A network threat defense method, system, storage medium and product

Abstract

This invention discloses a network threat defense method, system, storage medium, and product. The method senses and executes nodes' real-time reporting of abnormal deviations, dynamically calculates trust weights based on trust chain values, and dynamically adjusts node identity certificate permissions accordingly, achieving a tight binding between certificate permissions and the node's real-time risk status. Simultaneously, a global collaborative decision-making center generates collaborative defense instructions based on trust weights and global behavior analysis, and issues them after two-way identity certificate verification with the target node, ensuring the instruction's source is trustworthy. Upon receiving the instruction, the target node further considers its own trust status, the trustworthiness of the instruction's source, and preset policies to autonomously decide whether to execute it, effectively avoiding the security risks of nodes blindly executing malicious instructions or falsely reporting instructions, significantly improving the real-time performance, accuracy, and anti-attack capabilities of cross-domain network threat defense.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network threat defense method, system, storage medium, and product. Background Technology

[0002] Existing network security defense methods typically employ a centralized decision-making model, where endpoint nodes unconditionally execute instructions issued by the center. Furthermore, node permission certificates are mostly statically configured, making it impossible to dynamically adjust based on real-time behavioral risks and cross-domain collaboration history. Simultaneously, cross-domain collaborative defense lacks a two-way authentication mechanism based on identity certificates, making nodes susceptible to being misled by malicious instructions. The single-dimensional trust assessment makes it difficult to cope with complex and ever-changing cross-domain threats. Summary of the Invention

[0003] This invention provides a network threat defense method, system, storage medium, and product to solve the problems of static node permissions, blind execution of central instructions by nodes, and lack of dynamic and trusted verification in cross-domain collaboration in the prior art.

[0004] According to one aspect of the present invention, a network threat defense method is provided, the method comprising: The system collects behavioral data of the entities it carries by sensing execution nodes and reports any abnormal deviations in the behavioral data to the trust assessment engine. The trust assessment engine determines the trust weight of the perception execution node based on the abnormal deviation degree and the trust chain value, and synchronizes it to the global collaborative decision-making center. The global collaborative decision-making center adjusts the identity certificate permissions of the perception execution nodes based on trust weights, and then distributes the adjusted identity certificates to the perception execution nodes. The global collaborative decision-making center generates collaborative defense instructions based on the trust weights of each perception execution node and the results of global behavior analysis. After two-way verification of identity certificates between the center and the target perception execution node, the collaborative defense instructions are sent to the target perception execution node. The target-aware execution node receives collaborative defense instructions and executes corresponding defense actions based on its own trust status, the credibility of the instruction source, and the preset collaborative defense strategy.

[0005] According to another aspect of the present invention, a network threat defense system is provided for executing the network threat defense method described in any embodiment of the present invention. The system includes perception execution nodes and trust assessment engines deployed in each security domain, and a globally deployed global collaborative decision-making center.

[0006] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions for causing a processor to execute and implement the network threat defense method according to any embodiment of the present invention.

[0007] According to another aspect of the present invention, a computer program product is provided, the computer program product comprising a computer program that, when executed by a processor, implements the network threat defense method described in any embodiment of the present invention.

[0008] The technical solution of this invention is applied to a network threat defense system. It collects behavioral data of the entities it carries through sensing execution nodes and reports any abnormal deviations in this data to a trust assessment engine. The trust assessment engine determines the trust weight of the sensing execution nodes based on the abnormal deviation and trust chain value, and synchronizes this weight to the global collaborative decision-making center. The global collaborative decision-making center adjusts the identity certificate permissions of the sensing execution nodes based on the trust weights and distributes the adjusted identity certificates to the sensing execution nodes. The global collaborative decision-making center generates collaborative defense instructions based on the trust weights of each sensing execution node and the results of global behavioral analysis. After two-way identity certificate verification with the target sensing execution node, the collaborative defense instructions are distributed to the target sensing execution node. The target sensing execution node receives the collaborative defense instructions and executes the corresponding defense actions based on its own trust status, the credibility of the instruction source, and a preset collaborative defense strategy. This technical solution ensures that node permissions match the risk status in real time by dynamically calculating trust weights and adjusting node certificate permissions in real time. Through two-way certificate verification between the global collaborative decision-making center and the target sensing execution node, and a node autonomous decision-making mechanism, it prevents nodes from blindly executing malicious instructions, thereby effectively improving the real-time performance, accuracy, and anti-attack capability of cross-domain threat defense.

[0009] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 This is a flowchart of a network threat defense method provided in Embodiment 1 of the present invention; Figure 2This is a schematic diagram of the multi-factor dynamic trust weight fusion calculation process provided in Embodiment 1 of the present invention; Figure 3 This is a schematic diagram of a layered collaborative defense architecture provided in Embodiment 1 of the present invention; Figure 4 This is a schematic diagram of a network threat defense system provided in Embodiment 2 of the present invention. Detailed Implementation

[0012] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0013] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0014] Example 1 Figure 1 This is a flowchart of a network threat defense method provided in Embodiment 1 of the present invention. This embodiment is applicable to situations involving dynamic behavioral analysis and collaborative defense against rapidly spreading network threats that cross security domains. This method can be executed by a network threat defense system, which can be implemented in hardware and / or software. Figure 1 As shown in the figure, this embodiment provides a network threat defense method, which is applied to a network threat defense system. The method specifically includes the following steps: S110. Collect behavioral data of the entities carried by the perception execution node, and report the abnormal deviation of the behavioral data to the trust assessment engine.

[0015] In this context, the awareness execution node can refer to a functional module deployed on edge devices, servers, or terminal nodes in various security domains. It is used to collect real-time behavioral data of the entities it hosts, calculate local anomaly deviations, and receive and execute collaborative defense commands. An entity can refer to a running unit monitored by the awareness execution node, such as, but not limited to, user sessions, processes, containers, microservices, applications, and virtual instances.

[0016] Behavioral data can refer to multi-dimensional raw information that reflects the operational status of an entity. For example, it can include network traffic data (such as the target IP / port of the connection, protocol type, traffic volume, and connection frequency), system call data (such as process creation, file access, and registry modification), and resource usage data (such as CPU utilization, memory usage, and disk I / O rate).

[0017] Anomaly deviation can be a quantitative indicator calculated by the perception execution node after comparing the real-time collected behavior data with the local behavior baseline model. The value range is [0,1]. The larger the value, the higher the deviation of the current behavior from the baseline and the more serious the anomaly.

[0018] A trust assessment engine can refer to a functional module deployed on the core servers of each security domain. It is used to receive the abnormal deviation reported by the perception execution nodes within the domain, query the blockchain network to obtain the trust chain value of the node, calculate the dynamic trust weight of the node based on the two, and synchronize the trust weight to the global collaborative decision-making center.

[0019] In this embodiment of the invention, after the system is running, the sensing execution nodes deployed in each security domain can continuously collect real-time behavioral data of the entities they carry according to a preset monitoring period (e.g., 10 seconds). The dimensions of the collected data can be consistent with those in the behavioral baseline model establishment phase, and may include network traffic data, system call data, and resource usage data. Next, the sensing execution nodes compare the collected behavioral data with the locally pre-stored behavioral baseline model to calculate the corresponding abnormal deviation degree, which characterizes the degree to which the node's current behavior deviates from the normal pattern. Then, the sensing execution nodes report the calculated abnormal deviation degree to the trust assessment engine within their security domain according to a preset reporting strategy. The preset reporting strategy may include: reporting immediately when the abnormal deviation degree exceeds a preset mild alarm threshold, or reporting at a fixed period. The reporting data packet may contain node identifier, abnormal deviation degree value, a summary of the behavioral profile that triggered the abnormality (e.g., CPU mutation rate exceeding 80%, access to unconventional ports), timestamp, and other information.

[0020] S120. Based on the abnormal deviation and trust chain value, the trust weight of the perception execution node is determined by the trust assessment engine and synchronized to the global collaborative decision-making center.

[0021] The trust chain value refers to a numerical value stored in the blockchain network, reflecting the trustworthy performance of the sensing and execution nodes in historical collaborative defense. Its value can be dynamically updated based on the node's event records in cross-domain collaboration (such as successfully responding to cross-domain requests, providing effective threat intelligence, and being marked as attacked). The trust weight refers to a comprehensive trust metric calculated by the trust assessment engine based on the anomaly deviation and the trust chain value, used to characterize the overall trustworthiness of the sensing and execution nodes at the current moment.

[0022] A global collaborative decision-making center can refer to a core control node deployed at the system's global level, responsible for aggregating reported data from various security domains, performing global behavior analysis, generating collaborative defense commands, and uniformly managing the identity certificate permissions of each sensing and execution node.

[0023] In this embodiment of the invention, the trust assessment engine can receive abnormal deviations reported by each sensing execution node within the security domain, and send query requests to a preset blockchain network to obtain the trust chain value of the sensing execution node at the current moment. The trust chain value can be generated and stored in the blockchain network based on the node's collaborative performance record in historical collaborative defense. Then, the trust assessment engine performs a fusion calculation on the abnormal deviation and trust chain value of the sensing execution node to obtain the corresponding trust weight, and synchronizes it to the global collaborative decision center for subsequent certificate permission adjustments and collaborative defense instruction generation.

[0024] S130. Adjust the identity certificate permissions of the perception execution node based on trust weight through the global collaborative decision-making center, and distribute the adjusted identity certificate to the perception execution node.

[0025] In this context, an identity certificate can refer to a digital certificate issued by a certificate service that contains a node's identity identifier, permission level, trust weight, and validity period. It is used for node authentication and permission verification within the collaborative defense system. Identity certificate permissions can refer to authorization information embedded in the identity certificate, used to limit the scope of operations that a sensing and execution node can perform within the collaborative defense system. These permissions are dynamically determined based on the node's current trust weight and are adjusted in real time as the trust weight changes. They determine the node's role in collaborative defense and the specific defensive operations it can perform (such as isolating nodes, traffic redirection, etc.).

[0026] In this embodiment of the invention, the global collaborative decision-making center can receive the trust weights of the perception execution nodes synchronously reported by the trust assessment engines in each security domain, and then determine the identity certificate permissions that match the trust weights according to the pre-configured weight-permission mapping relationship. Next, the global collaborative decision-making center generates an identity certificate containing the current trust weight, identity certificate permissions, and a new validity period, and sends it to the corresponding perception execution node through a secure communication channel. The node receives and stores the certificate for identity authentication and permission verification in subsequent communications.

[0027] S140. The global collaborative decision-making center generates a collaborative defense command based on the trust weight of each perception execution node and the global behavior analysis results. After performing two-way identity certificate verification with the target perception execution node, the collaborative defense command is sent to the target perception execution node.

[0028] The global behavior analysis results can refer to the potential threat patterns, attack propagation path predictions, abnormal behavior correlation graphs, and comprehensive risk assessment conclusions identified by the global collaborative decision-making center after processing behavioral data reported from multiple security domains through cross-domain correlation, time series analysis, and attack pattern matching. These conclusions guide the generation of collaborative defense instructions. Collaborative defense instructions can refer to defense control instructions generated by the global collaborative decision-making center to guide target nodes in executing specific defense measures. For example, these instructions may include threat descriptions, suggested defense actions, and a list of affected nodes determined based on threat propagation path predictions. Two-way identity certificate verification refers to the process where both communicating parties present their identity certificates to each other before establishing a connection or transmitting data, and each verifies the signature validity, validity period, and whether the trust weight carried in the certificate meets a preset trust threshold. Target awareness execution nodes can refer to the awareness execution nodes specified in the collaborative defense instructions that need to execute defense actions.

