Authentication intelligent decision system based on knowledge graph

Abstract

The application is authentication intelligent decision system based on knowledge graph, relates to network security and intelligent decision technology field, and includes: multi-source data topology dynamics mapping module; authentication kinetic energy injection and damping distribution module; second-order dissipation system state solving module; transient energy density flow direction integral module; abnormal energy interception decision module.In the application, the structural dynamics theory and knowledge graph technology are organically integrated to construct a new network authentication behavior dynamic modeling framework.By mapping the authentication entity into a node with quality attributes, the interaction relationship between entities into a connection with stiffness attributes, and the node credibility and risk characteristics into damping coefficients, the physical abstraction and quantitative characterization of complex authentication behavior are realized.

Description

Technical Field

[0001] This invention relates to the fields of network security and intelligent decision-making technology, and in particular to an authentication intelligent decision-making system based on knowledge graphs. Background Technology

[0002] With the deep integration of next-generation information technologies such as cloud computing, the Internet of Things, and the Industrial Internet, network authentication systems, as the first line of defense for digital security, are experiencing a continuous increase in the scale and complexity of business operations. Authentication interactions between various entities are characterized by multi-source heterogeneity, high-frequency concurrency, and dynamic evolution. At the same time, advanced network attack methods such as identity impersonation, privilege escalation, and lateral movement are constantly evolving, placing higher demands on the accuracy and real-time performance of authentication anomaly detection, as well as the ability to perceive complex attack behaviors.

[0003] Currently, network authentication anomaly detection technology has developed into several mature technical approaches. Rule-based matching methods are simple to implement and respond quickly, effectively intercepting known typical attacks; statistical analysis-based methods establish a baseline of normal behavior and can identify abnormal activities deviating from the baseline; and knowledge graph-based detection methods, which have emerged in recent years, can better uncover hidden relationships between entities by structurally modeling network entities and their interactions, providing new technical support for the detection of complex attacks. In practical applications, these technologies complement each other, jointly constructing a multi-layered authentication security protection system.

[0004] Structural dynamics theory provides a mature theoretical framework for modeling and analyzing complex dynamic systems. By abstracting the system into a mass-spring-damped model, it can describe the transient response characteristics of the system under external excitation.

[0005] Combining structural dynamics with knowledge graph technology has opened up new research directions for dynamic modeling and anomaly detection of network authentication behavior. Some studies have explored the feasibility of combining the two, but the relevant technical solutions still need further improvement in terms of underlying hardware acceleration optimization, real-time processing capabilities of large-scale graph data, and hierarchical intelligent decision-making mechanisms. They are still difficult to fully meet the high-performance security protection requirements in large-scale distributed network environments. Summary of the Invention

[0006] The purpose of this invention is to propose an intelligent authentication decision-making system based on knowledge graphs in order to solve the above-mentioned problems.

[0007] To achieve the above objectives, the present invention adopts the following technical solution: A knowledge graph-based intelligent authentication decision-making system includes: The multi-source data topology dynamics mapping module is used to extract multi-source authentication data captured by the network interface card, map entities and interaction behaviors to nodes and relation edges of the knowledge graph, generate a main diagonal mass matrix based on node interaction frequency and attribute information entropy, and generate a stiffness matrix based on the historical cumulative interaction data volume and multi-dimensional distance corresponding to the relation edge. The authentication kinetic energy injection and damping allocation module is used to calculate the node credibility score by combining the node information of the knowledge graph to generate a global damping matrix, parse the real-time network authentication request, and transform it into a discrete external force queue applied to the preset source node and target node. The second-order dissipative system state solution module is used to receive the main diagonal mass matrix, stiffness matrix, global damping matrix and discrete external force queue, construct equations and perform time integral iterative calculations, and output the displacement and velocity time sequence states of the full spectrum nodes in each clock cycle. The transient energy density flow direction integration module is used to fuse the main diagonal mass matrix, stiffness matrix, and displacement and velocity time-series states to calculate the transient kinetic energy of nodes and the elastic potential energy of relational edges. It also performs topological subgraph partitioning of the knowledge graph and summarizes the local transient energy density and energy flow direction scalar of each topological subgraph. The abnormal energy interception decision module is used to establish a safe energy capacity benchmark for a local topological subgraph based on the main diagonal mass matrix and stiffness matrix. It compares the local transient energy density with the safe energy capacity benchmark to generate an energy overload ratio, solves the energy divergence of the target node by combining the energy flow direction scalar, and outputs corresponding instructions by comparing with preset critical parameters.

[0008] Preferably, generating the main diagonal mass matrix specifically includes: Using a floating-point arithmetic unit, a hash table algorithm for counting the frequency of attribute strings, and extracting the radix stored in the system security configuration register, the node is obtained by executing multiply-accumulate fusion instructions through the arithmetic logic unit. quality The calculation formula is: ; in, Represents a node The total number of valid authentication interactions within the preset time window; Represents a node The set of attributes; The entropy of multidimensional attribute information represents a set of attributes; Represents a node The base number of static permission levels; , , These are weighting adjustment coefficients, and their sum is always equal to a constant of one. After generating the quality calculation results, the processor uses a memory data structure that compresses sparse rows or stores only a one-dimensional diagonal array to load the quality scalar into main memory in order to avoid bandwidth congestion caused by large-scale matrices. node With nodes Stiffness coefficients between The calculation formula is: ; in, Represents a node With nodes The amount of historical cumulative interaction data between them; Represents the current timestamp and node and nodes The time difference between the timestamps of the last successful interaction; The time decay constant; Represents the norm of a multidimensional distance vector; This is the stiffness scaling factor; After generating stiffness coefficients, the data processing unit writes the calculated non-zero stiffness coefficient values ​​as undirected edge weights of the graph into the adjacency list memory structure. The diagonal elements are quickly aggregated by a hardware accumulator to sum the weights of all connected edges of the node.

[0009] Preferably, the multi-source data topology dynamics mapping module further includes underlying concurrent capture and lifecycle maintenance for multi-source authentication data: The raw data frames on the network interface card are captured using direct memory access technology and moved to a pre-allocated circular buffer for zero-copy capture. At the same time, the single instruction stream multiple data stream vector instruction set is called to synchronously clean the raw data frames and serialize them into a distributed key-value database. After the memory topology is established, a background garbage collection daemon process with a low-priority timer interrupt is started. It periodically scans the edge weight adjacency list in memory. When the comparator logic judgment circuit finds that the stiffness coefficient decays to below the preset hardware threshold register value over time, it triggers a lock-free concurrent memory unbinding operation to release the occupied memory pointer. Meanwhile, for newly added entities, space with a specific alignment format is pre-allocated in the memory pool to give them initial basic mass and basic stiffness to avoid transient changes.

[0010] Preferably, the process of generating the global damping matrix is ​​as follows: The system calculates a comprehensive trustworthiness score by combining external security threat intelligence sources, and then calculates a personalized damping coefficient for each node based on the comprehensive trustworthiness score. Personalized damping coefficient The calculation formula is: ; in, Represents the fundamental damping constant; For nodes The overall credibility score; This is a real-time risk index; and This is the proportionality coefficient; Personalized damping coefficients are bound and synchronized to the security control list buffer memory area of ​​the network firewall or application layer gateway as dynamic filtering weights. A reserved static memory pool is used to extract the diagonal mass matrix structure and the stiffness matrix structure in adjacency list form in parallel, which are then fed into the independent computation pipeline of the central processing unit. Through parallel vector addition instructions in the arithmetic logic unit, the personalized damping coefficients of each node are composited and superimposed to generate an equivalent damping memory image without changing the original sparse graph memory pointers. The global damping matrix... The combination formula is: ; in, and This represents the global Rayleigh damping coefficient; The main diagonal mass matrix; Here is the stiffness matrix; The diagonal matrix whose main diagonal elements are personalized damping coefficients.

