Generative artificial intelligence asset intelligence multi-source fusion analysis method and system

Abstract

The application relates to the technical field of network security, and discloses a generative artificial intelligence asset intelligence multi-source fusion analysis method, which comprises the following steps: performing time state labeling and normalization processing on multi-source original asset data to obtain a normalized asset record set; performing quantification on multi-source collection frequency differences and time window dislocations to obtain a time sequence offset quantization matrix and a state change anchor point set; calculating an effectiveness confidence and performing conditional branch fusion output to obtain a time state alignment asset attribute fusion table; inferring an implicit correlation between asset entities by using a large language model to obtain a candidate triple set; constructing an asset knowledge graph and performing graph traversal reasoning to output attack surface risk assessment results in combination with threat intelligence; and the application avoids false alarms and misblockings caused by time state contradictions of multi-source data, guarantees the credibility of output risk conclusions, and takes into account the discovery ability of hidden risk clues.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a generative artificial intelligence asset intelligence multi-source fusion analysis method and system. Background Technology

[0002] In the field of cybersecurity asset management and attack surface monitoring, multiple heterogeneous security components are typically deployed to achieve continuous awareness of digital assets. These include endpoint management systems that collect host configuration status, cloud platform asset centers that synchronize asset metadata in real time, and vulnerability scanning systems that periodically probe component vulnerabilities. Based on preset policies and data collection engines, these systems periodically acquire asset information and report it to a converged analysis platform. Knowledge graphs or generative models are then used to correlate multi-source data and construct a unified asset profile to support threat detection, exposure surface assessment, and automated response decisions. The key characteristic of this technology is its reliance on the matching and alignment of multi-source data, forming a comprehensive security posture through entity recognition and relationship deduction.

[0003] In actual operation, security operations personnel often receive threat alerts that deviate from the actual situation, leading to deviations in subsequent analysis and handling. For example, a core cloud host may have completed a business port change and patched a specific component vulnerability at a certain time, with the cloud platform asset center reporting the new asset configuration in real time; however, the vulnerability management system may only report the old port vulnerability data it scanned earlier. When processing these two reports, the fusion analysis system incorrectly binds the new port configuration with the old vulnerability record, directly presenting a high-risk attack surface that the host's current business can exploit on the monitored interface. Operations personnel then conduct attack surface verification, only to find that the system is launching invalid probes for vulnerabilities that no longer exist, while the linkage handling engine blocks the host's normal business traffic, causing service interruption. Such continuous false alarms fill the alert interface with numerous invalid threat events, and the attack surface view frequently displays risk indicators that do not match the current state. Security teams need to repeatedly verify the asset status to eliminate false intelligence, significantly reducing real-time response capabilities. Therefore, how to reduce attribute conflicts caused by temporal misalignment during the process of integrating multi-source security data to construct an asset map is a problem that urgently needs to be solved in this field. Summary of the Invention

[0004] To address the shortcomings of existing technologies, the present invention aims to provide a generative artificial intelligence asset intelligence multi-source fusion analysis method and system. By performing temporal annotation, entity normalization, temporal offset perception quantification, and conditional branch fusion on multi-source asset data, and combining a large language model to infer implicit asset relationships and construct a knowledge graph for graph traversal reasoning, the technical effect of improving the credibility of multi-source asset data fusion and accurately assessing attack surface risks is achieved.

[0005] To achieve the above objectives, the present invention adopts the following technical solution: In a first aspect, the present invention provides a generative artificial intelligence asset intelligence multi-source fusion analysis method, comprising: Collect multi-source raw asset data from multiple data interfaces, perform temporal annotation and multi-granularity entity normalization processing on the multi-source raw asset data, and output a normalized asset record set carrying temporal stamps and entity identification codes; Based on the normalized asset record set, a cross-source temporal offset sensing index is constructed. The time window misalignment driven by the multi-source acquisition frequency difference and state change event is quantified, and the temporal offset quantization matrix and state change anchor point set between each data source pair are output. Using the temporal offset quantization matrix and the set of state change anchor points as input, the validity confidence score is calculated for each record in the normalized asset record set. Based on the validity confidence score, conditional branch fusion is performed, and a temporal aligned asset attribute fusion table is output. Using the temporally aligned asset attribute fusion table as input, the implicit relationships between asset entities are inferred using a large language model, and a set of candidate triples for asset relationships is output. Using the set of candidate triples for asset association relationships as input, an asset knowledge graph is constructed. Graph traversal reasoning is performed on the asset knowledge graph to discover hidden risk paths. The attack surface risk assessment result is then output in combination with threat intelligence data.

