An intelligent network situation awareness method based on multi-modal fusion

Abstract

The application discloses an intelligent network situation awareness method based on multi-modal fusion, and relates to the technical field of network security, and comprises the following steps: collecting multi-source security data, and performing time synchronization, entity merging, event correlation and cross-modal semantic alignment, and fusing to generate a multi-modal security data frame; constructing a time sequence security graph, reconstructing an attack scene through an evidence closure mechanism and extracting key evidence; performing path expansion and scoring based on attack stage constraints, combining conflict pruning to generate an attack chain and situation assessment result; realizing situation deduction through counterfactual setting and probability constraint path search; generating a situation report by using evidence constraints, and formulating a response scheme in combination with a security knowledge graph; optimizing the model according to artificial feedback, and completing disposal closed loop by executing a response strategy. The application improves the accuracy of attack identification and situation analysis, and realizes integrated processing of network security situation awareness and response.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to an intelligent network situational awareness method based on multimodal fusion. Background Technology

[0002] As enterprise networks, cloud platforms, and endpoint devices continue to expand, multi-source data such as network traffic, security device logs, endpoint behavior, asset topology, and threat intelligence are widely used for network security situation awareness. MITRE ATT&CK has publicly disclosed the establishment of a knowledge base for attack tactics, techniques, and data sources based on real attack observations; GraphWeaver has publicly disclosed the use of a distributed graph structure to correlate large-scale security alerts; and the existing patent CN115225532B also discloses the combination of risk indicators, knowledge graph event embedding, and temporal convolutional networks for network security situation prediction, indicating that event correlation, attack graphs, and situation prediction are all existing technologies.

[0003] However, the following problems still exist in actual security operations: the time base, entity identifiers and semantic structures of different security data are inconsistent, and simple splicing or fixed weight fusion can easily cause the same attack to be split and unrelated events to be incorrectly merged; existing graph association methods usually focus on similar relationships or attack path connections, which makes it difficult to retain evidence support and evidence conflict at the same time, and also lack attack phase propagation constraints, reverse verification of business impact and boundary judgment based on changes in scenario closure, resulting in incomplete multi-stage attack scenarios; existing situation predictions mostly output risk values ​​based on historical risk sequences, which makes it difficult to extrapolate the path of counterfactual states such as asset loss and protection offline, and there is no traceable closed loop between analysis conclusions, original evidence, response plans and execution results, resulting in alarm judgment relying on manual intervention, high risk of mishandling, and difficulty in continuously feeding back and optimizing response effects.

[0004] Therefore, how to provide an intelligent network situational awareness method based on multimodal fusion is a problem that urgently needs to be solved by those skilled in the art. Summary of the Invention

[0005] One objective of this invention is to propose an intelligent network situational awareness method based on multimodal fusion. This invention comprehensively utilizes cross-modal semantic alignment, temporal security graphs, evidence closure scenario reconstruction, attack chain search, counterfactual inference, and knowledge graph technologies to achieve multi-source security data fusion, attack scenario reconstruction, situational assessment, trend inference, and response handling. It has the advantages of accurate evidence association, reliable attack chain identification, reasonable situational inference, traceable reporting, and efficient closed-loop security response.

[0006] A method for intelligent network situational awareness based on multimodal fusion according to an embodiment of the present invention includes the following steps:

[0007] Step 1: Collect multi-source network security data, and generate multi-modal security data frames through time synchronization, entity merging, event correlation, cross-modal semantic alignment, and trustworthiness weighted fusion.

[0008] Step 2: Construct a temporal security graph based on multimodal security data frames, reconstruct the network by inputting evidence closure scenarios, generate node representations through evidence anchoring, propagate evidence support messages and evidence conflict messages respectively, constrain the message propagation direction according to the attack phase transition relationship, inject business impact into the attack event in reverse along the business topology, and determine the scenario boundary based on the change in scenario closure before and after the addition of candidate nodes, and generate attack scenarios and key evidence.

[0009] Step 3: Based on the attack scenario, perform path expansion, path scoring, and conflict pruning under the constraints of the attack phase to generate the current attack chain and situation assessment results;

[0010] Step 4: Set counterfactual state based on the current attack chain, update the temporal security graph, calculate the attack transfer probability and perform probability-constrained path search to generate situational simulation results;

[0011] Step 5: Input the current attack chain, situational analysis results, and key evidence into the evidence constraint report generation network. The network generates a situational report through path encoding, evidence encoding, cross-alignment, field constraint decoding, and evidence referencing. A response plan is then generated based on the security knowledge graph.

[0012] Step 6: Based on human feedback, screen difficult cases, construct incremental training samples, and update the evidence closure scenario reconstruction network;

[0013] Step 7: Execute the response plan and write the execution results back to the timing security diagram, regenerate the situation assessment results and situation simulation results, and obtain the handling results.

[0014] Optionally, step one specifically includes:

[0015] The multi-source network security data includes network traffic records, security device logs, terminal behavior records, asset topology records, and threat intelligence records, which are processed through field parsing, time synchronization, and unified structure processing to generate a unified security record;

[0016] The disjoint-set data structure algorithm is used to merge entity identifiers pointing to the same network object to generate a unified entity identifier. Then, based on the unified entity identifier, network session, process behavior chain, vulnerability identifier, and threat indicator, event association is performed to generate a security event group.

[0017] We perform feature encoding and unified semantic space mapping on different modalities of data in the security event group, and use cosine similarity and InfoNCE loss function to perform cross-modal semantic alignment.

[0018] Evidence credibility is calculated based on data source credibility level, field completeness, event time freshness, and cross-modal consistency. Evidence conflict markers are generated based on object consistency, event time sequence, and behavioral outcome.

[0019] Based on the evidence conflict marker, the conflict penalty value is deducted from the evidence credibility of the corresponding modality. The modality fusion weight is generated using the Softmax function. The semantic representations of each modality are fused according to the modality fusion weight to generate a multimodal secure data frame.

[0020] Optionally, step two specifically includes:

[0021] A temporal security graph is constructed based on multimodal security data frames and input into an evidence closure scenario reconstruction network. The evidence closure scenario reconstruction network includes an evidence anchoring unit, a support-conflict dual-path propagation unit, an attack phase constraint unit, a business impact reverse injection unit, a scenario closure determination unit, a key evidence selection unit, and an attack scenario output unit.

[0022] The evidence anchoring unit generates an evidence anchoring node representation based on the multimodal fusion representation of the temporal security graph node, node type, evidence source, evidence credibility, evidence conflict marker, and event time, and transmits it to the support-conflict dual-path propagation unit and the attack phase constraint unit.

[0023] The support-conflict dual-path propagation unit generates aggregated evidence support messages and aggregated evidence conflict messages, and transmits the aggregated evidence support messages to the attack phase constraint unit; the attack phase constraint unit generates an initial attack phase probability distribution based on the attack event type, attack technology identifier, and attack behavior characteristics, and constrains the propagation of aggregated evidence support messages to generate constraint evidence support messages.

[0024] The business impact reverse injection unit generates a business impact representation based on the business topology; the evidence closure scenario reconstruction network updates the attack event node representation based on the constraint evidence support message, aggregated evidence conflict message, and business impact representation, and generates node anomaly probability, attack stage probability distribution, and attack relationship probability.

[0025] The scenario closure determination unit determines the attack scenario boundary based on the node anomaly probability, attack phase probability distribution, attack relationship probability, business impact representation, and evidence conflict marker. The key evidence selection unit selects key evidence that supports the attack starting point, attack target, attack behavior, attack phase transition, and business impact. The attack scenario output unit generates the attack scenario and key evidence.

[0026] Optionally, the processing of the support-conflict dual-path propagation unit, attack phase constraint unit, service impact reverse injection unit, and scenario closure determination unit includes:

[0027] The support-conflict dual-path propagation unit generates evidence support states based on the entity association, temporal continuity, and consistency of behavioral results of adjacent nodes, and generates evidence conflict states based on object, time, behavior, asset status, or attack phase conflict. The two states are then passed through independent gated branches to generate gate values, which are multiplied by the adjacent node representations that are linearly transformed according to the relationship type to generate evidence support messages and evidence conflict messages, and then aggregated.

[0028] The attack phase constraint unit generates attack phase transition coefficients based on the initial attack phase probability distribution of the source and target attack event nodes, the attack phase transition matrix, and the event time sequence. When phase transition is allowed, the evidence support message is multiplied by the attack phase transition coefficient. When cross-phase transition is allowed and there is evidence of intermediate attack phases, it is multiplied by the cross-phase propagation attenuation coefficient. When a phase reversal jump, time reversal, or lack of evidence of intermediate attack phases occurs, the attack phase transition coefficient is set to zero and written to the attack phase conflict flag.