[0011] Preferably, in the authentication kinetic energy injection and damping allocation module, the processing step of converting it into a discrete external force queue is as follows: When a real-time network authentication request arrives at the operating system's protocol stack, the continuous pulse discretization distributor microservice component extracts the corresponding source node, target node, and operation sensitivity, and activates the internal digital timer to cut the time window into time slices according to the preset Nyquist sampling clock frequency. The external force value is calculated based on the impulse function for each time slice. The impulse function is: ,in, For injecting source node external force function, To measure the sensitivity of operations, This is the gain factor for the excitation force amplitude. The central timestamp of the real-time network authentication request. For physical simulation time variables, This is the pulse width parameter; The external force values ​​and the timestamps of the corresponding time slices are concatenated into independent data frames and pushed into a first-in-first-out queue to form a discrete external force queue. For other nodes in the knowledge graph that do not participate in the calculation, a default null pointer mapping is used to avoid allocating invalid memory.

[0012] Preferably, in the second-order dissipative system state solution module, the specific data processing steps for performing time integral iterative calculations include: In the high-bandwidth memory of the graphics processing unit or the dedicated tensor processing unit, separate displacement registers, velocity registers and acceleration registers are allocated, and a block clearing instruction is issued to establish stable initial boundary conditions. The processor calls the basic linear algebra subroutine library to perform concurrent Koleski incomplete decomposition of the equivalent stiffness matrix, and stores the pointers of the resulting lower triangular matrix and upper triangular matrix in the resident area of ​​the secondary cache. In the iterative evolution loop, the processor uses multiple sets of parallel multiply-accumulates to extract the old state data stored in each register area and merge it with the discrete external force queue data to generate an equivalent excitation vector and store it in the intermediate buffer register. The scheduled calculation thread uses the forward substitution and backward replacement algorithm to find the new displacement state array, and the back substitution operation circuit derives the new velocity and new acceleration array. After the calculation task of one clock cycle is completed, the memory pointers of the front and back buffers are flipped and swapped at an atomic level.

[0013] Preferably, in the transient energy density flow integration module, the processing steps for calculating the transient kinetic energy of the node and the elastic potential energy of the relational edge include: The processor's vector processing unit uses a single instruction stream multiple data stream architecture to load the velocity data of multiple adjacent nodes into a wide-byte register at once. The hardware squarer performs the squaring operation in parallel and then performs the corresponding element-wise multiplication operation with the data in the main diagonal mass matrix. The data is then written to the cache to generate transient kinetic energy discrete values. Before calculating the elastic potential energy of the relation edges, a hardware-level graph node reordering algorithm is executed to change the logical mapping address of the nodes in memory, so that the addresses of adjacent nodes in the topology are continuous in the physical memory space. The displacement data is moved from main memory to cache in advance through the processor prefetching mechanism to eliminate cache misses, and then the elastic potential energy value is calculated. Simultaneously, a dedicated hardware accumulator is configured to accumulate discrete micro-elements formed by multiplying the square of the node transient velocity and the damping coefficient in real time through the arithmetic logic unit when microsecond-level time-series data arrives, thus forming a cumulative dissipated energy data block.

[0014] Preferably, the step of dividing the knowledge graph into topological subgraphs and summarizing the local transient energy density and energy flow scalars of each topological subgraph specifically includes: The concurrent thread pool of the multi-core processor is invoked to execute the memory-isolated topology subgraph partitioning job, which divides the entire graph data into multiple memory partitions. The processor cores are exclusively allocated to the memory partitions. A tree-like parallel reduction logic circuit is used to sum up the transient kinetic energy of all nodes in the memory partitions and the elastic potential energy of the related edges, and divide by the topology volume to obtain the local transient energy density. Extract the displacement difference data of the endpoint nodes, multiply it by the stiffness coefficient value, and perform a fixed-point multiplication with the transient velocity value of the node. Based on the positive or negative sign of the sign bit output by the arithmetic logic unit, accumulate it into the directed edge attribute field to generate an energy flow scalar. The background verification service process performs a fast summation and comparison on the system's total kinetic energy data block, total potential energy data block, cumulative dissipated energy data block, and the total work done by the external excitation queue. If the difference exceeds the rounding error threshold allowed by floating-point arithmetic, a bit flip error is determined to have occurred and an interrupt exception is thrown.

[0015] Preferably, in the abnormal energy interception decision module, the process of obtaining the safe energy capacity benchmark and energy dissipation is as follows: The scheduling module of the main controller sends instructions to the digital signal processor to retrieve the node mass scalar and stiffness coefficients into the local static random access memory. Using the multiply-accumulate unit, it performs parallel calculations at pipeline throughput to generate a safe energy capacity benchmark and stores it in the memory slots of the safe energy capacity table. The calculation formula is: ; in, and The dimensional constants are for calibration, and both are greater than zero; For the neighborhood of the topological subgraph The node quality scalar within; The stiffness coefficient between connected nodes; This is the preset safe upper limit value for the rate of change of physical displacement; This represents the maximum relative tensile displacement difference borne by the related edges. The dual-channel memory accumulation job executes two sets of concurrent threads to obtain the energy dissipation. The formula is: ,in, Representative and target node The set of all directly adjacent nodes connected to each other; The scalar represents the direction of the incoming energy flow; The scalar represents the direction of the outflowing energy.

[0016] Preferably, the comparison of preset critical parameters and output of corresponding instructions specifically includes: When the allow routine is triggered, the processor sends a system call to the operating system's network protocol stack, which loads the authentication data packet that was originally blocked in kernel mode into the network card's send queue, allowing it to pass through the security gateway to the next layer of service nodes. When the interception routine is triggered, a control plane data frame is sent to the hardware firewall to update its access control list and discard the data packet originating from the source address. At the same time, the operating system issues a forced reset command to the socket to cut off the physical link. The memory manager locates the personalized damping memory address of the intercepted source node, uses a bitmask overwrite instruction to forcibly modify the personalized damping value to the maximum floating-point value supported by the computer system, forces the connected stiffness memory pointer to point to a null address to achieve memory isolation, and then calls the block erase extension instruction to perform a parallel zeroing operation on the velocity buffer and acceleration buffer to clear the displacement state data caused by the incident. When the state degradation routine is triggered, the execution engine injects a reverse proxy redirection instruction into the application layer gateway, causing the Hypertext Transfer Protocol request that was originally directed to the core data to be routed to the multi-factor authentication server array for re-verification.

[0017] In summary, due to the adoption of the above technical solution, the beneficial effects of the present invention are: 1. This invention organically integrates structural dynamics theory with knowledge graph technology to construct a novel dynamic modeling framework for network authentication behavior. By mapping authentication entities to nodes with quality attributes, inter-entity interaction relationships to connections with stiffness attributes, and node credibility and risk characteristics to damping coefficients, a physical abstraction and quantitative representation of complex authentication behavior is achieved.

[0018] 2. This invention identifies abnormal activities by monitoring the energy fluctuation characteristics of the system under the stimulation of authentication requests. At the same time, based on the local energy density and flow direction analysis of the topological subgraph, it can effectively locate the occurrence area and propagation path of abnormal behavior, which helps to improve the accuracy of authentication anomaly detection and reduce the occurrence of false alarms. Attached Figure Description

[0019] Further details, features, and advantages of this application are disclosed in the following description of exemplary embodiments in conjunction with the accompanying drawings, in which: Figure 1 This is a system structure diagram of the present invention. Detailed Implementation

[0020] Several embodiments of this application will now be described in more detail with reference to the accompanying drawings to enable those skilled in the art to implement this application. This application may be embodied in many different forms and for various purposes and should not be limited to the embodiments set forth herein. These embodiments are provided to make this application thorough and complete, and to fully convey the scope of this application to those skilled in the art. The embodiments described do not limit this application.

