A network security protection method and system based on multi-dimensional threat perception

Abstract

The application relates to a network security protection method and system based on multi-dimensional threat perception, relates to the technical field of data analysis, and comprises the following steps: collecting first text data and first image data; acquiring a first image category; acquiring standard text data and scene text data according to the first text data, and determining a second image category; generating second image data according to the matching relationship between the first image category and the second image category; constructing first and second page semantic topology graphs based on the semantics, geometry and interactive attributes of page components; determining node semantic differences, topology differences and sensitive interactive path differences through cross-graph node alignment to generate a difference evidence subgraph; determining a scene dynamic threshold according to the same scene security sample, fusing various differences to obtain a structure consistency degree; generating prompt information according to the structure consistency degree and the dynamic threshold, and executing a protection strategy in combination with the difference evidence subgraph. The application can identify local camouflage and provide locatable abnormal evidence.

Description

Technical Field

[0001] This invention relates to the field of data analysis technology, and in particular to a network security protection method and system based on multi-dimensional threat perception. Background Technology

[0002] With the rapid development of information technology, threats in cyberspace are constantly evolving and escalating. Traditional network security measures mainly rely on signature-based detection methods, such as antivirus software and intrusion detection systems. These methods perform well in identifying known threats, but their defense capabilities against unknown threats or advanced persistent threats (APTs) are limited. Furthermore, with the diversification of data formats on the internet, especially the explosive growth of image and text information, relying solely on manual analysis to discover potential security threats is becoming increasingly impractical.

[0003] Currently, although considerable research has focused on applying machine learning, particularly deep learning, to cybersecurity, such as using convolutional neural networks for image classification and natural language processing for text analysis, research on effectively combining these two technologies to address complex cybersecurity issues is relatively limited. Furthermore, the question of how to fuse text and image information to improve threat perception and prediction accuracy remains in the exploratory stage. Existing image-text fusion schemes typically only calculate pixel similarity or global semantic similarity for the entire page image and use fixed thresholds for judgment. This makes it difficult to identify attackers' substitutions and rearrangements of sensitive input components, navigation relationships, or local page structures, and also fails to provide identifiable evidence of anomalies. Summary of the Invention

[0004] This invention addresses the technical problems existing in the prior art by providing a network security protection method and system based on multi-dimensional threat perception.

[0005] The technical solution of the present invention to solve the above-mentioned technical problems is as follows: This invention provides a network security protection method based on multi-dimensional threat perception, the method comprising: Collect multidimensional network data; the multidimensional network data includes first text data and first image data; Based on the first image data, obtain the first image category; Based on the first text data, obtain standard text data and scene text data; Based on the standard text data and the scene text data, a second image category is determined; Determine whether the first image category and the second image category match. If they match, generate the second image data based on the standard text data, the scene text data, and the second image category. Page component detection is performed on the first image data and the second image data respectively to obtain a first page component set and a second page component set. Based on the semantic attributes, geometric attributes and interaction attributes of each page component, a first page semantic topology map and a second page semantic topology map are constructed. Cross-graph node alignment is performed on the semantic topology graph of the first page and the semantic topology graph of the second page. Based on the node alignment results, the semantic differences, topological relationship differences and sensitive interaction path differences of nodes are determined, and a difference evidence subgraph composed of the difference nodes and their associated edges is generated. The scene category is determined based on the scene text data, the structural consistency distribution of the confirmed safe samples corresponding to the scene category is obtained, and the scene dynamic threshold is determined based on the structural consistency distribution. By integrating the node semantic differences, the topological relationship differences, and the sensitive interaction path differences, the structural consistency between the first image data and the second image data is obtained; Determine whether the structural consistency is not less than the scene dynamic threshold. If so, generate a first network security warning message; otherwise, generate a second network security warning message. Based on the first network security alert or the second network security alert and the difference evidence subgraph, a security protection strategy is executed.

[0006] Furthermore, determining whether the first image category and the second image category match also includes: if they do not match, generating a third network security alert message.

[0007] Optionally, obtaining standard text data and scene text data based on the first text data includes: Semantic analysis is performed on the first text data to extract a subset of factual descriptions and a subset of contextual descriptions; The factual description subset is matched with a pre-built cybersecurity ontology library to generate standard text data; Extract the explicit and implicit context from the contextual description subset; The explicit and implicit contexts are enhanced and completed to form an enhanced set of contextual elements; The enhanced contextual element set is input into a pre-trained scene recognition model, which outputs scene text data.