[0029] The business impact reverse injection unit propagates the business impact seed representation backward along the business system object, service object, asset object to the attack event object, multiplies it by the exponential decay coefficient and the business dependency strength, and accumulates the business impact representation pointing to the same attack event object;

[0030] The scenario closure determination unit performs a weighted summation of object closure, time closure, stage closure, evidence coverage, and business interpretability, deducts the penalty value corresponding to the conflict residue, and generates the scenario closure. It calculates the scenario closure increment before and after the candidate addition node is added, and writes the candidate addition node into the candidate attack scenario when the increment is greater than zero and no irremovable conflict is introduced.

[0031] Optionally, step three specifically includes:

[0032] The node anomaly probability, evidence credibility, and initial stage matching degree determined by the attack stage probability distribution of the attack event node are weighted and summed to generate an initial score. Then, the attack path starting node is selected from the predecessor attack event nodes with the highest initial score, no time conflict marker, no attack stage conflict marker, and no relationship connection that reaches the path expansion threshold through the attack relationship probability.

[0033] A set of candidate attack paths is established with the starting node of the attack path. Subsequent attack event nodes are extended along the temporal security graph relationship where the probability of the attack relationship reaches the path extension threshold. Event time sequence verification, attack phase transition verification, node duplication verification, and evidence conflict verification are performed.

[0034] The node anomaly probability, evidence credibility, business impact degree corresponding to the business impact representation, attack relationship probability and attack stage transition coefficient are normalized and weighted by Min-Max, and the penalty values ​​corresponding to object conflict, time conflict and attack stage conflict are deducted to generate candidate attack path scores.

[0035] The beam search algorithm is used to retain candidate attack paths within a preset beam width, delete candidate attack paths that are reversed in event time, reversed in attack phase, or interrupted in unified entity association, and determine the candidate attack path with the highest score and key evidence supporting the attack start point, attack target, attack behavior, attack phase transition and business impact as the current attack chain.

[0036] Based on the current attack chain, asset risk indicators, attack development indicators, protection gap indicators, and business impact indicators are generated, and after normalization and weighting, situation assessment results are generated.

[0037] Optionally, step four specifically includes:

[0038] Copy the temporal security graph to generate a counterfactual temporal security graph, select counterfactual objects from the current attack chain, and set the counterfactual objects to asset loss status, account credential leakage status, protection device offline status, or blocking rule failure status;

[0039] Update network access relationships, account permission relationships, and protection blocking relationships based on the counterfactual state, and determine the network reachability probability, vulnerability exploitation probability, account permission probability, simulation phase transfer probability, and protection blocking probability.

[0040] The attack transfer probability is generated by multiplying the network reachability probability, vulnerability exploitation probability, account privilege probability, and simulation phase transfer probability in sequence, and then multiplying by the difference between the network reachability probability, vulnerability exploitation probability, account privilege probability, and simulation phase transfer probability.

[0041] Taking the attack event node at the end of the current attack chain as the starting point of situational inference, the candidate inference path is expanded by using the probability constraint bundle search algorithm. The attack transfer probabilities between adjacent attack event nodes are multiplied in turn to generate the cumulative probability of the candidate inference path. Candidate inference paths with a cumulative probability lower than the path retention threshold or a protection blocking probability corresponding to any attack relationship reaching the blocking threshold are deleted.

[0042] Candidate simulation paths are scored based on their cumulative probability, target asset importance level, and expected business impact. They are then ranked according to their scores, and the expected occurrence time is determined based on the top-ranked candidate simulation paths and the median time interval of similar historical attacks, thus generating a situational simulation result.

[0043] Optionally, step five specifically includes:

[0044] The current attack chain and situational simulation results are converted into an attack path sequence, and the key evidence content is obtained based on the original record index in the key evidence.

[0045] The attack path sequence and key evidence content are input into the evidence constraint report generation network, which includes a path encoder, an evidence encoder, a cross-alignment layer, a field constraint decoder, and an evidence reference layer.

[0046] The path encoder and evidence encoder generate attack path encoding and key evidence encoding respectively, and transmit them to the cross-alignment layer; the cross-alignment layer generates a path-evidence joint representation and transmits it to the field constraint decoder and evidence reference layer.

[0047] The field constraint decoder generates candidate situation report fields and candidate attack conclusions based on the path-evidence joint representation, and transmits the candidate attack conclusions to the evidence citation layer; the evidence citation layer matches key evidence for the candidate attack conclusions and transmits the evidence citation results to the field constraint decoder, which then generates a situation report.

[0048] Based on the situation report, a bounded graph search is performed on the security knowledge graph to generate candidate response actions and their dependencies. Candidate response actions are then combined based on these dependencies to generate candidate response plans. Based on the expected risk reduction, the credibility of the reasoning path, the historical execution success rate, the execution cost of the response action, and the expected business impact, a score is generated for each candidate response plan. Finally, the response plan is determined based on the candidate response plan score.

[0049] Optionally, the evidence constraint report generation network specifically includes:

[0050] The path encoder and evidence encoder respectively use a bidirectional long short-term memory network to generate attack path codes and key evidence codes.

[0051] The cross-alignment layer uses the attack path encoding as the query vector and the key evidence encoding as the key vector and value vector. It uses scaled dot product attention to calculate the association weights and performs a weighted summation of the key evidence encodings based on the association weights to generate a path-evidence joint representation.

[0052] The field constraint decoder establishes a situation report field state machine, generates candidate situation report fields in the order of scenario summary, attack timeline, current attack stage, affected objects, business impact, situation simulation results, response suggestions, and matters to be confirmed, and uses a mask Softmax function to limit the candidate output range of the current attack stage field, affected object field, and response suggestion field.

[0053] The evidence citation layer uses a pointer network to calculate the key evidence citation probability corresponding to each candidate attack conclusion. When the highest key evidence citation probability reaches the evidence citation threshold, the field constraint decoder writes the corresponding candidate attack conclusion, evidence identifier, and original record index into the situation report. When the highest key evidence citation probability does not reach the evidence citation threshold, the corresponding candidate attack conclusion is written into the pending confirmation items.

[0054] Optionally, step six specifically includes:

[0055] Based on the confirmation, modification, or rejection results of security operations personnel regarding the attack scenario, current attack chain, situation simulation results, situation report, and response plan, manual feedback is generated.

[0056] The model output uncertainty of the evidence closure scenario reconstruction network is calculated using Shannon information entropy. The attack scenario structure fingerprint is generated using the Weisfeiler-Lehman graph hashing algorithm. The attack scenario structure difference is generated based on the Hamming distance between the current attack scenario structure fingerprint and the historical attack scenario structure fingerprint.

[0057] The degree of evidence conflict is generated based on the proportion of evidence with evidence conflict markers in the attack scenario. The degree of business impact is generated based on the number of affected business systems, the importance level of the business, and the scope of business impact. The uncertainty of the model output, the structural differences of the attack scenario, the degree of evidence conflict, and the degree of business impact are normalized and weighted by Min-Max to generate a difficult case score and screen difficult cases.

[0058] Positive samples are generated based on the results of manual confirmation. Negative samples are constructed by shuffling the order of attack phases, replacing event times, deleting key evidence, or disconnecting node associations. The situational difficulties, positive samples, negative samples, and historical training samples are combined to form incremental training samples, and the evidence closure scenario is updated to reconstruct the network.

[0059] The updated network parameters are released when at least two of the attack scenario recall rate, attack phase identification accuracy, and attack chain reconstruction accuracy are greater than the corresponding indicators before the update, and the error scenario merging rate is not greater than the error scenario merging rate before the update; otherwise, the network parameters before the update are retained.

[0060] Optionally, step seven specifically includes:

[0061] Construct a response action diagram based on the response actions, response action prerequisites, response action dependencies, and response action rollback relationships in the response plan;

[0062] The Kahn topology sorting algorithm is used to determine the execution order of response actions, and the connection status of the target device, the permissions of the execution account, the status of the target object, the permitted scope of the service, and the rollback conditions of the response actions are verified.

[0063] The verified response actions are encapsulated into a unified response command and sent to the corresponding security device or security management system through the security orchestration automation system to obtain the response action execution status, the reason for the response action failure and the actual business impact, and generate the response action execution result.

[0064] The response actions, response action execution results, and network security status changes are written back to the time-series security graph. The updated time-series security graph is then re-input into the evidence closure scenario to reconstruct the network and regenerate the attack scenario and key evidence.

[0065] The current attack chain and situation assessment results are regenerated based on the regenerated attack scenario. The situation simulation results are regenerated based on the regenerated current attack chain. The handling results are generated based on the situation assessment results before and after the handling, the number of effective attack paths, the number of potentially damaged assets, and the scope of business impact.

[0066] When the response action fails, the post-handling situation assessment result is not lower than the pre-handling situation assessment result, or the actual business impact is greater than the expected business impact, the attack scenario, response plan, and response action execution result will be fed back to step six as a new situational challenge.