[0006] Furthermore, the process of performing temporal annotation and multi-granularity entity normalization on multi-source original asset data, and outputting a normalized asset record set carrying temporal stamps and entity identifiers, includes: Attach a tuple containing the data source type code and the collection timestamp to each record in the multi-source raw asset data; Multi-granularity entity normalization is performed on the asset identifier field in the multi-source original asset data. Fields with format differences are uniformly converted into standard formats and concatenated in a fixed order to obtain normalized identifier vectors for each identifier dimension layer. The normalized identifier vectors are then serialized into a single string as the asset physical identifier. The asset physical identifier, the data source type code, and the collection timestamp are sequentially concatenated to generate a globally unique entity identifier code. The entity identifier code and the collection timestamp are then combined to form a temporal stamp, which is appended to the record. A normalized asset record set carrying the temporal stamp and the entity identifier code is output.

[0007] Furthermore, the quantization of time window misalignment driven by multi-source acquisition frequency differences and state change events includes: Group the asset physical identifier substring in the entity identifier code from the normalized asset record set, extract the collection timestamp sequence of the same asset under each data source to calculate the median collection cycle difference between each pair, and generate the data source collection cycle difference matrix. In the normalized asset record set, detect the location where the asset configuration field changes between adjacent collection records within each data source under the same asset physical identifier, and obtain the candidate change anchor point time generated by each data source. Candidate anchor points under the same asset physical identifier whose absolute value of the difference between candidate change anchor point times does not exceed the maximum value of the median collection period of all data sources are aggregated. The arithmetic mean of the times of each candidate anchor point in the aggregated cluster is taken as the state change anchor point time. All change anchor points are aggregated to obtain the state change anchor point set.

[0008] Furthermore, the time-series offset quantization matrix and state change anchor point set between the output data source pairs include: Traverse each anchor point in the set of state change anchor points, and extract all records of the asset corresponding to the anchor point from the normalized asset record set, where the collection timestamp falls within the collection period setting window of the corresponding data source under each data source. For each extracted record, calculate the difference between its collection timestamp and the anchor point time to obtain a signed offset value that retains the positive or negative sign and indicates the correlation between the collection time and the time before and after the anchor point. The signed offset values ​​of each data source at each anchor point are filled into the corresponding positions of the time-series offset quantization matrix. If a data source has no record near the anchor point, it is marked with a null value. After traversing all anchor points, the complete time-series offset quantization matrix is ​​output.

[0009] Furthermore, the calculation of the validity confidence level for each record in the normalized asset record set includes: Query the signed offset value corresponding to the record in the time-series offset quantization matrix. If the position is empty, trigger empty value compensation and take the negative value of half the acquisition period in the data source as the interpolated signed offset value. When the signed offset value is negative and its absolute value is less than or equal to the median acquisition period of the data source, the validity confidence is calculated as a decay value that is inversely proportional to the absolute value of the signed offset value. When the signed offset value is non-negative and less than or equal to the median acquisition period, the validity confidence level is set to a preset benchmark value; When the absolute value of the signed offset is greater than the median acquisition period, the validity confidence is reduced to a preset penalty value.