[0008] Optionally, the scene recognition model is a sequence-to-sequence pre-trained model based on the Transformer architecture.

[0009] Optionally, determining the second image category based on the standard text data and the scene text data includes: The standard text data and the scene text data are semantically fused to generate a joint semantic representation; Based on the joint semantic representation, query the pre-built graph-text mapping knowledge base; Based on the query results, the typical page visual category with the highest confidence level was selected as the second image category.

[0010] Optionally, determining whether the first image category and the second image category match includes: The first image category is represented as a first image vector, and the second image category is represented as a second image vector; The similarity between the first image vector and the second image vector is calculated using cosine similarity, and this is used as the matching result.

[0011] Optionally, generating the second image data based on the standard text data, the scene text data, and the second image category includes: The standard text data, the scene text data, and the second image category are aligned using multimodal semantics to construct a structured image generation prompt; The structured image generation prompts are input into the conditional generation model; The model generates a synthetic image that conforms to the prompts, which is then used as the second image data.

[0012] Optionally, the steps of constructing the first page semantic topology graph and the second page semantic topology graph, performing the cross-graph node alignment, and obtaining the structural consistency include: Text blocks, input boxes, buttons, logo images, and content images are identified as page components. The component type, text semantics, normalized position, and sensitive attributes of the page components are identified as node attributes. Topological edges are established based on the inclusion, adjacency, and triggering relationships between page components. Candidate node pairs are selected based on component type compatibility and geometric neighborhood. The node alignment cost is determined based on text semantic distance, image feature distance, geometric displacement and neighborhood structure difference. The node alignment relationship is determined with the goal of minimizing the total alignment cost. The difference evidence subgraph is generated based on the node alignment relationship, and the semantic consistency of nodes, the topological consistency, and the completeness of sensitive interaction paths are determined respectively. The semantic consistency of the nodes, the topological relationship consistency, and the completeness of the sensitive interaction paths are weighted and fused according to the scenario risk coefficient to obtain the structural consistency. The lower quantile value corresponding to the target false alarm rate in the structural consistency distribution of confirmed safe samples in the same scenario is selected as the scenario dynamic threshold.

[0013] This invention also provides a network security protection system based on multi-dimensional threat perception, the system comprising: The data acquisition module is used to acquire multidimensional network data; the multidimensional network data includes first text data and first image data; An image analysis module is used to obtain a first image category based on the first image data; The text analysis module is used to obtain standard text data and scene text data based on the first text data; and to determine a second image category based on the standard text data and the scene text data. The judgment module is further configured to construct a first page semantic topology graph and a second page semantic topology graph, perform cross-graph node alignment, determine node semantic differences, topological relationship differences, and sensitive interaction path differences, and generate a difference evidence subgraph; determine a scene dynamic threshold based on the structural consistency distribution of security samples in the same scene, and fuse various differences to obtain structural consistency; determine whether the structural consistency is not less than the scene dynamic threshold, and if so, generate a first network security prompt message; otherwise, generate a second network security prompt message.

[0014] The security protection module is used to execute security protection strategies based on the first network security prompt information or the second network security prompt information and the difference evidence subgraph.

[0015] Furthermore, determining whether the first image category and the second image category match also includes: if they do not match, generating a third network security alert message.

[0016] Furthermore, to achieve the above objectives, the present invention also proposes an electronic device, comprising: a memory for storing computer software programs; and a processor for reading and executing the computer software programs, thereby realizing the network security protection method based on multi-dimensional threat perception as described above.

[0017] Furthermore, to achieve the above objectives, the present invention also proposes a non-transitory computer-readable storage medium storing a computer software program, which, when executed by a processor, implements the network security protection method based on multi-dimensional threat perception as described above.