[0067] The beneficial effects of this invention are:

[0068] (1) By performing time synchronization, entity merging, event association, cross-modal semantic alignment, and weighted fusion based on evidence credibility and evidence conflict markers on network traffic records, security device logs, terminal behavior records, asset topology records, and threat intelligence records, the problems of inconsistent time bases, fragmented entity identifiers, inconsistent semantic spaces, and direct discarding of conflict records can be solved. This can reduce the probability of the same attack being split and unrelated events being mistakenly merged, forming a multimodal security data frame with original record indexes and credible evidence, providing a complete and traceable data foundation for subsequent attack scenario reconstruction.

[0069] (2) By reconstructing the network through evidence closure scenarios, evidence support messages and evidence conflict messages are propagated separately. The propagation of evidence support messages is constrained by the attack phase transition relationship. The business impact is injected into the attack event in reverse along the business topology. The scenario boundary is determined based on the scenario closure increment before and after the addition of candidate nodes. This solves the problem that existing graph association methods only expand the scenario based on node similarity or local connection relationship, which easily leads to attack scenarios with phase breaks, business irrelevance and evidence conflict residue. It can improve the accuracy of multi-stage attack scenario boundaries, attack chains and key evidence, so that the situation assessment results have both technical attack logic and business impact basis.

[0070] (3) By setting counterfactual states such as asset loss, offline protection equipment or failure of blocking rules, the attack transfer probability is calculated and a probability constraint path search is performed. At the same time, the attack conclusion is bound to the original evidence by using the evidence constraint report generation network. A response plan is generated based on the security knowledge graph and the execution result is written back to the time sequence security graph. This solves the problems of existing situational awareness systems that only output static risk values, lack evidence support for conclusions, and cannot provide feedback on the handling effect. It can identify potential attack paths in advance, limit the output of conclusions without evidence, and continuously update the model according to the actual handling results. This is of great significance for reducing the risk of mishandling, shortening the security operation response time, and forming a verifiable automated defense closed loop. Attached Figure Description

[0071] The accompanying drawings are provided to further illustrate the invention and form part of the specification. They are used in conjunction with embodiments of the invention to explain the invention and do not constitute a limitation thereof. In the drawings:

[0072] Figure 1 This is a flowchart of an intelligent network situational awareness method based on multimodal fusion proposed in this invention;

[0073] Figure 2 This is a framework diagram of the evidence closure scenario reconstruction network in an intelligent network situational awareness method based on multimodal fusion proposed in this invention.

[0074] Figure 3 This is a framework diagram of the evidence constraint report generation network in the intelligent network situational awareness method based on multimodal fusion proposed in this invention. Detailed Implementation

[0075] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0076] refer to Figures 1-3 A method for intelligent network situational awareness based on multimodal fusion includes the following steps:

[0077] Step 1: Collect multi-source network security data, and generate multi-modal security data frames through time synchronization, entity merging, event correlation, cross-modal semantic alignment, and trustworthiness weighted fusion.

[0078] Step 2: Construct a temporal security graph based on multimodal security data frames, reconstruct the network by inputting evidence closure scenarios, generate node representations through evidence anchoring, propagate evidence support messages and evidence conflict messages respectively, constrain the message propagation direction according to the attack phase transition relationship, inject business impact into the attack event in reverse along the business topology, and determine the scenario boundary based on the change in scenario closure before and after the addition of candidate nodes, and generate attack scenarios and key evidence.

[0079] Step 3: Based on the attack scenario, perform path expansion, path scoring, and conflict pruning under the constraints of the attack phase to generate the current attack chain and situation assessment results;

[0080] Step 4: Set counterfactual state based on the current attack chain, update the temporal security graph, calculate the attack transfer probability and perform probability-constrained path search to generate situational simulation results;

[0081] Step 5: Input the current attack chain, situational analysis results, and key evidence into the evidence constraint report generation network. The network generates a situational report through path encoding, evidence encoding, cross-alignment, field constraint decoding, and evidence referencing. A response plan is then generated based on the security knowledge graph.

[0082] Step 6: Based on human feedback, screen difficult cases, construct incremental training samples, and update the evidence closure scenario reconstruction network;

[0083] Step 7: Execute the response plan and write the execution results back to the timing security diagram, regenerate the situation assessment results and situation simulation results, and obtain the handling results.

[0084] In this embodiment, step one specifically includes:

[0085] Collect multi-source network security data, including network traffic records, security device logs, terminal behavior records, asset topology records, and threat intelligence records;

[0086] Field parsing and unified structure processing are performed on multi-source network security data to extract data source identifiers, event time, event type, source entity, target entity, behavioral attributes, and original record indexes, generating an initial unified security record;

[0087] The timestamps in network traffic records are selected as the base time. Corresponding records corresponding to network connection, account login, file transfer or command execution are extracted from security device logs and terminal behavior records. The time offset between different data sources is calculated. Abnormal time offsets are removed by the median absolute deviation algorithm. The event time in the initial unified security record is corrected according to the arithmetic mean of the remaining time offsets to generate a unified security record.

[0088] Based on the communication quintuple, the network traffic records are aggregated and divided into sessions and time slices. The network traffic temporal features are extracted and then input into the network traffic coding branch, which includes a one-dimensional convolutional layer, a batch normalization layer, a ReLU activation function, a global average pooling layer, and a fully connected mapping layer, to generate a network traffic coding vector.

[0089] The Drain log parsing algorithm is used to parse the security device logs into templates. The security log template is input into the Sentence-BERT text encoding model to generate a security log template semantic vector. The variable fields in the security device log are input into the Embedding layer to generate a security log field encoding vector. The security log template semantic vector and the security log field encoding vector are concatenated and input into a multilayer perceptron to generate a security log encoding vector.

[0090] A process behavior tree is constructed based on terminal behavior records. The process behavior tree is then input into a tree-structured long short-term memory network (Tree-LSTM) to generate terminal behavior encoding vectors. Asset topology records are subjected to category encoding, numerical normalization, and feature cross-processing to generate asset topology encoding vectors. A threat intelligence relationship graph is constructed based on threat intelligence records, and a threat intelligence encoding vector is generated using the TransE graph embedding model.

[0091] Entity equivalence relations are established based on asset management records, address resolution records, terminal agent records, and identity authentication records. The disjoint-set data structure algorithm is used to merge entity identifiers pointing to the same network object to generate a unified entity identifier.

[0092] Based on unified entity identifiers, network sessions, process behavior chains, vulnerability identifiers, and threat indicators, unified security records are correlated to generate security event groups.

[0093] Specifically, within the sliding event association time window, when unified security records of different modalities meet at least one of the following conditions: same unified entity identifier, same network session, same process behavior chain, same vulnerability identifier, and same threat indicator, the corresponding unified security records will be assigned to the same security event group; when unified security records of different modalities only meet the condition that the event time is close but do not meet any object association condition, the corresponding unified security records will not be assigned to the same security event group.

[0094] The credibility of evidence is calculated based on the data source credibility level, field completeness, event time freshness, and cross-modal consistency of the unified security record within the security incident group. Among them, the exponential decay function is used to calculate the event time freshness based on the time interval between the event occurrence time and the current analysis time.

[0095] Consistency checks are performed on unified security records of different modalities within the same security event group. When the unified entity identifier is inconsistent, an object conflict mark is generated. When the event time sequence is reversed from the network connection sequence or process call sequence, a time conflict mark is generated. When the same behavior has both a successful execution record and a blocking record, a behavior conflict mark is generated. Object conflict marks, time conflict marks, and behavior conflict marks are collectively referred to as evidence conflict marks. Unified security records with evidence conflict marks are not deleted from the security event group, and the corresponding original record index is retained.

[0096] The network traffic encoding vector, security log encoding vector, terminal behavior encoding vector, asset topology encoding vector, and threat intelligence encoding vector are respectively input into the corresponding modality mapping branch. The different modality encoding vectors are mapped to a unified semantic space through fully connected mapping, batch normalization, and LeakyReLU activation function.

[0097] Different modal semantic representations within the same security event group are paired as positive samples, and different modal semantic representations within different security event groups are paired as negative samples. The modal mapping branch is trained using cosine similarity and InfoNCE loss function to obtain the modal semantic representations that complete cross-modal semantic alignment.

[0098] Based on the evidence conflict marker, the conflict penalty value corresponding to the evidence conflict type is deducted from the evidence credibility of the corresponding modality; when the corresponding modality is missing, the corresponding modality is set as an invalid modality; the Softmax function is used to normalize the evidence credibility of each valid modality and generate modality fusion weights.

[0099] The semantic representations of each modality are weighted and summed according to the modality fusion weights. The resulting multimodal fusion representations are then associated and encapsulated with unified entity identifiers, event times, event types, evidence credibility, evidence conflict markers, and original record indexes to generate multimodal secure data frames.

[0100] In this embodiment, step two specifically includes:

[0101] Construct a time-series security graph based on multimodal security data frames, and set asset objects, account objects, service objects, vulnerability objects, attack event objects, business system objects, and evidence record objects as nodes in the time-series security graph. Set network access relationships, account login relationships, process call relationships, vulnerability exploitation relationships, threat indicator hit relationships, asset ownership relationships, business dependency relationships, and evidence support relationships as relationships in the time-series security graph.

