A multimodal intelligent terminal security protection platform and method

Abstract

This invention relates to the field of network security technology and discloses a multimodal intelligent terminal security protection platform and method. It acquires multi-source heterogeneous security data through a distributed acquisition module and an adaptive mechanism. For this multi-source heterogeneous security data, it performs correlation analysis based on knowledge graphs and constructs attack chains using a temporal weighting algorithm. A three-level fusion strategy based on multi-head attention mechanism generates fused feature vectors. Based on the fused feature vectors, a multi-layer machine learning model outputs real-time risk scores and future risk trends. Adaptive protection strategies are executed across layers based on the risk scores. The model and protection strategies are continuously optimized based on federated learning and reinforcement learning. The system provides situational awareness and automated response. This invention, through multimodal data fusion, dynamic risk assessment, and cross-layer collaborative defense, forms an integrated security protection solution adaptable to multiple architectures and systems, significantly improving the detection rate and response efficiency of unknown threats under hybrid IT architectures.

Description

Technical Field

[0001] This invention relates to the field of network security technology, specifically to a multimodal smart terminal security protection platform and method. Background Technology

[0002] As digital transformation deepens, terminal types are becoming increasingly diversified (from traditional PCs to domestically developed IT devices and IoT terminals), and attack methods are becoming more complex (advanced persistent threats, ransomware, multimodal inference attacks, etc.).

[0003] Existing endpoint security solutions suffer from the following shortcomings: Severe data isolation: Endpoint logs, network traffic, user behavior, and other data are processed in a fragmented manner, lacking cross-dimensional correlation analysis capabilities; traditional solutions only analyze single data sources, making it difficult to identify cross-media coordinated attacks. Lagging defense response: Reliance on static rule bases and feature matching is prevalent, but rule base updates always lag behind the evolution of attack methods, resulting in insufficient adaptability to unknown threats and dynamic environmental changes; while existing ransomware protection solutions can back up files, the lack of global risk assessment and linkage mechanisms means that backups are merely physical data preservation, failing to proactively intervene and contain the attack process through policy coordination when a threat occurs. Weak coordination capabilities: Endpoint protection, network control, and data security modules have long operated with independent logic, lacking standardized communication interfaces and policy interoperability. This fragmented operation directly leads to functional silos within the security protection system; for example, DLP (Data Loss Prevention) systems cannot directly invoke network isolation policies, forcing response actions to rely on manual intervention or limited handling by a single module, resulting in slow response times when data leaks occur.

[0004] Existing technologies have significant shortcomings in dealing with multimodal inference attacks (such as combined attacks combining endpoint vulnerabilities and social engineering): **Lagging signature database:** Traditional EDR relies on static signature database matching mechanisms based on known features to identify intrusion behavior. However, combined attacks involving zero-day vulnerabilities (unknown) and phishing emails (non-signature-based social engineering techniques) fall outside the coverage of existing signature databases. Therefore, this security logic, which relies on historical experience, naturally suffers from insufficient attack identification rates when facing unknown combined attacks. **Cross-layer data fragmentation:** Endpoint process logs and email gateway data are stored in different databases without correlation. Since a complete reconstruction of the attack chain requires cross-verification of behavioral events at different levels in chronological order, data fragmentation inevitably leads to unfillable breakpoints in the attack chain, resulting in incomplete attack chain reconstruction. Without proper integration, security analysts cannot fully trace how an intrusion progresses from the initial entry point to the final target. Furthermore, there are shortcomings in the adaptation of domestically developed technologies: existing protection modules for terminals with domestically produced chip architectures have functional deficiencies, such as the failure of kernel-level process isolation. This failure means that even if front-end detection rules detect suspicious processes, the system cannot truly isolate them from critical resources at the underlying level, significantly weakening defense capabilities at the architecture adaptation level. Finally, there is the privacy-security conflict: in fields such as healthcare and finance, strict data privacy regulations (such as GDPR) require full anonymization of user data and restrictions on the scope of analysis. However, threat detection requires comprehensive acquisition of raw behavioral data to identify abnormal data. This conflict between privacy protection (such as GDPR compliance) and threat detection needs makes it difficult for existing solutions to achieve a balance. Summary of the Invention

[0005] This invention aims to provide a multimodal smart terminal security protection platform and method. Through multimodal data fusion, dynamic risk assessment and cross-layer collaborative defense, it forms an integrated solution that adapts to multiple architectures and systems, significantly improving the detection rate and response efficiency of unknown threats under hybrid IT architecture.

[0006] The basic solution provided by this invention is: a multimodal intelligent terminal security protection platform, comprising: The multimodal data acquisition layer is used to acquire multi-source heterogeneous security data through distributed acquisition modules and by introducing terminal architecture, user, and environment adaptive mechanisms. The data includes terminal, network, user behavior, and environmental context. The multi-source data fusion engine is used to perform correlation analysis based on knowledge graphs for multi-source heterogeneous security data and construct attack chains by combining attack chain temporal weighting algorithms. It also performs cross-modal feature fusion based on three-level feature extraction and introduces a multi-head attention mechanism to generate fused feature vectors, in which the attack chain participates in cross-modal feature fusion. The dynamic risk assessment system is used to quantify risk based on fused feature vectors using a multi-layer machine learning model, output real-time risk scores, and predict future risk trends; the attack chain participates in the real-time risk score adjustment. The cross-layer collaborative defense mechanism is used to coordinate the system layer, network layer, application layer, and data layer to execute adaptive protection strategies based on risk scores, and to trigger an early warning mechanism based on predicted future risk trends to coordinate the system layer, network layer, application layer, and data layer to execute preventive actions. The Adaptive Learning Center is used to build threat detection models based on federated learning for threat detection and introduce multi-layered anti-poisoning defense mechanisms. It also continuously optimizes the models of the multi-source data fusion engine and dynamic risk assessment system, and continuously optimizes the protection strategy based on reinforcement learning. A digital operations platform for visualizing situations and automating responses.

[0007] This invention also provides a multimodal smart terminal security protection method, utilizing a multimodal smart terminal security protection platform; the method includes: Multi-source heterogeneous security data is acquired through a distributed acquisition module and by introducing terminal architecture, user, and environment adaptive mechanisms. The data includes terminal, network, user behavior, and environmental context. For multi-source heterogeneous security data, we perform correlation analysis based on knowledge graphs and construct attack chains by combining attack chain temporal weighting algorithm. We also perform cross-modal feature fusion based on three-level feature extraction and introduce a multi-head attention mechanism to generate fused feature vectors, in which the attack chains participate in cross-modal feature fusion. Based on the fused feature vectors, a multi-layer machine learning model is used to quantify risk, output a real-time risk score, and predict future risk trends; the attack chain participates in the adjustment of the real-time risk score. Based on the risk score, adaptive protection strategies are implemented at the system layer, network layer, application layer, and data layer. Based on the predicted future risk trends, an early warning mechanism is triggered to implement preventive actions at the system layer, network layer, application layer, and data layer. A threat detection model is built based on federated learning for threat detection, and a multi-layered anti-poisoning defense mechanism is introduced to continuously optimize the multi-source data fusion engine and dynamic risk assessment system. Furthermore, the protection strategy is continuously optimized based on reinforcement learning. Visualizing the situation and automating the response.