[0010] Furthermore, the conditional branch fusion based on validity confidence, and the output of the temporally aligned asset attribute fusion table, includes: When there are records with a validity confidence level not lower than the benchmark value in the source records corresponding to the same asset physical identifier, the asset configuration fields of each record are weighted and fused using the validity confidence level of each record as the weight. When the validity confidence of all source records is lower than the low confidence threshold, the asset configuration field is marked as pending verification. When none of the aforementioned validity confidence scores reach the benchmark value but there are records that are not lower than the low confidence threshold, the record with the highest validity confidence score is taken as the representative value. The fusion results are organized into rows by asset entities and columns by attribute fields to construct a two-dimensional table. A weight vector consisting of the validity confidence of each source record participating in the fusion is appended to each attribute field cell to obtain a temporally aligned asset attribute fusion table.

[0011] Furthermore, the method of inferring implicit relationships between asset entities using a large language model and outputting a candidate triplet set for asset relationship includes: Extract the set of attribute fields for each asset entity from the temporally aligned asset attribute fusion table, serialize them into structured text in key-value pair format, and use them as context input for the large language model; Submit an inference task to the large language model that constrains the type and direction of the association relationship. The large language model outputs estimates of the type, direction, and strength of the association relationship between each pair of asset entities to form candidate triples. Parse the output and obtain the candidate triple list. Remove weakly associated candidate triples whose association strength estimates are lower than the preset screening threshold. Aggregate the remaining strongly associated candidate triples into a set of asset association candidate triples.

[0012] Furthermore, after aggregating the remaining strongly correlated candidate triples into a set of asset-related candidate triples, the process further includes: For each candidate triple in the set of candidate triples for asset association relationships, query the weight vector of the corresponding attribute field in the temporal aligned asset attribute fusion table; The mean of the non-zero components of all relevant weight vectors obtained from the query is calculated, the average weight of the attribute fields involved in the candidate triple is calculated, and the arithmetic mean of the average weight of the field is then taken as the average weight. The average weight is attached to the candidate triple as a source credibility label, and the set of candidate triples for asset association is updated.

[0013] Furthermore, the construction of the asset knowledge graph and the execution of graph traversal reasoning on the asset knowledge graph to discover hidden risk paths include: An asset knowledge graph is constructed using the asset physical identifier as nodes, the association type and direction of the candidate triplet set of asset association relationships as directed edges, and the source credibility label as edge weights. Candidate triples whose source credibility is below the lower confidence limit are incorporated into the asset knowledge graph as virtual edges and marked as edges to be confirmed. Perform a directed graph depth-first traversal on the asset knowledge graph, limiting the expansion of real edges with edge weights higher than the traversal confidence threshold layer by layer, record all internal asset nodes reachable from the exposed surface node and the reaching paths, and generate a set of exposed surface reachable paths.

[0014] Furthermore, after generating the set of reachable paths to the exposed surface, the method further includes: Extract currently active vulnerability exploit features from the acquired threat intelligence data, including attack chain steps and affected component version ranges; For each reachable path in the set of reachable paths of the exposed surface, the step conditions in the attack chain step sequence are matched step by step with the attribute fields of the path nodes on the port and component. When all the step conditions of the attack chain sequence can be completely mapped along a certain path of arrival, the path is marked as a high-risk attack path and a list of high-risk attack paths is generated.

[0015] Furthermore, after generating the list of high-risk attack paths, the process also includes: For each node in the list of high-risk attack paths, the mean confidence level of the validity of the corresponding asset entity and the mean source credibility label are summarized in the form of an arithmetic mean. Using a weighted coefficient that biases towards the mean of the validity confidence score, the mean of the validity confidence score and the mean of the source credibility label are weighted and summed to calculate the node's overall risk confidence score. Each path node is sorted from high to low according to its comprehensive risk confidence level to generate an attack surface risk assessment result. For high-risk attack paths that exceed the handling trigger threshold, automated handling response instructions are executed to block or ban traffic.