[0029] In this embodiment of the invention, the global collaborative decision-making center can receive the trust weights of the perception execution nodes reported by the trust assessment engines of each security domain, and combine them with the cross-domain threat intelligence and attack pattern identification results obtained through global behavioral analysis to comprehensively judge the current network threats and their scope of influence, and generate structured collaborative defense instructions. These instructions may include key information such as threat descriptions (e.g., attack source, attack type, behavioral characteristics), suggested defense actions (e.g., isolation, rate limiting, privilege downgrading, traffic redirection), and a list of affected nodes (a set of target perception execution nodes determined based on threat propagation path prediction). Then, during the process of the global collaborative decision-making center issuing the collaborative defense instructions to the corresponding target perception execution nodes, both communicating parties need to verify each other's identity certificates. This includes verifying the validity and expiration of the signature in the certificate, and whether the trust weight carried in the certificate meets the preset trust threshold. Only after both parties' identity certificates are verified will the collaborative defense instructions be sent to the receiving party, until the instructions are issued to the designated target perception execution nodes.

[0030] S150: Receive collaborative defense instructions through the target awareness execution node, and execute corresponding defense actions based on its own trust status, the credibility of the instruction source, and the preset collaborative defense strategy.

[0031] Here, "self-trust status" can refer to the current trust metric of the target perception execution node, such as its abnormal deviation and trust weight. "Instruction source credibility" can be a quantitative assessment of the credibility of the sender of the collaborative defense instruction and its transmission path, used to measure whether the instruction has been tampered with during transmission, whether the instruction initiator has sufficient trust level, and whether the entire transmission link is trustworthy. "Preset collaborative defense strategy" can refer to a set of decision rules pre-configured and stored locally on the target perception execution node. This set of rules defines how, upon receiving a collaborative defense instruction, the target perception execution node's self-trust status, instruction source credibility, and suggested defense actions in the collaborative defense instruction are comprehensively judged to determine whether to execute the collaborative defense instruction and what defense actions to execute.

[0032] In this embodiment of the invention, after receiving a collaborative defense instruction from the global collaborative decision-making center, the target-aware execution node does not execute it unconditionally. Instead, it obtains the credibility of the instruction source. For example, it can obtain the trust weight of each node by parsing the identity certificates of each node on the instruction transmission path, and calculate the credibility of the instruction source based on a preset path trust algorithm. Then, the target-aware execution node intelligently decides whether to execute the instruction based on a preset collaborative defense strategy, combined with the credibility of the instruction source and its current trust status. For example, the decision-making process may include: when the instruction requires isolation and the node's own trust weight is higher than a threshold, the source credibility is higher than a threshold, and the anomaly deviation is lower than a threshold, the decision is to execute isolation; when the node's own trust weight is lower than a security threshold, regardless of the instruction content, the decision is to downgrade the execution permission; when the source credibility is low but the node's local anomaly deviation is high and matches the threat described in the instruction, the decision is to execute the defense action corresponding to the local anomaly; when no execution conditions are met, the decision is to refuse to execute the instruction, etc. Finally, the target-aware execution node executes the corresponding defense action based on the decision result, or refuses to execute and ignores the instruction. If the decision is to execute, the node will perform the corresponding operations according to the suggested defense actions in the instruction, including but not limited to isolating the node, redirecting traffic, downgrading privileges, and updating firewall rules; if the decision is to deny, the node will record the reason for denial and will not perform any defense actions.

[0033] The technical solution of this invention achieves a tight binding between certificate permissions and the real-time risk status of nodes by sensing and executing nodes' real-time reporting of abnormal deviations, dynamically calculating trust weights based on trust chain values, and dynamically adjusting node identity certificate permissions accordingly. Simultaneously, the global collaborative decision-making center generates collaborative defense instructions based on trust weights and global behavior analysis, and issues them after two-way verification of the target node's identity certificate, ensuring the trustworthiness of the instruction source. After receiving the instruction, the target node further considers its own trust status, the trustworthiness of the instruction source, and preset strategies to autonomously decide whether to execute it, effectively avoiding the security risks of nodes blindly executing malicious instructions or falsely reporting instructions. This method significantly improves the real-time performance, accuracy, and anti-attack capability of cross-domain network threat defense through the synergistic effect of multiple mechanisms: dynamic weight-driven certificate adjustment, two-way verification to ensure instruction trustworthiness, and node autonomous decision-making to enhance robustness.

[0034] Furthermore, based on the above embodiments of the invention, behavioral data of the entity being carried is collected through the perception execution node, and the abnormal deviation of the behavioral data is reported to the trust assessment engine, including: Behavioral data of entities is collected in real time through sensing execution nodes; the behavioral data includes at least network traffic data, system call data, and resource usage data; By comparing behavioral data with a locally pre-built behavioral baseline model through the perception execution node, the abnormal deviation degree is obtained and reported to the trust assessment engine.

[0035] Among these, the behavioral baseline model can refer to a pre-constructed benchmark data model used to characterize the normal behavioral standards of the entities carried by the sensing execution node, and is used to determine the degree of anomalies in subsequent real-time behavioral data. Network traffic data can refer to communication-related data such as data packets, transmission rates, and access addresses generated by the entities carried by the sensing execution node during network communication. System call data can refer to operation-related data such as system interface calls, instruction executions, and file accesses initiated by the entities carried by the sensing execution node during operation. Resource usage data can refer to data related to the occupation and consumption of system resources such as hardware, storage, and computing power by the entities carried by the sensing execution node.

[0036] In this embodiment of the invention, the process of collecting behavioral data and reporting abnormal deviations by the perception execution nodes deployed in each security domain specifically includes: (1) The perception execution node can collect behavioral data of the entities it carries in real time, such as at least network traffic data, system call data and resource usage data. Among them, network traffic data may include the target IP address of the connection, port number, protocol type, data packet size, connection frequency, etc.; system call data may include process creation, file reading and writing, registry modification, system API call sequence, etc.; and resource usage data may include CPU utilization, memory usage, disk I / O rate, etc.

[0037] (2) The perception execution node can maintain a pre-built behavior baseline model locally. This baseline model is built based on behavior data collected during normal operation in the past, using statistical methods (such as mean, standard deviation) or machine learning algorithms (such as single-class support vector machine, isolated forest) to describe the behavioral profile of an entity in a normal state. When real-time behavior data for the current period is obtained, the perception execution node can compare the behavior data with the pre-built behavior baseline model and statistically calculate an anomaly deviation to quantify the degree of difference between the current real-time behavior data and the local behavior baseline. In one embodiment, each feature value in the real-time behavior data can be compared with the normal range of the corresponding feature in the behavior baseline model to calculate the deviation of each feature, and all features can be combined to obtain a normalized anomaly deviation, where the value range of the anomaly deviation is [0,1], and the higher the value, the more the current behavior deviates from the normal pattern.

[0038] (3) After calculating the abnormal deviation, the sensing execution node can report the data packet containing the node identifier, abnormal deviation, timestamp and possible behavior summary information to the trust assessment engine in the same security domain through a secure communication channel according to a preset strategy (e.g., report immediately when the abnormal deviation exceeds the mild alarm threshold, or report at a fixed period).

[0039] In one embodiment, comparing behavioral data with a locally pre-built behavioral baseline model through a perception execution node to obtain the abnormal deviation degree may include: S1. Within a preset sampling window (e.g., 10 seconds), the perception execution node normalizes the multidimensional behavioral data collected from entity e into a standard feature vector. ,in For network subvectors, at least include connection attempt frequency, proportion of access to unused ports, and entropy value of external domain name requests; For system subvectors, at least the edit distance of sensitive system call sequences, the temporal anomaly degree of file access, and the violation degree of process derivation relationships should be included; The resource subvector should include at least the fluctuation coefficient of CPU utilization, the unexpected growth slope of the memory working set, and the randomness ratio of disk I / O.

[0040] S2. The perception execution node calls the dynamic behavioral baseline model maintained for each entity i. This baseline model includes not only the statistical values ​​of each behavioral feature (such as moving averages) Standard deviation This also includes its normal behavioral patterns (such as typical sequences and association rules). The following evaluation metrics are calculated for each entity i: ① Statistical deviation. This is used to measure the shift of the current behavioral feature value relative to the historical distribution, where This is the current behavior feature value. To prevent division by zero by small constants; ② Quantile deviation It is specifically designed to capture extreme behavior that breaks through historical highs (such as the 95th percentile), among which ③ Historical 95th percentile; ③ Pattern deviation It is used to detect changes in behavioral habits, among which This is a time series segment of this recent behavioral characteristic. These are typical pattern templates learned from historical normal behavior. The similarity function can be measured using dynamic time warping (DTW) distance or cosine similarity, etc.

[0041] Next, for the i-th behavioral characteristic of entity e, the maximum value among the above three evaluation indicators is taken as the comprehensive deviation. Taking the maximum value ensures that any angular anomaly can be captured by the system.

[0042] S3. The perception execution node determines the initial deviation of each entity e according to the following formula: in, The dynamic weight of the i-th behavioral feature can be dynamically adjusted based on the importance of the business carried by the entity and the current context. For example, on a financial server, the weight of the feature "frequency of large database queries" is higher than the weight of the feature "number of network packets"; when lateral movement is detected, the weight of the feature "number of network connections" is temporarily increased, etc.

[0043] In one embodiment, the calculated initial deviation of the entity can be corrected within the operational context. For example, if entity e is accessing the core database (a highly sensitive operation), its initial deviation will be multiplied by a sensitivity coefficient greater than 1. (e.g., 1.3), to raise the risk level: .

[0044] Furthermore, to prevent score jitter caused by transient noise, an exponentially weighted moving average algorithm can be used to smooth the deviation after context enhancement: in, It is a smoothing coefficient used to control the response speed to new anomalies.

[0045] In one embodiment, a single sensing execution node can monitor multiple entities (such as user sessions, processes, microservices, etc.), then the node-level anomaly detection score ( This is a converged view of the entity's threat status, calculated using the following formula: In the formula, The maximum deviation among all monitored entities represents the most severe anomaly of the entity within the monitoring range of this node, used to capture the extreme case of "a single point being completely hijacked". The 95th percentile of the deviation of all entities, i.e. the average anomaly of the top 5% of the most severe entities, is used to characterize the overall anomaly trend of the nodes. This is a weighting balancing factor used to balance the proportion of "worst-case scenario" (max) and "overall anomaly trend" (P95) in the node-level score. This design ensures that a node can be identified as anomaly even if only one entity is completely hijacked (high max value) or multiple entities exhibit moderate anomalies (high P95 value).