[0018] The beneficial effects of this invention are: (1) This invention collects multi-dimensional network data; the multi-dimensional network data includes first text data and first image data; based on the first image data, a first image category is obtained; based on the first text data, standard text data and scene text data are obtained; based on the standard text data and the scene text data, a second image category is determined; it is determined whether the first image category and the second image category match, and if they match, a second image data is generated based on the standard text data, the scene text data, and the second image category; a first page semantic topology graph and a second page semantic topology graph are constructed, and node semantic differences, topological relationship differences, and sensitive interaction path differences are determined by cross-graph node alignment, generating a difference evidence subgraph; a scene dynamic threshold is determined based on the structural consistency distribution of security samples in the same scene, and a network security prompt message is generated based on the comparison result of structural consistency and the scene dynamic threshold, and a security protection strategy is executed in conjunction with the difference evidence subgraph. This improves the accuracy of threat perception and enhances the synergy and real-time performance of the overall defense system.

[0019] (2) This invention extracts factual descriptions and contextual descriptions separately, and combines them with a network security ontology library and a multi-source context enhancement mechanism to generate standard text data and scenario text data respectively. This significantly improves the ability to identify advanced camouflage threats.

[0020] (3) Potential security threats, such as phishing attacks, can be detected by comparing the actual first image data with the “expected” second image data generated based on the relevant text data. If there is a significant difference between the two, it may mean that the user is visiting a fake website.

[0021] (4) This invention no longer relies solely on the global similarity of the entire graph, but performs bi-graph difference through page component nodes and their inclusion, adjacency and triggering relationships, which can identify local spoofing such as sensitive input box replacement, component rearrangement and abnormal jump path; at the same time, the scene dynamic threshold reduces false alarms caused by different page types and display conditions, and the difference evidence subgraph can provide a locationable decision basis for blocking, enhanced authentication and traffic depth detection. Attached Figure Description

[0022] Figure 1 A scenario diagram illustrating a network security protection method based on multi-dimensional threat perception provided by this invention; Figure 2 A flowchart illustrating a network security protection method based on multi-dimensional threat perception provided by this invention; Figure 3 A schematic diagram of the structure of a network security protection system based on multi-dimensional threat perception provided by the present invention; Figure 4A schematic diagram of the hardware structure of a possible electronic device provided by the present invention; Figure 5 This is a schematic diagram of the hardware structure of a possible computer-readable storage medium provided by the present invention. Detailed Implementation

[0023] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] In the description of this invention, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of indicated technical features. Thus, a feature defined as "first" or "second" may explicitly or implicitly include one or more of the stated features. In the description of this invention, "a plurality of" means two or more, unless otherwise explicitly specified.

[0025] In the description of this invention, the term "for example" is used to mean "used as an example, illustration, or description." Any embodiment described as "for example" in this invention is not necessarily to be construed as being more preferred or advantageous than other embodiments. The following description is provided to enable any person skilled in the art to make and use the invention. Details are set forth in the following description for purposes of explanation. It should be understood that those skilled in the art will recognize that the invention can be made without using these specific details. In other instances, well-known structures and processes will not be described in detail to avoid obscuring the description of the invention with unnecessary detail. Therefore, the invention is not intended to be limited to the embodiments shown, but is consistent with the broadest scope of the principles and features disclosed herein.

[0026] Please see Figure 1 , Figure 1 This provides a scenario diagram for the network security protection method based on multi-dimensional threat perception, as described in this invention. Figure 1 As shown, the terminal and server are connected via a network, such as a wired or wireless network. The terminal can include, but is not limited to, portable devices such as smartwatches, mobile phones, and tablets with network platform applications installed, as well as fixed terminals such as computers, kiosks, and advertising machines. The server provides users with various business services, including service push servers and user recommendation servers.

[0027] It should be noted that, Figure 1The scenario diagram of the network security protection method based on multi-dimensional threat perception shown is merely an example. The terminals, servers, and application scenarios described in the embodiments of the present invention are for the purpose of more clearly illustrating the technical solutions of the embodiments of the present invention, and do not constitute a limitation on the technical solutions provided by the embodiments of the present invention. As those skilled in the art will know, with the evolution of the system and the emergence of new business scenarios, the technical solutions provided by the embodiments of the present invention are also applicable to similar technical problems.