[0016] Secondly, the present invention provides a generative artificial intelligence asset intelligence multi-source fusion analysis system, comprising: The data normalization module is used to collect multi-source raw asset data from multiple data interfaces, perform temporal annotation and multi-granularity entity normalization processing on the multi-source raw asset data, and obtain a normalized asset record set. The time-series offset quantization module is used to build an index based on the normalized asset record set, perform quantization on the time window misalignment driven by the differences in the frequency of multi-source collection and state change events, and obtain the time-series offset quantization matrix and the set of state change anchor points between each data source pair. The conditional branch fusion module is used to calculate the validity confidence of each record in the normalized asset record set based on the temporal offset quantization matrix and the state change anchor point set, perform conditional branch fusion based on the validity confidence, and output a temporal aligned asset attribute fusion table. The implicit relationship inference module is used to infer the implicit relationship between asset entities using the temporally aligned asset attribute fusion table as input and a large language model to obtain a set of candidate triplets for asset relationship; The risk assessment result output module is used to construct an asset knowledge graph based on the set of candidate triples of asset association, perform graph traversal reasoning on the asset knowledge graph to discover hidden risk paths, and output attack surface risk assessment results in combination with threat intelligence data.

[0017] Compared to existing technologies, the beneficial effects of this invention are as follows: This invention performs temporal annotation and multi-granularity entity normalization on multi-source original asset data, outputting a normalized asset record set carrying temporal stamps and entity identification codes, providing a record-by-record indexing basis for cross-source temporal alignment; based on the normalized asset record set, a cross-source temporal offset-aware index is constructed to quantify the differences in multi-source acquisition frequency and the time window misalignment driven by state change events. A temporal offset quantification matrix is ​​generated by the data source acquisition cycle difference matrix and the state change anchor point set, enabling the system to perceive the temporal position of each record relative to the change time and structurally expose the distribution of empty values ​​in the matrix as data blind spots; the temporal offset is converted into validity confidence, and a three-branch conditional fusion is performed based on the confidence distribution, so that the real-time record after the change dominates the fusion result. The system effectively suppresses outdated records before changes, severing the erroneous association between outdated vulnerability data and real-time network configuration at the source, thus avoiding the generation of asset profiles with conflicting attributes. A large language model is introduced to infer implicit associations in temporally aligned asset attributes, overcoming the blind spots of structured field matching in semantic association coverage. In the construction of the asset knowledge graph, a virtual edge retention mechanism and cross-node threat intelligence attack chain matching are employed. While ensuring the credibility of the main path reasoning conclusions, low-confidence associations are retained as clues to be confirmed, achieving a balance between discovering hidden risks and suppressing false warnings. Ultimately, a complete confidence propagation chain is formed from temporal information collected from data collection to attack surface risk conclusions, effectively avoiding false warnings and mis-blocking caused by temporal contradictions in multi-source data, and improving the accuracy and reliability of asset security analysis data processing. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of the generative artificial intelligence asset intelligence multi-source fusion analysis method in this invention; Figure 2 This is a schematic diagram of the normalized identifier vector structure in an embodiment of the present invention; Figure 3 This is a schematic diagram of the entity identification code splicing structure in an embodiment of the present invention; Figure 4 This is a schematic diagram of cross-source aggregation of candidate change anchor points in an embodiment of the present invention; Figure 5 This is a schematic diagram of the null value blind zone of the timing offset quantization matrix in an embodiment of the present invention; Figure 6 This is a schematic diagram of the three-interval gating of validity confidence in an embodiment of the present invention; Figure 7 This is a schematic diagram of the fusion of three-branch conditions in an embodiment of the present invention; Figure 8 This is an example of an embodiment of the invention showing the addition of a fusion representation to the weight vector; Figure 9 This is a schematic diagram of the attack chain matching of real and virtual edges in the asset knowledge graph in an embodiment of the present invention; Figure 10 This is a functional module diagram of the generative artificial intelligence asset intelligence multi-source fusion analysis system in this invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Example 1: Please see Figure 1 As shown, this embodiment provides a generative artificial intelligence asset intelligence multi-source fusion analysis method, including: This embodiment provides a generative AI-based multi-source fusion analysis system and method for asset intelligence, deployed on an enterprise security operations platform. The security operations platform establishes data connections with the endpoint security management system, cloud platform asset center, vulnerability scanning system, penetration testing interface, situational awareness platform, and perimeter protection devices through data interfaces. Each data interface retrieves asset data from its corresponding system via network communication. This embodiment addresses scenarios where changes to ports, components, or protection strategies of enterprise digital assets occur within a short period, leading to time window misalignments in multi-source data due to differences in collection frequency and reporting cycles. This misalignment results in delayed vulnerability data being incorrectly associated with real-time network configurations, generating conflicting asset profiles and triggering ineffective actions.