[0046] Furthermore, based on the above embodiments of the invention, the behavioral baseline model includes a spatiotemporally dependent multimodal anomaly detection model. This model comprises a multimodal feature encoding layer, a spatiotemporally dependent encoding layer, and an anomaly scoring layer. By comparing behavioral data with the locally pre-built behavioral baseline model through a perception execution node, the anomaly deviation is obtained, including: The collected behavioral data is input into a pre-trained spatiotemporal dependent multimodal anomaly detection model through the perception execution node; The behavioral data is encoded by channel-wise using a multimodal feature coding layer to extract sequence features, graph structure features, and statistical features. Spatiotemporal dependency modeling and fusion of sequence features and graph structure features are performed through a spatiotemporal dependency coding layer to obtain fused spatiotemporal features; Spatiotemporal and statistical features are obtained through an anomaly scoring layer, and the anomaly deviation degree is output based on the spatiotemporal and statistical features.

[0047] Specifically, the spatiotemporal dependent multimodal anomaly detection model is designed to address the temporal, topological, and statistical characteristics of cybersecurity behavior data. It adopts a three-layer architecture of "multimodal coding - spatiotemporal fusion - multi-scale scoring," with the specific implementation of each layer as follows: (1) Multimodal feature coding layer This layer employs a channel-based encoding strategy to process different types of behavioral data and outputs the following three types of deep features: ① Sequence Feature Encoding Channel: Used to process temporal behavioral data such as network connection sequences and system call sequences, it can be implemented using an improved Causal Dilated CNN. The input dimension is... Where T is the length of the time window. The sequence feature dimension is used; after processing with 1D convolutions and residual connections with progressively increasing dilatancy, the output dimension is... Sequence features ( (as the encoded feature dimension), capturing long sequence dependencies while maintaining real-time inference efficiency.

[0048] ② Graph Structure Feature Encoding Channel: Used to process graph structure data such as process derivation relationships and network topology connections, it can be implemented using a lightweight graph attention network (LightGAT). A behavioral graph is constructed with entities as nodes and relationships between entities as edges. A multi-head attention mechanism aggregates features from neighboring nodes, and edge-type attention is introduced to distinguish the weights of different relationships such as parent-child processes and network connections. The output dimension is... The graph structure features, in which For the number of entity nodes, This is the dimension for encoding graph features. The graph structural features are used to characterize the spatial dependencies and structural context information between entities.

[0049] ③ Statistical Feature Encoding Channel: Used to process resource usage statistics such as CPU utilization, memory usage, and disk I / O, this can be implemented using an adaptive feature cross-network. Specifically, each resource usage statistical indicator is used as input features, and the non-linear interaction relationship between different statistical indicators is automatically learned through the feature cross-layer. ,in , These are the i-th and j-th resource usage statistics indicators, This is the enhanced feature resulting from the cross-fusion of the i-th resource indicator with all other indicators. The cross weights are learnable; they are then mapped to statistical coding features of a unified dimension through a fully connected layer. These statistical features are used to capture abnormal patterns in resource usage.

[0050] (2) Spatiotemporal Dependency Coding Layer This layer is the core module of the model, which performs in-depth modeling of temporal and topological features in both temporal and spatial dimensions, and then completes the fusion through a gating mechanism. The specific process is as follows: ① Temporal dependency modeling: The temporal features output from the sequence feature encoding channels are processed using bi-temporal convolution (Bi-Temporal Conv) to simultaneously capture forward causal dependencies and backward backtracking dependencies, outputting a temporal dimension representation. .

[0051] ② Spatial Dependency Modeling: The graph structure features output from the graph structure feature encoding channels are processed using a relation-aware graph neural network to distinguish the association weights between different types of entities and output a spatial dimension representation. .

[0052] ③ Spatiotemporal Gated Fusion: Learnable gating units are used to adaptively fuse temporal and spatial features. The fusion formula is as follows: In the formula, Gate is the gate weight, which is used to control the respective contribution ratio of temporal features and spatial features in the fusion. is the sigmoid activation function, used to map the gate value to the interval [0, 1]; and The weight matrix and bias terms are learnable. This mechanism enables the model to dynamically adjust the fusion ratio of temporal and spatial features based on the context of the current behavioral data. When the gate value is close to 1, more temporal features are retained, and when the gate value is close to 0, more spatial features are retained, thus achieving adaptive spatiotemporal feature fusion.

[0053] To constrain the semantic consistency of spatiotemporal representations and improve model robustness, a spatiotemporal consistency loss function is introduced during the model training phase, as follows: In the formula, The value represents the spatiotemporal consistency loss; N is the number of entity nodes in the sample. This represents the time dimension of the i-th entity. This represents the spatial dimension of the i-th entity. This represents spatiotemporal similarity. The loss function encourages the model to learn spatiotemporally semantically consistent behavioral representations; the lower the spatiotemporal similarity of samples, the greater the penalty for loss.

[0054] (3) Anomaly scoring layer This layer receives the fused spatiotemporal and statistical features, performs feature concatenation, and outputs anomaly scores through a multi-scale detection head. Specifically, it includes the following three types of detection branches: ① Transient Anomaly Detection Head: Focuses only on the latest time step of the fused spatiotemporal features to detect sudden transient anomalous behaviors. This detection head is based on... The features of the last time step are mapped to instantaneous anomaly scores using a multilayer perceptron (MLP). This is used to capture sudden, extremely short-lived abnormal events (such as a single malicious connection or a momentary CPU spike). Transient Anomaly Score ,in This represents the last time step after taking the spatiotemporal features after fusion.

[0055] ② Context Anomaly Detection Head: This head uses an attention mechanism to weighted aggregate historical features to detect persistent anomalies that deviate from the context. Attention-weighted aggregation of the complete time series: This involves using learnable attention weights to perform a weighted summation of historical time steps to generate a context anomaly score. This branch is used to detect persistent anomalies that require contextual analysis (such as slow privilege escalation or long-term data breaches), and triggers an alert when the current behavior deviates significantly from the local context (such as the past hour).

[0056] ③ Collective Anomaly Detection Head: This head aggregates features from all nodes using graph pooling to detect collaborative group anomalies across multiple nodes. It inputs statistical features and fused spatiotemporal features into the graph pooling layer (Graph_Pooling) to aggregate feature representations of all entities. This branch is used to detect distributed attacks that require multi-node collaboration to discover (such as DDoS attacks, worm propagation, collaborative scanning, etc.). An alert is triggered when the behavior of a single node appears normal but the behavior of the group exhibits an abnormal pattern.

[0057] Furthermore, the anomaly scoring layer also includes an uncertainty estimation module. This module employs Monte Carlo Dropout technology, performing T forward propagations during inference. The final anomaly deviation is the mean of the T scores, and it also outputs the uncertainty of the score. When the uncertainty exceeds a preset threshold, the weight of that score is automatically reduced, improving the system's robustness in noisy environments. The final output anomaly deviation (ADS) ranges from [0,1], with a larger value indicating a higher degree of behavioral abnormality.

[0058] Furthermore, the spatiotemporal dependent multimodal anomaly detection model employs a multi-task learning strategy for pre-training. The primary task is anomaly detection and binary classification, while auxiliary tasks include behavior sequence prediction and normal behavior pattern reconstruction. This multi-task approach enhances the model's generalization ability. Model updates utilize the Elastic Weight Consolidation (EWC) algorithm for incremental learning, preventing catastrophic forgetting. During deployment, knowledge distillation compresses the complex teacher model into a lightweight student model, adapting to the edge computing power limitations of the perception execution nodes. It also supports dynamic adjustment of model complexity based on the real-time load of the nodes; for example, switching to lightweight mode when CPU utilization exceeds a preset threshold and switching to standard mode when the load is normal. This achieves a balance between detection accuracy and operational overhead, ensuring stable system operation under various load conditions.

[0059] This embodiment independently collects behavioral data of the entities it carries by the perception execution nodes deployed in each security domain, and calculates and reports abnormal deviations. This enables real-time and accurate perception of threats at the source of network security defense, and provides a reliable data foundation for subsequent dynamic trust weight calculation and cross-domain collaborative defense.

[0060] Furthermore, based on the above embodiments of the invention, the trust weight of the perception execution node is determined by the trust assessment engine based on the abnormal deviation degree and the trust chain value, and synchronized to the global collaborative decision-making center, including: The trust assessment engine receives abnormal deviations reported by the sensing execution nodes and queries the preset blockchain network for the current trust chain value. The trust assessment engine integrates and calculates the abnormal deviation and trust chain value to obtain the trust weight, and then synchronizes the trust weight to the global collaborative decision-making center.

[0061] In this context, a blockchain network can refer to a distributed ledger system jointly maintained by nodes in multiple security domains. It is used to store the trust chain value and its change records of each sensing and execution node, and ensures that the data is immutable and globally consistent through a consensus mechanism, providing a reliable data source for trust assessment.

[0062] In this embodiment of the invention, the process by which the trust evaluation engine determines the trust weight of each perception execution node and synchronizes it to the global collaborative decision-making center specifically includes: (1) The trust assessment engine can receive the abnormal deviation reported by each sensing execution node within this security domain, and then initiate a query request to the preset blockchain network based on the node ID and other identification information of the sensing execution node to obtain the current trust chain value of the node. The trust chain value can be recorded in the blockchain ledger to reflect the node's trustworthy performance in historical cross-domain collaborative defense, such as the number of times it has successfully responded to cross-domain requests, the record of providing effective threat intelligence, and whether it has been successfully attacked.

[0063] In one embodiment, the Trust Chain Value (TC) quantifies the historical trustworthiness of a node as a "collaboration partner," with the core idea that "past successful collaborations enhance future trustworthiness." Specifically, the quantification process of the Trust Chain Value TC includes: ① Definition and recording of collaborative events Define positive and negative collaboration events. A positive collaboration event is recorded when node A responds to a collaboration command and provides effective security services to node B (such as forwarding a genuine threat intelligence or successfully intercepting attack traffic flowing through it). Conversely, a negative collaboration event is recorded when node A fails to execute the command (e.g., due to insufficient resources) or the information provided is verified to be false or misleading.

[0064] All collaborative events are digitally signed by the coordinator within the relevant security domain and recorded in a lightweight, append-only distributed log (such as a simplified permissioned blockchain sidechain or a distributed hash table DHT) to ensure that the event records are immutable and traceable. Each collaborative event record may include information such as the initiating node identifier, the target node identifier, the event type (positive / negative), the event value score, the timestamp, and the digital signature.

[0065] ② Trust chain graph modeling The defense nodes in the network can be abstracted into a dynamic trust graph. Where node V represents each sensing execution node or its corresponding network security domain, and directed edges... This represents the direct trust assessment of node A towards node B. Its weight is calculated based on the historical collaboration event records between node A and node B. The higher the edge weight, the higher the degree of trust A has in B.

[0066] ③ Calculate the trust chain value of the target node N: In the formula, The direct trust value of the target node N; The indirect trust value of the target node N; As a harmonizing factor, it is used to balance the importance of direct experience and indirect recommendations, for example This indicates that direct experience is more important. Among these, the direct trust value... The acquisition process includes: collecting evaluations of N from all nodes that have had direct collaboration records with N; for each evaluation, aggregating (e.g., weighted averaging) the evaluations of all nodes towards N based on event type weights (e.g., successful interception has a higher weight than intelligence sharing) and time decay factors (recent events have a greater impact) to obtain a direct trust value. The range is [0,1].

