For entity nodes The timestamp of the corresponding log occurrence. Adjacent nodes The timestamp of the corresponding log occurrence; τ is a time decay constant, which is dynamically adjusted according to the log type. The value of τ is 10s for traffic logs and 30s for process logs. For entity nodes The set of all adjacent nodes.

[0072] The improved multi-head temporal causal attention module ultimately outputs two types of results: first, a temporal causal attention weight matrix, used to characterize the attack correlation strength between nodes; and second, a temporal causal enhanced node feature vector, used for subsequent anomaly scoring. The module possesses six core functions: precise attack chain focusing, dynamic weight adaptation, low false positive discrimination, unified alignment of multimodal logs, real-time high-performance computing, and interpretable tracing of security events.

[0073] S4. Multimodal Feature Fusion and Threat Correlation Calculation: Extract log semantic features and traffic statistics features, fuse them with temporal causal graph topological features, input them into a temporal causal attention-weighted temporal graph neural network to calculate node anomaly scores, and accumulate and judge abnormal behavior through a sliding time window; specifically including:

[0074] A pre-trained BERT model is used to extract log semantic features from the log text field, and a one-dimensional CNN convolutional neural network is used to extract log traffic statistical features from the log traffic parameters. The extracted log semantic features, traffic statistical features and topological features of the time-series causal graph are then fused with gated weights to form a multimodal fusion feature vector with a dimension of 256.

[0075] The multimodal fusion feature vector is input into a temporal graph neural network (Causal-T-GNN) with temporal causal attention weighting. The batch size is set to 128, the learning rate to 0.001, and the training epochs to 50. The model training is completed. The temporal causal attention weights are used as the dynamic adjacency weights of the graph convolution to perform causal perception aggregation on the node neighbor information, so that the anomaly score is more consistent with the real attack chain propagation law.

[0076] After T-GNN aggregation, a multimodal feature gating fusion layer is introduced to adaptively learn the weight coefficients of three types of features: semantic, traffic, and topology, and to perform weighted compression on the fused features. Then, the node output is mapped to the [0,1] interval through the Sigmoid activation function to obtain a standardized anomaly score, ensuring that the anomaly scores of different devices and different log types are comparable. The higher the score, the greater the probability that the behavior corresponding to the entity node is a security threat.

[0077] A sliding time window with a duration of 10 seconds is set up. A time-series cumulative anomaly scoring mechanism is constructed, which performs a time-series weighted sum of the anomaly scores of nodes in three consecutive time windows. The window weights are set to 0.5, 0.3, and 0.2, respectively, and the cumulative score is the weighted sum. The closer the window is to the current time, the higher its weight. The cumulative anomaly score is used as the final judgment criterion. If the cumulative score exceeds the preset anomaly threshold of 0.85, the node in the sliding time window is judged to have abnormal security behavior, triggering the correlation analysis mechanism. This avoids misjudgment caused by single-point spikes and improves the robustness of threat judgment in complex environments.

[0078] S5. Security Incident Correlation Analysis and Alarm Output: Based on time-series causal attention weights, the system traces the correlation paths of abnormal nodes, reconstructs the attack chain, generates analysis reports, and provides real-time alarms. Specifically, this includes:

[0079] For entity nodes that are judged to be abnormal and whose abnormal scores exceed the threshold, the associated nodes are traced back from high to low based on the temporal causal attention weight: starting from the abnormal node, the nodes are traversed forward along the edges whose attention weight is greater than the preset threshold, sorted by time sequence and causal strength, to restore the complete attack association path including malicious IP access → abnormal process creation → lateral movement within the intranet, thus realizing threat tracing.

[0080] Generate multi-dimensional security incident analysis reports, including information on abnormal entities, the timing of attack behaviors, the strength of causal relationships, and the risk level. Simultaneously, push the analysis results to the security management platform in real time, issue audible and visual alarms and text alerts, and mark the risk level as high-risk to remind operations and maintenance personnel to take timely action, thereby achieving real-time early warning and source tracing analysis of potential security incidents.

[0081] Implementation results:

[0082] Tests showed that the method in this embodiment achieved an accuracy rate of 94.3% in identifying complex network attacks, with a false positive rate of only 4.1%. The single time window analysis latency was 260ms, and it could stably process 120,000 log data per second. Compared with traditional rule matching methods and conventional graph neural network methods, it has significant advantages in accuracy, real-time performance, and ability to identify complex threats, fully meeting the practical application needs of real-time correlation analysis of network security logs.

[0083] The specific embodiments of the present invention have been described in detail above with reference to the accompanying drawings. However, the present invention is not limited to the above embodiments. Within the scope of knowledge possessed by those skilled in the art, various changes can be made without departing from the spirit of the present invention.

Claims

1. A multimodal network security log correlation analysis method based on temporal causal attention, characterized in that: The method includes the following: Collect and standardize multi-source heterogeneous network security logs, construct a multimodal log time-series causal graph, and calculate the causal strength between nodes using a PC causal inference algorithm; Design an improved multi-head temporal causal attention module, dynamically calculate temporal causal attention weights, and integrate log semantic features, traffic statistics features, and temporal causal graph topology features; The node anomaly score is calculated by using a temporal graph neural network with temporal causal attention weighting, and then security event correlation analysis and real-time alarms are performed based on the node anomaly score.