[0028] The terminal has an application installed that can be used to perform the following steps: Collect multidimensional network data; the multidimensional network data includes first text data and first image data; Based on the first image data, obtain the first image category; Based on the first text data, obtain standard text data and scene text data; Based on the standard text data and the scene text data, a second image category is determined; Determine whether the first image category and the second image category match. If they match, generate the second image data based on the standard text data, the scene text data, and the second image category. Page component detection is performed on the first image data and the second image data respectively to obtain a first page component set and a second page component set. Based on the semantic attributes, geometric attributes and interaction attributes of each page component, a first page semantic topology map and a second page semantic topology map are constructed. Cross-graph node alignment is performed on the semantic topology graph of the first page and the semantic topology graph of the second page. Based on the node alignment results, the semantic differences, topological relationship differences and sensitive interaction path differences of nodes are determined, and a difference evidence subgraph composed of the difference nodes and their associated edges is generated. The scene category is determined based on the scene text data, the structural consistency distribution of the confirmed safe samples corresponding to the scene category is obtained, and the scene dynamic threshold is determined based on the structural consistency distribution. By integrating the node semantic differences, the topological relationship differences, and the sensitive interaction path differences, the structural consistency between the first image data and the second image data is obtained; Determine whether the structural consistency is not less than the scene dynamic threshold. If so, generate a first network security warning message; otherwise, generate a second network security warning message. Based on the first network security alert or the second network security alert and the difference evidence subgraph, a security protection strategy is executed.

[0029] Please see Figure 2The present invention provides a flowchart of a network security protection method based on multi-dimensional threat perception. like Figure 2 As shown in the embodiment of the present invention, a network security protection method based on multi-dimensional threat perception is proposed. The method includes: S201. Collect multidimensional network data; the multidimensional network data includes first text data and first image data.

[0030] This can be achieved by using web crawlers or API interfaces to collect first text data and first image data from a page on websites including but not limited to social media, news websites, and forums.

[0031] S202. Obtain the first image category based on the first image data.

[0032] In this process, a deep learning model (such as a convolutional neural network CNN) can be used to classify the first image data. This model is pre-trained on a large-scale labeled image dataset and is able to identify multiple image categories.

[0033] S203. Based on the first text data, obtain standard text data and scene text data.

[0034] In one implementation, S203 specifically includes the following steps: Semantic analysis is performed on the first text data to extract a subset of factual descriptions and a subset of contextual descriptions.

[0035] The factual description subset consists of operations or technical objects explicitly recorded on the webpage, including: form submission behaviors and field definitions (such as "The page submits bank card information to / api / submit_card"), etc. The contextual description subset consists of interface text used to construct the interactive context on the webpage, including: page title and navigation path text (such as the slogan "Dear VIP user, you have an exclusive benefit to claim"), time / status dynamic text (such as "You are the 888th lucky user today!"), etc.

[0036] The factual description subset is matched with a pre-built cybersecurity ontology library to generate standard text data.

[0037] For example, extracting the factual description subset "form submitted to 00000000 / api / submit_card" into a structured triple: { action: "submit", object: " / api / submit_card", fields: ["ID card", "phone number"]}, and matching the network security ontology: "The page collects [FIELDS] through [OBJECT], which constitutes a sensitive information acquisition behavior.", then the output will be the standard text data: "The page collects ID card and phone number through / submit_card, which constitutes a sensitive information acquisition behavior." Extract the explicit and implicit contexts from the contextual description subset.

[0038] Explicit context refers to environmental information explicitly stated in natural language on a webpage, which can be directly extracted through rules or keyword matching. Examples include: time-related information such as "Event ends December 31, 2025"; and source-related information such as "Official year-end bonus distribution channel." Implicit context refers to environmental information that is not explicitly stated but can be inferred from the webpage's structure, layout, or interactive elements. For example, a form containing "bank card number" or "CVV" fields implicitly indicates a "payment / financial scenario."

[0039] The explicit and implicit contexts are enhanced and completed to form an enhanced contextual element set.

[0040] Optionally, the enhancements include domain reputation enhancement, TLS / certificate enhancement, and IP geolocation enhancement. For example, it checks whether the webpage domain is in a known phishing site database; if it is, it corrects "official" to "fake official"; it checks whether the page uses a valid SSL certificate; if invalid, it adds a "no valid encryption" label; it resolves the country / region to which the server IP belongs, and if it is a high-risk area, it adds "server located in a high-risk area overseas".

[0041] The enhanced contextual element set is input into a pre-trained scene recognition model, which outputs scene text data.

[0042] The scene recognition model is a sequence-to-sequence pre-trained model based on the Transformer architecture. The architecture of this model is existing technology in this field and will not be described in detail here.

[0043] S204. Based on the standard text data and the scene text data, determine the second image category.