[0067] Indirect Trust Value The acquisition process includes: for nodes that have not directly collaborated with node N, indirect trust values ​​need to be calculated through trust graph propagation. For example, algorithms similar to PageRank or trust propagation can be used to perform a limited number of hops (such as 2 to 3 hops) of search and aggregation in the trust graph to calculate the recommendation trust value from "friends of friends".

[0068] ④ The trust assessment engine periodically (e.g., every minute) or upon triggering events (e.g., detecting a new attack or a node reporting new behavioral data), recalculates the TC value for nodes within its jurisdiction and reports it along with the node's ADS value to the global collaborative decision-making center. When a node participates in a new collaborative event, its TC value is updated in real time according to the above steps to reflect its latest historical trustworthiness. Simultaneously, the TC value is persistently stored through the blockchain network's smart contract mechanism, ensuring that it can be queried and verified by all security domains.

[0069] This embodiment uses trust graph modeling and propagation algorithms. The TC value not only considers the direct collaboration history of nodes, but also captures the "word-of-mouth effect" in the network through indirect trust propagation, so that newly joined nodes or nodes with less collaboration can also obtain a reasonable initial trust assessment. The time decay mechanism ensures that the trust value can reflect the recent behavior of nodes in a timely manner, preventing nodes from maintaining a false high trust value after being compromised. Event digital signatures and blockchain storage ensure the immutability of collaboration records, providing a reliable data foundation for trust assessment.

[0070] (2) The trust assessment engine takes the obtained abnormal deviation degree and trust chain value as input, and performs fusion calculation according to the preset dynamic weight formula to obtain the trust weight of the perception execution node, which is specifically expressed as follows: In the formula, DW is the trust weight; ADS is the anomaly deviation degree; TC is the trust chain value; This is the abnormal deviation weighting coefficient, used to control the degree of influence of real-time behavioral risk on trust weight; This is the trust chain value weight coefficient, used to control the degree of influence of historical trustworthiness on trust weight.

[0071] (3) The trust assessment engine synchronizes the calculated trust weights to the global collaborative decision-making center. The global collaborative decision-making center receives the trust weights of each perception execution node reported by each security domain, which serve as the basis for subsequent collaborative defense instruction generation and certificate permission adjustment.

[0072] This embodiment achieves a dynamic and comprehensive assessment of node trust status by integrating real-time behavioral anomaly levels with historical collaborative trust performance, overcoming the limitations of single-dimensional assessment. The trust chain value is stored in the blockchain network, ensuring the immutability and global consistency of trust data, providing a reliable foundation for trust assessment. Trust weights are synchronized to the global collaborative decision-making center, enabling the center to grasp the trust status of nodes in each security domain, providing a quantitative basis for generating cross-domain collaborative defense commands and dynamically adjusting certificates. Trust weights are updated in real-time according to changes in anomaly deviation and trust chain value, enabling rapid response to changes in node behavior and reputation, achieving dynamic and precise trust management.

[0073] Furthermore, based on the above embodiments, this embodiment also provides a specific implementation method for multi-factor dynamic trust weight fusion calculation. This embodiment is applicable to scenarios that require refined quantitative evaluation of the real-time trust status of sensing execution nodes. By fusing multi-dimensional factors to calculate trust weights, it provides a more accurate quantitative basis for collaborative defense decisions.

[0074] like Figure 2 As shown, the multi-factor dynamic trust weight fusion calculation process in this embodiment includes the following steps: S210. Calculate the real-time security status score S(t).

[0075] Specifically, the trust assessment engine obtains the current abnormal deviation reported by the perception execution node. The real-time security status score is calculated as follows: in, The normalization function is expressed as: In the formula, and These are the minimum and maximum ADS values ​​for all nodes within the security domain to which this node belongs, respectively, within the most recent hour. To prevent small constants (such as 0.001) from being divided by zero, the influence of differences in ADS dimensions between different security domains is eliminated through intra-domain normalization.

[0076] The behavioral consistency factor is represented as: In the formula, represents the standard deviation of the node's most recent 10 ADS samples, and k is a sensitivity parameter. The smaller the ADS fluctuation, the lower the sensitivity parameter. A smaller value indicates higher consistency, and the closer the behavior consistency factor is to 1, indicating that the node behavior is stable and reliable. Conversely, a smaller value indicates that the node behavior fluctuates more and its reliability decreases.

[0077] S220. Calculate the threat intelligence contribution score C(t).

[0078] Specifically, the trust assessment engine statistically analyzes the valid threat intelligence records submitted by the perception execution nodes in the past 24 hours and calculates the basic contribution value: In the formula, The value score of the j-th threat intelligence is given (the value range is 0-1). The submission time of intelligence j. Value score is the attenuation factor, where N is the number of valid intelligence reports submitted in the last 24 hours. Further weighted calculation based on the following factors: In the formula, For intelligence accuracy (based on subsequent verification results); For timeliness scoring, it is represented as ; The score for the scope of influence is represented as follows: ; , and These are preset weighting coefficients.

[0079] Furthermore, nodes that trigger effective collaborative defense will receive a collaborative bonus: in, The number of times effective collaborative defense is triggered. The maximum bonus is set at 0.3 to avoid excessive influence. The final threat intelligence contribution score is: S230. Calculate the attack penalty factor A(t).

[0080] Specifically, the trust assessment engine integrates the confidence level of local attack detection. (Malicious behavior analysis from DBN), collaborative detection confidence level (Alarm aggregation of adjacent nodes) and manual confirmation flags (If applicable) Determine the confidence level that the node has been attacked. : Determine the attack severity level and assign values ​​based on the stage of the attack: 0.2 for reconnaissance stage, 0.5 for intrusion attempt stage, 0.8 for privilege acquisition stage, and 1.0 for full control stage.

[0081] Calculate the time decay factor: In the formula, This is the start time of the latest attack. The decay rate is such that the penalty after the attack ends gradually weakens over time.

[0082] The final penalty factor for the attacked state is: S240, Update the historical trust baseline H(t).

[0083] Specifically, the trust assessment engine uses an exponentially weighted moving average to maintain the historical trust baseline of the nodes: In the formula, The historical preservation coefficient, initial value (Neutral Trust). This mechanism smooths out short-term fluctuations, preventing trust weights from drastically changing due to a single instance of abnormal behavior.

[0084] S250 calculates trust weights by fusing real-time security status score S(t), threat intelligence contribution score C(t), attack status penalty factor A(t), and historical trust baseline H(t).

[0085] Specifically, the trust assessment engine integrates the above four components according to preset weighting coefficients: In the formula, The trust weight for the final output; The real-time security state weight is used to control the degree of impact of real-time behavioral risks; Contribution weight is used to control the degree of impact of threat intelligence contributions; This is the attack penalty weight, used to control the severity of the penalty for the attacked state; The historical baseline weight is used to control the smoothness of historical trust.

[0086] S260. Dynamically adjust the weight coefficients based on the defense phase and node role.

[0087] Specifically, the weighting coefficient adjustments based on the defense phase include: When the global threat level is high, set , , , When a node is on the critical path, set , , , When in normal defense mode, set , , , .

[0088] Furthermore, personalized adjustments can be made based on node roles: For gateway nodes, improve Weighting to 0.6, emphasizing real-time security status; For intelligence analysis nodes, improve Weighting to 0.5, focusing on contribution; For core business nodes, improve Weight reduced to 0.5, severely punishing the attacked state.

[0089] S270. Nodes are divided into different trust levels according to trust weight.

[0090] Specifically, the trust assessment engine can be based on the calculated... Divide the nodes into different trust levels: High Trustworthiness (0.8-1.0): Can participate in core collaborative defense and be assigned high-privilege tasks; Trustworthy (0.6-0.8): Normally participates in collaborative defense and is assigned routine tasks; Low confidence level (0.4-0.6): Limited participation, additional verification required; Suspicious (0.2-0.4): Only allow operations with minimum privileges; strengthen monitoring. Untrusted (0-0.2): Force isolation, only allowing communication repair.

[0091] For newly added nodes, the initial DW is 0.5 and a 24-hour observation period is set; for nodes that have been repaired, the attack penalty is reset to zero, but the DW gradually recovers from 0.3; for nodes that have been offline for a long time, the DW value decays over time and needs to be reassessed when they come back online.

[0092] The trust assessment engine will synchronize the final calculated trust weight to the global collaborative decision-making center for use in subsequent certificate permission adjustments and collaborative defense command generation.

[0093] This embodiment achieves a comprehensive, dynamic, and accurate assessment of node trust weights through the aforementioned multi-factor fusion calculation mechanism. Compared to single-dimensional trust assessment schemes, this embodiment simultaneously considers four dimensions: real-time behavioral security status, threat intelligence contribution, attack status, and historical trust baseline. This allows trust weights to reflect a node's instantaneous risk, long-term reputation, historical contribution, and current security posture, effectively improving the accuracy and robustness of trust assessment. Furthermore, through a dynamic adjustment mechanism for weight coefficients and special state handling rules, trust assessment can adapt to different defense stages, node roles, and network states, providing a more accurate and reliable quantitative basis for decision-making in collaborative defense systems.

[0094] Furthermore, based on the above embodiments of the invention, the method further includes: The trust assessment engine receives summaries of behavioral profiles reported by the perception execution nodes, as well as global behavioral analysis results issued by the global collaborative decision-making center. The trust assessment engine corrects the abnormal deviation and trust chain values ​​based on behavioral profile summaries, global behavioral analysis results, and preset correction strategies, resulting in corrected abnormal deviation and trust chain values. The trust weight is obtained by fusing the corrected anomaly deviation and the trust chain value through a trust assessment engine.

[0095] Among them, the behavioral profile summary can refer to the summary data reported by the perception execution node, which summarizes its overall behavioral characteristics. For example, it can include the behavioral patterns, abnormal situations, and key event records of the entities carried by the node. The global behavioral analysis result can refer to the cross-domain threat pattern recognition result generated by the global collaborative decision-making center after performing spatiotemporal correlation analysis on the behavioral data reported by multiple security domains. It is used to reveal distributed attacks, collaborative attacks, or attack propagation paths that cannot be detected by a single node.

[0096] The preset correction strategy can refer to a set of pre-configured rules for correcting anomaly deviation and trust chain values. This strategy defines how to adjust the values ​​of anomaly deviation and trust chain values ​​based on behavioral profile summaries and global behavioral analysis results. The rules may include, for example, intelligence contribution rewards, zeroing upon attack, slow improvement for sustained low anomalies, and enhancement of cross-domain attack patterns.

[0097] In this embodiment of the invention, the solution further includes a dynamic optimization calculation process for the trust weight of the perception execution node by the trust evaluation engine, specifically including: (1) The trust assessment engine receives behavioral profile summaries reported by the perception execution nodes and global behavioral analysis results issued by the global collaborative decision-making center. The behavioral profile summary refers to the key behavioral feature information extracted by the perception execution node based on its local behavioral baseline model, reflecting the behavioral patterns and anomalies of the entities carried by that node. The global behavioral analysis results refer to the cross-domain threat pattern recognition results generated by the global collaborative decision-making center after performing correlation analysis on behavioral data from multiple security domains, revealing distributed or collaborative attack behaviors that cannot be detected by a single node.