[0008] The working principle and advantages of this invention are as follows: This invention specifically addresses security protection scenarios in hybrid IT architectures (traditional terminals, domestically developed IT devices, and IoT / industrial control terminals). It proposes an integrated terminal security platform that combines multimodal data fusion, dynamic risk assessment, and cross-layer collaborative defense. Through real-time correlation analysis of multimodal data from the terminal, network, data, and user layers, it constructs an intelligent defense closed loop encompassing perception, analysis, decision-making, execution, and optimization. This forms an integrated security protection solution adaptable to multiple architectures and systems, significantly improving the detection rate and response efficiency to unknown threats in hybrid IT architectures. Its core advantages are: This invention utilizes a multimodal data acquisition layer to uniformly collect heterogeneous data from multiple sources, integrating previously isolated terminal vulnerability alerts and phishing email alerts into a single analytical framework, thus breaking down data silos across layers. The multi-source data fusion engine constructs an entity relationship model based on a knowledge graph, mapping terminals, users, and network connections as graph nodes. It connects the complete behavioral chain of "malicious email → user click → process anomaly → abnormal external connection" through association rules, and employs an attack chain temporal weight algorithm to filter out noisy alerts, accurately reconstructing complex attack chains. Multimodal fusion analysis effectively overcomes the inherent local blind spots of single data sources from an attack perspective, significantly suppressing false positives caused by single-modal noise and solving the problem of high false positive rates from single data sources. Simultaneously, based on the construction and reconstruction of attack chains and the generation of fusion feature vectors using a three-level fusion strategy, this invention achieves more accurate detection of unknown vulnerability exploits and covert attacks, realizing a dual improvement in detection accuracy and the ability to perceive unknown threats.

[0009] This invention's dynamic risk assessment system weighted and merges phishing and vulnerability exploitation behaviors into a unified feature vector. It employs a multi-layered machine learning model for real-time risk quantification, enabling the identification and high-risk scoring of unknown combined attacks deviating from the normal baseline. This millisecond-level dynamic risk scoring of process behavior at the endpoint allows for early detection of threats such as ransomware encryption. Simultaneously, the scoring results are coordinated across the system, network, application, and data layers, compressing endpoint-network collaborative response time and achieving a closed-loop response latency from threat awareness to boundary blocking down to within seconds. Compared to traditional manual assessment or independent handling by individual devices, this system intercepts ransomware before encryption is complete, minimizing the risk of business data loss. By combining real-time risk scoring with cross-layer collaboration, this invention overcomes the lag inherent in traditional static EDR feature database matching, without relying on known signatures, and through behavioral correlation and anomaly detection. This significantly improves the detection rate and attack chain reconstruction completeness of unknown composite threats such as zero-day vulnerabilities combined with social engineering.

[0010] This invention designs an architecture and terminal adaptation mechanism at each layer, completely shielding the differences in underlying hardware architecture and operating system platform, enabling security protection strategies to run across all platforms, completing compatibility integration without modifying the terminal's native system kernel, supporting multiple architecture terminals (x86 / ARM / MIPS) and multiple operating systems (Windows / Linux / domestic innovation systems), improving terminal type compatibility, and enhancing adaptation capabilities.

[0011] This invention combines automated response with visualized operations to automate the entire process of security incidents from discovery, analysis, handling to auditing and archiving. Combined with visualized traceability maps, it compresses the manual auditing work that originally required hours to generate automated reports in minutes, greatly improving auditing efficiency. At the same time, the automated response engine handles more than 80% of routine alarm handling work, significantly reducing the operational pressure and manpower costs of the security operations team.

[0012] This invention combines federated learning with encryption technology, ensuring that the original training data of each participant remains locally, with only encrypted model parameters uploaded for cloud aggregation. This fundamentally eliminates the privacy risks associated with data leaving the domain, complying with the strict constraints of GDPR, the Personal Data Protection Act, and the Data Security Act regarding cross-border and local data requirements, thus guaranteeing privacy and security. This allows for seamless deployment in industries with high compliance requirements. This invention specifically introduces a multi-layered anti-poisoning defense mechanism within the federated learning framework, proactively defending against potential model and data poisoning attacks by malicious participants. Combined with a Byzantine fault-tolerant aggregation strategy, even in extreme scenarios with a high proportion of malicious participants, the global model accuracy remains stable, ensuring the security of collaborative training. This is far superior to traditional federated average aggregation schemes, significantly improving the attack robustness and global model reliability in multi-institutional joint modeling scenarios, providing solid technical support for the next generation of highly reliable security protection systems. Attached Figure Description

[0013] Figure 1 This is a schematic diagram of the structure of a multimodal smart terminal security protection platform provided in an embodiment of the present invention; Figure 2 This is a flowchart of the multimodal data fusion process provided in an embodiment of the present invention; Figure 3 This is a schematic diagram of the dynamic risk assessment system provided in an embodiment of the present invention; Figure 4 This is a schematic diagram of the federated learning anti-poisoning mechanism provided in an embodiment of the present invention. Detailed Implementation

[0014] The following detailed explanation illustrates the specific implementation methods: The basic implementation examples are as follows: Figure 1 As shown: A multimodal intelligent terminal security protection platform, comprising: The multimodal data acquisition layer is used to acquire multi-source heterogeneous security data through distributed acquisition modules and by introducing terminal architecture, user, and environment adaptive mechanisms. The data includes terminal, network, user behavior, and environmental context. The multi-source data fusion engine is used to perform correlation analysis based on knowledge graphs and construct attack chains by combining attack chain temporal weighting algorithms for multi-source heterogeneous security data. It generates fusion feature vectors based on a three-level fusion strategy with multi-head attention mechanism. The dynamic risk assessment system is used to quantify risk based on fused feature vectors using a multi-layer machine learning model, and output real-time risk scores and future risk trends. A cross-layer collaborative defense mechanism is used to coordinate the system layer, network layer, application layer, and data layer to execute adaptive protection strategies based on risk scores. The adaptive learning center is used to build threat detection models based on federated learning for threat detection and introduces a federated learning anti-poisoning mechanism for multi-source data fusion engine and dynamic risk assessment system model continuous optimization, and to continuously optimize protection strategies based on reinforcement learning. A digital operations platform for visualizing situations and automating responses.

[0015] This embodiment also provides a multimodal smart terminal security protection method, utilizing a multimodal smart terminal security protection platform; the method includes: Multi-source heterogeneous security data is acquired through a distributed acquisition module and by introducing terminal architecture, user, and environment adaptive mechanisms. The data includes terminal, network, user behavior, and environmental context. For multi-source heterogeneous security data, we perform correlation analysis based on knowledge graphs and construct attack chains by combining attack chain temporal weighting algorithm. We also perform cross-modal feature fusion based on three-level feature extraction and introduce a multi-head attention mechanism to generate fused feature vectors, in which the attack chains participate in cross-modal feature fusion. Based on the fused feature vectors, a multi-layer machine learning model is used to quantify risk, output a real-time risk score, and predict future risk trends; the attack chain participates in the adjustment of the real-time risk score. Based on the risk score, adaptive protection strategies are implemented at the system layer, network layer, application layer, and data layer. Based on the predicted future risk trends, an early warning mechanism is triggered to implement preventive actions at the system layer, network layer, application layer, and data layer. A threat detection model is built based on federated learning for threat detection, and a multi-layered anti-poisoning defense mechanism is introduced to continuously optimize the multi-source data fusion engine and dynamic risk assessment system. Furthermore, the protection strategy is continuously optimized based on reinforcement learning. Visualizing the situation and automating the response.