[0021] Unless otherwise defined, all terms used herein (including technical and scientific terms) shall have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains. It will be further understood that terms such as those defined in commonly used dictionaries shall be interpreted as having a meaning consistent with their meaning in the relevant field and / or the context of this specification, and shall not be interpreted in an idealized or overly formal sense unless expressly defined herein.

[0022] Example 1 Its specific implementation method is combined with the appendix Figure 1 Please provide a detailed explanation.

[0023] Appendix Figure 1 The block diagram of the authentication intelligent decision-making system based on knowledge graph provided in the embodiments of the present invention shows the connection relationship between the multi-source data topology dynamics mapping module and the abnormal energy interception decision module, and marks the main functional interaction flow of each module.

[0024] In this embodiment, it includes: Module 1, Multi-Source Data Topology Dynamics Mapping Module: This module is used to extract multi-source authentication data captured by the network interface card, map entities and interaction behaviors to nodes and relation edges in the knowledge graph, generate a main diagonal mass matrix based on node interaction frequency and attribute information entropy, and generate a stiffness matrix based on the historical cumulative interaction data volume and multi-dimensional distance corresponding to the relation edges. The multi-source data topology dynamics mapping module is the underlying basic building block of the graph authentication decision system based on damping dissipation and energy flow direction calculation; The main task of this module is to transform discrete, multi-dimensional identity authentication elements and network environment states in the real world into continuous physical vibration system parameters, thereby establishing a second-order dynamic topological space that reflects the strength of entity relationships within the digital data processing space. Traditional graph databases only provide static node and edge associations, while this module endows the graph with physical properties of "quality" and "elasticity".

[0025] During the data acquisition phase involving underlying hardware and software collaboration, this module does not employ the traditional single-threaded loop polling mechanism. Instead, it uses a distributed multi-source data probe set deployed in the operating system kernel and user modes to capture raw data frames from the network interface card using direct memory access technology.

[0026] These data frames are rapidly moved into a pre-allocated circular buffer to achieve zero-copy data capture, reducing the CPU's interrupt context switching overhead.

[0027] These data are divided into two main categories: entity data and interaction data. Entity data includes, but is not limited to: user identification (such as account numbers, ID card hash values), terminal device fingerprints (such as device motherboard serial numbers, CPU models, graphics card device identifiers, media access control addresses), network environment characteristics (such as public network routing autonomous system numbers, base station cell identifiers, subnet mask ranges), and biometric credentials. Interaction data records the historical behavioral patterns between these entities, such as the frequency with which a specific device logs into a particular account within a specific time period, the switching records of the wireless LAN identifier connected to the device, and the data request packet traffic across network segments.

[0028] This module incorporates a multi-dimensional heterogeneous data cleaning engine based on a single-instruction-stream, multi-data-stream vector instruction set. When data is pulled from the circular buffer to the L2 cache, multiple concurrent worker threads of the cleaning engine use vectorized instructions to synchronously perform missing value imputation, outlier removal, and standardization of units on massive amounts of raw data.

[0029] The processed clean data is serialized according to the preset topological ontology diagram and mapped into a distributed key-value database located in non-volatile storage medium to ensure the accuracy of subsequent dynamic parameter mapping.

[0030] After data cleaning, this module abstracts various entities into nodes in a knowledge graph, and the interactions between entities into edges between nodes. To map this static topology into a dynamic physical space, the module first needs to calculate the "dynamic mass" of each node in the graph.

[0031] In classical physics, mass represents the magnitude of an object's inertia in resisting changes in its state of motion; In the current authentication decision system, the quality of a node represents the "importance" and "state stability" of the entity in the entire authentication network.

[0032] For core nodes that have been stable for a long time, have extremely high privileges, and interact frequently (such as the core authentication server of the enterprise intranet and the main office computer used for a long time), the system will assign them higher quality parameters. For temporarily generated session identifiers, short-lived guest devices, or anonymous Internet Protocol addresses appearing for the first time, the system assigns them lower quality parameters.

[0033] Specifically, the calculation of node quality depends not only on the node's historical interaction frequency, but also on the information entropy of the node's attributes.

[0034] Here, addressing the previously existing issues of parameter symbol conflicts and formulas being detached from hardware calculations, the data processing unit of this module performs the following hardware-level index calculation steps to obtain the nodes. quality : The processor retrieves parameters representing the frequency of interaction from the historical state database. (i.e., node) The total number of valid authentication interactions within the preset time window, replacing the original symbol that might be confused with external excitation force. ).

[0035] The processor uses the floating-point arithmetic unit to perform logarithmic operations to generate the first sub-feature: ; Processor read node attribute set Calculate the multidimensional attribute information entropy of this attribute set. ; The process of calculating information entropy is transformed into a hash table statistical algorithm for the frequency of occurrence of attribute strings. The more feature dimensions there are and the more difficult they are to forge (e.g., devices with advanced hardware trusted platform modules), the larger the calculated information entropy value will be. This is the second sub-feature.

[0036] The processor extracts the static privilege level base pre-frozen in the system security configuration register. , as the third sub-feature.

[0037] The data processing unit introduces a pre-set weight adjustment coefficient. Furthermore, the system hardware verifier enforces the constraint that these three coefficients are located in the (0,1) interval and their sum is always equal to 1. By executing multiply-accumulate fusion instructions through the arithmetic logic unit (ALU), the discrete scalar value of the node quality is finally obtained: ; Through the above steps, the module generates a definite scalar mass value for each node in the graph, and uses this to construct the main diagonal mass matrix of the entire system. .

[0038] To avoid bandwidth congestion in memory caused by a large matrix, the module was not instantiated in its entirety. Instead of a two-dimensional array, it uses a compressed sparse row (CSR) memory data structure or stores only a one-dimensional diagonal array.

[0039] This data reconstruction process allows the quality parameters of millions of nodes to be fully loaded into the server's main memory (RAM), reducing bus data transmission latency.

[0040] After establishing the mass distribution of the nodes, the module then performs the "dynamic stiffness" mapping of the edges between the nodes.

[0041] Stiffness represents the tightness of the business logic connection between two nodes. Two nodes With nodes Stiffness coefficients between The calculation formula is defined as follows: ; in, This represents the cumulative amount of historical interaction data. Indicates the time difference factor; The time decay constant; The norm of a multidimensional distance vector; This is the stiffness scaling factor; Based on this, the module constructs the system's overall stiffness matrix. .

[0042] During the memory construction phase, the stiffness matrix The generation is transformed into a process of breadth-first traversal of a graph structure and construction of a hash map.

[0043] The data processing unit will calculate the non-zero value. The values ​​are written as the weights of the undirected edges in the graph into the adjacency list memory structure. Diagonal elements. The sum of the weights of all connected edges of the node is quickly aggregated using a hardware accumulator.

[0044] To address real-time changes in entity relationships in real-world authentication scenarios, this module also includes a topology aging and dynamic update mechanism. This mechanism is visualized as a background garbage collection daemon.

[0045] The daemon process uses a dedicated low-priority timer to periodically scan the edge weight adjacency list in memory. When the comparator's logic circuit detects the current stiffness of an edge... As time progresses and the edge decays to below a preset hardware threshold register value, the daemon will immediately trigger a lock-free concurrent memory unbinding operation to release the memory pointer occupied by the edge, thereby physically pruning those edges that have not been active for a long time from the memory topology.