[0098] (2) The trust assessment engine dynamically corrects the Abnormal Deviation (ADS) and Trust Chain Value (TC) of the perceived execution node based on a preset correction strategy and in combination with the received behavioral profile summary and global behavioral analysis results, to obtain the corrected Abnormal Deviation (ADS') and the corrected Trust Chain Value (TC'). In one embodiment, the correction process may include, but is not limited to: increasing the TC value when the behavioral profile summary indicates that the node has provided valid threat intelligence; increasing the ADS value when the global behavioral analysis results indicate that the node has participated in a cross-domain attack mode; slowly increasing the TC value at a preset rate when the node maintains a low abnormality state; and resetting the TC value to zero when the node is successfully attacked.

[0099] (3) The trust assessment engine performs a fusion calculation on the corrected abnormal deviation (ADS') and the corrected trust chain value (TC') to obtain the latest trust weight of the perception execution node, and synchronizes the trust weight to the global collaborative decision center.

[0100] This embodiment dynamically corrects anomaly deviation and trust chain values ​​by introducing behavioral profile summaries and global behavioral analysis results, achieving multi-dimensional fusion and context awareness in trust assessment. On one hand, behavioral profile summaries enable the trust assessment engine to perceive the local behavioral details and threat intelligence contributions of nodes, thereby allowing for more precise adjustments to the trust chain values ​​of nodes. On the other hand, global behavioral analysis results enable the trust assessment engine to gain a global perspective on cross-domain attack patterns, thus identifying risks and correcting anomaly deviations in advance, even before a single node's anomaly deviation reaches a threshold. This two-layer correction mechanism effectively improves the accuracy and real-time performance of trust weights, enabling the system to detect covert distributed and coordinated attacks earlier. Simultaneously, positive incentives such as intelligence contribution rewards encourage nodes to actively participate in coordinated defense, forming a virtuous cycle of trust ecosystem.

[0101] Furthermore, based on the above embodiments of the invention, the global collaborative decision-making center includes a certificate service. The global collaborative decision-making center adjusts the identity certificate permissions of the sensing execution nodes based on trust weights, and distributes the adjusted identity certificates to the sensing execution nodes, including: The trust weight of the perceived execution node is obtained through the certificate service and synchronized with the trust assessment engine. The certificate service converts trust weights into corresponding permission levels based on a preset weight-permission mapping relationship; the permission level is used to determine the scope of operations that the perception execution node can perform in collaborative defense. Generate an identity certificate that includes permission level, trust weight, and new validity period through the certificate service; The identity certificate is signed using the certificate service, and the signed identity certificate is then distributed to the perception execution node.

[0102] The certificate service can refer to a functional module responsible for managing the lifecycle of identity certificates of the perception execution node. Specific functions may include generating certificates based on trust weights, signing, issuing and updating certificates, etc. In one embodiment, the certificate service can be integrated into the global collaborative decision-making center. The certificate service can be a lightweight certificate (LWCert) service.

[0103] The preset weight-permission mapping relationship can refer to a pre-configured rule that maps a range of trust weight values ​​to corresponding permission levels. For example, different trust weight segments correspond to different permission levels, which is used to convert quantified trust weights into executable authorization policies. The permission level can refer to a discrete authorization level determined according to the trust weight through the preset mapping relationship, which is used to limit the scope of operations that the perception execution node can perform in collaborative defense, such as whether access to critical resources is allowed, and whether cross-domain commands can be initiated.

[0104] In this embodiment of the invention, the process of dynamically adjusting identity certificate permissions based on trust weight specifically includes: (1) A certificate service can be deployed within the global collaborative decision-making center. This certificate service receives the trust weights (DWs) of the perception execution nodes synchronized by the trust assessment engines of each security domain. Then, it converts the trust weights (DWs) into corresponding permission levels according to a preset weight-permission mapping relationship. This mapping relationship can take the form of a piecewise function, for example, mapping DWs with consecutive values ​​[0,1] to discrete permission levels such as "high trust," "medium trust," "low trust," or "observer," "executor," and "coordinator." This permission level determines the scope of operations that the perception execution node can perform in collaborative defense, such as whether it can initiate cross-domain commands or access critical resources. In one specific embodiment, the certificate service can dynamically determine the current executable defense role of the perception execution node based on its trust weight (DW), such as "observer," "executor-isolation," "executor-blocking," or "coordinator." In another embodiment, when the trust weight is greater than or equal to a preset threshold, the permission level can be set to a high trust level to allow the perception execution node to access critical resources.

[0105] (2) The certificate service generates a new identity certificate for the current sensing execution node and embeds the current Trust Weight (DW) value, the corresponding permission level, and the newly set validity period in the certificate's extended fields. The validity period can be set to a short time (such as 1 hour) to force the node to update the certificate periodically and ensure that the certificate always carries the latest trust status.

[0106] (3) The certificate service uses the private key of the global collaborative decision-making center to digitally sign the generated identity certificate, ensuring the integrity and trustworthiness of the certificate's source. After signing, the certificate is distributed to the corresponding perception execution node through a secure channel. The node uses the certificate for identity authentication and permission verification during subsequent communication and collaborative defense command execution.

[0107] This embodiment dynamically adjusts certificate permissions based on real-time trust weights, ensuring that identity certificates always reflect the latest behavioral risks and collaborative trust levels of the perceived execution nodes. On one hand, high-trust nodes can promptly obtain high-privilege certificates to support critical business and collaborative defense operations; on the other hand, when a node's behavior is abnormal or its historical collaborative trust declines, its trust weight decreases, and its certificate permissions are automatically downgraded, effectively preventing compromised nodes from using static high-privilege certificates to move laterally or launch malicious commands. Simultaneously, the embedded trust weights and permission levels in the certificate allow the authenticator to directly obtain the node's trust status during communication without additional queries, improving the verification efficiency and reliability of cross-domain collaborative defense. The entire mechanism forms a closed loop of "real-time assessment - dynamic authorization - immediate effect," significantly enhancing the proactive response capability and security of the network threat defense system in a distributed environment.

[0108] Furthermore, based on the above embodiments of the invention, a collaborative defense command is generated by the global collaborative decision-making center based on the trust weights of each sensing execution node and the results of global behavior analysis. After two-way identity certificate verification between the center and the target sensing execution node, the collaborative defense command is sent to the target sensing execution node, including: The global collaborative decision-making center receives the trust weights of each sensing and execution node and generates corresponding collaborative defense instructions based on the global behavior analysis results. The collaborative defense instructions include at least a threat description, suggested defense actions, and a list of affected nodes. The target perception execution node in the list of affected nodes is determined by the global collaborative decision-making center. Based on the identity certificates of both parties, two-way identity and permission verification is performed, and after the verification is passed, the collaborative defense command is issued to the target perception execution node.

[0109] The threat description can be a structured description of the detected threat type, attack source, and behavioral characteristics. Recommended defensive actions can be the types of defensive operations suggested to the target sensing nodes, such as isolation, rate limiting, privilege downgrading, and traffic redirection. The list of affected nodes can be the set of sensing nodes that require defensive actions, determined based on threat propagation path prediction or a global view; this may include nodes that have been detected as abnormal and nodes on high-risk paths.

[0110] In this embodiment of the invention, the process of the global collaborative decision-making center generating and issuing collaborative defense instructions specifically includes: (1) The Global Collaborative Decision Center receives the trust weights of the perception execution nodes synchronously reported by the trust assessment engines of each security domain. At the same time, the Global Collaborative Decision Center obtains the global behavior analysis results based on its own global behavior analysis, such as spatiotemporal correlation analysis of multiple node behavior data and attack pattern matching. Then, combining the trust weights of each node and the global behavior analysis results, the Global Collaborative Decision Center generates corresponding collaborative defense instructions. These instructions contain at least three parts of information: ① Threat description, such as threat type, attack source, and behavioral characteristics; ② Suggested defense actions, such as isolation, rate limiting, privilege downgrading, and traffic redirection; ③ A list of affected nodes, i.e., the set of node identifiers that need to be defended.

[0111] (2) The global collaborative decision-making center determines the target perception execution node from the list of affected nodes that needs to issue instructions. The list of affected nodes may contain one or more nodes, which may be distributed in the same or different security domains.

[0112] (3) Two-way identity and permission verification based on identity certificates is performed between the global collaborative decision-making center and each target perception execution node. Specifically, the global collaborative decision-making center presents its identity certificate to the target perception execution node, and the target perception execution node verifies whether the signature validity, validity period, and trust weight carried by the certificate meet the preset sender threshold. At the same time, the target perception execution node presents its identity certificate to the global collaborative decision-making center, and the global collaborative decision-making center verifies whether the signature validity, validity period, and trust weight carried by the certificate meet the preset receiver threshold. Only when both parties pass the verification is the two-way verification considered successful.

[0113] (4) After the two-way identity and permission verification is passed, the global collaborative decision center will send the collaborative defense instruction to the corresponding target perception execution node. After receiving the instruction, the node will decide whether to execute and how to execute the defense action in the instruction based on its own trust status, the credibility of the instruction source and the preset strategy.

[0114] This embodiment centrally aggregates the trust weights of each node and performs global behavioral analysis through a global collaborative decision-making center. This enables the generation of collaborative defense commands with a more global perspective. The list of affected nodes carried in the commands can cover all risk nodes along the attack propagation path, achieving preventative collaboration. Simultaneously, before issuing commands, mandatory two-way identity and permission verification based on identity certificates is enforced, ensuring that only communicating parties meeting the trust threshold can transmit commands. This effectively prevents forged commands, man-in-the-middle attacks, and malicious reception or transmission of commands by low-trust nodes, significantly improving the security and reliability of cross-domain collaborative defense.

[0115] Furthermore, based on the above embodiments of the invention, corresponding cooperative defense instructions are generated, including: When the trust weight is greater than or equal to the first preset threshold and less than the second preset threshold, a collaborative defense instruction that triggers cross-domain linkage is generated, and the recommended defense action is to redirect the abnormal node traffic to the sandbox environment. When the trust weight is less than the first preset threshold, a collaborative defense command for full-domain isolation is generated. The recommended defense action is to issue a full-domain isolation command and update the firewall rules simultaneously.

[0116] The first and second preset thresholds can refer to pre-defined lower and upper limits of trust weight, respectively, used to define low-trust and high-trust intervals. A sandbox environment refers to an isolated, controlled virtual execution environment used for in-depth analysis and detection of suspicious network traffic or programs, preventing potential threats from impacting actual business systems. A global isolation command can be a command that requires blocking communication within all relevant security domains; for example, it can include updating firewall rules in each domain, revoking node certificates, and blocking all incoming and outgoing traffic, with the aim of completely severing the connection between the compromised node and the network. Firewall rules refer to pre-defined access control policies in network firewall devices, used to determine whether to allow or deny traffic from specific source IPs, destination IPs, ports, or protocols.

[0117] In this embodiment of the invention, the process by which the global collaborative decision-making center generates collaborative defense instructions of different levels based on the trust weights of the sensing execution nodes specifically includes: (1) The global collaborative decision-making center obtains the current trust weight of each perception execution node from the trust assessment engine, and compares it with the first preset threshold T1 and the second preset threshold T2 respectively, and then generates the corresponding collaborative defense instruction based on the comparison result.