[0022] S1: Collect multi-source raw asset data from multiple data interfaces, perform temporal annotation and multi-granularity entity normalization processing on the multi-source raw asset data, and obtain a normalized asset record set.

[0023] In enterprise attack surface management scenarios, data sources such as endpoint security management systems, cloud platform asset centers, and vulnerability scanning systems each employ independent acquisition clocks and reporting cycles. The same physical asset is recorded in different data sources with different identifier fields and different acquisition times. If the raw records from different data sources are directly mixed, subsequent steps will be unable to determine whether two records describe the same asset at the same time or at different times, leading to the incorrect association of lagging data with real-time data. This step adds a temporal stamp to each record and normalizes various asset identifier fields into a unified entity identifier code, providing a record-by-record indexing basis for subsequent cross-source temporal alignment.

[0024] Further, step S1 includes: S11: Pull raw data from the endpoint security management system, cloud platform asset center, vulnerability scanning system, penetration testing interface, situational awareness platform and perimeter protection equipment respectively, and append a tuple (data source type code, collection timestamp) to each record according to the data source type and the time of retrieval to obtain multi-source raw asset data.

[0025] The subsequent step S2 needs to distinguish which data source each record comes from and when the record was collected. However, the raw data returned directly by each data source only contains the asset field itself and does not carry a unified source and time identifier. This step adds a data source and time tuple to each record, making the raw record eligible for time-series indexing.

[0026] Specifically, the data interface of the security operation platform assigns an integer code to each data source according to a predefined data source type code table. The data source type code table identifies the endpoint security management system as 1, the cloud platform asset center as 2, the vulnerability scanning system as 3, the penetration testing interface as 4, the situational awareness platform as 5, and the boundary protection device as 6.

[0027] The data interface records the system time when the pull action is completed each time it is pulled, and represents it in the form of a UTC second-level timestamp as the collection timestamp.

[0028] For each retrieved original record, append a tuple (data source type code, collection timestamp). The tuple is stored in the record header as two fields, with the data source type code being an integer from 1 to 6 and the collection timestamp being a non-negative integer value in seconds.

[0029] The records obtained by aggregating the additional tuples from all data sources are used to obtain multi-source raw asset data. The multi-source raw asset data is organized in the form of a record list, and each record contains an asset identifier field, an asset configuration field, and a tuple (data source type code, collection timestamp).

[0030] S12: Perform multi-granularity entity normalization on the asset identifier field in the multi-source original asset data to obtain the normalized identifier vector of each identifier dimension layer.

[0031] In multi-source raw asset data, the cloud platform asset center identifies assets by instance ID, the endpoint security management system identifies assets by hostname and MAC address, and the vulnerability scanning system identifies assets by IP address. The identification field types and writing formats of the same physical asset are different in different data sources. If the identification fields are not standardized, the multi-source records of the same physical asset will be misclassified as different assets when grouping by asset later. This step maps the multiple identification fields to a unified identification dimension layer and eliminates the format differences.

[0032] Specifically, four identification dimension layers are predefined: IP address dimension layer, hostname dimension layer, instance ID dimension layer, and MAC address dimension layer.

[0033] Please see Figure 2 As shown, for each record in the multi-source original asset data, the asset identifier field of the record is filled into the corresponding identifier dimension layer according to the type, the IP address is filled into the IP address dimension layer, the hostname is filled into the hostname dimension layer, the instance ID is filled into the instance ID dimension layer, and the MAC address is filled into the MAC address dimension layer.