[0102] Configure multimodal fusion representation, node type, event time, evidence credibility, evidence conflict marker, and original record index for nodes in the time-series security graph; configure relationship type, relationship time, relationship credibility, and associated evidence identifier for relationships in the time-series security graph.

[0103] The temporal security graph is input into the evidence closure scenario reconstruction network, which includes an evidence anchoring unit, a support-conflict dual-path propagation unit, an attack phase constraint unit, a business impact reverse injection unit, a scenario closure determination unit, a key evidence selection unit, and an attack scenario output unit.

[0104] The evidence anchoring unit concatenates the multimodal fusion representation of the temporal security graph node, node type encoding, evidence source encoding, evidence credibility, and evidence conflict marker. It uses sine position encoding and cosine position encoding to process event time and event time interval, and generates evidence anchoring node representation through fully connected mapping and LeakyReLU activation function. The evidence anchoring node representation is then transmitted to the support-conflict dual-path propagation unit and the attack phase constraint unit.

[0105] The support-conflict dual-path propagation unit generates an evidence support state based on whether adjacent temporal security graph nodes share a unified entity identifier, network session, process behavior chain, vulnerability identifier or threat indicator, and whether the event time is continuous and the behavior results are consistent; it generates an evidence conflict state based on whether adjacent temporal security graph nodes have object conflicts, time conflicts, behavior conflicts, mutually exclusive asset states or attack phase conflicts.

[0106] The support-conflict dual-path propagation unit concatenates the representations of adjacent evidence anchor nodes, the temporal security graph relationship type, the event time interval, and the evidence support state, and inputs them into the evidence support gating branch. It then generates the evidence support gating value through a fully connected mapping and a Sigmoid function. Concatenating the representations of adjacent evidence anchor nodes, the temporal security graph relationship type, the event time interval, and the evidence conflict state, it inputs them into the evidence conflict gating branch. It then generates the evidence conflict gating value through a fully connected mapping and a Sigmoid function.

[0107] For each adjacent evidence anchor node, a linear transformation corresponding to the temporal security graph relationship type is performed. The evidence support gate value is multiplied by the corresponding linear transformation result to generate an evidence support message. The evidence conflict gate value is multiplied by the corresponding linear transformation result to generate an evidence conflict message. The mean of the evidence support messages and the mean of the evidence conflict messages generated by adjacent temporal security graph nodes are calculated to generate an aggregated evidence support message and an aggregated evidence conflict message. The aggregated evidence support message is then transmitted to the attack phase constraint unit.

[0108] The attack phase constraint unit generates an initial attack phase probability distribution by performing fully connected mapping and Softmax normalization on the initial attack phase identification branch based on the attack event type, attack technology identifier, and attack behavior characteristics. The attack behavior characteristics include vulnerability exploitation behavior, process behavior, and network behavior.

[0109] An attack phase transition matrix is ​​established according to the reconnaissance phase, initial access phase, execution phase, persistence phase, privilege escalation phase, lateral movement phase, and data transfer phase. The attack phase transition matrix is ​​determined based on preset attack phase rules and the phase transition frequency of historical attack events. The matrix elements in the attack phase transition matrix represent the degree of permission for the transition from the source attack phase to the target attack phase.

[0110] The attack phase constraint unit generates attack phase transition coefficients based on the initial attack phase probability distribution of the source attack event node, the initial attack phase probability distribution of the target attack event node, the attack phase transition matrix, and the event time sequence.

[0111] Specifically, the probability of the source attack event node at each attack stage is combined with the corresponding matrix elements in the attack stage transition matrix to generate a potential stage distribution; the potential stage distribution is multiplied and accumulated with the initial attack stage probability distribution of the target attack event node to generate a stage matching strength; when the event time of the source attack event node is earlier than the event time of the target attack event node, the stage matching strength is determined as the attack stage transition coefficient; when the event time of the source attack event node is not earlier than the event time of the target attack event node, the attack stage transition coefficient is set to zero.

[0112] When the corresponding matrix element in the attack phase transition matrix is ​​zero, the corresponding attack phase transition is determined to be a prohibited transition; when the corresponding attack phase transition belongs to a cross-phase transition that is allowed, the corresponding matrix element is set to a non-zero value that is less than the element of the normal transition matrix of the adjacent phase.

[0113] When the source attack event node and the target attack event node satisfy the allowed attack phase transition relationship and the event time increases, the corresponding evidence support message is multiplied by the attack phase transition coefficient to generate a constraint evidence support message; when the attack phase satisfies the allowed cross-phase transition relationship and the current candidate attack scenario has evidence of an intermediate attack phase, the corresponding evidence support message is multiplied by the attack phase transition coefficient and the cross-phase propagation attenuation coefficient in sequence to generate a constraint evidence support message; when the attack phase jumps backward, the event time is reversed, or the intermediate attack phase cannot be supplemented by evidence in the current candidate attack scenario, the attack phase transition coefficient is set to zero, and an attack phase conflict flag is generated.

[0114] The business impact reverse injection unit constructs a business topology based on asset carrying relationships, service call relationships, and data dependencies, and generates business impact seed representations based on business importance level, business operation status, and business continuity requirements.

[0115] Starting from the business system object, the business impact seed representation is propagated in the reverse direction from the business system object, service object, asset object to the attack event object. The business impact seed representation is multiplied by the exponential decay coefficient corresponding to the business topology distance, and then multiplied by the business dependency strength of the corresponding business dependency relationship to generate the business impact representation corresponding to each business topology path.

[0116] When multiple business topology paths point to the same attack event object, the business impact representations corresponding to each business topology path are accumulated to generate the business impact representation of the attack event object; when the attack event object cannot establish a connection with the business exception along the business topology, the corresponding business impact representation is set to zero.

[0117] The evidence closure scenario reconstruction network accumulates the constraint evidence support message and business impact representation into the original representation of the attack event node, multiplies the aggregated evidence conflict message by the conflict penalty coefficient and deducts it from the accumulation result, and then generates the updated attack event node representation through the ReLU activation function.

[0118] The updated attack event node representations are input into the node anomaly classification branch and the attack phase classification branch, respectively. The node anomaly classification branch generates node anomaly probabilities through a fully connected mapping and a Sigmoid function, while the attack phase classification branch generates attack phase probability distributions through a fully connected mapping and a Softmax function. The initial attack phase probability distribution is used to calculate the attack phase transition coefficients and to support the propagation constraints of the evidence support message. The attack phase probability distribution serves as the output of the attack scenario and the basis for attack chain search.

[0119] The representations of adjacent attack event nodes are concatenated with the corresponding temporal security graph relationship representations, and the attack relationship classification branch is input. The attack relationship probability is generated through fully connected mapping and the Sigmoid function.

[0120] The scenario closure determination unit determines the scenario seed threshold based on the node anomaly probability distribution of normal event nodes and abnormal attack event nodes in the historical verification samples, sets the attack event nodes whose node anomaly probability reaches the scenario seed threshold but have not yet been included in the attack scenario as scenario seeds, and determines candidate nodes to be added from the adjacent nodes of the scenario seeds.

[0121] The scenario closure determination unit calculates the object closure, time closure, stage closure, evidence coverage, business interpretability, and conflict residual based on the object association status, event time status, attack stage status, evidence support status, business impact status, and evidence conflict status in the candidate attack scenario.

[0122] Object closure is determined based on the proportion of valid relationships between the attack event object and the attack source object, victim asset object, account object, service object, vulnerability object, and business system object; temporal closure is determined based on the continuity of time intervals between adjacent attack event objects; phase closure is determined based on the attack phase transition coefficient; evidence coverage is determined based on the proportion of the number of attack origins, attack objects, attack behaviors, attack phase transitions, and business impacts supported by evidence to the corresponding total number; business interpretability is determined based on the completeness of business impact representation and business topology path; conflict residuals are determined based on the number of uninterpreted object conflicts, temporal conflicts, behavioral conflicts, and attack phase conflicts.

[0123] The object closure, time closure, stage closure, evidence coverage, and business interpretability are weighted and summed according to the preset closure weights, and then the penalty value corresponding to the conflict residue is deducted to generate the scenario closure.

[0124] The scene closure increment is generated by subtracting the scene closure before the candidate node is added from the scene closure after the candidate node is added.

[0125] When the scenario closure increment is greater than zero, and the candidate node does not introduce any unavoidable object conflicts, time conflicts, or attack phase conflicts, the candidate node is written into the current candidate attack scenario; when the scenario closure increment is not greater than zero, the candidate node is not written into the current candidate attack scenario, and the candidate node is reserved as a candidate node for other attack scenarios or an isolated abnormal node; when the candidate node only increases the number of nodes, but does not increase the evidence coverage, phase closure, or business interpretability, the candidate node is not written into the current candidate attack scenario.