[0118] (2) If the trust weight DW falls within the medium-risk interval, that is, satisfies T1≤DW<T2, a collaborative defense instruction triggering cross-domain linkage is generated, and the recommended defense action in the instruction is set as "redirect the abnormal node traffic to the sandbox environment", that is, direct the suspicious network traffic of the node to the isolated sandbox for in-depth detection to prevent threat spreading.

[0119] (3) If the trust weight DW falls within the high-risk interval, that is, satisfies DW<T1, a collaborative defense instruction for full-domain isolation is generated, and the recommended defense action in the instruction is set as "issue a full-domain isolation instruction and synchronously update firewall rules", that is, implement network-wide isolation for the node, and simultaneously modify the access control lists of each relevant firewall to block all its communications.

[0120] In this embodiment, by introducing a defense instruction generation mechanism based on trust weight grading, dynamic and accurate response to network threats is realized. Wherein, mild isolation measures of redirecting traffic to the sandbox are adopted for medium-risk nodes, completing in-depth detection while avoiding service interruption; for high-risk nodes, full-domain isolation and synchronous update of firewall rules are implemented to completely block threat spreading. This grading strategy effectively balances defense strength and service continuity, is particularly applicable to unknown threat scenarios that spread rapidly across security domains, and significantly improves the real-time performance, adaptability and refinement level of collaborative defense.

[0121] Further, based on the foregoing embodiments of the present invention, the network threat defense system further comprises an intra-domain coordinator deployed in each security domain; when the target awareness execution node and the global collaborative decision center are located in the same security domain, after performing two-way identity certificate authentication with the target awareness execution node, the collaborative defense instruction is issued to the target awareness execution node, comprising: performing two-way identity and permission verification by the global collaborative decision center with the intra-domain coordinator of the security domain where the global collaborative decision center is located, and sending the collaborative defense instruction to the intra-domain coordinator after the verification is passed; performing two-way identity and permission verification by the intra-domain coordinator with the target awareness execution node, and sending the collaborative defense instruction to the target awareness execution node after the verification is passed.

[0122] Wherein, the intra-domain coordinator may refer to intermediate nodes that are respectively deployed inside each security domain and are responsible for distribution and verification of collaborative defense instructions in the local domain.

[0123] In the embodiment of the present invention, when it is necessary to issue a collaborative defense instruction to the target awareness execution node located in the same security domain as the global collaborative decision center, trusted delivery of the instruction can be realized by introducing the intra-domain coordinator, and the specific process is as follows: (1) The global collaborative decision-making center and the domain coordinator conduct two-way identity and permission verification based on their respective identity certificates. The verification content may include: verifying the signature validity of the other party's certificate, the certificate validity period, and whether the trust weight carried in the certificate meets the preset trust weight threshold, etc.

[0124] (2) If the two-way verification passes, the global collaborative decision center will send the collaborative defense command to the domain coordinator.

[0125] (3) After receiving the instruction, the domain coordinator performs two-way identity and permission verification with the target perception execution node based on their respective identity certificates.

[0126] (4) If the two-way verification passes, the domain coordinator will send the collaborative defense instruction to the target perception execution node, which will then make an intelligent decision on whether to execute the instruction.

[0127] Furthermore, based on the above embodiments, the network threat defense system also includes intra-domain coordinators deployed in each security domain, and the global collaborative decision-making center includes a cross-domain coordinator; when the target awareness execution node and the global collaborative decision-making center are located in different security domains, bidirectional identity and permission verification is performed based on the identity certificates of both parties, and after the verification is successful, the collaborative defense command is sent to the target awareness execution node, including: The global collaborative decision-making center performs two-way identity and permission verification with the domain coordinator of the source security domain, and sends the collaborative defense command to the domain coordinator of the source security domain after the verification is successful. Two-way identity and permission verification is performed through the intra-domain coordinator and cross-domain coordinator of the source security domain, and the collaborative defense command is sent to the cross-domain coordinator after the verification is successful. The cross-domain coordinator performs two-way identity and permission verification with the intra-domain coordinator of the target security domain where the target perception execution node is located. After the verification is successful, an encrypted communication link is established with the intra-domain coordinator of the target security domain. The collaborative defense command is sent to the intra-domain coordinator of the target security domain through the encrypted communication link. The target security domain's intra-domain coordinator and the target awareness execution node perform two-way identity and permission verification, and after successful verification, the collaborative defense command is sent to the target awareness execution node.

[0128] The cross-domain coordinator can be a functional module integrated within the global collaborative decision-making center, responsible for establishing temporary encrypted communication links between intra-domain coordinators in different security domains, and forwarding and verifying collaborative defense commands transmitted across domains. The source security domain can be the security domain that initiates the collaborative defense command transmission process, i.e., the security domain where the global collaborative decision-making center is located or the security domain into which the command first enters. The target security domain can be the security domain where the target perception and execution node to which the collaborative defense command ultimately needs to be delivered is located. The encrypted communication link can be a temporary communication channel established based on mutual verification of the identity certificates of both parties, encrypted using a temporary session key, also known as a temporary trust chain, used to ensure the confidentiality and integrity of cross-domain command transmission.

[0129] In this embodiment of the invention, when the target perception execution node and the global collaborative decision-making center are located in different security domains, the cross-domain distribution process of collaborative defense commands specifically includes: (1) The global collaborative decision-making center first conducts two-way identity and permission verification with the coordinator within the source security domain (i.e., its own security domain) based on their respective identity certificates. For example, both parties verify the validity of each other's certificates, the authenticity of the signature, the validity period, and whether the trust weight carried in the certificate meets the preset trust weight threshold. After the verification is successful, the global collaborative decision-making center sends the collaborative defense command to the coordinator within the source security domain.

[0130] (2) After receiving the collaborative defense instruction, the intra-domain coordinator of the source security domain forwards the instruction to the cross-domain coordinator within the global collaborative decision-making center. Similarly, before forwarding the instruction, the intra-domain coordinator of the source security domain also needs to perform two-way identity and permission verification with the cross-domain coordinator based on their respective identity certificates. After the verification is successful, the intra-domain coordinator of the source security domain sends the collaborative defense instruction to the cross-domain coordinator.

[0131] (3) The cross-domain coordinator determines the intra-domain coordinator of the target security domain based on the target security domain identifier in the collaborative defense command. Then, the cross-domain coordinator and the intra-domain coordinator of the target security domain perform two-way identity and permission verification based on their respective identity certificates. After the verification is successful, the two parties negotiate to generate a one-time session key and establish a temporary encrypted communication link (i.e., a temporary trust chain) to ensure that the content of the command transmitted subsequently will not be eavesdropped on or tampered with. After the link is established, the cross-domain coordinator sends the collaborative defense command to the intra-domain coordinator of the target security domain through this encrypted communication link.

[0132] (4) After receiving the collaborative defense instruction, the intra-domain coordinator of the target security domain determines the target awareness execution node specified in the instruction. Then, the intra-domain coordinator and the target awareness execution node perform two-way identity and permission verification based on their respective identity certificates. After successful verification, the intra-domain coordinator sends the collaborative defense instruction to the target awareness execution node. The target awareness execution node then decides and executes the corresponding defense action based on its own trust status, the credibility of the instruction source, and the preset collaborative defense strategy.

[0133] This embodiment introduces intra-domain and cross-domain coordinators to achieve reliable, secure, and efficient transmission of collaborative defense commands within and across security domains. In intra-domain scenarios, the global collaborative decision-making center performs bidirectional identity and permission verification hop-by-hop with the intra-domain coordinator and with the target perception execution node. This ensures that each hop in the command distribution within the domain undergoes dual authentication of identity and trust weight, preventing unauthorized or low-trust nodes from participating in command forwarding. In cross-domain scenarios, the global collaborative decision-making center sequentially delivers commands to the target node through the source domain coordinator, cross-domain coordinator, and target domain coordinator. The cross-domain coordinator and target domain coordinator not only perform bidirectional verification but also establish a temporary encrypted communication link (trust chain), ensuring the confidentiality and integrity of cross-domain transmission while avoiding long-term network resource occupation. Both scenarios employ a "hop-by-hop bidirectional verification + dynamic trust weight" mechanism, ensuring that each node on the command distribution path meets a preset trust threshold. This effectively prevents malicious or low-trust nodes from initiating or forwarding harmful commands, significantly reducing security risks caused by central node intrusion or command forgery. Meanwhile, through the hierarchical collaboration of intra-domain coordinators and cross-domain coordinators, this solution combines centralized decision-making with distributed execution, which reduces the communication load of the global collaborative decision-making center and shortens the command response time. It is especially suitable for large-scale, multi-security-domain network environments, and achieves proactive, precise, and collaborative defense against rapidly spreading threats.

[0134] Furthermore, based on the above embodiments of the invention, the target-aware execution node receives collaborative defense instructions and executes corresponding defense actions based on its own trust status, the credibility of the instruction source, and a preset collaborative defense strategy, including: The target-aware execution node receives collaborative defense instructions and verifies the credibility of the collaborative defense instructions to obtain the source credibility. The target-aware execution node obtains its own abnormal deviation degree and trust weight as its own trust status. Based on a preset collaborative defense strategy, the target-aware execution node determines whether the instruction execution conditions in the preset collaborative defense strategy are met, taking into account the source credibility and its own trust status. If the command execution conditions are met, the corresponding defense action is executed through the target perception execution node, and the execution result is reported to the corresponding trust assessment engine. If the conditions for instruction execution are not met, the collaborative defense instruction will be rejected by the target-aware execution node, and the rejection information will be reported to the corresponding trust assessment engine.

[0135] In this embodiment of the invention, the process of the target perception execution node intelligently making decisions and executing collaborative defense instructions specifically includes: (1) Upon receiving the coordinated defense instruction, the target-aware execution node does not execute it immediately. Instead, it verifies the credibility of the instruction. Specifically, the node extracts the transmission path information of the instruction, obtains the trust weight values ​​of each node along the path (e.g., intra-domain coordinator, cross-domain coordinator, etc.), and calculates the source credibility of the instruction. This source credibility reflects whether the instruction has passed through a trusted node link during transmission. If there are nodes with low trust weights along the path, the source credibility is reduced accordingly.

[0136] (2) The target-aware execution node acquires two key state values: one is the current abnormal deviation degree, which is calculated by the node itself through real-time behavior monitoring and reflects the degree of abnormality of the node's current behavior relative to the normal baseline; the other is the current trust weight, which is calculated by the trust assessment engine based on the abnormal deviation degree and the trust chain value and synchronized to the node, reflecting the node's overall trustworthiness in the system. These two key state values ​​together constitute the node's own trust state.

[0137] (3) The target-aware execution node takes the acquired source credibility and its own trust status as input, and makes a comprehensive decision based on the pre-configured collaborative defense strategy. For example, it determines whether its own trust weight is greater than a preset threshold, whether the source credibility is greater than a preset threshold, and whether its own abnormal deviation is less than a preset threshold. The node performs a comprehensive evaluation based on these conditions to determine whether the current condition meets the instruction execution conditions in the preset collaborative defense strategy.

[0138] (4) If the conditions for instruction execution are met, the target-aware execution node will perform the corresponding operation according to the suggested defense action in the collaborative defense instruction, such as isolating the node, redirecting traffic, and downgrading privileges. After execution, the node will report the execution result (including whether it was successful and the blocking effect) to the trust assessment engine in this security domain so that the system can update the trust chain value of the node.