[0016] It is understandable that the aforementioned platform can fully execute the above methods, with the same process and effect, as detailed below.

[0017] Specifically: The first step is the multimodal data acquisition layer. S1. This platform acquires multi-source security data through a distributed acquisition module: Terminal data acquisition module: Deploys a lightweight agent (Windows <50MB, Linux <30MB), collecting data including: hardware performance metrics (CPU, memory, disk I / O), terminal system logs (process tree, registry changes, network connections), application behavior (software installation, file operations, peripheral device calls), and security events (virus scans, vulnerability status). Supports multiple architecture platforms (x86, ARM, MIPS) and multiple operating systems (Windows / Linux / Android / iOS / NeoKylin and other domestic IT innovation systems), outputting standardized data through a unified data interface (JSON format).

[0018] Architecture Adaptive Proxy: For x86 / ARM / MIPS architecture terminals, it automatically switches the instruction set adaptation mode (such as using a lightweight probe optimized with the Thumb-2 instruction set for ARM terminals) to ensure a low CPU utilization rate on domestically produced chips.

[0019] An industrial terminal protocol adaptation and acquisition mechanism is introduced to supplement industrial terminal adaptation: it supports the parsing of industrial protocols such as Modbus and OPC UA, collects register read and write records and firmware version information of PLC devices, samples key operations once every 100ms, and is compatible with mainstream industrial control terminals such as Siemens S7-1200 / 1500.

[0020] Network data acquisition module: Captures terminal inbound and outbound data packets through traffic probes (supporting SPAN port mirroring and NetFlow protocol), extracts five-tuple information, application layer payload characteristics (HTTP header, DNS query) and abnormal connection patterns (such as heartbeat packet frequency, encrypted traffic entropy value); and works with firewalls and NAC devices (network access control devices) to obtain terminal access status and policy group information.

[0021] User behavior collection module: Records user login information (time, IP, device fingerprint), operation trajectory (file access sequence, permission change history, data transfer volume), and authentication events (multi-factor authentication results) and other user behavior data; combines biometric behavioral characteristics (keyboard dynamics, mouse movement trajectory) to enhance identity credibility assessment.

[0022] Introduce a behavioral anomaly measurement model: Construct a baseline of normal user operation sequence based on Hidden Markov Model (HMM), calculate the deviation of real-time operation sequence from the baseline (such as the anomaly score of an administrator suddenly performing batch file deletion), and trigger enhanced identity authentication when the anomaly score is greater than the threshold (e.g., 0.8).

[0023] Environment Awareness Module: Integrates terminal adaptive environment awareness capabilities under a zero-trust architecture, collecting data on physical location (GPS / Wi-Fi triangulation), system environment (patch status, baseline compliance), and application environment (software signature, process integrity); supports custom awareness templates and dynamically adjusts the collection frequency according to the risk level (sampling every 10 minutes for low risk, and real-time sampling for high risk).

[0024] Physical environment trust verification: The TPM2.0 chip reads the terminal hardware fingerprint and combines it with the light sensor and microphone to collect environmental sound / light texture features to generate an unalterable environmental trust value (range 0-1). When the trust value is lower than a preset threshold (e.g., 0.3), the platform automatically increases the environmental risk level of the terminal and pushes this information as a key input factor to the dynamic risk assessment system, causing the terminal's comprehensive risk score to rise, thereby triggering the cross-layer collaborative defense mechanism to execute a protection strategy that matches the current risk level.

[0025] Specifically, the increase in environmental risk level will be linked to the following four layers of protection strategies for enhancement: System-level protection: Automatically enables kernel-level process isolation, blocks unauthorized driver loading, and activates memory instruction sequence detection technology to defend against vulnerability exploitation; Network layer collaboration: Through a software-defined network linkage architecture, the terminal is quickly switched to a dedicated isolation slice, allowing access only to patch servers and other repair resources; Application layer protection: Increase the frequency of application behavior monitoring and force suspicious processes into the full system simulation sandbox for in-depth dynamic analysis; Data layer protection: Immediately triggers the blocking of sensitive data from being sent out, and activates immutable storage technology to protect backup files.

[0026] Through the above-mentioned linkage mechanism, a four-layer collaborative adaptive security protection based on the trustworthiness of the physical environment is achieved.

[0027] Table 1 summarizes the main data types, acquisition content, acquisition frequency, and their applications in subsequent analysis covered by the multimodal data acquisition layer of this platform. For details on the specific acquisition methods and adaptive mechanisms of each data type, please refer to the detailed descriptions of each acquisition module in S1.

[0028] Table 1. Main Multimodal Data Acquisition Information

[0029] The second step is a multi-source data fusion engine, such as... Figure 2 As shown, attack chain reconstruction and feature fusion are performed on multimodal heterogeneous data. Specifically: S2, Data Preprocessing Unit: Cleans, standardizes (unifies UTC timestamps and UTF-8 encoding), and extracts features (using the MinHash algorithm to extract process hash features and Word2Vec to extract URL semantic features) for structured data (log records, etc.), semi-structured data (JSON / XML, etc.) and unstructured data (network packets, binary files, etc.).

[0030] S3. Association Analysis Unit: Based on knowledge graph technology, an entity relationship model is constructed, mapping entities such as terminals, users, files, and network connections to graph nodes. Edge relationships are established through association rules (such as "user A uploads a file from terminal B to an external IP of C"). The temporal association algorithm (Dynamic Time Warping DTW) is used to identify attack chains across time dimensions (e.g., vulnerability exploitation → malicious process startup → data outgoing).

[0031] A temporal weighting algorithm for attack chains is proposed: Each link in the attack chain (e.g., "vulnerability scanning → exploit → C2 connection") is assigned a time decay weight (the closer to the current time, the higher the weight), solving the problem of misjudging early events in traditional temporal correlation and improving the accuracy of attack chain reconstruction. Specifically, the temporal weighting algorithm for attack chains is introduced, and the attack chain is accurately reconstructed through a time decay mechanism. The steps are as follows: The first step is alarm screening: Security alarms at each stage of the attack chain are assigned time decay weights. These weights are inversely proportional to the distance from the current time (i.e., the closer the alarm occurred, the higher its time decay weight, and the greater its reference value for attack chain reconstruction). Alarms with time decay weights below a preset threshold are marked as low-value alarms and filtered out. Alarms with time decay weights at or above the preset threshold are retained, forming a candidate alarm set. This screening mechanism effectively eliminates the interference of outdated and noisy alarms on attack chain reconstruction.

[0032] The second step is attack chain combination: Based on the attack stage labels (such as initial intrusion, execution, persistence, lateral movement, data leakage, etc.) and timestamp information of each alarm in the candidate alarm set, multiple alarms whose timestamps satisfy the temporal sequence and whose stage labels conform to the attack progression logic are associated and combined according to the standard stage sequence of the attack chain model to form several candidate attack chains.