[0046] For newly added devices or users, the module will pre-allocate a space with a specific alignment format in the memory pool in a smooth insertion manner, giving it initial basic mass and basic stiffness, and avoiding the mass matrix from being disrupted. and stiffness matrix A transient change occurs.

[0047] All dynamic parameters generated by the mapping will be serialized and stored in a high-concurrency in-memory database, providing low-latency data retrieval support for subsequent energy injection and system state solving. Through the processing of this module, the originally complex discrete authentication network is transformed into a set of highly structured continuous dynamic parameters that can be analyzed using mechanical principles.

[0048] Module 2, Authentication Kinetic Energy Injection and Damping Allocation Module: This module is used to calculate node credibility scores by combining node information from the knowledge graph, generate a global damping matrix based on the node credibility scores, parse real-time network authentication requests, and transform them into a queue of discrete external forces applied to preset source and target nodes. The certified kinetic energy injection and damping distribution module is the core control center that determines how kinetic energy evolves in the spectrum; In second-order dissipative systems in physics, besides the mass matrix and stiffness matrix In addition, the damping coefficient is a key property that determines whether energy can be effectively absorbed or allowed to oscillate back and forth in the system.

[0049] The primary task of this module is to transform the system's "credibility assessment" of each entity into "damping coefficients" in the dynamic space, and then transform each external real-time authentication request into "excitation force" or "initial kinetic energy" and inject it into the corresponding node, thereby initiating the physical state evolution of the entire system.

[0050] In this system logic, high-trust nodes and secure paths are configured to have high-damping characteristics. From a physical intuition, when a normal authentication request is transmitted along a highly trusted path that has undergone multiple verifications, the high damping along the way will rapidly absorb and dissipate this energy. Conversely, in the event of a malicious coordinated attack, the attackers exploit edge nodes with very low damping coefficients. Energy not only fails to dissipate quickly but also reflects and accumulates back and forth in these vulnerable local subgraphs.

[0051] To quantify this process, this module first performs damping allocation; The system calculates the comprehensive credibility score of each node in the graph based on the node information obtained from the multi-source data topology dynamics mapping module and combined with external security threat intelligence sources.

[0052] Based on the confidence score, the module calculates the damping coefficient for each node. ; in, This represents the fundamental damping constant assigned to all nodes by the system. For nodes The overall credibility score; This is a real-time risk index; and This is the proportionality coefficient; When implementing systems engineering, the personalized damping coefficient at this node In reality, these are dynamic filtering weights that are bound to and synchronized to the security control list buffer memory area of ​​the network firewall or application layer gateway.

[0053] This allows the subsequent dynamic energy dissipation process to be directly mapped to the physical packet dropping or rate limiting actions of network devices.

[0054] After calculating the damping at the node level, the module further constructs the damping matrix for the entire system. ; Global damping matrix Defined as: ; To avoid allocating massive amounts of continuous memory in real time during system operation to perform high-dimensional matrix addition, the data processing engine of this module utilizes a reserved static memory pool.

[0055] The data processing engine first extracts the already constructed diagonal mass matrix structure from memory in parallel. Stiffness matrix structure in adjacency list form They are then fed into multiple independent computing pipelines of the CPU.

[0056] The multiplier on the production line utilizes the global Rayleigh damping constant. and Perform fixed-point scaling on the extracted values; A diagonal matrix (whose main diagonal elements are the individual damping coefficients stored in the gateway layer for each node mentioned above). The data is read into the cache and, through the parallel vector addition instruction of the arithmetic logic unit, an equivalent damped memory image after composite superposition is instantly generated without changing the original sparse graph memory pointer.

[0057] After the damping matrix is ​​constructed, the task of this module shifts to the injection of authentication kinetic energy. This module abstracts the business action (authentication request) as an external excitation force applied to a specific node in the graph.

[0058] Because the real physical external force vector is an analog variable that changes continuously over time, while computer processors can only process discrete digital signals.

[0059] This module includes a microservice component called "Continuous Pulse Discretization Distributor"; When an authentication request packet arrives at the operating system's protocol stack, the distributor first extracts the corresponding source node, target node, and operation sensitivity through packet parsing, and the high-precision digital timer inside the distributor is activated.

[0060] Higher operational sensitivity translates to greater external stimulus energy in physical space. This applies to the source nodes participating in authentication. and target node The external force it experiences is defined as an impulse function over a discrete time interval: ; in, This is a quantification of operational sensitivity. This is the gain factor for the excitation force amplitude; The central timestamp of when the request occurred; This is the pulse width parameter; To convert this Gaussian impulse function into computer-executable data, the distributor component, based on the system's preset Nyquist sampling clock frequency, will... The extremely short time window centered on the element is divided into thousands of microsecond-level time slices.

[0061] In each time slice, the computing unit calculates a specific external force value based on the Gaussian function mentioned above, and concatenates the external force value with the timestamp of the current time slice to form an independent data frame.

[0062] These data frames, representing transient thrust at different times, are pushed into a first-in-first-out (FIFO) external force data queue in chronological order; For the other millions of nodes in the graph that are not directly involved in the request, the distributor will not allocate any memory to store zero-value external forces, but will instead use the default null pointer mapping.

[0063] Through this scheduling conversion between time-series slicing and first-in-first-out queues, the module decomposes a theoretically continuous pulse force function into a one-dimensional time-series discrete array suitable for the central processing unit to read cycle by cycle.

[0064] The module performs memory address alignment and time bus synchronization on the generated discrete external force queue data, damping memory image, and mass and stiffness data structures received from Module 1. Subsequently, it encapsulates all memory access pointers for these underlying digital parameters into a standard system state snapshot package, which is then passed to the next module for integral evolution solving. Through this series of sophisticated mapping and energy injection mechanisms, anomaly authentication attempts that are difficult to perceive intuitively in the digital world are transformed into initial dynamic source data in the computer memory space that can be directly numerically observed and sliced ​​for calculation.

[0065] Module 3, Second-order dissipative system state solution module: It is used to receive the main diagonal mass matrix, stiffness matrix, global damping matrix and discrete external force queue, construct the second-order dynamic control equation and perform time integral iterative calculation, and output the displacement and velocity time sequence state of the full spectrum nodes in each clock cycle. After receiving the mass memory matrix, stiffness memory matrix, equivalent damping memory image, and discrete-time external force data queue representing the authentication request from the front-end module, this module uses the underlying computing unit to solve the state evolution process of each node in the entire multidimensional knowledge graph topology space within a discrete time step.

[0066] In this module, the degree of disturbance of a node from its static equilibrium state is defined as the "node displacement vector". The larger the displacement, the more severe the safety shock that the node is subjected to.

[0067] The fundamental dynamic control criteria followed in this module are expressed as multi-degree-of-freedom second-order ordinary differential equations: ; In the formula, These are the diagonal mass, damping, and stiffness matrices, respectively. It is an external force vector that changes with time; The system is respectively in The column vectors of displacement, velocity, and acceleration at each moment.

[0068] Instead of seeking a purely mathematical analytical solution to the differential equation in the continuous domain, this module constructs a highly parallel time-series data iterative update framework to guide the underlying hardware in performing step-by-step numerical approximation.

[0069] To accommodate the data deluge generated by millions of nodes during the evolution process, the system first allocates three independent and contiguous memory spaces in the high-bandwidth memory (HBM) of the host's graphics processing unit (GPU) or dedicated tensor processing unit, named "displacement register area", "velocity register area" and "acceleration register area" respectively.