[0126] When two candidate attack scenarios share key evidence, can fill in missing attack phases, and the closure of the merged scenario is greater than the closure of each of the two candidate attack scenarios before merging, the two candidate attack scenarios are merged; when there are unrelated attack source objects, unconnected business impact paths, or irremovable conflict evidence in the same candidate attack scenario, low connection relationships are determined based on the attack relationship probability and evidence support gating value, and candidate attack scenarios are split along the low connection relationships.

[0127] The key evidence selection unit establishes a set of conclusions to be supported based on the attack starting point, attack target, attack behavior, attack phase transition and business impact in the attack scenario, and establishes the coverage relationship between the evidence recording object and the conclusions to be supported.

[0128] A weighted greedy set coverage algorithm is used to select key evidence. An evidence selection score is generated based on the credibility of the evidence, the number of unsupported conclusions that the evidence recording object can cover, and the number of evidence conflict markers contained in the evidence recording object. The evidence recording object with the highest evidence selection score is selected in turn until the attack starting point, attack target, attack behavior, attack phase transition, and business impact are all supported by key evidence.

[0129] The network for reconstructing evidence closure scenarios is trained using historical attack events confirmed by security personnel. The node scenario attribution task uses the cross-entropy loss function, the attack relationship identification task uses the binary cross-entropy loss function, the attack phase identification task uses the multi-class cross-entropy loss function, the evidence support and evidence conflict separation task uses the supervised comparison loss function, the key evidence selection task uses the binary cross-entropy loss function, and the scenario closure ranking task uses the triplet loss function. The Adam optimization algorithm is used to update the parameters of the network for reconstructing evidence closure scenarios.

[0130] The attack scenario output unit encapsulates the results of attack scenario expansion, attack scenario merging, attack scenario splitting, and key evidence selection to generate attack scenarios and key evidence.

[0131] In this embodiment, step three specifically includes:

[0132] The starting node of the attack path is determined based on the node anomaly probability, evidence credibility, and attack stage probability distribution in the attack scenario, and a set of candidate attack paths is established using a beam search algorithm.

[0133] Calculate the initial score for each attack event node in the attack scenario, multiply the node anomaly probability by the first preset weight coefficient, multiply the evidence credibility by the second preset weight coefficient, multiply the initial stage matching degree by the third preset weight coefficient, and add the three products to generate the initial score for the corresponding attack event node. The sum of the first preset weight coefficient, the second preset weight coefficient, and the third preset weight coefficient is one.

[0134] The probability of the reconnaissance phase and the probability of the initial access phase in the probability distribution of the attack phase are added together to generate the matching value of the early phase. When the matching value of the early phase reaches the preset initial phase threshold, the matching value of the early phase is used as the matching degree of the initial phase. When the matching value of the early phase does not reach the preset initial phase threshold, the probability of the execution phase is multiplied by the preset phase penalty coefficient to generate the matching degree of the initial phase.

[0135] The attack event nodes in the attack scenario are sorted from high to low according to the initial score. From the sorting results, the attack event nodes that simultaneously meet the following conditions are selected: the node anomaly probability reaches the preset anomaly threshold, the evidence credibility reaches the preset credibility threshold, there is no time conflict mark, there is no attack stage conflict mark, and there is no predecessor attack event node connected by the temporal security graph relationship with the attack relationship probability reaching the path extension threshold. These are then used to form the attack path starting node candidate set.

[0136] The attack event node with the highest initial score and whose number does not exceed the preset bundle width is selected from the attack path starting node candidate set; when the attack path starting node candidate set is empty, the attack event node with the highest initial score is selected from all attack event nodes in the attack scenario as the attack path starting node.

[0137] Extend subsequent attack event nodes from the terminal attack event nodes of the current candidate attack path along the temporal security graph relationship where the attack relationship probability reaches the path extension threshold, and perform event time sequence verification, attack phase transition verification, node duplication verification, and evidence conflict verification on the subsequent attack event nodes.

[0138] Normalization mapping is performed on the business impact representation of the attack event node to generate the business impact degree; the Min-Max normalization method is used to process the node anomaly probability, evidence credibility, business impact degree corresponding to the business impact representation, attack relationship probability and attack stage transition coefficient respectively. The normalized data are weighted and summed according to the preset path scoring weight, and the penalty values ​​corresponding to object conflict, time conflict and attack stage conflict are deducted to generate candidate attack path scores.

[0139] Candidate attack paths are sorted in descending order according to their scores, and candidate attack paths within the preset beam width are retained for further expansion. When the probability of no attack relationship reaches the path expansion threshold and a subsequent attack event node passes the event time sequence verification, attack phase transfer verification, node duplication verification, and evidence conflict verification, the expansion of the corresponding candidate attack path is stopped.

[0140] When a candidate attack path exhibits reversed event time, reversed attack phase, or interrupted unified entity association, the corresponding candidate attack path will be removed from the candidate attack path set. When multiple candidate attack paths have the same score, they will be re-sorted from high to low according to the number of attack starting points, attack targets, attack behaviors, attack phase transitions, and business impacts supported by key evidence.

[0141] The candidate attack path with the highest score, and whose attack origin, target, behavior, attack phase transition, and business impact are all supported by key evidence, is identified as the current attack chain.

[0142] Based on the asset importance level, node anomaly probability, vulnerability severity and network exposure of the asset objects involved in the current attack chain, generate asset risk indicators; based on the attack stage and attack path length of the current attack chain, generate attack development indicators; based on the difference between the protection measures required during the attack process and the currently effective protection measures, generate protection gap indicators; and based on the business impact path formed by the current attack chain along the business topology, generate business impact indicators.

[0143] The Min-Max normalization method is used to process asset risk indicators, attack development indicators, defense gap indicators, and business impact indicators, and they are weighted and summed according to preset situation assessment weights to generate situation assessment results.

[0144] In this embodiment, step four specifically includes:

[0145] Copy the current temporal security graph and generate a counterfactual temporal security graph. Select critical asset objects, critical account objects, or critical protection equipment objects as counterfactual objects from the current attack chain.

[0146] Set critical asset objects to an asset compromised state, critical account objects to an account credential leaked state, critical protection equipment objects to an offline state, or set the corresponding blocking rules to a rule invalid state, and update the network access relationship, account permission relationship and protection blocking relationship in the counterfactual sequence security graph according to the counterfactual state.

[0147] The probability of network reachability is determined based on network routing and access control rules; the probability of vulnerability exploitation is determined based on the vulnerability existence status and vulnerability exploitation prerequisites; the probability of account privileges is determined based on the matching degree between the current account privilege level and the target operation privilege level; the probability of transition during the simulation stage is determined based on the attack stage transition matrix; and the probability of protection and blocking is determined based on the coverage ratio of protection measures to the current attack techniques, target assets and access paths, as well as the historical blocking success rate.

[0148] The attack transfer probability is generated by multiplying the network reachability probability, vulnerability exploitation probability, account privilege probability, and simulation phase transfer probability in sequence, and then multiplying by the difference between the network reachability probability, vulnerability exploitation probability, account privilege probability, and simulation phase transfer probability.

[0149] When the network is unreachable, the target vulnerability does not exist, or the preconditions for exploitation are not met, the corresponding attack relationship is set to a non-extendable state; when the current account privilege level is lower than the target operation privilege level, the account privilege matching coefficient is determined based on the difference between the two levels, and the account privilege matching coefficient is used as the account privilege probability; when the protection measures cover the current attack technology, target assets, or access path, the protection blocking probability is calculated based on the coverage ratio and historical blocking success rate.

[0150] Taking the attack event node at the end of the current attack chain as the starting point of situation inference, the candidate inference path is expanded by using the probability constraint bundle search algorithm. The attack transfer probabilities between each adjacent attack event node in the candidate inference path are multiplied in turn to generate the cumulative probability of the candidate inference path.

[0151] When the cumulative probability of a candidate inference path is lower than the path retention threshold, the expansion of the corresponding candidate inference path is stopped; when the protection blocking probability corresponding to any attack relationship in the candidate inference path reaches the blocking threshold, the corresponding candidate inference path is deleted from the candidate inference path set; when multiple candidate inference paths reach the same target object, they are sorted according to the cumulative probability of the candidate inference path and the business interpretability, and the candidate inference path with the higher ranking is retained.

[0152] The cumulative probability of candidate simulation paths, the importance level of target assets, and the expected business impact are weighted and summed according to the preset simulation scoring weights to generate candidate simulation path scores, and the candidate simulation paths are ranked according to the candidate simulation path scores.

[0153] Obtain the event time intervals of historical similar attack relationships, take the median of the event time intervals as the predicted event interval, add the predicted event intervals to the expected occurrence time of the previous attack event to generate the expected occurrence time of the next attack event, and generate situational inference results based on the top-ranked candidate inference paths and their corresponding expected occurrence times.

[0154] In this embodiment, step five specifically includes:

[0155] The current attack chain and situational simulation results are converted into an attack path sequence, and the key evidence content is obtained based on the original record index in the key evidence.