[0033] The third step is attack chain optimization: Calculate the total weight of each candidate attack chain, which is the sum of the time decay weights of all alarms contained in the chain; select one or more attack chains with the highest total weight from all candidate attack chains as the final reconstructed attack chain output. The higher the total weight, the more recent the alarms contained in the attack chain are, the stronger the correlation with the current time window, and the more reliable the reconstruction result.

[0034] The reconstructed attack chain information plays a role in two steps: First, it is input into the feature fusion unit, which uses the completeness of the attack chain stages and the total weight as attention guidance signals to assign higher weights to the feature vectors of key entities in the attack chain, so that the fused features prominently reflect the overall attack rather than isolated alarm features; Second, it is input into the dynamic risk assessment system, which uses the completeness of the attack chain as a reference factor for the threat intensity (one of the scoring dimensions in S6), with higher completeness resulting in a higher score, and uses the total weight of the attack chain as a time urgency factor, with a higher weight indicating a fresher attack, and the risk score (i.e., the final output total score) is correspondingly improved. This allows for risk quantification from a macro perspective of the entire attack lifecycle, improving the accuracy of identifying complex multi-step attacks.

[0035] S4. Feature Extraction and Enhancement Unit: This unit performs feature extraction and quality enhancement on multi-source heterogeneous security data, laying the foundation for subsequent cross-modal fusion. It is divided into three levels: First layer: Single-modal feature extraction Preliminary features are extracted from the raw data acquired by each acquisition module. Specifically, this includes: Extract terminal behavior characteristics from terminal system logs, such as process creation frequency, process tree depth, abnormal CPU peak values, and number of times sensitive paths are modified. Extracting network features from network traffic: abnormal connection entropy value, external domain name reputation score, heartbeat packet frequency deviation, encrypted traffic entropy value, etc. Extract user behavior features from user operation records: operation sequence deviation (based on HMM anomaly score), login location anomaly, keyboard dynamics matching degree, etc. Extract environmental features from the environmental context: physical location deviation, vulnerability exposure surface score, software signature verification failure rate, environmental trust value, etc.

[0036] Second layer: Contrastive learning feature enhancement The SimCLR (Simple Contrastive Learning Framework) is used for self-supervised contrastive training of homologous features across modalities. Its core mechanism lies in enabling the model to automatically learn to extract stable, essential features unaffected by noise, distortion, and individual differences through comparative learning with a large amount of unlabeled data of the same and different classes. For example, comparative training on log sequences of normal and malicious processes on different terminals allows the model to capture common malicious behavior patterns across terminals without requiring extensive manual data labeling. Features enhanced through contrastive learning exhibit higher robustness and generalization ability, providing high-quality input for subsequent fusion.

[0037] Third layer: Knowledge distillation model compression By utilizing knowledge distillation techniques, the deep discriminative capabilities learned in feature extraction by large cloud models (such as ResNet-101) are transferred to lightweight terminal models (such as MobileNetV3). Specifically, the soft-label output of the large cloud model is used as a supervision signal to train the lightweight terminal model to simulate its output distribution. This allows the terminal model to maintain feature extraction accuracy close to that of the large model while compressing its size to 1 / 5, and improving feature extraction speed by 3 times, thus meeting the performance requirements of real-time detection on the terminal side.

[0038] S5, Cross-modal Feature Fusion Unit: This unit uses a multi-head attention mechanism to weightedly fuse the modal enhancement features output by S4.

[0039] Fusion Mechanism: Terminal behavior features, network features, user behavior features, and environmental context features are mapped into independent feature vectors, which serve as inputs for multi-head attention. Each attention head learns the interaction relationships between features of different modalities from different representation subspaces and automatically assigns importance weights to each modality for the current security analysis task. The outputs of all attention heads are concatenated and linearly transformed to generate a unified comprehensive feature vector.

[0040] Weighting Guidance Mechanism: During the fusion process, weight allocation does not only rely on the features themselves, but is also guided by the attack chain information reconstructed by S3. The feature vectors corresponding to key entities involved in the attack chain (such as victim terminals, malicious processes, external domains, etc.) are given higher attention weights, so that the comprehensive feature vector can prominently reflect the whole picture of the attack chain, rather than just reflecting the local features of isolated alarms.

[0041] S6. Real-time Scoring Unit: The comprehensive feature vector output from S5 is input into a multi-layer machine learning model (improved random forest algorithm), outputting a real-time risk score for the terminal. This score is then adjusted based on a business value weighting factor, attack chain completeness, and time urgency factor, ultimately achieving multi-dimensional risk quantification. The business value weighting factor adjusts the risk score according to the importance of the business carried by the terminal (e.g., a core database server has a weight of 1.2, while a regular office terminal has a weight of 0.6). Importance is positively correlated with risk score; that is, for vulnerabilities of the same level, higher importance locations result in higher risk scores, avoiding a one-size-fits-all approach. For example, a vulnerability of the same level might have a 20-point higher risk score on a payment terminal than on an office terminal. The mechanism for adjusting the score using attack chain completeness and time urgency factors is described in S3 above.

[0042] The scoring dimensions include: threat intensity (virus malice level, vulnerability CVSS score); behavioral anomaly (Markov distance from baseline); environmental trustworthiness (zero trust status assessment); and compliance (compliance rate with the technical requirements of the Information Security Level Protection 2.0).

[0043] The rating ranges from 0 to 100 points, is updated every 5 minutes, and historical impact is adjusted using a time decay factor.

[0044] S7. Risk Prediction Unit: Uses an optimized LSTM neural network to train on historical risk score sequences to predict risk trends within a preset time period (within the next hour); when the predicted risk value exceeds a threshold (e.g., 80 points), it triggers an early warning mechanism (e.g., initiating a backup process or isolating the network).

[0045] Among them, the optimized LSTM neural network is the Attention-LSTM (Attention-LSTM): it assigns higher attention weights to recent high-frequency risk events (such as multiple vulnerability exploitation attempts within 1 hour), and improves the accuracy of short-term (1 hour) risk prediction to 92%, which is 15 percentage points higher than the traditional LSTM.

[0046] The early warning mechanism specifically includes the following preventative joint actions: Data layer prevention: Immediately trigger critical data backup processes, use immutable storage technology to protect backup files, and prevent ransomware encryption and damage; Network layer prevention: Preemptively restrict network access permissions for threatened terminals, allowing only access to necessary resources such as patch servers and backup servers; System-level prevention: Increase the frequency of terminal process behavior monitoring and intercept the startup of non-whitelisted processes; Application-layer prevention: Start the full system simulation sandbox in advance to perform predictive dynamic analysis on suspicious applications.

[0047] By employing the aforementioned predictive preventative protection mechanisms, the timing of threat response is shifted from reactive to proactive prevention. Critical data protection and access control restrictions are implemented before ransomware encryption actually occurs, minimizing potential losses.

[0048] S8, Baseline Adaptive Unit: Used to generate and maintain personalized behavioral anomaly detection baselines for the dynamic risk assessment system. Based on dimensions such as terminal type (server / PC / IoT terminal), user role (administrator / general employee), and business scenario (office / production / R&D), it automatically generates a dynamic set of baseline parameters adapted to various terminals and users, including but not limited to: upper limit for process creation frequency, upper limit for sensitive path modification frequency, upper limit for the number of external domain names, and operation sequence deviation threshold.