[0139] (5) If the execution conditions are not met, the target perception execution node refuses to execute the collaborative defense instruction and reports the refusal information (including the reason for refusal, its current trust status, source credibility, etc.) to the trust assessment engine within this security domain. This feedback information is also used to update the node's trust chain value. For example, a node's trust value may be increased if it correctly refuses a malicious instruction, while its trust value may be decreased if it incorrectly refuses a real threat.

[0140] This embodiment significantly improves the robustness and security of the defense system by introducing source credibility verification and self-trust status assessment before executing collaborative defense commands, and combining these with preset strategies for multi-factor decision-making. On the one hand, even if the global collaborative decision-making center is compromised or malicious commands are issued, nodes can proactively refuse to execute them based on their own status and source credibility, avoiding greater losses caused by being misled by malicious commands. On the other hand, nodes feed back the execution results or rejection information to the trust assessment engine, providing a basis for the system to update the trust chain value, forming a closed-loop optimization mechanism. This solution effectively solves the security risks of nodes "blindly following" commands in traditional centralized defense, realizes edge-side autonomous intelligent defense, and enhances the credibility and adaptability of the entire network security collaborative defense system.

[0141] Furthermore, based on the above embodiments, in order to improve detection accuracy and reduce false alarms, this embodiment can employ a three-level adaptive threshold optimization mechanism to dynamically adjust some key threshold parameters in the defense system. The specific mechanism is as follows: The first level is a single-node local adaptive threshold, where each sensing and execution node maintains its own short-term sensitive threshold. and long-term stable threshold ,in, This is the moving average of ADS over the past hour. The standard deviation of ADS over the past hour. Sensitivity coefficient The 95th percentile of the 24-hour ADS. This represents the 24-hour trend slope of ADS. This is a trend-sensitive factor. Next, the short-term sensitivity threshold and the long-term stability threshold are fused to obtain the abnormal deviation judgment threshold for the actual use of the sensing execution node at time t. This threshold is used to compare the anomaly deviation with the real-time calculated value. When comparing, An anomaly alarm will be triggered or reported immediately. Adaptive weighting is one such feature. Used to balance the proportions of short-term and long-term thresholds in the final fusion threshold, s is a sensitivity coefficient used to control the steepness of weight switching; This is the standard deviation threshold, used as a benchmark to determine whether the fluctuation is too large. It's important to understand that when... Significantly higher than hour, Approaching 1, the final fusion threshold leans towards a short-term sensitive threshold, ensuring a rapid response to sudden anomalies; when Significantly lower than hour, Approaching 0, the final fusion threshold leans towards a long-term stable threshold, effectively filtering behavioral jitter and reducing the false alarm rate.

[0142] The second level is intra-domain collaborative threshold optimization. This involves periodically collecting threshold execution performance metrics from all sensing execution nodes i within the domain via a trust assessment engine. These metrics include true positive rate (TPR), false positive rate (FPR), threshold trigger frequency distribution, and the business load level of each node. Using these threshold execution performance metrics as input data, a comprehensive quantitative value, i.e., information entropy, is calculated using the information entropy formula. Used to measure the current threshold The ability to distinguish between normal and abnormal behavior. Next, based on the information entropy differences between neighboring nodes, a threshold correction amount is calculated for each sensing execution node i: ,in The set of neighboring nodes of node i is the perception execution node that has similar business type, similar deployment location or communication relationship with node i within the domain. The similarity weight between node i and node j is [0,1]. It can be calculated based on factors such as business type similarity, network topology distance, and consistency of historical behavior patterns. The higher the similarity, the greater the weight. The learning rate is used to control the step size of a single threshold correction to prevent threshold oscillation.

[0143] Next, the trust assessment engine adjusts the threshold amount. Generate threshold adjustment suggestions for each perception execution node i, i.e., the final adjusted thresholds are as follows: In the formula, The optimized threshold after adjustment for node i; The current threshold for node i; It is the weighted average of the threshold values ​​of all sensing and execution nodes within the security domain of node i; This is a consensus adjustment coefficient used to control the impact of the threshold correction amount on the threshold, preventing performance fluctuations caused by excessive single adjustments. This is a domain consistency adjustment factor used to control the pull of the domain average threshold on the node threshold. The formula achieves co-optimization of the threshold through two corrections: the first term... Consensus correction is performed on the current threshold based on the information entropy differences of neighboring nodes, so that the detection capability of the nodes approaches the optimal level in the domain; the second item The current threshold is pulled back based on the domain average threshold to ensure that the node threshold does not deviate excessively from the overall level within the domain. The two corrections work together to both incorporate the successful experiences of neighboring nodes and maintain the consistency of threshold configuration within the domain.

[0144] The trust assessment engine will generate threshold adjustment suggestions (including those for each perception execution node). The updated threshold is then distributed to all sensing and execution nodes within the domain. At the start of the next detection cycle, these nodes use the updated threshold to determine abnormal deviations, thus achieving collaborative optimization of thresholds across the domain. Simultaneously, after implementing the new threshold, each sensing and execution node continues to report execution performance metrics, forming a continuous feedback loop.

[0145] The third level is a globally policy-driven threshold elastic adjustment, which dynamically adjusts the threshold based on the global threat level through the global collaborative decision-making center. Specifically, when the global threat level is high, the optimized threshold is multiplied by 0.8 to lower the threshold and increase detection sensitivity; when it is a critical business period, the optimized threshold is multiplied by 1.2 to raise the threshold and reduce the false alarm rate; under normal conditions, the optimized threshold is used directly.

[0146] In addition, the global collaborative decision-making center establishes a reward function based on the following threshold utility: In the formula, The threshold parameter to be optimized; The true positive rate; The false positive rate; For response delay; , and The preset weight coefficients are used. A lightweight Q-learning algorithm can be used to continuously optimize the threshold strategy for each node.

[0147] Furthermore, the optimization process of the threshold parameters is executed according to a preset cycle, such as local adaptive fine-tuning every 10 minutes, intra-domain collaborative adjustment every hour, and global strategy adjustment in real time according to threat events.

[0148] Figure 3 This is a schematic diagram of a layered collaborative defense architecture provided in Embodiment 1 of the present invention. Figure 3As shown, the edge layer includes a trust assessment engine and multiple perception execution nodes, the computing layer includes a global collaborative decision-making center and a firewall, and the control layer includes a lightweight certificate service. Each layer's components communicate with each other through two-way authentication based on identity certificates. When a perception execution node detects abnormal behavior, the trust assessment engine calculates the trust weight and reports it to the global collaborative decision-making center. The global collaborative decision-making center combines the global analysis results to generate collaborative defense instructions. Simultaneously, the certificate service dynamically adjusts node permissions, and the firewall performs traffic blocking or redirection operations, thereby achieving layered, collaborative, and dynamic network security defense.

[0149] Example 2 Figure 4 This is a schematic diagram of a network threat defense system provided in Embodiment 2 of the present invention. Figure 4 As shown, the system includes perception execution nodes 11 and trust assessment engines 12 deployed in each security domain, and a globally deployed global collaborative decision-making center 13; wherein: The perception execution node 11 is used to collect the behavior data of the entity it carries and report the abnormal deviation of the behavior data to the trust assessment engine 12; and to receive collaborative defense instructions and execute corresponding defense actions based on its own trust status, the credibility of the instruction source and the preset collaborative defense strategy. Trust assessment engine 12 is used to determine the trust weight of perception execution node 11 based on abnormal deviation degree and trust chain value and synchronize it to global collaborative decision center 13; The global collaborative decision-making center 13 is used to adjust the identity certificate permissions of the perception execution node 11 based on the trust weight, and to send the adjusted identity certificate to the perception execution node 11; and to generate collaborative defense instructions based on the trust weight of each perception execution node 11 and the global behavior analysis results, and after performing two-way verification of the identity certificate with the target perception execution node 11, to send the collaborative defense instructions to the target perception execution node 11.

[0150] Furthermore, based on the above embodiments of the invention, the sensing execution node 11 is used for: Collect entity behavior data in real time; behavior data includes at least network traffic data, system call data, and resource usage data; The behavioral data is compared with the locally pre-built behavioral baseline model to obtain the abnormal deviation degree, and the abnormal deviation degree is reported to the trust assessment engine 12.

[0151] Furthermore, based on the above embodiments of the invention, the trust assessment engine 12 is used for: Receive the abnormal deviation reported by the sensing execution node 11, and query the current trust chain value from the preset blockchain network; The abnormal deviation degree and the trust chain value are fused and calculated to obtain the trust weight, and the trust weight is synchronized to the global collaborative decision-making center 13.

[0152] Furthermore, based on the above embodiments of the invention, the trust assessment engine 12 is also used for: Receive the behavior profile summary reported by the perception execution node 11, and receive the global behavior analysis results issued by the global collaborative decision-making center 13; Based on the behavioral profile summary, global behavioral analysis results, and preset correction strategies, the abnormal deviation and trust chain values ​​are corrected to obtain the corrected abnormal deviation and trust chain values. The corrected anomaly deviation and trust chain value are fused together to obtain the trust weight.

[0153] Furthermore, based on the above embodiments of the invention, the global collaborative decision-making center 13 includes a certificate service, which is used for: Acquire the trust weights of the synchronous perception execution nodes of the trust assessment engine 12; Based on the preset weight-permission mapping relationship, the trust weight is converted into the corresponding permission level; the permission level is used to determine the scope of operations that the perception execution node 11 can perform in collaborative defense. Generate an identity certificate that includes permission level, trust weight, and a new validity period; The identity certificate is signed and then sent to the perception execution node 11.

[0154] Furthermore, based on the above embodiments of the invention, the global collaborative decision-making center 13 is used for: The system receives the trust weights of each sensing execution node 11 and generates corresponding collaborative defense instructions based on the global behavior analysis results. The collaborative defense instructions include at least a threat description, suggested defense actions, and a list of affected nodes. The target perception execution node 11 in the list of affected nodes is identified. Two-way identity and permission verification is performed based on the identity certificates of both parties. After the verification is successful, the collaborative defense command is sent to the target perception execution node 11.

[0155] Furthermore, based on the above embodiments of the invention, the global collaborative decision-making center 13 is also used for: When the trust weight is greater than or equal to the first preset threshold and less than the second preset threshold, a collaborative defense instruction that triggers cross-domain linkage is generated, and the recommended defense action is to redirect the abnormal node traffic to the sandbox environment. When the trust weight is less than the first preset threshold, a collaborative defense command for full-domain isolation is generated. The recommended defense action is to issue a full-domain isolation command and update the firewall rules simultaneously.

[0156] Furthermore, based on the above embodiments, the network threat defense system also includes an intra-domain coordinator deployed in each security domain; when the target awareness execution node 11 and the global collaborative decision-making center 13 are located in the same security domain, the intra-domain coordinator is used for: It performs two-way identity and permission verification with the global collaborative decision-making center 13, and receives collaborative defense instructions sent by the global collaborative decision-making center 13 after the verification is successful; Perform two-way identity and permission verification with the target perception execution node 11, and send the collaborative defense command to the target perception execution node 11 after the verification is successful.