[0070] At the start of the authentication request pulse injection (when the system's internal high-precision clock is reset to zero), the memory controller issues a block clear instruction to these three register areas, forcibly setting all initial state data to zero and establishing stable initial boundary conditions.

[0071] Considering that in large-scale enterprise-level authentication scenarios, the above control equations constitute a very large sparse system, directly using conventional calculations would lead to CPU cache penetration and bus congestion.

[0072] Therefore, this module executes preprocessing instructions before starting the iteration: Construct an "equivalent memory stiffness matrix". The data processing unit retrieves sparse data blocks of the mass matrix, damping matrix and stiffness matrix in parallel from the memory pool according to the microsecond-level clock step instructions of the system oscillator.

[0073] The arithmetic logic unit (ALU) inside the processor core uses preset integral scalar coefficients to execute vectorized multiply-accumulate fusion instructions on the captured data blocks, generating an equivalent stiffness sparse topology graph that incorporates mass inertia and damping dissipation. Since the system's basic topology remains locked throughout this certification lifecycle, this equivalent stiffness matrix only needs to be calculated once before each iteration.

[0074] The processor calls the underlying basic linear algebra subroutine library to perform concurrent Kolesky incomplete decomposition of the equivalent stiffness matrix.

[0075] The pointers to the lower triangular matrix and upper triangular matrix generated by the decomposition are fixed in the resident area of ​​the processor's L2 cache, which can be reused at high frequency for countless subsequent microsecond-level iterations, thus fundamentally avoiding the computational power paralysis caused by repeatedly solving high-dimensional inverse matrices.

[0076] In each clock cycle of the iterative evolution loop, the module executes the following hardware data transfer steps: The "continuous pulse discretization distributor" pops a data frame containing the current external force value from the head of the external force first-in-first-out queue and sends it to the processor's first-level data cache. The processor retrieves the old state data saved in the previous clock cycle from the displacement, velocity, and acceleration registers. Using multiple sets of parallel multiply-accumulate (MAC) units, the processor converges the external force data and the inertial force components of the old state data to generate the "equivalent excitation vector" at the current moment and stores it in the intermediate buffer register.

[0077] The solution process enters the most critical sparse matrix solution stage. Since the equivalent stiffness matrix has been pre-triangularly decomposed and stored in the cache, the system schedules a large number of lightweight computing threads and adopts a parallel algorithm of forward substitution and backward replacement. Using the equivalent excitation vector in the intermediate buffer register, the system quickly solves for the new "displacement state array" at the current moment.

[0078] Once the new displacement state has been calculated, a dedicated back-substitution circuit will use the displacement difference data between two adjacent clock cycles to deduce the corresponding new velocity and acceleration arrays within a very short clock cycle.

[0079] To ensure consistency in time-series data reading and writing and to avoid concurrent conflicts, this module adopts a "double-buffered memory ping-pong switching" mechanism; While the hardware computing unit is writing the displacement, velocity, and acceleration arrays for the new moment to the foreground buffer area, the background direct memory access (DMA) controller is transferring the state arrays calculated in the previous moment in batches to the downstream energy analysis module memory area via the peripheral component interconnect high-speed bus (PCIe).

[0080] After a computation task is completed within a clock cycle, the memory pointers of the foreground and background buffers are atomically flipped and swapped. This time-based iterative evolution process will continue to execute seamlessly under the control of the hardware scheduler until the accumulated clock ticks reach the preset safety assessment time window limit.

[0081] This iterative engine generates a massive but highly structured temporal tensor data stream that records in detail the motion response of every node in the entire graph every microsecond, providing ample numerical space support for in-depth security assessment.

[0082] Module 4, Transient Energy Density Direction Integral Module: This module integrates the main diagonal mass matrix, stiffness matrix, and displacement and velocity time-series states to calculate the transient kinetic energy of nodes and the elastic potential energy of relational edges. It also performs topological subgraph partitioning of the knowledge graph and summarizes the local transient energy density and energy direction scalars of each topological subgraph. After obtaining the full spectrum node temporal motion state output by the second-order dissipative system state solution module, the transient energy density flow direction integration module undertakes the key responsibility of transforming the micro-temporal state into a macro-energy characteristic parameter matrix.

[0083] Faced with highly concealed distributed collaborative forgery attacks, data changes on a single node are easily masked, while the accumulation and flow of energy in complex topologies are difficult to fake. This module leverages the powerful aggregation and reduction computational capabilities of the computer's underlying layers to deeply analyze the dynamic essence hidden behind authentication behavior.

[0084] In order to comprehensively depict the energy state of the system, this module first calculates the basic energy components for each node in the graph and its connected edges at each discrete clock step.

[0085] The energy contained in the system is mainly divided into three physical forms: the kinetic energy of the nodes themselves. Elastic potential energy inherent in the relationship edges between nodes And the energy dissipated due to damping characteristics.

[0086] The theoretical core of these three fundamental energies follows the laws of classical physics: kinetic energy is proportional to the product of nodal mass and the square of velocity; potential energy is proportional to the product of edge stiffness and the square of the displacement difference between nodes.

[0087] At the underlying hardware and software execution level, this module transforms these energy formulas into efficient memory traversal and vectorized computation operations. When calculating transient kinetic energy, since the velocity data of different nodes are stored in contiguous memory arrays, the processor's Vector Processing Unit (VPU) utilizes a Single Instruction Multiple Data (SIMD) architecture to load the velocity data of multiple adjacent nodes into wide-byte registers at once. After the hardware squarer performs parallel squaring operations, it then performs element-wise multiplication with the mass array read through the bus, thereby producing a batch of discrete node kinetic energy values ​​within a single instruction cycle and writing them into the kinetic energy cache.

[0088] The calculation of elastic potential energy involves two independent nodes connected in the spectrum. and If the displacement of the corresponding node is randomly read by traversing the edges, it will cause extremely serious cache misses and slow down the system performance.

[0089] During the data initialization phase, this module introduces a "hardware-level graph node reordering" algorithm (such as the reverse Cuthill-McKee algorithm optimization strategy).

[0090] This algorithm modifies the logical mapping addresses of nodes in memory, ensuring that nodes that are adjacent in the topology are also as contiguous as possible in terms of physical memory addresses. When the processing unit traverses the stiffness edge structure and extracts the endpoint displacements to calculate "displacement difference squared multiplied by stiffness", the processor prefetch mechanism can move the displacement data of relevant nodes from main memory to the cache in advance, ensuring the full-load operation of the computation pipeline.

[0091] The calculation of dissipated energy no longer relies on continuous integration. Instead, a dedicated hardware accumulator is configured to accumulate discrete infinitesimal elements of the product of the square of the transient velocity of the node and the damping coefficient in real time when each microsecond-level time-series data arrives, forming a cumulative dissipated energy data block.

[0092] After the basic energy components are calculated, in order to accurately capture local anomalies, this module calculates the "local transient energy density" through the data processing unit. ).

[0093] When faced with massive graph data with tens of millions of nodes, changes in the global total energy can easily mask subtle local anomalies. Therefore, this module calls the concurrent thread pool of the multi-core processor to perform memory-isolated topology subgraph partitioning.

[0094] The system divides the massive full-graph data into multiple appropriately sized memory partitions based on a network community discovery algorithm. Each processor core is exclusively allocated to one memory partition. Within this core, the arithmetic logic unit sums up the kinetic energy of all nodes in the partition, as well as the elastic potential energy of the related edges, and then divides it by the sum of the number and weight of nodes and edges in that partition (i.e., the topological volume).