[0049] The core function of dynamic baselines is to provide personalized reference benchmarks for judging abnormal behavior, enabling terminals and users with different characteristics to have differentiated standards for defining normal behavior. For example, R&D terminals, due to the frequent installation of test software, have a significantly higher software installation frequency baseline than office terminals, preventing normal development behavior of R&D personnel from being falsely reported as abnormal; servers, due to their highly stable operating environment, have a stricter process creation baseline than PCs, prohibiting the startup of any non-whitelisted processes; administrators, due to work needs to perform system configuration changes, have a higher tolerance for deviations in their operation sequences than ordinary employees. If a fixed baseline is used, normal software installation on R&D terminals may be falsely identified as malware delivery, and the startup of non-whitelisted processes on servers may not be alerted in time due to an overly broad baseline.

[0050] The dynamic baseline is not static but continuously adaptively adjusts as terminal operational data accumulates. When the business carried by the terminal changes (such as switching from an office scenario to a production scenario) or the user role changes, the baseline adaptive unit automatically switches the corresponding baseline parameters according to the new classification dimension, ensuring that the anomaly judgment criteria always match the current actual operational characteristics. As the core reference benchmark for risk scoring calculation, the dynamic baseline's output directly affects the behavior anomaly calculation stage of the S6 real-time scoring unit, making risk assessment personalized and adaptive.

[0051] The fourth step is a cross-layer collaborative defense mechanism. The cross-layer collaborative defense mechanism serves as a collaborative control bridge between the platform's core layer (multi-source data fusion engine and dynamic risk assessment system) and the collaborative execution layer (system layer, application layer, data layer, and network layer). Based on the real-time risk score output by the dynamic risk assessment system or the early warning signal output by the risk prediction unit, it achieves adaptive protection through four-layer linkage.

[0052] Collaborative Control Mechanism: After the dynamic risk assessment system outputs a comprehensive risk score to the terminal, the collaborative control engine in the cross-layer collaborative defense mechanism automatically generates a corresponding collaborative defense instruction set based on the risk level range of the risk score. This instruction set is not an isolated instruction for a single layer, but rather a sequence of collaborative actions linking the system layer, application layer, data layer, and network layer. The actions at each layer are executed in an orderly manner according to preset priorities and timing relationships, ensuring coordination and consistency between multi-layer protection actions and avoiding policy conflicts.

[0053] The specific collaborative control process is as follows: (1) Instruction generation: The collaborative control engine maps the risk score to a unified risk level (low risk 0-30 points, medium risk 31-70 points, high risk 71-100 points), and retrieves the corresponding collaborative defense strategy template from the protection strategy library according to the risk level to generate a collaborative defense instruction set containing parameters such as specific actions, execution order, and timeout time for each layer.

[0054] (2) Command distribution: The collaborative control engine distributes the command set to each layer of defense modules in parallel through a standardized interface. Each module independently parses and executes the protection action of its own layer, and at the same time provides real-time feedback on the execution status to the collaborative control engine.

[0055] (3) Collaborative control: During the protection execution process, the collaborative control engine continuously monitors the execution progress and effect of actions at each layer. When the protection action of a certain layer fails or times out, a compensation strategy is automatically triggered (such as immediately upgrading the network layer isolation level to the highest level as a fallback when the system layer process isolation fails), to ensure that the overall protection effect is not affected in the event of a single layer failure.

[0056] (4) Closed-loop feedback: After each layer of protection action is completed, the execution result and the terminal status after execution are sent back to the collaborative control engine; the collaborative control engine synchronously feeds back the execution result to the dynamic risk assessment system for subsequent risk score update calculation, forming a complete closed loop of "assessment → decision → execution → feedback → reassessment".

[0057] like Figure 1 As shown, based on the above-mentioned collaborative control mechanism, the adaptive protection strategy executed by the cross-layer collaborative defense mechanism is as follows: S9. System-level defense module: Integrates at least host firewall, vulnerability management, and system hardening functions. Actions are executed based on different risk scores and system configurations. These actions include: When the risk score exceeds the threshold (e.g., 70 points), kernel-level process isolation is automatically enabled (via Linux Namespace or Windows Job Object) to block unauthorized driver loading. For systems with service interruption (such as WinXP / Win7), memory instruction sequence detection technology (based on hardware virtualization-based abnormal instruction interception) is used to defend against vulnerability exploitation. This involves leveraging the characteristics of CPU hardware virtualization (such as Intel VT-x / AMD-V) to build a microscope-level monitoring system at the memory instruction execution level. This system checks each instruction of the program about to run for abnormalities, and immediately intercepts any malicious instructions found, thus blocking the vulnerability at the lowest level of vulnerability triggering.

[0058] Domestic kernel protection: Develop a kernel behavior monitoring module based on eBPF for Linux kernels (such as Kylin V10) to achieve real-time interception of process privilege escalation and system call hooks.

[0059] S10, Application Layer Protection Module: Combining EDR (Endpoint Detection and Response) and application control functions, it achieves process behavior monitoring, malware detection and removal, and abnormal application isolation. It improves the detection rate through multi-engine collaboration (cooperative scheduling engine, QCE cloud engine, QDE machine learning engine, and third-party engines); the specific collaborative process is as follows: Engine positioning and complementary advantages: The QCE cloud engine is responsible for quickly and accurately matching known threats based on a massive feature library in the cloud, while the QDE machine learning engine is responsible for intelligently identifying unknown threats and variant samples based on behavior. Third-party engines supplement detection capabilities to cover specific threats in specific fields.

[0060] Parallel scanning and weight allocation: The collaborative scheduling engine distributes the files or processes to be detected to three engines simultaneously for parallel scanning, and each engine independently returns the detection results and confidence scores. Based on the historical detection accuracy of each engine on different threat types, its voting weight is dynamically allocated (for example, QCE cloud engine has a higher weight for known ransomware; QDE machine learning engine has a higher weight for unknown script trojans).

[0061] Weighted Fusion Adjudication: The collaborative scheduling engine performs weighted fusion calculations on the detection results returned by each engine to comprehensively derive the final threat assessment conclusion and overall confidence level. When the results from different engines are inconsistent, the overall confidence level after weighted fusion is used as the final judgment basis; when the overall confidence level is in the gray area (it is impossible to clearly determine whether it is black or white), the entire system simulation sandbox is automatically triggered for in-depth dynamic analysis.

[0062] The entire system simulates a sandbox (capable of simulating 40+ hardware architecture environments) to perform dynamic behavior analysis on suspicious files. By simulating the execution environment of real-world scenarios, it observes the execution behavior of files and serves as a fallback mechanism for multi-engine collaborative detection, ensuring a high detection rate for highly concealed threats.

[0063] S11, Data Layer Defense Module: Integrates DLP (Data Loss Prevention) functionality, identifying sensitive data based at least on keyword matching, regular expressions, and / or data identifiers (such as credit card number patterns); enables data traceability through secure watermarks (printed watermarks, screen watermarks, and screenshot hidden watermarks); combines file tracking technology to record the entire lifecycle of sensitive files (creation → modification → transmission → deletion); and employs immutable storage technology (Write-once-read-many) to protect backup files and prevent ransomware encryption.