[0044] Specifically, the standard text data and the scene text data are semantically fused to generate a joint semantic representation; based on the joint semantic representation, a pre-built image-text mapping knowledge base is queried; according to the query results, the typical page visual category with the highest confidence is selected as the second image category.

[0045] Optionally, the image-text mapping knowledge base is constructed in the following way: a large number of labeled benign and malicious web page samples are collected, each sample contains standard text, scene text and corresponding page image; cluster analysis is performed on the samples to extract co-occurrence patterns and establish a mapping rule of "(standard text, scene text) -- typical page visual category".

[0046] S205. Determine whether the first image category and the second image category match. If they match, generate second image data based on the standard text data, the scene text data, and the second image category. If they do not match, generate third network security alert information.

[0047] Optionally, the first image category is represented as a first image vector, and the second image category is represented as a second image vector; the similarity between the first image vector and the second image vector is calculated using cosine similarity, and this is used as the matching result.

[0048] Furthermore, the standard text data, the scene text data, and the second image category are aligned using multimodal semantics to construct a structured image generation prompt; the structured image generation prompt is input into a conditional generation model; and the conditional generation model outputs a synthesized image that conforms to the prompt, which serves as the second image data.

[0049] The structured image generation prompts include the target page type (determined by the second image category), the set of required UI components (mapped from the behavioral entities in the standard text data), and contextual style constraints (extracted from the scene text data). Furthermore, the conditional generation model is a page layout generator based on a diffusion mechanism or a generative adversarial network (GAN) architecture, and is fine-tuned based on a large number of benign webpage screenshots and their corresponding structured annotations.

[0050] S206. Construct a page semantic topology dual graph based on the first image data and the second image data, perform cross-graph differential analysis, and generate a difference evidence subgraph, structural consistency degree, and scene dynamic threshold.

[0051] In one implementation, S206 specifically includes the following steps: The first image data and the second image data are subjected to layout analysis, optical character recognition and component detection respectively. Text blocks, input boxes, buttons, logo images and content images are identified as page components to obtain the first page component set and the second page component set.

[0052] For each page component, the component type, text semantic vector, image feature vector, normalized position, size, operable state, and sensitive attributes are recorded as node attributes. Topological edges are established based on the visual inclusion, spatial adjacency, and click or submit trigger relationships between components, forming the first page semantic topology graph and the second page semantic topology graph respectively.

[0053] First, candidate node pairs are selected from the semantic topology graphs of the two pages based on component type compatibility and geometric neighborhood constraints, in order to exclude node combinations with type conflicts or obvious spatial hierarchy inconsistencies.

[0054] For each candidate node pair, the node alignment cost is determined by combining its textual semantic distance, image feature distance, normalized geometric displacement, and neighborhood structural difference. Bipartite graph matching is performed with the goal of minimizing the total alignment cost of all candidate node pairs to obtain cross-graph node alignment relationships.

[0055] Unaligned nodes, nodes with attribute differences exceeding the attribute difference threshold, abnormal topological edges that exist only in the semantic topology graph of one side of the page, and abnormal interaction paths that point from sensitive input nodes such as bank card numbers, passwords, or verification codes to untrusted external address nodes are recorded as difference nodes and difference edges, forming a difference evidence subgraph.

[0056] Based on the attribute differences of aligned nodes, the edge preservation between aligned nodes, and whether the sensitive interaction path is complete and reliable, the semantic consistency of nodes, the topological consistency, and the completeness of the sensitive interaction path are determined respectively.

[0057] Based on the sensitive information acquisition behavior in the standard text data, the business scenario in the scenario text data, and the domain reputation, certificate status, and external redirection information, the scenario risk coefficient is determined; the higher the risk, the higher the weight assigned to the integrity of the sensitive interaction path. Subsequently, the three consistency factors are weighted and fused to obtain the structural consistency.

[0058] Security samples matching the current scenario category, terminal type, and page resolution are selected from the confirmed security sample library. The structural consistency of each security sample is statistically analyzed to form a structural consistency distribution within the same scenario. The lower quantile value corresponding to the target false alarm rate is selected as the dynamic threshold of the scenario.

[0059] When the number of matched safe samples is less than the sample number threshold, the nearest neighboring scene is selected based on the scene text vector, the lower quantile value of the neighboring scene is adopted, and the lower quantile value is corrected based on the difference between the current scene risk coefficient and the neighboring scene risk coefficient.