[0095] To improve aggregation efficiency, the core employs a "tree-structured parallel reduction" logic circuit. The local transient energy density values ​​calculated from each memory partition are uniformly pushed to a density index table within a shared memory region. This density index enhances the system's sensitivity to covert attacks.

[0096] If a subgraph consists of a large number of temporarily generated anonymous devices and low-reputation IP addresses, when an attacker attempts to launch an attack through that subgraph, the energy data will be forced to form a high-value highlighted "hotspot" that lasts for a long time within that memory partition.

[0097] In addition to examining the static density distribution of energy, this module also focuses on calculating the dynamic propagation direction of energy in the entire topological space, that is, constructing an "energy flow array".

[0098] By tracing the energy transfer path, the system can clearly reverse-engineer the source and intended target of the attack.

[0099] In physical space, from nodes Flow to Node instantaneous scalar It is determined by the product of the elastic restoring force between the two nodes and the node velocity. During system execution, this process is translated into a directed scan operation on the graph connection edge memory table.

[0100] Data processing unit extracts nodes With nodes The displacement difference data is multiplied by the stiffness coefficient value corresponding to the memory pointer on this side, and then multiplied by the node. The transient velocity value is multiplied by a fixed-point number. When the sign bit of the arithmetic logic unit output is positive, the hardware controller accumulates the value to... point to In the directed edge attribute field; if the sign bit is negative, it is accumulated in reverse.

[0101] As the time step progresses, the instantaneous direction values ​​on each associated edge are continuously discretely accumulated and truncated within a dedicated sliding time window register, ultimately generating a directed weighted topology graph in memory that reflects the macroscopic energy directional transmission flux.

[0102] The verification service process of this module will be woken up in the background to perform a fast summation and comparison of the system's total kinetic energy data block, total potential energy data block, cumulative dissipated energy data block, and total work done by the external excitation queue within the current time slice.

[0103] If the verification circuit finds that the difference between the two data points exceeds the rounding error threshold allowed by the hardware floating-point arithmetic, it determines that the current memory data has been tampered with or a bit flip error has occurred. The system will immediately throw a hardware interrupt exception and request a recalculation.

[0104] After ensuring that the data is strictly conserved and error-free, this module will securely deliver the macroscopic physical parameter matrix, including the high-frequency anomaly subgraph density distribution table and the directed energy flow array, to the high-dimensional anomaly interception decision module for final adjudication via the internal system bus.

[0105] Module 5, Abnormal Energy Interception Decision Module: This module is used to establish a safe energy capacity benchmark for a local topological subgraph based on the main diagonal mass matrix and stiffness matrix. It compares the local transient energy density with the safe energy capacity benchmark to generate an energy overload ratio. It combines the energy flow direction scalar to solve the energy flow divergence of the target node and compares the preset critical parameters to output the corresponding release, interception, or state degradation routine instructions. The abnormal energy interception decision module is the top-level adjudication unit and execution center of the entire dynamic spectrum authentication system of this invention; The four front-end modules complete the mapping from discrete multi-source data to continuous dynamic space, as well as the array integral calculation of transient mechanical energy, elastic potential energy, dissipated energy and energy flow direction in memory space.

[0106] The task of this module is to receive these macroscopic feature data packets that have been solved in high-dimensional space, and based on the pure boundary state theory and mathematical statistical analysis principles, make a final judgment on the current authentication request to "allow", "intercept" or "upgrade verification", and on this basis, complete the reset and topological isolation of the physical state of the entire knowledge graph in memory.

[0107] Before making a safety ruling, this module first needs to establish a "safe energy capacity baseline" for each local subgraph in the map.

[0108] Traditional threshold determination often relies on manually set static constants, which can easily lead to poor adaptability to complex and ever-changing network topologies. In contrast, this solution employs dynamic calculation equations based on the inherent properties of node dynamics.

[0109] For any monitored local topological subgraph neighborhood The maximum safe cumulative energy it can theoretically withstand It depends on the overall mass reserve of the nodes in the region and the comprehensive stiffness of the relation edges.

[0110] The calculation formula is defined as follows: ; In order to avoid the risk of insufficient parameter disclosure in the previous process of low-level hardware and software collaboration, this module explicitly fixes the physical constraints in the above formula in the system's base register.

[0111] Among them, the dimensional constant of kinetic energy capacity calibration Dimensional constant of potential energy capacity calibration It is strictly constrained by the hardware verifier to be a real number greater than zero, and has the scaling property to convert pure numerical values ​​into energy Joule equivalent units. It is the maximum safe limit value of the rate of change of physical displacement preset in the non-volatile memory of the system; This represents the maximum relative tensile displacement difference that the related edges can withstand.

[0112] When it is necessary to calculate the safe energy capacity baseline, the main controller's scheduling module sends instructions to a dedicated digital signal processor (DSP).

[0113] The digital signal processor first uses its internal high-speed multiplier to process the read data. and The constant is squared and the result is locked in a special register; The subgraph neighborhood is accessed via a direct memory access (DMA) channel. All node quality scalars within and stiffness coefficient Fetched in batches from main memory to local static random access memory (SRAM).

[0114] The digital signal processor uses a multiply-accumulate unit (MAC) to calculate the sum of kinetic and potential energy capacities separately at extremely high pipeline throughput, and finally sums them with... and The multiplication and addition produce a precise floating-point result, which is stored in the memory slot of the "safety baseline capacity table". This hardware-level calculation process fundamentally avoids the rigidity of static thresholds, allowing high-weight core business areas to naturally have a higher memory data capacity.

[0115] After establishing the baseline, the module will use the cumulative energy retention index output by the front-end module. With this safe energy capacity benchmark A dimensionless comparison was performed to calculate the "energy overload ratio". : ; At this point, the floating-point unit (FPU) of the central processing unit (CPU) executes a hardware-level division instruction. To prevent an interrupt crash caused by a denominator of zero, the divider logic circuit incorporates a minimum value shim detection mechanism.

[0116] When the output When the value stored in the result register is much less than one, it indicates that the local fluctuations caused by the authentication request data stream have been smoothly absorbed by the damped memory image along the way; when the value approaches or exceeds one, the interrupt controller on the system motherboard will immediately receive a hardware-level safety warning signal, indicating that the low-confidence memory subgraph network is experiencing violent oscillations.

[0117] To further distinguish whether the anomaly stems from an occasional surge in normal requests (such as peak concurrency caused by a flash sale) or from a malicious, organized attack (such as distributed credential stuffing), this module introduces the "divergence" operator from discrete vector calculus.

[0118] For the core gateway node or target account node in the subgraph Calculate its "energy dissipation": ; From a computer architecture perspective, this divergence formula is visualized as a two-channel memory accumulation operation. The data processing engine locates the target node in memory. The head pointer of the adjacency list; The first group of concurrent threads is dedicated to traversing all the nodes that point to it. The in-degree directed edges are identified, and the transient energy flux stored in the edge attributes is extracted using an arithmetic logic unit. Perform forward accumulation; the second group of concurrent threads synchronously traverses all slave nodes. Extract the corresponding flux from the out-degree directed edge of the origin. Accumulate.

[0119] The two sets of threads send their summed values ​​to the comparator circuit to perform subtraction instructions. If the final divergence value is an extremely large positive value, it means that the node is absorbing abnormal traffic from surrounding low-damped nodes in the digital topology, which is a typical physical imprint of multi-hop agent probing.