[0064] Introducing a dynamic watermark generation algorithm: generating a unique watermark based on the file content hash and the terminal hardware fingerprint, supporting invisible watermarks for PDF / Office documents (without affecting visual effects) and robust watermarks for images (resistant to cropping / compression attacks).

[0065] S12, Network Layer Coordination Module: Works in conjunction with NGFW (Next Generation Firewall) and NAC (Network Access Control) to dynamically adjust network access permissions based on endpoint risk scores. It standardizes the transmission of endpoint-network coordinated handling commands through preset protocols (such as OpenC2). For example: Low-risk terminals (score < 30) can access the core business area; Medium-risk terminals (30≤score≤80) have restricted access (requires secondary authentication); High-risk endpoints (score > 80) are isolated to the repair area (which can only access the patch server).

[0066] It adopts a software-defined networking (SDN) linkage architecture: it works in conjunction with the SDN controller through the OpenFlow protocol. When the terminal risk score is greater than the threshold (e.g., 80 points), it completes network slice isolation (switching the terminal to a dedicated isolation slice) within a preset time (e.g., 50ms), which is 10 times faster than traditional VLAN isolation.

[0067] Table 2: Collaborative Defense Strategies Based on Risk Scoring

[0068] Table 2 shows a high-level view of the collaborative defense strategy based on risk scoring, defining the strategy intent at the system layer, application layer, network layer, and data layer for each risk level. The specific technical implementation methods and detailed execution mechanisms for each layer's strategy are described in detail in the S9 system layer protection module, S10 application layer protection module, S11 data layer protection module, and S12 network layer collaboration module, respectively. The separation of the strategy layer from the technical implementation layer allows security managers to flexibly adjust the action mappings for each level within the strategy framework without modifying the underlying technical implementation, thus achieving decoupling between strategy management and technical implementation.

[0069] Step 5, Adaptive Learning Center, such as Figure 1 As shown, machine learning is used to continuously optimize the model and protection strategy: S13, Threat Intelligence Learning Unit: Connects to the cloud-based threat intelligence center to synchronize IOC (Indicator of Compromise) data in real time (a threat indicator used to identify whether a system or network has been compromised in a cybersecurity incident); employs federated learning technology to train a localized threat detection model (ResNet-50 architecture) while protecting endpoint data privacy, thereby improving the ability to identify targeted attacks.

[0070] During federated learning, the original training data of each participant remains locally, with only encrypted model parameters uploaded to the cloud for aggregation, fundamentally eliminating the privacy risks associated with data leaving the local domain. Simultaneously, to address the potential model poisoning attack risk in federated learning, a multi-layered anti-poisoning defense mechanism is introduced, such as... Figure 4 As shown, a complete defense is built from three stages: terminal-side verification, cloud aggregation, and model distribution. First layer: Terminal-side local model verification Before submitting local model updates to the cloud, each participating terminal first verifies the updated model's output using a locally stored white sample dataset. Specifically, the white samples are input into the updated model to check if the output matches expectations. If the model update causes a significant deviation in the detection results for the white samples (e.g., misclassifying known normal behavior as malicious), the update is deemed abnormal, discarded, and not uploaded to the cloud. This mechanism effectively filters maliciously submitted poisoned model updates, ensuring that all model parameters participating in the aggregation come from trusted nodes.

[0071] Second layer: Cloud-based Byzantine fault-tolerant aggregation After collecting local model updates uploaded by various terminals, the cloud aggregation server employs a Byzantine Fault Tolerance (BFT) aggregation algorithm for secure aggregation, rather than a simple weighted average. This algorithm can identify and eliminate outliers through a consensus mechanism among a majority of honest nodes, even when malicious nodes submit abnormal updates, thus generating a secure global model. Testing has verified that this mechanism can withstand poisoning attacks from malicious nodes comprising no more than 33% of the total population. Even in this extreme scenario, the accuracy drop of the global model can be controlled within 5%, far superior to traditional federated average aggregation schemes.

[0072] Third layer: Secure distribution of dynamic knowledge distillation The cloud-based system compresses the aggregated global model into a lightweight model using knowledge distillation technology, reducing the deployment and inference overhead on the terminal side. A dynamic verification mechanism is introduced during the distillation and distribution process: before each distribution, the lightweight model is inferred and verified using an independent verification dataset stored in the cloud. The output of the lightweight model is compared item by item with the original global model to ensure consistency. Only after confirming that the model behavior has not been tampered with or implanted with backdoors is it officially distributed to all participating terminals. Dynamic knowledge distillation, while compressing the model size, adds a layer of security verification during the model distribution process, preventing the model from being tampered with by man-in-the-middle attacks during the distribution phase.

[0073] Strategy Optimization Unit: This unit uses a reinforcement learning algorithm (PPO algorithm) to achieve adaptive dynamic optimization of protection strategy parameters. Specifically, the strategy optimization problem is modeled as a Markov decision process: taking the terminal's current comprehensive risk score, threat type distribution, and business load as state inputs, protection strategy parameters such as terminal scanning frequency, process behavior monitoring sensitivity, network isolation threshold, and data backup trigger conditions are encoded into an adjustable action space. Through continuous interaction between the agent and the terminal's security environment, the optimal parameter configuration scheme is automatically learned.

[0074] The PPO algorithm's reward function comprehensively considers two core indicators: risk reduction rate and response time. Risk reduction rate serves as a positive reward; the greater the risk reduction, the higher the reward, guiding the algorithm to prioritize parameter combinations that effectively eliminate threats. Response time serves as a negative penalty; the longer the time delay from threat detection to response completion, the greater the penalty, driving the algorithm to prioritize fast-execution, rapidly converging protective actions. The algorithm employs near-end strategy optimization, limiting the update magnitude with each parameter update to ensure training stability. In the initial training phase, different parameter combinations are randomly explored with a certain probability, and their impact on the security state is observed. As training progresses, the algorithm gradually converges to the optimal parameter range. After training, the strategy optimization unit continuously outputs the current optimal parameter combination based on real-time input state information, achieving dynamic adaptive adjustment of the protection strategy. For example, during ransomware outbreaks, the terminal scanning frequency is automatically increased from the usual every 10 minutes to real-time, and the network isolation threshold is reduced from the default 80 points to 60 points to trigger isolation measures earlier. During peak business periods, the scanning intensity of non-critical terminals is automatically reduced to every 30 minutes, minimizing the impact of security scanning on business performance.

[0075] Building upon this foundation, a business interruption cost factor mechanism is further introduced to ensure that strategy optimization balances security effectiveness with business continuity. The system first categorizes terminals into different business levels based on the importance of the services they carry and pre-sets differentiated business impact weight coefficients: core transaction / production terminals have a weight of 5.0, important business systems (such as ERP and email servers) have a weight of 3.0, general business systems have a weight of 1.5, and ordinary office terminals have a weight of 1.0. This weight is embedded in the reward function as a penalty, calculated as follows: Reward Value = Risk Reduction Reward - Response Time Penalty - Business Interruption Cost Penalty × Business Impact Weight. The business interruption cost penalty is determined by the type of protection action (e.g., the basic interruption cost for network isolation is 10, and the basic interruption cost for enhanced monitoring is 2), while the business impact weight acts as a multiplier amplification effect. Therefore, the same protective action generates differentiated reward values ​​on terminals with different business levels: the penalty for performing isolation operations on office terminals with a weight of 1.0 is 10, while the penalty for performing the same isolation operation on the core transaction system with a weight of 5.0 is amplified to 50. Through exploration, the algorithm automatically learns to prioritize non-disruptive protective actions such as enhanced monitoring and data backup for high-weight terminals, while decisively taking isolation and blocking measures for low-weight terminals. Actual testing shows that after introducing this mechanism, the business adaptability of the optimized strategy improved by 60%. This means that, while ensuring the same security effect, the number of unnecessary interruptions to core business caused by protective actions is significantly reduced, achieving a dynamic balance between security protection and business continuity.