2. The multimodal network security log correlation analysis method based on temporal causal attention as described in claim 1, characterized in that: The method includes the following steps: S1. Multi-source heterogeneous network security log collection and standardized preprocessing: Real-time collection of multimodal log data from firewalls, intrusion detection systems, servers, and terminals; cleaning, deduplication, and desensitization processing; unified log format; extraction of core log fields; formation of structured log data. S2. Construction of Temporal Causal Graph for Multimodal Logs: Transform structured log data into entity-event-timestamp triples, construct an initial log topology graph, use the PC causal inference algorithm to calculate the causal strength between nodes, and construct a temporal causal graph with temporal attributes and causal weights. S3. Dynamic Calculation of Temporal Causal Attention Weights: An improved multi-head temporal causal attention module is designed, which combines causal strength, temporal decay factor, and semantic similarity to dynamically calculate temporal causal attention weights through a preset formula. S4. Multimodal feature fusion and threat association calculation: Extract log semantic features and traffic statistics features, fuse them with temporal causal graph topological features, input temporal causal attention-weighted temporal graph neural network to calculate node anomaly scores, and accumulate and judge abnormal behavior through sliding time windows; S5. Security Incident Correlation Analysis and Alarm Output: Based on time-series causal attention weights, trace the correlation path of abnormal nodes, restore the attack chain, generate analysis reports and provide real-time alarms.

3. The multimodal network security log correlation analysis method based on temporal causal attention as described in claim 2, characterized in that: In S1, the core log fields include entity information, behavioral events, timestamps, and traffic parameters. Entity information includes IP address, process ID, and user account. Behavioral events include network connection, process creation, and file modification.

4. The multimodal network security log correlation analysis method based on temporal causal attention as described in claim 2, characterized in that: S2 includes: Apply temporal causal order constraints to the initial log topology graph, only for those that satisfy the temporal order. < entity pairs Perform PC conditional independence tests, construct a directed causal subgraph with temporal sequence, and transform the traditional undirected association into a directional causal relationship in the attack chain. For entity nodes The timestamp of the corresponding log occurrence. Adjacent entity nodes The timestamp of the corresponding log occurrence; Calculate the causal strength between events of each node in the initial log topology graph. ,in , These represent two related entity nodes in the initial log topology graph, with causal strength... The value range is [0,1]; The causal skeleton and conditional independence test statistic output by the PC causal inference algorithm are transformed into continuous causal strength values, normalized and mapped to the [0,1] interval as dynamic weights of graph edges, and weak causal association edges are removed according to a preset causal strength threshold to form a temporal causal graph with temporal attributes and causal weights.

5. The multimodal network security log correlation analysis method based on temporal causal attention as described in claim 2, characterized in that: In S3, the improved multi-head temporal causal attention module includes a causal attention head, a temporal attention head, a semantic attention head, and a topological attention head, which are used to extract four types of features: causal strength, temporal decay, log semantics, and graph topology, respectively, and adopt adaptive gating fusion. Causality strength obtained by the PC causality inference algorithm The calculation process of embedding temporal causal attention weights as attention priors; Set up an independent time-series attention head, dynamically weight log events in different time windows based on the time-series decay factor, and enhance the attention to key events; An adaptive gating fusion mechanism is used to automatically learn the weights of each attention head; Adaptive gating fusion uses learnable weight vectors to weight the outputs of each attention head, with the weights generated by the fully connected layer and Softmax. The scope of attention calculation is constrained to the effective edges of the temporal causal graph.

6. The multimodal network security log correlation analysis method based on temporal causal attention as described in claim 2, characterized in that: In S3, the formula for calculating the temporal causal attention weight is: ； in: express Time-based entity nodes For entity nodes Temporal causal attention weights; λ is the causal weight coefficient, with a value range of [0.5, 1.5], which is used to adjust the degree of influence of causal strength on attention weight; For entity nodes and The strength of causality between them; For the current analysis time window, For entity nodes The timestamp of the corresponding log occurrence. Adjacent nodes The timestamp of the corresponding log occurrence; τ is the time decay constant, which is dynamically adjusted according to the log type; For entity nodes The set of all adjacent nodes.

7. The multimodal network security log correlation analysis method based on temporal causal attention as described in claim 2, characterized in that: In S4, a pre-trained BERT model is used to extract log semantic features, and a one-dimensional CNN convolutional neural network is used to extract traffic statistical features. The extracted log semantic features, traffic statistics features, and topological features of the time-series causal graph are gated and weighted and fused to form a multimodal fusion feature vector; The multimodal fusion feature vector is input into the temporal graph neural network with temporal causal attention weighting. The temporal causal attention weights are used as the dynamic adjacency weights of graph convolution to perform causal perception aggregation of node neighbor information. After aggregation, a multimodal feature gating fusion layer is introduced to adaptively learn the weight coefficients of three types of features: log semantic features, traffic statistics features, and temporal causal graph topology features. The multimodal fusion feature vector is then weighted and compressed. The node output is then mapped to the [0,1] interval through the Sigmoid activation function to obtain the standardized node anomaly score. Set up a sliding time window and construct a sliding window time-series cumulative anomaly scoring mechanism to perform time-series weighted accumulation of node anomaly scores within the sliding time window; The cumulative node anomaly score is used as the final judgment criterion. If the cumulative score exceeds the preset anomaly threshold, it is determined that the node in the sliding time window has abnormal security behavior, triggering the correlation analysis mechanism.

8. A multimodal network security log correlation analysis system based on temporal causal attention, characterized in that, The system includes a module for performing the multimodal network security log correlation analysis method based on temporal causal attention as described in any one of claims 1 to 7.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the multimodal network security log correlation analysis method based on temporal causal attention as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the multimodal network security log correlation analysis method based on temporal causal attention as described in any one of claims 1 to 7.

Images