[0120] Based on the energy overload ratio and energy dissipation calculated by the hardware, the execution engine of this module reads the decision matrix rule table pre-programmed in the programmable read-only memory (PROM) and outputs the final decision through a set of multi-branch machine instructions: Condition 1: If the maximum energy overload ratio of the entire spectrum within the determination window period is... And the target node divergence If this is the case, the secure access routine is triggered. In this routine, the processor sends a system call to the operating system's network protocol stack, attaching the authentication data packet, which was originally blocked in kernel mode, to the network interface card (NIC)'s (NIC) send queue, allowing it to pass through the security gateway to the next-layer service node; Condition 2: If Or target node divergence (in , If the system's preset high-risk critical parameters are used, the high-risk interception routine will be triggered.

[0121] At this point, this module will directly send control plane data frames of a specific format to the hardware firewall; The firewall updates its access control list (ACL) within microseconds, directly dropping all packets originating from that source address at the physical port level. At the same time, the operating system issues a forced reset (RST) command to the socket, instantly severing the physical link. Condition 3: If the parameter is in the middle of the above two conditions, that is... Furthermore, if the energy flow exhibits a slight asymmetric convergence, a state degradation routine is triggered. The execution engine injects a reverse proxy redirection instruction into the application layer gateway, causing the Hypertext Transfer Protocol (HTTP) request originally directed to the core data to be forcibly routed to the Multi-Factor Authentication (MFA) server array, forcibly initiating dynamic biometric or SMS verification code verification.

[0122] While issuing the ruling command, this module also needs to handle the underlying memory cleanup work of "topology reset and kinetic energy zeroing" in the physics space.

[0123] Without intervention, the computational data left behind by intercepted malicious requests will continue to reside in the system, causing memory leaks and interfering with subsequent computations. Therefore, once a malicious attack is identified, this module will immediately impose an "infinite damping penalty" on the low-reputation nodes involved. At the specific data processing level, the memory manager will locate the source node. The personalized damping memory address is used to forcibly modify the damping value to the maximum floating-point value supported by the current computer system (such as MAX_FLOAT under the IEEE754 standard) using a bitmask overwrite instruction.

[0124] At the same time, the stiffness memory pointer connected to it is forced to point to a null address. This process, at the data structure level, performs "memory-level sandbox isolation" on the infected node from the dynamic system space, ensuring that the disturbance it generates is instantly "drained" by the huge damping value in the next clock cycle.

[0125] Finally, after confirming that the malicious session has been cleared, the system will invoke a dedicated block erase advanced extension instruction to perform parallel zeroing operations on all speed buffers and acceleration buffers in the high-concurrency memory database.

[0126] This action safely clears all state shifts caused by the request, restoring the system to a stable and undamaged initial baseline state, ensuring that the CPU's registers are ready to receive and parse the impact signals from the next network authentication event.

[0127] The foregoing has only described certain exemplary embodiments of the present invention by way of illustration. Undoubtedly, those skilled in the art can modify the described embodiments in various ways without departing from the spirit and scope of the present invention. Therefore, the foregoing drawings and descriptions are illustrative in nature and should not be construed as limiting the scope of protection of the claims of the present invention.

[0128] It should be noted that, in this document, the use of relational terms such as "first" and "second" is merely for distinguishing one entity or operation from another, and does not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0129] It should be understood that in the various embodiments of this application, the sequence number of each process does not imply the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of this application.

[0130] In addition, the functional units in the various embodiments of this application can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0131] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. An authentication intelligent decision system based on a knowledge graph, characterized in that, include: The multi-source data topology dynamics mapping module is used to extract multi-source authentication data captured by the network interface card, map entities and interaction behaviors to nodes and relation edges of the knowledge graph, generate a main diagonal mass matrix based on node interaction frequency and attribute information entropy, and generate a stiffness matrix based on the historical cumulative interaction data volume and multi-dimensional distance corresponding to the relation edge. The authentication kinetic energy injection and damping allocation module is used to calculate the node credibility score by combining the node information of the knowledge graph to generate a global damping matrix, parse the real-time network authentication request, and transform it into a discrete external force queue applied to the preset source node and target node. The second-order dissipative system state solution module is used to receive the main diagonal mass matrix, stiffness matrix, global damping matrix and discrete external force queue, construct equations and perform time integral iterative calculations, and output the displacement and velocity time sequence states of the full spectrum nodes in each clock cycle. The transient energy density flow direction integration module is used to fuse the main diagonal mass matrix, stiffness matrix, and displacement and velocity time-series states to calculate the transient kinetic energy of nodes and the elastic potential energy of relational edges. It also performs topological subgraph partitioning of the knowledge graph and summarizes the local transient energy density and energy flow direction scalar of each topological subgraph. The abnormal energy interception decision module is used to establish a safe energy capacity benchmark for a local topological subgraph based on the main diagonal mass matrix and stiffness matrix. It compares the local transient energy density with the safe energy capacity benchmark to generate an energy overload ratio, solves the energy divergence of the target node by combining the energy flow direction scalar, and outputs corresponding instructions by comparing with preset critical parameters. 2.The knowledge graph based authentication intelligent decision system according to claim 1, wherein, Generating the main diagonal mass matrix specifically includes: Using a floating-point arithmetic unit, a hash table algorithm for counting the frequency of attribute strings, and extracting the radix stored in the system security configuration register, the node is obtained by executing multiply-accumulate fusion instructions through the arithmetic logic unit. quality The calculation formula is: ； in, Represents a node The total number of valid authentication interactions within the preset time window; Represents a node The set of attributes; The entropy of multidimensional attribute information represents a set of attributes; Represents a node The base number of static permission levels; , , These are weighting adjustment coefficients, and their sum is always equal to a constant of one. After generating the quality calculation results, the processor uses a memory data structure that compresses sparse rows or stores only a one-dimensional diagonal array to load the quality scalar into main memory in order to avoid bandwidth congestion caused by large-scale matrices. node With nodes Stiffness coefficients between The calculation formula is: ； in, Represents a node With nodes The amount of historical cumulative interaction data between them; Represents the current timestamp and node and nodes The time difference between the timestamps of the last successful interaction; The time decay constant; Represents the norm of a multidimensional distance vector; This is the stiffness scaling factor; After generating stiffness coefficients, the data processing unit writes the calculated non-zero stiffness coefficient values ​​as undirected edge weights of the graph into the adjacency list memory structure. The diagonal elements are quickly aggregated by a hardware accumulator to sum the weights of all connected edges of the node.

3. The knowledge graph-based intelligent authentication decision-making system according to claim 2, characterized in that, The multi-source data topology dynamics mapping module also includes low-level concurrent capture and lifecycle maintenance for multi-source authenticated data: The raw data frames on the network interface card are captured using direct memory access technology and moved to a pre-allocated circular buffer for zero-copy capture. At the same time, the single instruction stream multiple data stream vector instruction set is called to synchronously clean the raw data frames and serialize them into a distributed key-value database. After the memory topology is established, a background garbage collection daemon process with a low-priority timer interrupt is started. It periodically scans the edge weight adjacency list in memory. When the comparator logic judgment circuit finds that the stiffness coefficient decays to below the preset hardware threshold register value over time, it triggers a lock-free concurrent memory unbinding operation to release the occupied memory pointer. Meanwhile, for newly added entities, space with a specific alignment format is pre-allocated in the memory pool to give them initial basic mass and basic stiffness to avoid transient changes.