[0060] Compare the structural consistency with the scene dynamic threshold: when the structural consistency is not less than the scene dynamic threshold, generate a first network security alert; when the structural consistency is less than the scene dynamic threshold, generate a second network security alert, and associate and store the difference evidence subgraph with the second network security alert.

[0061] S207. Based on the first network security warning information or the second network security warning information, execute the security protection strategy.

[0062] The first network security alert indicates that after cross-validation of the page's semantic topology dual graph, the node attributes, topological relationships, and sensitive interaction paths meet the security baseline of the corresponding scenario, and are judged as low-risk or safe. The second network security alert indicates that node replacement, component relationship rearrangement, or abnormal sensitive interaction paths are detected, and the structural consistency is lower than the scenario's dynamic threshold, and are judged as high-risk or suspicious.

[0063] Based on the above judgment, and combined with the sensitive attributes of the difference nodes in the difference evidence subgraph, the type of the abnormal topology edge, and the target address of the abnormal interaction path, the following security protection strategy is executed: If a first network security prompt message is generated: allow the user to access the target website or resource normally; record the interaction log in the background and mark it as "verified safe"; optionally, add the image and text sample to the trusted sample library for subsequent model training or whitelist comparison; do not trigger alarms, and do not impose restrictions on network traffic or user behavior. If a second network security alert is generated: the system will execute a graded response strategy based on the risk level, including but not limited to one or more of the following combinations: (a) Block access: immediately interrupt the user's connection with the target website, return to the security interception page, and prompt "Inconsistent image and text content detected, which may pose a risk of phishing or spoofing"; (b) Enhanced authentication: if in the enterprise intranet or sensitive business scenario, force the user to complete two-factor authentication (such as SMS verification code, biometric identification) before continuing to operate; (c) Traffic mirroring and deep detection: copy the relevant network traffic to the security analysis engine for sandbox execution, JavaScript behavior analysis, or DNS source tracing; (d) Report to the threat intelligence platform: package the first image data, the first text data, and the evidence of mismatch and automatically upload them to the internal SIEM system or the external threat intelligence sharing platform.

[0064] This improves the accuracy of threat perception and enhances the synergy and real-time performance of the overall defense system.

[0065] Please see Figure 3 , Figure 3 This is a schematic diagram of the structure of a network security protection system based on multi-dimensional threat perception provided by the present invention.

[0066] like Figure 3 As shown in the embodiment of the present invention, a network security protection system based on multi-dimensional threat perception is proposed. The system includes: The data acquisition module 301 is used to acquire multidimensional network data; the multidimensional network data includes first text data and first image data.

[0067] The image analysis module 302 is used to obtain a first image category based on the first image data.

[0068] The text analysis module 303 is used to obtain standard text data and scene text data based on the first text data; and to determine a second image category based on the standard text data and the scene text data.

[0069] The judgment module 304 is used to determine whether the first image category and the second image category match. If they match, the second image data is generated based on the standard text data, the scene text data, and the second image category. The judgment module 304 is further configured to construct page semantic topology graphs corresponding to the first image data and the second image data respectively, determine node semantic differences, topological relationship differences and sensitive interaction path differences through cross-graph node alignment, and generate difference evidence subgraphs; determine scene dynamic thresholds based on the structural consistency distribution of security samples in the same scene, and obtain structural consistency by fusing various differences; determine whether the structural consistency is not less than the scene dynamic threshold, and if so, generate a first network security prompt message; otherwise, generate a second network security prompt message.

[0070] The security protection module 305 is used to execute a security protection strategy based on the first network security prompt information or the second network security prompt information and the difference evidence subgraph.

[0071] Please see Figure 4 , Figure 4 This is a schematic diagram illustrating an embodiment of the electronic device provided in this invention. For example... Figure 4 As shown, an embodiment of the present invention provides an electronic device 400, including a memory 410, a processor 420, and a computer program 411 stored in the memory 410 and executable on the processor 420. When the processor 420 executes the computer program 411, it performs the following steps: An application is installed on the electronic device 400. The application is used to collect multidimensional network data. The multidimensional network data includes first text data and first image data. Based on the first image data, a first image category is obtained. Based on the first text data, standard text data and scene text data are obtained. Based on the standard text data and the scene text data, a second image category is determined. It is determined whether the first image category and the second image category match. If they match, second image data is generated based on the standard text data, the scene text data, and the second image category. The similarity between the first image data and the second image data is determined. If the similarity is greater than a preset threshold, a first network security warning message is generated. Otherwise, a second network security warning message is generated. Based on the first network security warning message or the second network security warning message, a security protection strategy is executed.