[0157] Furthermore, based on the above embodiments, the network threat defense system also includes intra-domain coordinators deployed in each security domain, and the global collaborative decision-making center 13 includes a cross-domain coordinator; when the target awareness execution node 11 and the global collaborative decision-making center 13 are located in different security domains: The intra-domain coordinator of the source security domain is used to: perform two-way identity and permission verification with the global collaborative decision-making center 13, receive collaborative defense instructions, and send collaborative defense instructions to the cross-domain coordinator after performing two-way identity and permission verification with the cross-domain coordinator. The cross-domain coordinator is used to: perform two-way identity and permission verification with the intra-domain coordinator of the target security domain, and establish an encrypted communication link with the intra-domain coordinator of the target security domain after successful verification, and send collaborative defense instructions to the intra-domain coordinator of the target security domain through the encrypted communication link; The intra-domain coordinator of the target security domain is used to: perform two-way identity and permission verification with the target awareness execution node 11, and send the collaborative defense command to the target awareness execution node 11 after the verification is successful.

[0158] Furthermore, based on the above embodiments of the invention, the target-aware execution node 11 is used for: Receive collaborative defense instructions and verify the credibility of the collaborative defense instructions to obtain the source credibility; Obtain its own abnormal deviation degree and trust weight as its own trust status; Based on the preset collaborative defense strategy, and combined with the source credibility and its own trust status, it is determined whether the instruction execution conditions in the preset collaborative defense strategy are met. If the command execution conditions are met, the corresponding defense action is executed, and the execution result is reported to the corresponding trust assessment engine 12; If the conditions for instruction execution are not met, the collaborative defense instruction will be refused to be executed, and the refusal information will be reported to the corresponding trust assessment engine 12.

[0159] Furthermore, based on the above embodiments of the invention, the behavioral baseline model includes a spatiotemporal dependent multimodal anomaly detection model, which includes a multimodal feature encoding layer, a spatiotemporal dependency encoding layer, and an anomaly scoring layer. The perception execution node is used for: The collected behavioral data is input into a pre-trained spatiotemporal dependent multimodal anomaly detection model; The behavioral data is encoded by channel-wise using a multimodal feature coding layer to extract sequence features, graph structure features, and statistical features. Spatiotemporal dependency modeling and fusion of sequence features and graph structure features are performed through a spatiotemporal dependency coding layer to obtain fused spatiotemporal features; Spatiotemporal and statistical features are obtained through an anomaly scoring layer, and the anomaly deviation degree is output based on the spatiotemporal and statistical features.

[0160] The network threat defense system provided in this embodiment of the invention can execute the network threat defense method provided in any embodiment of the invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0161] Example 3 In some embodiments, the network threat defense method may be implemented as a computer program, which is implicitly included in a computer program product. When executed by a processor, the computer program implements the network threat defense method of the present invention. The computer program product can be understood as a software product that primarily implements its solution through a computer program. The computer program used to implement the method of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer program causes the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer program may be executed entirely on a machine, partially on a machine, partially on a remote machine as a standalone software package, or entirely on a remote machine or server.

[0162] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0163] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0164] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for defending against network threats, characterized in that, An application to a network threat defense system, the system comprising awareness execution nodes and trust assessment engines deployed in various security domains, and a globally deployed global collaborative decision-making center; the method includes: The perception execution node collects behavioral data of the entities it carries and reports any abnormal deviations in the behavioral data to the trust assessment engine. The trust assessment engine determines the trust weight of the perception execution node based on the abnormal deviation and trust chain value and synchronizes it to the global collaborative decision-making center. The global collaborative decision-making center adjusts the identity certificate permissions of the perception execution node based on the trust weight, and then distributes the adjusted identity certificate to the perception execution node. The global collaborative decision-making center generates a collaborative defense command based on the trust weight of each perception execution node and the global behavior analysis results. After performing two-way identity certificate verification with the target perception execution node, the collaborative defense command is sent to the target perception execution node. The target perception execution node receives the collaborative defense command and executes the corresponding defense action based on its own trust status, the credibility of the command source, and the preset collaborative defense strategy.

2. The method according to claim 1, characterized in that, The step of collecting behavioral data of the entity being carried through the perception execution node and reporting the abnormal deviation of the behavioral data to the trust assessment engine includes: The entity's behavioral data is collected in real time through the sensing execution node; the behavioral data includes at least network traffic data, system call data, and resource usage data. The perception execution node compares the behavioral data with a locally pre-built behavioral baseline model to obtain the abnormal deviation degree, and then reports the abnormal deviation degree to the trust assessment engine.

3. The method according to claim 1, characterized in that, The step of determining the trust weight of the sensing execution node and synchronizing it to the global collaborative decision-making center based on the abnormal deviation degree and trust chain value through the trust evaluation engine includes: The trust evaluation engine receives the abnormal deviation reported by the perception execution node and queries the preset blockchain network for the current trust chain value. The trust weight is obtained by fusing the abnormal deviation and the trust chain value through the trust assessment engine, and then the trust weight is synchronized to the global collaborative decision-making center.

4. The method according to claim 3, characterized in that, Also includes: The trust assessment engine receives the behavior profile summary reported by the perception execution node, as well as the global behavior analysis results issued by the global collaborative decision-making center. The trust assessment engine corrects the abnormal deviation and the trust chain value based on the behavior profile summary, the global behavior analysis results, and the preset correction strategy, to obtain the corrected abnormal deviation and trust chain value. The trust weight is obtained by fusing the corrected abnormal deviation and the trust chain value through the trust assessment engine.

5. The method according to claim 1, characterized in that, The global collaborative decision-making center includes a certificate service. The step of adjusting the identity certificate permissions of the sensing execution node based on the trust weight through the global collaborative decision-making center, and then distributing the adjusted identity certificate to the sensing execution node, includes: The trust weight of the perception execution node synchronized by the trust evaluation engine is obtained through the certificate service; The certificate service converts the trust weight into a corresponding permission level according to a preset weight-permission mapping relationship; the permission level is used to determine the scope of operations that the perception execution node can perform in collaborative defense. The certificate service generates an identity certificate that includes the permission level, the trust weight, and a new validity period. The identity certificate is signed using the certificate service, and the signed identity certificate is then sent to the perception execution node.

6. The method according to claim 1, characterized in that, The step of generating a collaborative defense command based on the trust weights of each perception execution node and the results of global behavior analysis through the global collaborative decision-making center, and then issuing the collaborative defense command to the target perception execution node after performing two-way identity certificate verification with the target perception execution node, includes: The global collaborative decision-making center receives the trust weights of each perception execution node and generates corresponding collaborative defense instructions based on the global behavior analysis results; the collaborative defense instructions include at least a threat description, suggested defense actions, and a list of affected nodes. The global collaborative decision-making center determines the target perception execution node in the list of affected nodes, performs two-way identity and permission verification based on the identity certificates of both parties, and sends the collaborative defense command to the target perception execution node after the verification is successful.

7. The method according to claim 6, characterized in that, The generation of the corresponding collaborative defense command includes: When the trust weight is greater than or equal to the first preset threshold and less than the second preset threshold, a collaborative defense instruction that triggers cross-domain linkage is generated, and the suggested defense action is to redirect the abnormal node traffic to the sandbox environment. When the trust weight is less than the first preset threshold, a collaborative defense instruction for full-domain isolation is generated. The suggested defense action is to issue a full-domain isolation instruction and simultaneously update the firewall rules.

8. The method according to claim 1, characterized in that, The system also includes domain coordinators deployed in each security domain; when the target awareness execution node and the global collaborative decision-making center are located in the same security domain, the step of performing two-way identity certificate verification with the target awareness execution node and then issuing the collaborative defense command to the target awareness execution node includes: The global collaborative decision-making center performs two-way identity and permission verification with the domain coordinator of the security domain, and sends the collaborative defense command to the domain coordinator after the verification is successful. The domain coordinator performs two-way identity and permission verification with the target perception execution node, and after successful verification, sends the collaborative defense command to the target perception execution node.

9. The method according to claim 1, characterized in that, The system also includes intra-domain coordinators deployed in each security domain, and the global collaborative decision-making center includes a cross-domain coordinator; when the target awareness execution node and the global collaborative decision-making center are located in different security domains, the system performs bidirectional identity and permission verification based on the identity certificates of both parties, and after the verification is successful, sends the collaborative defense command to the target awareness execution node, including: The global collaborative decision-making center performs two-way identity and permission verification with the domain coordinator of the source security domain, and sends the collaborative defense command to the domain coordinator of the source security domain after the verification is successful. The source security domain's intra-domain coordinator and the cross-domain coordinator perform two-way identity and permission verification, and after successful verification, the collaborative defense command is sent to the cross-domain coordinator. The cross-domain coordinator performs bidirectional identity and permission verification with the intra-domain coordinator of the target security domain where the target perception execution node is located. After successful verification, an encrypted communication link is established with the intra-domain coordinator of the target security domain, and the collaborative defense command is sent to the intra-domain coordinator of the target security domain through the encrypted communication link. The target security domain's intra-domain coordinator performs bidirectional identity and permission verification with the target awareness execution node, and after successful verification, sends the collaborative defense command to the target awareness execution node.

10. The method according to claim 1, characterized in that, The step of receiving the collaborative defense instruction through the target perception execution node and executing the corresponding defense action based on its own trust status, the credibility of the instruction source, and the preset collaborative defense strategy includes: The target perception execution node receives the collaborative defense command and verifies the credibility of the collaborative defense command to obtain the source credibility. The target perception execution node obtains its own abnormal deviation degree and trust weight as its own trust status. The target perception execution node determines whether the instruction execution conditions in the preset collaborative defense strategy are met based on the preset collaborative defense strategy, combined with the source credibility and its own trust status. If the instruction execution conditions are met, the corresponding defense action is executed through the target perception execution node, and the execution result is reported to the corresponding trust assessment engine. If the execution conditions of the instruction are not met, the target perception execution node will refuse to execute the collaborative defense instruction and report the refusal information to the corresponding trust assessment engine.

11. The method according to claim 2, characterized in that, The behavioral baseline model includes a spatiotemporal dependent multimodal anomaly detection model, which comprises a multimodal feature encoding layer, a spatiotemporal dependency encoding layer, and an anomaly scoring layer. The step of comparing the behavioral data with the locally pre-built behavioral baseline model through the perception execution node to obtain the anomaly deviation includes: The collected behavioral data is input into the pre-trained spatiotemporal dependent multimodal anomaly detection model through the perception execution node; The behavioral data is encoded by channel-wise using the multimodal feature encoding layer to extract sequence features, graph structure features, and statistical features. The spatiotemporal dependency coding layer is used to model and fuse the sequence features and the graph structure features in a spatiotemporal manner to obtain the fused spatiotemporal features. The spatiotemporal features and statistical features are obtained through the anomaly scoring layer, and the anomaly deviation is output based on the spatiotemporal features and statistical features.

12. A network threat defense system, characterized in that, The system for executing the network threat defense method as described in any one of claims 1-11 includes awareness execution nodes and trust assessment engines deployed in each security domain, as well as a globally deployed global collaborative decision-making center.

13. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions that are used to cause a processor to execute the network threat defense method according to any one of claims 1-11.

14. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the network threat defense method according to any one of claims 1-11.

Images