4. The knowledge graph-based intelligent authentication decision-making system according to claim 1, characterized in that, The process of generating the global damping matrix is ​​as follows: The system calculates a comprehensive trustworthiness score by combining external security threat intelligence sources, and then calculates a personalized damping coefficient for each node based on the comprehensive trustworthiness score. Personalized damping coefficient The calculation formula is: ； in, Represents the fundamental damping constant; For nodes The overall credibility score; This is a real-time risk index; and This is the proportionality coefficient; Personalized damping coefficients are bound and synchronized to the security control list buffer memory area of ​​the network firewall or application layer gateway as dynamic filtering weights. A reserved static memory pool is used to extract the diagonal mass matrix structure and the stiffness matrix structure in adjacency list form in parallel, which are then fed into the independent computation pipeline of the central processing unit. Through parallel vector addition instructions in the arithmetic logic unit, the personalized damping coefficients of each node are composited and superimposed to generate an equivalent damping memory image without changing the original sparse graph memory pointers. The global damping matrix... The combination formula is: ； in, and This represents the global Rayleigh damping coefficient. The main diagonal mass matrix; Here is the stiffness matrix; A diagonal matrix whose main diagonal elements are personalized damping coefficients.

5. The knowledge graph-based intelligent authentication decision-making system according to claim 1, characterized in that, In the certified kinetic energy injection and damping distribution module, the processing steps for converting it into a discrete external force queue are as follows: When a real-time network authentication request arrives at the operating system's protocol stack, the continuous pulse discretization distributor microservice component extracts the corresponding source node, target node, and operation sensitivity, and activates the internal digital timer to cut the time window into time slices according to the preset Nyquist sampling clock frequency. The external force value is calculated based on the impulse function for each time slice. The impulse function is: ,in, For injecting source node external force function, To measure the sensitivity of operations, This is the gain factor for the excitation force amplitude. The central timestamp of the real-time network authentication request. For physical simulation time variables, This is the pulse width parameter; The external force values ​​and the timestamps of the corresponding time slices are concatenated into independent data frames and pushed into a first-in-first-out queue to form a discrete external force queue. For other nodes in the knowledge graph that do not participate in the calculation, a default null pointer mapping is used to avoid allocating invalid memory.

6. The knowledge graph-based intelligent authentication decision-making system according to claim 1, characterized in that, In the state-finding module for second-order dissipative systems, the specific data processing steps for performing time integral iterative calculations include: In the high-bandwidth memory of the graphics processing unit or the dedicated tensor processing unit, separate displacement registers, velocity registers and acceleration registers are allocated, and a block clearing instruction is issued to establish stable initial boundary conditions. The processor calls the basic linear algebra subroutine library to perform concurrent Koleski incomplete decomposition of the equivalent stiffness matrix, and stores the pointers of the resulting lower triangular matrix and upper triangular matrix in the resident area of ​​the secondary cache. In the iterative evolution loop, the processor uses multiple sets of parallel multiply-accumulates to extract the old state data stored in each register area and merge it with the discrete external force queue data to generate an equivalent excitation vector and store it in the intermediate buffer register. The scheduled calculation thread uses the forward substitution and backward replacement algorithm to find the new displacement state array, and the back substitution operation circuit derives the new velocity and new acceleration array. After the calculation task of one clock cycle is completed, the memory pointers of the front and back buffers are flipped and swapped at an atomic level.

7. The knowledge graph-based intelligent authentication decision-making system according to claim 1, characterized in that, In the transient energy density flow integration module, the steps for processing the transient kinetic energy of nodes and the elastic potential energy of relational edges include: The processor's vector processing unit uses a single instruction stream multiple data stream architecture to load the velocity data of multiple adjacent nodes into a wide-byte register at once. The hardware squarer performs the squaring operation in parallel and then performs the corresponding element-wise multiplication operation with the data in the main diagonal mass matrix. The data is then written to the cache to generate transient kinetic energy discrete values. Before calculating the elastic potential energy of the relation edges, a hardware-level graph node reordering algorithm is executed to change the logical mapping address of the nodes in memory, so that the addresses of adjacent nodes in the topology are continuous in the physical memory space. The displacement data is moved from main memory to cache in advance through the processor prefetching mechanism to eliminate cache misses, and then the elastic potential energy value is calculated. Simultaneously, a dedicated hardware accumulator is configured to accumulate discrete micro-elements formed by multiplying the square of the node transient velocity and the damping coefficient in real time through the arithmetic logic unit when microsecond-level time-series data arrives, thus forming a cumulative dissipated energy data block.

8. The knowledge graph-based intelligent authentication decision-making system according to claim 7, characterized in that, The knowledge graph is divided into topological subgraphs, and the local transient energy density and energy flow scalar of each topological subgraph are summarized, specifically including: The concurrent thread pool of the multi-core processor is invoked to execute the memory-isolated topology subgraph partitioning job, which divides the entire graph data into multiple memory partitions. The processor cores are exclusively allocated to the memory partitions. A tree-like parallel reduction logic circuit is used to sum up the transient kinetic energy of all nodes in the memory partitions and the elastic potential energy of the related edges, and divide by the topology volume to obtain the local transient energy density. Extract the displacement difference data of the endpoint nodes, multiply it by the stiffness coefficient value, and perform a fixed-point multiplication with the transient velocity value of the node. Based on the positive or negative sign of the sign bit output by the arithmetic logic unit, accumulate it into the directed edge attribute field to generate an energy flow scalar. The background verification service process performs a fast summation and comparison on the system's total kinetic energy data block, total potential energy data block, cumulative dissipated energy data block, and the total work done by the external excitation queue. If the difference exceeds the rounding error threshold allowed by floating-point arithmetic, a bit flip error is determined to have occurred and an interrupt exception is thrown.

9. The knowledge graph-based intelligent authentication decision-making system according to claim 1, characterized in that, In the abnormal energy interception decision module, the process of obtaining the safe energy capacity benchmark and energy dissipation is as follows: The scheduling module of the main controller sends instructions to the digital signal processor to retrieve the node mass scalar and stiffness coefficients into the local static random access memory. Using the multiply-accumulate unit, it performs parallel calculations at pipeline throughput to generate a safe energy capacity benchmark and stores it in the memory slots of the safe energy capacity table. The calculation formula is: ； in, and The dimensional constants are for calibration, and both are greater than zero; For the neighborhood of the topological subgraph The node quality scalar within; The stiffness coefficient between connected nodes; This is the preset safe upper limit value for the rate of change of physical displacement; This represents the maximum relative tensile displacement difference borne by the related edges. The dual-channel memory accumulation job executes two sets of concurrent threads to obtain the energy dissipation. The formula is: ,in, Representative and target node The set of all directly adjacent nodes connected to each other; The scalar represents the direction of the incoming energy flow; The scalar represents the direction of the outflowing energy.

10. The knowledge graph-based intelligent authentication decision-making system according to claim 1, characterized in that, The corresponding instructions are output by comparing the preset critical parameters, specifically including: When the allow routine is triggered, the processor sends a system call to the operating system's network protocol stack, which loads the authentication data packet that was originally blocked in kernel mode into the network card's send queue, allowing it to pass through the security gateway to the next layer of service nodes. When the interception routine is triggered, a control plane data frame is sent to the hardware firewall to update its access control list and discard the data packet originating from the source address. At the same time, the operating system issues a forced reset command to the socket to cut off the physical link. The memory manager locates the personalized damping memory address of the intercepted source node, uses a bitmask overwrite instruction to forcibly modify the personalized damping value to the maximum floating-point value supported by the computer system, forces the connected stiffness memory pointer to point to a null address to achieve memory isolation, and then calls the block erase extension instruction to perform a parallel zeroing operation on the velocity buffer and acceleration buffer to clear the displacement state data caused by the incident. When the state degradation routine is triggered, the execution engine injects a reverse proxy redirection instruction into the application layer gateway, causing the Hypertext Transfer Protocol request that was originally directed to the core data to be routed to the multi-factor authentication server array for re-verification.

Images