[0156] The attack path sequence and key evidence content are input into the evidence constraint report generation network, which includes a path encoder, an evidence encoder, a cross-alignment layer, a field constraint decoder, and an evidence reference layer.

[0157] The path encoder uses a bidirectional long short-term memory network to encode the attack path sequence and generate the attack path code; the evidence encoder uses a bidirectional long short-term memory network to encode the key evidence content and generate the key evidence code, and transmits the attack path code and the key evidence code to the cross-alignment layer.

[0158] The cross-alignment layer uses the attack path code as the query vector and the key evidence code as the key vector and value vector. It uses the scaling dot product attention function to calculate the association weight between the attack path code and the key evidence code, and performs a weighted summation on the key evidence code according to the association weight to generate a path-evidence joint representation. The path-evidence joint representation is then transmitted to the field constraint decoder and the evidence reference layer.

[0159] The field constraint decoder establishes a state machine for the situation report field based on the path-evidence joint representation. It generates candidate situation report fields and candidate attack conclusions in the order of scenario summary, attack timeline, current attack stage, affected objects, business impact, situation simulation results, response suggestions, and matters to be confirmed. The mask Softmax function is used to limit the candidate output range of each candidate situation report field.

[0160] Among them, the current attack phase field can only output the preset attack phase, the affected object field can only output the asset object, account object, service object and business system object in the attack scenario, and the response suggestion field can only output the response action registered in the response action library.

[0161] The field constraint decoder transmits the candidate attack conclusions to the evidence citation layer. The evidence citation layer uses a pointer network to calculate the key evidence citation probability corresponding to each candidate attack conclusion, generates the evidence citation result, and transmits the evidence citation result to the field constraint decoder.

[0162] When the probability of citing the highest critical evidence reaches the evidence citation threshold, the field constraint decoder writes the corresponding candidate attack conclusion, evidence identifier, and original record index into the situation report; when the probability of citing the highest critical evidence does not reach the evidence citation threshold, the corresponding candidate attack conclusion is written into the pending confirmation items, and a situation report is generated.

[0163] The field constraint decoder is trained using the cross-entropy loss function, the correspondence between the attack path encoding and the key evidence encoding is trained using the contrastive loss function, the evidence citation layer is trained using the binary cross-entropy loss function, and the network parameters for generating the evidence constraint report are updated using the Adam optimization algorithm.

[0164] The attack technology identifier, vulnerability identifier, asset type, attack stage and business impact are extracted from the situation report. A breadth-first search algorithm is used to perform a bounded graph search on the security knowledge graph to generate candidate response actions and their dependencies.

[0165] Candidate response actions are combined based on their dependencies to generate candidate response schemes. The expected risk reduction, the credibility of the security knowledge graph reasoning path, and the historical execution success rate are weighted and accumulated according to the preset response scheme scoring weights. The score corresponding to the execution cost of the response action and the expected business impact is deducted to generate a candidate response scheme score. The response scheme is determined based on the candidate response scheme score.

[0166] In this embodiment, step six specifically includes:

[0167] Based on the confirmation, modification, or rejection results of security operations personnel regarding the attack scenario, current attack chain, situation simulation results, situation report, and response plan, manual feedback is generated.

[0168] The model output uncertainty of the evidence closure scenario reconstruction network is calculated using Shannon information entropy. The attack scenario structure fingerprint is generated using the Weisfeiler-Lehman graph hashing algorithm. The Hamming distance between the current attack scenario structure fingerprint and the historical attack scenario structure fingerprint is calculated, and the minimum Hamming distance is taken as the attack scenario structure difference.

[0169] The degree of evidence conflict is generated based on the proportion of evidence with conflict markers in the attack scenario to the total number of evidence; the degree of business impact is generated based on the number of affected business systems, the corresponding business importance level, and the scope of business impact.

[0170] The Min-Max normalization method is used to process the uncertainty of model output, the difference in attack scenario structure, the degree of evidence conflict and the degree of business impact, and the model is weighted and summed according to the preset difficulty example score weight to generate a difficulty example score. The situational difficulty examples are selected based on the difficulty example score.

[0171] The attack scenarios and the current attack chain, which are manually confirmed, are used as positive samples. Negative samples are constructed by shuffling the order of attack stages, replacing event times, deleting key evidence, or disconnecting node associations.

[0172] The incremental training samples are composed of situational difficulties, positive samples, negative samples and historical training samples. The incremental training samples are then grouped into training batches according to the experience playback method. The InfoNCE loss function, cross-entropy loss function, binary cross-entropy loss function, multi-class cross-entropy loss function and triplet loss function are used for incremental training. The Adam optimization algorithm is used to update the network parameters for evidence closure scene reconstruction.

[0173] Using fixed validation samples, we statistically analyzed the attack scenario recall rate, attack stage identification accuracy, attack chain reconstruction accuracy, F1 score, and error scenario merging rate.

[0174] The updated evidence closure scenario reconstruction network parameters will be released only if at least two of the attack scenario recall rate, attack phase identification accuracy, and attack chain reconstruction accuracy are greater than the corresponding indicators before the update, and the error scenario merging rate is not greater than the error scenario merging rate before the update; otherwise, the previous evidence closure scenario reconstruction network parameters will continue to be used.

[0175] In this embodiment, step seven specifically includes:

[0176] Set the response actions in the response plan as response action nodes, and construct a response action graph based on the response action prerequisites, response action dependencies, and response action rollback relationships.

[0177] The Kahn topology sorting algorithm is used to determine the execution order of response actions, and the target device connection status, target device interface status, execution account permissions, target object status, business allowed scope, and response action rollback conditions are verified before the response actions are executed.

[0178] The response actions that pass the execution condition verification are encapsulated into a unified response command, and the unified response command is sent to the corresponding security device or security management system through the security orchestration automation system. The system receives the execution status of the response action, the reason for the failure of the response action and the actual business impact, and generates the execution result of the response action.

[0179] The response actions, response action execution results, and network security status changes are written back to the time-series security graph. The updated time-series security graph is then re-input into the evidence closure scenario to reconstruct the network and regenerate the attack scenario and key evidence.

[0180] The current attack chain and situation assessment results are regenerated based on the regenerated attack scenario, and the situation simulation results are regenerated based on the regenerated current attack chain.

[0181] The reduction in situational risk is generated by subtracting the post-action situational assessment from the pre-action situational assessment. The number of effective attack paths, the number of potentially affected assets, and the scope of business impact are compared before and after the action to generate the action result.

[0182] When the reduction in situational risk is greater than zero, and at least one of the following is less than the corresponding value before the action, the corresponding response plan will be marked as an effective response plan.

[0183] When the response action fails, the post-handling situation assessment result is not lower than the pre-handling situation assessment result, or the actual business impact is greater than the expected business impact, the corresponding attack scenario, response plan, and response action execution result will be fed back to step six as a new situational difficulty example.

[0184] This forms a closed-loop processing procedure encompassing multi-source network security data processing, attack scenario reconstruction, current attack chain generation, situational analysis, situational report generation, response plan execution, effectiveness evaluation, and evidence closure scenario reconstruction network updates.

[0185] Example 1: To verify the feasibility of this invention in practice, it was applied to the hybrid cloud security operations center of a large manufacturing enterprise. This center connects to a firewall, intrusion detection system, endpoint detection and response system, identity authentication system, and cloud audit platform, covering 680 asset objects, 326 account objects, and 28 business system objects. Data from 30 consecutive days was selected, including 192 million network traffic records, 7.15 million security device logs, 2.68 million endpoint behavior records, and corresponding asset topology and threat intelligence records. The network was trained using 780 historical attack scenarios confirmed by security personnel, and an additional 200 independent attack scenarios were selected for testing. These included phishing logins, vulnerability exploitation, command execution, privilege escalation, lateral movement, and data leakage. 64 of these attack scenarios contained conflict evidence such as time conflicts, behavioral conflicts, or mutually exclusive asset states.

[0186] In practical applications, the data generated by each security system first undergoes time synchronization, entity merging, event correlation, cross-modal semantic alignment, and trustworthiness weighted fusion to generate multimodal security data frames. The system constructs a temporal security graph based on these multimodal security data frames and processes evidence-supporting messages and evidence-conflicting messages separately using evidence closure scenario network reconstruction. It utilizes attack phase transition relationships to limit the propagation of unreasonable messages, injects business impacts back into attack events along the business topology, and determines the attack scenario boundary based on the scenario closure increment before and after the addition of candidate nodes. The system further generates the current attack chain and situation assessment results, performs situational simulations for counterfactual states such as asset compromise, offline protection equipment, and failed blocking rules, generates situation reports and response plans, and writes the execution results of the response actions back to the temporal security graph.