[0034] For each missing field in the identifier dimension layer, a placeholder is used to fill it. The placeholder is the string NULL, which indicates that the record has no corresponding value in that identifier dimension layer.

[0035] Fields with format differences are uniformly converted to the standard format. The conversion rules for the standard format are as follows: zeros omitted in the IPv4 short format are padded to complete dotted decimal format, hostnames are uniformly converted to lowercase letters, and MAC addresses are uniformly converted to colon-separated hexadecimal uppercase format.

[0036] The values ​​of the four identifier dimensions are concatenated into a four-element string vector in a fixed order: IP address dimension, hostname dimension, instance ID dimension, and MAC address dimension. This results in the normalized identifier vector of the record, which is a string vector with a fixed length of 4.

[0037] For example, the original IP field of a cloud host in the cloud platform asset center is 192.168.1.5, the instance ID is i-0a3, the hostname and MAC address are missing, and the normalized identifier vector after normalization is (192.168.001.005, NULL, i-0a3, NULL).

[0038] S13: Concatenate the normalized identifier vector with the tuple (data source type code, collection timestamp) to generate a globally unique entity identifier code for each record, and attach the entity identifier code and collection timestamp together as a temporal stamp to the record, outputting a normalized asset record set carrying the temporal stamp and entity identifier code.

[0039] The normalized identifier vector output by S12 has unified the identifier representation of the same physical asset, but it has not yet bound the identifier to the collection time as a single indexable key value. The subsequent step S2 needs to both aggregate records by physical asset and distinguish the collection batches of the same asset at different times. This step generates an entity identifier code by combining the identifier and time to simultaneously meet the above two indexing requirements.

[0040] Specifically, the normalized identifier vector output by S12 is sequentially concatenated with the values ​​of the four dimension layers using vertical line separators, and serialized into a single string as the asset physical identifier. The asset physical identifier is an unchanging string shared by the same physical asset across all data sources and at all times.

[0041] The asset physical identifier, data source type code, and collection timestamp are concatenated sequentially using hash symbols to generate an entity identifier code. This entity identifier code is a string, written as asset physical identifier#data source type code#collection timestamp. Since the collection timestamp is unique at the record level, the entity identifier code is globally unique within the normalized asset record set. See also... Figure 3 This is a schematic diagram of the entity identifier code splicing structure provided in the embodiments of this application. For example... Figure 3As shown, the top section consists of three blocks in sequence: Asset Physical Identifier, Data Source Type Code, and Data Collection Timestamp. The Asset Physical Identifier is valued at 192.168.001.005|NULL|i-0a3|NULL, the Data Source Type Code is valued at 2, and the Data Collection Timestamp is valued at 1718000000. These three blocks are connected by hash symbols and then joined downwards by a diagonal arrow to form the Entity Identifier block below, written as 192.168.001.005|NULL|i-0a3|NULL#2#1718000000. This diagram clearly illustrates the process of sequentially concatenating the Asset Physical Identifier, Data Source Type Code, and Data Collection Timestamp using hash symbols to generate the Entity Identifier block. Because the collection timestamp is unique at the record level and the entity identifier is globally unique in the normalized asset record set, the asset physical identifier allows multiple source records of the same physical asset to be aggregated, while incorporating the collection timestamp into the entity identifier allows collection records of the same physical asset at different times to carry distinct entity identifiers, providing an index basis that can distinguish collection batches for subsequent batch comparison of configuration fields along the collection timestamp.

[0042] The entity identifier and the acquisition timestamp added in S11 are combined to form a temporal stamp, which is a tuple (entity identifier, acquisition timestamp) and appended to the record.

[0043] Aggregate all records with added temporal stamps and output a normalized asset record set. The normalized asset record set is a list of records, and each record contains an asset physical identifier, a normalized identifier vector, an asset configuration field, a temporal stamp, and a tuple (data source type code, collection timestamp).