[0072] Please see Figure 5 , Figure 5 This is a schematic diagram illustrating an embodiment of a computer-readable storage medium provided by an embodiment of the present invention. For example... Figure 5 As shown, this embodiment provides a computer-readable storage medium 500 storing a computer program 411. When executed by a processor, the computer program 411 performs the following steps: the computer-readable storage medium 500 includes an application program for collecting multidimensional network data; the multidimensional network data includes first text data and first image data; based on the first image data, a first image category is obtained; based on the first text data, standard text data and scene text data are obtained; based on the standard text data and the scene text data, a second image category is determined; it is determined whether the first image category and the second image category match; if they match, second image data is generated based on the standard text data, the scene text data, and the second image category; the similarity between the first image data and the second image data is determined; if the similarity is greater than a preset threshold, a first network security warning message is generated; otherwise, a second network security warning message is generated; based on the first network security warning message or the second network security warning message, a security protection strategy is executed.

[0073] It should be noted that the descriptions of each embodiment in the above embodiments have different focuses. For parts that are not described in detail in a certain embodiment, please refer to the relevant descriptions in other embodiments.

[0074] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0075] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A system that specifies functions in one or more boxes.

[0076] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including an instruction set implemented in a process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0077] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0078] Although preferred embodiments of the invention have been described, those skilled in the art, upon learning the basic inventive concept, can make other changes and modifications to these embodiments. Therefore, the appended claims are intended to be interpreted as including both the preferred embodiments and all changes and modifications falling within the scope of the invention.

[0079] Obviously, those skilled in the art can make various modifications and variations to this invention without departing from its spirit and scope. Therefore, if these modifications and variations fall within the scope of the claims of this invention and their equivalents, this invention also intends to include these modifications and variations.

Claims

1. A network security protection method based on multi-dimensional threat perception, characterized in that, The method includes: Collect multidimensional network data; the multidimensional network data includes first text data and first image data; Based on the first image data, obtain the first image category; Based on the first text data, obtain standard text data and scene text data; Based on the standard text data and the scene text data, a second image category is determined; Determine whether the first image category and the second image category match. If they match, generate the second image data based on the standard text data, the scene text data, and the second image category. Page component detection is performed on the first image data and the second image data respectively to obtain a first page component set and a second page component set. Based on the semantic attributes, geometric attributes and interaction attributes of each page component, a first page semantic topology map and a second page semantic topology map are constructed. Cross-graph node alignment is performed on the semantic topology graph of the first page and the semantic topology graph of the second page. Based on the node alignment results, the semantic differences, topological relationship differences and sensitive interaction path differences of nodes are determined, and a difference evidence subgraph composed of the difference nodes and their associated edges is generated. The scene category is determined based on the scene text data, the structural consistency distribution of the confirmed safe samples corresponding to the scene category is obtained, and the scene dynamic threshold is determined based on the structural consistency distribution. By integrating the node semantic differences, the topological relationship differences, and the sensitive interaction path differences, the structural consistency between the first image data and the second image data is obtained; Determine whether the structural consistency is not less than the scene dynamic threshold. If so, generate a first network security warning message; otherwise, generate a second network security warning message. Based on the first network security alert or the second network security alert and the difference evidence subgraph, a security protection strategy is executed.

2. The network security protection method based on multi-dimensional threat perception according to claim 1, characterized in that, The step of determining whether the first image category and the second image category match also includes: if they do not match, generating a third network security alert message.

3. The network security protection method based on multi-dimensional threat perception according to claim 1, characterized in that, The step of obtaining standard text data and scene text data based on the first text data includes: Semantic analysis is performed on the first text data to extract a subset of factual descriptions and a subset of contextual descriptions; The factual description subset is matched with a pre-built cybersecurity ontology library to generate standard text data; Extract the explicit and implicit context from the contextual description subset; The explicit and implicit contexts are enhanced and completed to form an enhanced set of contextual elements; The enhanced contextual element set is input into a pre-trained scene recognition model, which outputs scene text data.