[0187] The event association time window was set to 300 seconds, the scene seed threshold to 0.65, the path expansion threshold to 0.55, the preset beamwidth to 8, the cross-stage propagation attenuation coefficient to 0.60, the evidence citation threshold to 0.70, the path preservation threshold to 0.08, and the blocking threshold to 0.75. The evidence closure scene reconstruction network was trained for 60 epochs using the Adam optimization algorithm, with an initial learning rate of 0.001.

[0188] Comparison Method A uses a fixed time window and preset association rules to generate attack scenarios; Comparison Method B uses a regular graph neural network for single-path message propagation and generates attack chains through beam search; Comparison Method C uses an unmodified scenario to reconstruct the network, retaining multimodal coding, graph representation, node classification, and attack relationship classification processing, but does not set support for conflict-based dual-path propagation, attack phase propagation constraints, reverse injection of business impact, and incremental determination of scenario closure.

[0189] Table 1. Comparison of Attack Scenario Reconstruction and Handling Effects of Different Methods

[0190]

[0191] As shown in Table 1, Comparison Method A only associates known attacks covered by preset rules, thus achieving a scene accuracy of 96.2%, which is slightly higher than that of the present invention. The error scene merging rate is only 3.4%, making it suitable for quickly identifying known attacks with clear features. However, it cannot fully associate events across time windows, entities, and attack stages, and the scene recall rate and attack chain reconstruction accuracy are only 74.8% and 72.1%, respectively.

[0192] Method B expands the scope of security incident propagation through graph structure, achieving a scenario recall rate of 95.6%, the highest among all methods, indicating its strong ability to detect scattered attack events. However, single-path message propagation cannot distinguish between supporting evidence and conflicting evidence, resulting in a scenario precision rate of 84.9% and an erroneous scenario merging rate of 10.8%, which easily leads to irrelevant events being merged into the same attack scenario.

[0193] The scene precision, scene recall, and attack chain reconstruction accuracy of method C are 92.1%, 91.3%, and 89.2%, respectively, which are more balanced than those of methods A and B, indicating that multimodal coding and graph classification can improve the correlation effect of attack events. However, it lacks attack stage propagation constraints and scene closure increment judgment. In the case of conflicting evidence and complex business topology, the erroneous scene merging rate is still 5.6%.

[0194] The scenario precision rate of this invention is 95.4%, only 0.8 percentage points lower than the more conservative comparative method A, while the scenario recall rate reaches 94.1%, approaching that of the comparative method B, which emphasizes scalability. The attack chain reconstruction accuracy rate of this invention reaches 94.0%, an improvement of 4.8 percentage points compared to comparative method C, and the erroneous scenario merging rate is reduced to 1.9%. This indicates that the support-conflict dual-path propagation can suppress erroneous associations caused by conflict evidence, the attack phase propagation constraints can eliminate time reversal and phase reverse jump paths, and the reverse injection of business impact and incremental determination of scenario closure can prevent nodes without business relevance from being incorrectly written into the attack scenario.

[0195] The post-treatment risk reduction rate of this invention reached 45.8%, which is 8.6 percentage points higher than that of comparative method C and 21.1 percentage points higher than that of comparative method A. This indicates that the potential attack paths deduced based on counterfactual states and the response scheme generated based on security knowledge graphs can prioritize the handling of risk paths with high attack transfer probability and significant business impact. This embodiment demonstrates that, while maintaining high scenario accuracy and scenario recall, this invention can improve the accuracy of current attack chain generation, reduce erroneous scenario merging, and form a closed loop of situation deduction, response execution, and feedback on treatment effects.

[0196] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A method for intelligent network situational awareness based on multimodal fusion, characterized in that, The steps include the following: Step 1: Collect multi-source network security data, and generate multi-modal security data frames through time synchronization, entity merging, event correlation, cross-modal semantic alignment, and trustworthiness weighted fusion. Step 2: Construct a temporal security graph based on multimodal security data frames, reconstruct the network by inputting evidence closure scenarios, generate node representations through evidence anchoring, propagate evidence support messages and evidence conflict messages respectively, constrain the message propagation direction according to the attack phase transition relationship, inject business impact into the attack event in reverse along the business topology, and determine the scenario boundary based on the change in scenario closure before and after the addition of candidate nodes, and generate attack scenarios and key evidence. Step 3: Based on the attack scenario, perform path expansion, path scoring, and conflict pruning under the constraints of the attack phase to generate the current attack chain and situation assessment results; Step 4: Set counterfactual state based on the current attack chain, update the temporal security graph, calculate the attack transfer probability and perform probability-constrained path search to generate situational simulation results; Step 5: Input the current attack chain, situational analysis results, and key evidence into the evidence constraint report generation network. The network generates a situational report through path encoding, evidence encoding, cross-alignment, field constraint decoding, and evidence referencing. A response plan is then generated based on the security knowledge graph. Step 6: Based on human feedback, screen difficult cases, construct incremental training samples, and update the evidence closure scenario reconstruction network; Step 7: Execute the response plan and write the execution results back to the timing security diagram, regenerate the situation assessment results and situation simulation results, and obtain the handling results.

2. The intelligent network situational awareness method based on multimodal fusion according to claim 1, characterized in that, Step one specifically includes: The multi-source network security data includes network traffic records, security device logs, terminal behavior records, asset topology records, and threat intelligence records, which are processed through field parsing, time synchronization, and unified structure processing to generate a unified security record; The disjoint-set data structure algorithm is used to merge entity identifiers pointing to the same network object to generate a unified entity identifier. Then, based on the unified entity identifier, network session, process behavior chain, vulnerability identifier, and threat indicator, event association is performed to generate a security event group. We perform feature encoding and unified semantic space mapping on different modalities of data in the security event group, and use cosine similarity and InfoNCE loss function to perform cross-modal semantic alignment. Evidence credibility is calculated based on data source credibility level, field completeness, event time freshness, and cross-modal consistency. Evidence conflict markers are generated based on object consistency, event time sequence, and behavioral outcome. Based on the evidence conflict marker, the conflict penalty value is deducted from the evidence credibility of the corresponding modality. The modality fusion weight is generated using the Softmax function. The semantic representations of each modality are fused according to the modality fusion weight to generate a multimodal secure data frame.

3. The intelligent network situational awareness method based on multimodal fusion according to claim 1, characterized in that, Step two specifically includes: A temporal security graph is constructed based on multimodal security data frames and input into an evidence closure scenario reconstruction network. The evidence closure scenario reconstruction network includes an evidence anchoring unit, a support-conflict dual-path propagation unit, an attack phase constraint unit, a business impact reverse injection unit, a scenario closure determination unit, a key evidence selection unit, and an attack scenario output unit. The evidence anchoring unit generates an evidence anchoring node representation based on the multimodal fusion representation of the temporal security graph node, node type, evidence source, evidence credibility, evidence conflict marker, and event time, and transmits it to the support-conflict dual-path propagation unit and the attack phase constraint unit. The support-conflict dual-path propagation unit generates aggregated evidence support messages and aggregated evidence conflict messages, and transmits the aggregated evidence support messages to the attack phase constraint unit; the attack phase constraint unit generates an initial attack phase probability distribution based on the attack event type, attack technology identifier, and attack behavior characteristics, and constrains the propagation of aggregated evidence support messages to generate constraint evidence support messages. The business impact reverse injection unit generates a business impact representation based on the business topology; the evidence closure scenario reconstruction network updates the attack event node representation based on the constraint evidence support message, aggregated evidence conflict message, and business impact representation, and generates node anomaly probability, attack stage probability distribution, and attack relationship probability. The scenario closure determination unit determines the attack scenario boundary based on the node anomaly probability, attack phase probability distribution, attack relationship probability, business impact representation, and evidence conflict marker. The key evidence selection unit selects key evidence that supports the attack starting point, attack target, attack behavior, attack phase transition, and business impact. The attack scenario output unit generates the attack scenario and key evidence.

4. The intelligent network situational awareness method based on multimodal fusion according to claim 3, characterized in that, The processing of the support-conflict dual-path propagation unit, attack phase constraint unit, business impact reverse injection unit, and scenario closure determination unit includes: The support-conflict dual-path propagation unit generates evidence support states based on the entity association, temporal continuity, and consistency of behavioral results of adjacent nodes, and generates evidence conflict states based on object, time, behavior, asset status, or attack phase conflict. The two states are then passed through independent gated branches to generate gate values, which are multiplied by the adjacent node representations that are linearly transformed according to the relationship type to generate evidence support messages and evidence conflict messages, and then aggregated. The attack phase constraint unit generates attack phase transition coefficients based on the initial attack phase probability distribution of the source and target attack event nodes, the attack phase transition matrix, and the event time sequence. When phase transition is allowed, the evidence support message is multiplied by the attack phase transition coefficient. When cross-phase transition is allowed and there is evidence of intermediate attack phases, it is multiplied by the cross-phase propagation attenuation coefficient. When a phase reversal jump, time reversal, or lack of evidence of intermediate attack phases occurs, the attack phase transition coefficient is set to zero and written to the attack phase conflict flag. The business impact reverse injection unit propagates the business impact seed representation backward along the business system object, service object, asset object to the attack event object, multiplies it by the exponential decay coefficient and the business dependency strength, and accumulates the business impact representation pointing to the same attack event object; The scenario closure determination unit performs a weighted summation of object closure, time closure, stage closure, evidence coverage, and business interpretability, deducts the penalty value corresponding to the conflict residue, and generates the scenario closure. It calculates the scenario closure increment before and after the candidate addition node is added, and writes the candidate addition node into the candidate attack scenario when the increment is greater than zero and no irremovable conflict is introduced.