[0076] S14, Terminal Adaptation Unit: This unit adapts to new terminals (such as ARM architecture devices and industrial control terminals) through domain adaptation, generating targeted protection strategies. This unit utilizes transfer learning technology to achieve rapid security protection adaptation for new terminals (such as ARM architecture devices, industrial control terminals, and IoT terminals). The source domain knowledge for transfer learning comes from the platform's mature threat detection model, multimodal feature extraction network, and risk assessment logic trained on traditional x86 architecture terminals; the target domain is the new terminal to be adapted, whose hardware architecture, operating system, application behavior patterns, and resource limitations differ significantly from the source domain.

[0077] The adaptation process consists of three steps: First, domain-adaptive feature alignment, which uses domain adversarial training technology to map data from the source and target domains to a common feature space, eliminating cross-architecture data distribution differences and allowing the malicious behavior recognition capabilities trained in the source domain to be directly transferred to the target domain; second, model fine-tuning, which uses a small number of labeled samples from the target domain to fine-tune the pre-trained model, enabling the model to learn target domain-specific threat patterns while retaining generalization knowledge; and third, differentiated strategy generation, which adjusts the general protection strategy template according to the resource constraints and security requirements of new terminals. For example, for IoT terminals, the full-system simulation sandbox analysis with high resource consumption is simplified, and firmware integrity verification based on whitelist hash verification is strengthened; for industrial control terminals, the weight of phishing email detection in office scenarios is weakened, and the detection of abnormal control commands and register read / write monitoring are strengthened. Simultaneously, the baseline adaptation unit automatically generates corresponding dynamic baselines based on the operating characteristics of the new terminals, ensuring that the abnormal behavior judgment criteria match the actual operating environment of the new terminals. Through the above mechanisms, it is possible to quickly adapt to various heterogeneous new terminals and generate targeted security protection strategies without retraining the model.

[0078] Step 6: Digital Operation Platform S15. Provides a centralized management interface and automated operation capabilities: Visualized Dashboard: Real-time display of endpoint security status (installation rate, normalization rate, baseline compliance rate), threat landscape (virus handling rate, vulnerability remediation rate, sensitive data outflow rate), and risk distribution (by department, endpoint type, and region); supports drill-down analysis (click on "high-risk endpoints" to view specific devices and the reasons for the risks).

[0079] Automated Response Unit: Pre-set response playbooks that automatically execute actions to address different threat types.

[0080] For example, when ransomware is detected, the terminal is automatically isolated, the files before encryption are backed up (using AES256 encryption), and a decryption tool is pushed to the system; when data leakage is detected, the DLP policy is automatically triggered to block transmission, a dynamic watermark is added, and the administrator is notified.

[0081] It also designs industry-specific response scripts to automatically execute actions across different industries: Financial industry: When bank card information is detected to be being sent out, the online banking permissions of the terminal involved will be automatically frozen and the anti-money laundering system will be triggered for verification. Healthcare industry: When a breach of medical record data is discovered, automatically save the audit log and notify the data protection officer as required by HIPAA; Compliance Audit Unit: Built-in inspection items for Cybersecurity Classified Protection 2.0, GDPR, and PCI DSS, automatically generating compliance reports; records all operation logs (administrator configuration changes, endpoint protection actions), and supports traceability query (blockchain-based log tamper-proof storage).

[0082] Blockchain-based evidence storage: Key operation logs are stored on a consortium blockchain (such as Hyperledger Fabric). Each block contains the terminal fingerprint, operation hash, and timestamp, supporting real-time auditing by regulatory agencies.

[0083] This embodiment provides a multimodal smart terminal security protection platform and method, which forms an integrated security protection solution that adapts to multiple architectures and systems through multimodal data fusion, dynamic risk assessment and cross-layer collaborative defense, significantly improving the detection rate and response efficiency of unknown threats under hybrid IT architecture.

[0084] The above descriptions are merely embodiments of the present invention. Commonly known structures and characteristics of the solutions are not described in detail here. Those skilled in the art are aware of all common technical knowledge in the field prior to the application date or priority date, are aware of all existing technologies in that field, and have the ability to apply conventional experimental methods prior to that date. Those skilled in the art can, under the guidance of this application, improve and implement this solution in combination with their own capabilities. Some typical known structures or methods should not be obstacles for those skilled in the art to implement this application. It should be noted that those skilled in the art can make several modifications and improvements without departing from the structure of the present invention. These should also be considered within the scope of protection of the present invention, and will not affect the effectiveness of the implementation of the present invention or the practicality of the patent.

Claims

1. A multimodal intelligent terminal security protection platform, characterized in that, include: The multimodal data acquisition layer is used to acquire multi-source heterogeneous security data through distributed acquisition modules and by introducing terminal architecture, user, and environment adaptive mechanisms. The data includes terminal, network, user behavior, and environmental context. The multi-source data fusion engine is used to perform correlation analysis based on knowledge graphs for multi-source heterogeneous security data and construct attack chains by combining attack chain temporal weighting algorithms. It also performs cross-modal feature fusion based on three-level feature extraction and introduces a multi-head attention mechanism to generate fused feature vectors, in which the attack chain participates in cross-modal feature fusion. The dynamic risk assessment system is used to quantify risk based on fused feature vectors using a multi-layer machine learning model, output real-time risk scores, and predict future risk trends. The attack chain participates in real-time risk score adjustment; The cross-layer collaborative defense mechanism is used to coordinate the system layer, network layer, application layer, and data layer to execute adaptive protection strategies based on risk scores, and to trigger an early warning mechanism based on predicted future risk trends to coordinate the system layer, network layer, application layer, and data layer to execute preventive actions. The Adaptive Learning Center is used to build threat detection models based on federated learning for threat detection and introduce multi-layered anti-poisoning defense mechanisms. It also continuously optimizes the models of the multi-source data fusion engine and dynamic risk assessment system, and continuously optimizes the protection strategy based on reinforcement learning. A digital operations platform for visualizing situations and automating responses.

2. The multimodal intelligent terminal security protection platform according to claim 1, characterized in that, The multimodal data acquisition layer includes a terminal data acquisition module, a network data acquisition module, a user behavior acquisition module, and an environmental perception module; The terminal data acquisition module deploys a lightweight proxy to collect data and adopts an architecture-adaptive proxy that automatically switches instruction set adaptation modes for different architectures, and introduces an industrial terminal protocol adaptation acquisition mechanism; the network data acquisition module captures terminal inbound and outbound data packets through traffic probes, extracts five-tuple information, application layer load characteristics and abnormal connection patterns, and works with firewalls and network access control devices to obtain terminal access status and policy group information; the user behavior acquisition module collects user behavior data, and combines it with biometric behavioral characteristics and introduces a behavioral anomaly measurement model to enhance identity authentication; the environment awareness module integrates terminal adaptive environment awareness capabilities under a zero-trust architecture and triggers a cross-layer collaborative defense mechanism based on physical environment trusted verification to execute protection strategies that match the current risk level.