4. The network security protection method based on multi-dimensional threat perception according to claim 3, characterized in that, The scene recognition model is a sequence-to-sequence pre-trained model based on the Transformer architecture.

5. The network security protection method based on multi-dimensional threat perception according to claim 1, characterized in that, The process of determining the second image category based on the standard text data and the scene text data includes: The standard text data and the scene text data are semantically fused to generate a joint semantic representation; Based on the joint semantic representation, query the pre-built graph-text mapping knowledge base; Based on the query results, the typical page visual category with the highest confidence level was selected as the second image category.

6. The network security protection method based on multi-dimensional threat perception according to claim 1, characterized in that, The step of determining whether the first image category and the second image category match includes: The first image category is represented as a first image vector, and the second image category is represented as a second image vector; The similarity between the first image vector and the second image vector is calculated using cosine similarity, and this is used as the matching result.

7. The network security protection method based on multi-dimensional threat perception according to claim 1, characterized in that, The process of generating second image data based on the standard text data, the scene text data, and the second image category includes: The standard text data, the scene text data, and the second image category are aligned using multimodal semantics to construct a structured image generation prompt; The structured image generation prompts are input into the conditional generation model; The model generates a synthetic image that conforms to the prompts, which is then used as the second image data.

8. The network security protection method based on multi-dimensional threat perception according to claim 1, characterized in that, The steps of constructing the first page semantic topology graph and the second page semantic topology graph, aligning the first page semantic topology graph and the second page semantic topology graph across graph nodes, and obtaining the structural consistency include: Text blocks, input boxes, buttons, logo images, and content images are identified as page components. The component type, text semantics, normalized position, and sensitive attributes of the page components are identified as node attributes. Topological edges are established based on the inclusion, adjacency, and triggering relationships between page components. Candidate node pairs are selected based on component type compatibility and geometric neighborhood. The node alignment cost is determined based on the text semantic distance, image feature distance, geometric displacement and neighborhood structure difference between candidate node pairs. The node alignment relationship is determined with the goal of minimizing the total alignment cost. Unaligned nodes, nodes whose attribute differences exceed the attribute difference threshold, abnormal topological edges, and abnormal interaction paths from sensitive input nodes to external address nodes are recorded in the difference evidence subgraph. The semantic consistency of nodes, the topological relationship consistency, and the completeness of sensitive interaction paths are determined respectively. The structural consistency is obtained by weighted fusion based on the scenario risk coefficient determined by the standard text data and the scenario text data. The lower quantile value corresponding to the target false alarm rate in the structural consistency distribution of confirmed safe samples in the same scenario is selected as the scenario dynamic threshold. When the number of confirmed safe samples in the same scenario is less than the sample number threshold, the lower quantile value of the adjacent scenario is used and corrected according to the scenario risk coefficient.

9. A network security protection system based on multi-dimensional threat perception, characterized in that, The system includes: The data acquisition module is used to acquire multidimensional network data; the multidimensional network data includes first text data and first image data; An image analysis module is used to obtain a first image category based on the first image data; The text analysis module is used to obtain standard text data and scene text data based on the first text data; and to determine a second image category based on the standard text data and the scene text data. The judgment module is used to determine whether the first image category and the second image category match. If they match, the second image data is generated based on the standard text data, the scene text data, and the second image category. The judgment module is further configured to perform page component detection on the first image data and the second image data respectively, and construct a first page semantic topology graph and a second page semantic topology graph based on the semantic attributes, geometric attributes and interaction attributes of the page components; perform cross-graph node alignment on the first page semantic topology graph and the second page semantic topology graph, determine node semantic differences, topological relationship differences and sensitive interaction path differences and generate difference evidence subgraphs; determine the scene dynamic threshold according to the structural consistency distribution of the confirmed security samples corresponding to the scene text data, and obtain the structural consistency by fusing the node semantic differences, the topological relationship differences and the sensitive interaction path differences; determine whether the structural consistency is not less than the scene dynamic threshold, and if so, generate a first network security prompt message; otherwise, generate a second network security prompt message. The security protection module is used to execute security protection strategies based on the first network security prompt information or the second network security prompt information and the difference evidence subgraph.

10. The network security protection system based on multi-dimensional threat perception according to claim 9, characterized in that, The step of determining whether the first image category and the second image category match also includes: if they do not match, generating a third network security alert message.

Images