5. The intelligent network situational awareness method based on multimodal fusion according to claim 1, characterized in that, Step three specifically includes: The node anomaly probability, evidence credibility, and initial stage matching degree determined by the attack stage probability distribution of the attack event node are weighted and summed to generate an initial score. Then, the attack path starting node is selected from the predecessor attack event nodes with the highest initial score, no time conflict marker, no attack stage conflict marker, and no relationship connection that reaches the path expansion threshold through the attack relationship probability. A set of candidate attack paths is established with the starting node of the attack path. Subsequent attack event nodes are extended along the temporal security graph relationship where the probability of the attack relationship reaches the path extension threshold. Event time sequence verification, attack phase transition verification, node duplication verification, and evidence conflict verification are performed. The node anomaly probability, evidence credibility, business impact degree corresponding to the business impact representation, attack relationship probability and attack stage transition coefficient are normalized and weighted by Min-Max, and the penalty values ​​corresponding to object conflict, time conflict and attack stage conflict are deducted to generate candidate attack path scores. The beam search algorithm is used to retain candidate attack paths within a preset beam width, delete candidate attack paths that are reversed in event time, reversed in attack phase, or interrupted in unified entity association, and determine the candidate attack path with the highest score and key evidence supporting the attack start point, attack target, attack behavior, attack phase transition and business impact as the current attack chain. Based on the current attack chain, asset risk indicators, attack development indicators, protection gap indicators, and business impact indicators are generated, and after normalization and weighting, situation assessment results are generated.

6. The intelligent network situational awareness method based on multimodal fusion according to claim 1, characterized in that, Step four specifically includes: Copy the temporal security graph to generate a counterfactual temporal security graph, select counterfactual objects from the current attack chain, and set the counterfactual objects to asset loss status, account credential leakage status, protection device offline status, or blocking rule failure status; Update network access relationships, account permission relationships, and protection blocking relationships based on the counterfactual state, and determine the network reachability probability, vulnerability exploitation probability, account permission probability, simulation phase transfer probability, and protection blocking probability. The attack transfer probability is generated by multiplying the network reachability probability, vulnerability exploitation probability, account privilege probability, and simulation phase transfer probability in sequence, and then multiplying by the difference between the network reachability probability, vulnerability exploitation probability, account privilege probability, and simulation phase transfer probability. Taking the attack event node at the end of the current attack chain as the starting point of situational inference, the candidate inference path is expanded by using the probability constraint bundle search algorithm. The attack transfer probabilities between adjacent attack event nodes are multiplied in turn to generate the cumulative probability of the candidate inference path. Candidate inference paths with a cumulative probability lower than the path retention threshold or a protection blocking probability corresponding to any attack relationship reaching the blocking threshold are deleted. Candidate simulation paths are scored based on their cumulative probability, target asset importance level, and expected business impact. They are then ranked according to their scores, and the expected occurrence time is determined based on the top-ranked candidate simulation paths and the median time interval of similar historical attacks, thus generating a situational simulation result.

7. The intelligent network situational awareness method based on multimodal fusion according to claim 1, characterized in that, Step five specifically includes: The current attack chain and situational simulation results are converted into an attack path sequence, and the key evidence content is obtained based on the original record index in the key evidence. The attack path sequence and key evidence content are input into the evidence constraint report generation network, which includes a path encoder, an evidence encoder, a cross-alignment layer, a field constraint decoder, and an evidence reference layer. The path encoder and evidence encoder generate attack path encoding and key evidence encoding respectively, and transmit them to the cross-alignment layer; the cross-alignment layer generates a path-evidence joint representation and transmits it to the field constraint decoder and evidence reference layer. The field constraint decoder generates candidate situation report fields and candidate attack conclusions based on the path-evidence joint representation, and transmits the candidate attack conclusions to the evidence citation layer; the evidence citation layer matches key evidence for the candidate attack conclusions and transmits the evidence citation results to the field constraint decoder, which then generates a situation report. Based on the situation report, a bounded graph search is performed on the security knowledge graph to generate candidate response actions and their dependencies. Candidate response actions are then combined based on these dependencies to generate candidate response plans. Based on the expected risk reduction, the credibility of the reasoning path, the historical execution success rate, the execution cost of the response action, and the expected business impact, a score is generated for each candidate response plan. Finally, the response plan is determined based on the candidate response plan score.

8. The intelligent network situational awareness method based on multimodal fusion according to claim 7, characterized in that, The evidence constraint report generation network specifically includes: The path encoder and evidence encoder respectively use a bidirectional long short-term memory network to generate attack path codes and key evidence codes. The cross-alignment layer uses the attack path encoding as the query vector and the key evidence encoding as the key vector and value vector. It uses scaled dot product attention to calculate the association weights and performs a weighted summation of the key evidence encodings based on the association weights to generate a path-evidence joint representation. The field constraint decoder establishes a situation report field state machine, generates candidate situation report fields in the order of scenario summary, attack timeline, current attack stage, affected objects, business impact, situation simulation results, response suggestions, and matters to be confirmed, and uses a mask Softmax function to limit the candidate output range of the current attack stage field, affected object field, and response suggestion field. The evidence citation layer uses a pointer network to calculate the key evidence citation probability corresponding to each candidate attack conclusion. When the highest key evidence citation probability reaches the evidence citation threshold, the field constraint decoder writes the corresponding candidate attack conclusion, evidence identifier, and original record index into the situation report. When the highest key evidence citation probability does not reach the evidence citation threshold, the corresponding candidate attack conclusion is written into the pending confirmation items.

9. The intelligent network situational awareness method based on multimodal fusion according to claim 1, characterized in that, Step six specifically includes: Based on the confirmation, modification, or rejection results of security operations personnel regarding the attack scenario, current attack chain, situation simulation results, situation report, and response plan, manual feedback is generated. The model output uncertainty of the evidence closure scenario reconstruction network is calculated using Shannon information entropy. The attack scenario structure fingerprint is generated using the Weisfeiler-Lehman graph hashing algorithm. The attack scenario structure difference is generated based on the Hamming distance between the current attack scenario structure fingerprint and the historical attack scenario structure fingerprint. The degree of evidence conflict is generated based on the proportion of evidence with evidence conflict markers in the attack scenario. The degree of business impact is generated based on the number of affected business systems, the importance level of the business, and the scope of business impact. The uncertainty of the model output, the structural differences of the attack scenario, the degree of evidence conflict, and the degree of business impact are normalized and weighted by Min-Max to generate a difficult case score and screen difficult cases. Positive samples are generated based on the results of manual confirmation. Negative samples are constructed by shuffling the order of attack phases, replacing event times, deleting key evidence, or disconnecting node associations. The situational difficulties, positive samples, negative samples, and historical training samples are combined to form incremental training samples, and the evidence closure scenario is updated to reconstruct the network. The updated network parameters are released when at least two of the attack scenario recall rate, attack phase identification accuracy, and attack chain reconstruction accuracy are greater than the corresponding indicators before the update, and the error scenario merging rate is not greater than the error scenario merging rate before the update; otherwise, the network parameters before the update are retained.

10. The intelligent network situational awareness method based on multimodal fusion according to claim 1, characterized in that, Step seven specifically includes: Construct a response action diagram based on the response actions, response action prerequisites, response action dependencies, and response action rollback relationships in the response plan; The Kahn topology sorting algorithm is used to determine the execution order of response actions, and the connection status of the target device, the permissions of the execution account, the status of the target object, the permitted scope of the service, and the rollback conditions of the response actions are verified. The verified response actions are encapsulated into a unified response command and sent to the corresponding security device or security management system through the security orchestration automation system to obtain the response action execution status, the reason for the response action failure and the actual business impact, and generate the response action execution result. The response actions, response action execution results, and network security status changes are written back to the time-series security graph. The updated time-series security graph is then re-input into the evidence closure scenario to reconstruct the network and regenerate the attack scenario and key evidence. The current attack chain and situation assessment results are regenerated based on the regenerated attack scenario. The situation simulation results are regenerated based on the regenerated current attack chain. The handling results are generated based on the situation assessment results before and after the handling, the number of effective attack paths, the number of potentially damaged assets, and the scope of business impact. When the response action fails, the post-handling situation assessment result is not lower than the pre-handling situation assessment result, or the actual business impact is greater than the expected business impact, the attack scenario, response plan, and response action execution result will be fed back to step six as a new situational challenge.

Images