3. The multimodal intelligent terminal security protection platform according to claim 1, characterized in that, The multi-source data fusion engine includes a correlation analysis unit and a feature extraction and enhancement unit; The association analysis unit is used to construct an entity relationship model based on knowledge graph technology, identify attack chains across time dimensions using a temporal association algorithm, and reconstruct the attack chain by assigning time decay weights to each link in the attack chain using an attack chain temporal weight algorithm. The feature extraction and enhancement unit is used to extract single-modal features from multi-source heterogeneous security data, enhance features through contrastive learning, and compress and output multi-modal enhanced features by combining a knowledge distillation model. A multi-head attention mechanism is used to weightedly fuse multimodal features to obtain a fused feature vector. A weight guidance mechanism is introduced to adjust the attention weights of the feature vector using the attack chain stage completeness and total weight as attention guidance signals.

4. The multimodal intelligent terminal security protection platform according to claim 1, characterized in that, The dynamic risk assessment system shall adopt at least one of the following optimization strategies to adjust the real-time risk score: A business value weighting factor mechanism is introduced to adjust the risk score based on the importance of the business carried by the terminal, with importance being positively correlated with the risk score; The completeness of the attack chain is used as a reference factor for the threat intensity score in dynamic risk assessment. The completeness is positively correlated with the threat intensity score. The total weight of the attack chain is used as a time urgency factor to adjust the risk score. The total weight of the attack chain is positively correlated with the risk score. Construct a baseline adaptive unit that automatically generates a dynamic baseline based on at least the terminal type, user role, and / or business scenario, and adaptively adjusts the baseline threshold for abnormal behavior detection so that the criteria for judging abnormal behavior under different terminal types, user roles, or business scenarios match their respective actual operating characteristics.

5. The multimodal intelligent terminal security protection platform according to claim 1, characterized in that, The dynamic risk assessment system uses an attention mechanism—LSTM neural network—to train historical risk score sequences and predict risk trends within a preset time period. During the process, higher attention weights are given to recent high-frequency risk events. When the predicted risk score exceeds a threshold, an early warning mechanism is triggered, and at least one of the following preventative actions is performed: Data layer prevention: Immediately trigger critical data backup processes, use immutable storage technology to protect backup files, and prevent ransomware encryption and damage; Network layer prevention: Preemptively restrict network access permissions for threatened terminals, allowing only access to necessary resources such as patch servers and backup servers; System-level prevention: Increase the frequency of terminal process behavior monitoring and intercept the startup of non-whitelisted processes; Application-layer prevention: Start the full system simulation sandbox in advance to perform predictive dynamic analysis on suspicious applications.

6. The multimodal intelligent terminal security protection platform according to claim 1, characterized in that, Adaptive protection strategies under cross-layer collaborative defense mechanisms include at least one of the following: System-level defense includes at least integrating host firewall, vulnerability management and system hardening functions, and executing actions based on different risk scores and system configurations. These actions include kernel-level process isolation and blocking, memory instruction sequence detection technology to defend against vulnerability exploitation, and domestic kernel protection. Application-layer defense includes combining terminal detection and response with application control functions, at least performing process behavior monitoring, malicious code detection and removal, and abnormal application isolation. During the process, multi-engine collaborative detection is used, and a full-system simulation sandbox is introduced for dynamic analysis. Data layer defense includes integrated data leakage prevention functions, identifying sensitive data based at least on keyword matching, regular expressions and / or data identifiers, tracing data through security watermarks and introducing dynamic watermark generation algorithms, recording the entire lifecycle of sensitive files in conjunction with file tracking technology, and protecting backup files with immutable storage technology. Network layer collaboration includes linkage with next-generation firewalls and network access control, dynamic adjustment of network access permissions based on terminal risk scores, standardized transmission of end-to-end collaborative handling instructions through preset protocols, and network slicing isolation based on risk scores using a software-defined network linkage architecture.

7. The multimodal intelligent terminal security protection platform according to claim 1, characterized in that, The multi-layered anti-poisoning defense mechanism of the adaptive learning center includes: local model verification at the terminal, using locally stored white sample datasets to verify the model and filter malicious model updates from malicious terminals, while retaining local model updates from normal terminals; after collecting local model updates uploaded by each terminal in the cloud, the model parameters are aggregated using the Byzantine fault-tolerant algorithm to generate a secure global model; the cloud compresses the aggregated global model into a lightweight model using knowledge distillation technology and distributes it to each participating terminal after inference verification.

8. The multimodal intelligent terminal security protection platform according to claim 1, characterized in that, The Adaptive Learning Center, based on reinforcement learning algorithms, models the policy optimization problem as a Markov decision process: taking the terminal's current risk score, threat type distribution, and business load as state inputs, it encodes the protection policy parameters into an adjustable action space. Through continuous interaction between the agent and the terminal's security environment, it automatically learns the optimal parameter configuration scheme; and adopts at least one of the following policy optimization adaptations: The reward function of reinforcement learning algorithms comprehensively considers two core indicators: risk reduction rate and response time, and optimizes policy parameters. A business interruption cost factor mechanism is introduced, and business impact weights are added to the reward function of the reinforcement learning algorithm for business adaptation in strategy optimization; A terminal adaptation unit is constructed, which adapts to new terminals through transfer learning and generates targeted protection strategies.

9. A multimodal intelligent terminal security protection platform according to claim 1, characterized in that, The digital operations platform uses a visual dashboard to display the endpoint security status, threat landscape, and / or risk distribution in real time; and automatically executes response actions for different threat types and in combination with different industries through preset response scripts.

10. A method for security protection of a multimodal smart terminal, characterized in that, The method utilizes a multimodal smart terminal security protection platform according to any one of claims 1-9; the method includes: Multi-source heterogeneous security data is acquired through a distributed acquisition module and by introducing terminal architecture, user, and environment adaptive mechanisms. The data includes terminal, network, user behavior, and environmental context. For multi-source heterogeneous security data, we perform correlation analysis based on knowledge graphs and construct attack chains by combining attack chain temporal weighting algorithm. We also perform cross-modal feature fusion based on three-level feature extraction and introduce a multi-head attention mechanism to generate fused feature vectors, in which the attack chains participate in cross-modal feature fusion. Based on the fused feature vectors, a multi-layer machine learning model is used to quantify risk, output a real-time risk score, and predict future risk trends; the attack chain participates in the adjustment of the real-time risk score. Based on the risk score, adaptive protection strategies are implemented at the system layer, network layer, application layer, and data layer. Based on the predicted future risk trends, an early warning mechanism is triggered to implement preventive actions at the system layer, network layer, application layer, and data layer. A threat detection model is built based on federated learning for threat detection, and a multi-layered anti-poisoning defense mechanism is introduced to continuously optimize the multi-source data fusion engine and dynamic risk assessment system. Furthermore, the protection strategy is continuously optimized based on reinforcement learning. Visualizing the situation and automating the response.

Images