[0044] For example, the cloud host mentioned above was collected by the cloud platform asset center at collection timestamp 1718000000, and its entity identifier code was 192.168.001.005|NULL|i-0a3|NULL#2#1718000000. When it was collected by the vulnerability scanning system at collection timestamp 1718000900, its entity identifier code was 192.168.001.005|NULL|i-0a3|NULL#3#1718000900. The two records have the same asset physical identifier but different entity identifier codes.

[0045] Asset physical identifiers enable the aggregation of multi-source records of the same physical asset, while incorporating the collection timestamp into the entity identifier code allows collection records of the same physical asset at different times to carry distinct entity identifier codes. In scenarios where the cloud platform and vulnerability scanning system report data sequentially after a cloud host port change, if only the asset physical identifier is used as the index without distinguishing collection batches, two records of the same asset before and after the change will degenerate into indistinguishable identical keys, and S2 will be unable to locate which two adjacent collection records the change occurred between. After incorporating the entity identifier code into the collection timestamp, S2 can sort and compare configuration fields batch by batch along the collection timestamp, providing an index foundation that can distinguish collection batches for the accurate location of subsequent status change anchor points.

[0046] S2: Based on the normalized asset record set, an index is built, and the time window misalignment driven by the differences in the collection frequency of multiple sources and the state change event is quantized to obtain the time offset quantization matrix and the set of state change anchor points between each data source pair.

[0047] While the normalized asset record set carries record-by-record temporal stamps, it does not characterize the inherent reporting frequency differences among data sources, nor does it pinpoint the actual time when asset configuration changes occur. Existing fusion systems rely solely on static asset identifiers or fixed timestamps for data mapping, failing to quantify the inherent time window misalignments in the acquisition mechanisms of multiple heterogeneous data sources. When temporal inconsistencies exist in the underlying data, they associate lagging, vulnerable data with real-time configuration errors. This step first quantifies the acquisition cycle differences between data sources, then locates the asset status change anchor point, and finally uses both as joint inputs to generate a temporal offset quantization matrix, enabling subsequent fusion to perceive the temporal position of each record relative to the change time.

[0048] Further, step S2 includes: S21: Group the assets in the normalized asset record set according to the asset physical identifier substring in the entity identifier code, extract the collection timestamp sequence of the same asset under each data source, calculate the median collection cycle difference between each pair of data sources, and generate the data source collection cycle difference matrix.

[0049] The difference in reporting frequency among different data sources is one of the root causes of time window misalignment. Without quantifying this frequency difference first, it is impossible to determine whether the lag of a record exceeds the normal collection interval of its data source. This step characterizes the frequency difference by statistically analyzing the median collection period of each data source and subtracting the values ​​from each pair.

[0050] Specifically, for the normalized asset record set, the records are grouped according to the asset physical identifier substring in the entity identifier code, so that all multi-source records of the same physical asset are grouped into the same group.

[0051] Within each group, it is further divided according to the data source type code. Records under each data source type code are arranged in ascending order by collection timestamp. The difference between the collection timestamps of two adjacent records is calculated to obtain the collection interval sequence of the data source on the asset.

[0052] The collection interval sequence of the same data source is aggregated across all assets, and the median of the collection interval sequence is taken as the median collection period of the data source. The median is the value at the middle position after the collection interval sequence is sorted in ascending order. When the length of the collection interval sequence is even, the arithmetic mean of the two middle values ​​is taken.

[0053] For any two data sources, calculate the absolute value of the difference between the median acquisition periods of the two data sources, and use it as the element at the corresponding position in the data source acquisition period difference matrix. The data source acquisition period difference matrix is ​​a 6-row, 6-column symmetric matrix, where the row and column indices are both data source type codes, and the diagonal elements are 0.

[0054] For example, if the median data collection period of the cloud platform asset center is 60 seconds and the median data collection period of the vulnerability scanning system is 900 seconds, then the element in the 2nd row and 3rd column of the data source data collection period difference matrix is... Second.

[0055] S22: In the normalized asset record set, detect the location where the asset configuration field changes between adjacent collection records within each data source under the same asset physical identifier. After aggregating the candidate change anchors, obtain the status change anchors. Gather all change anchors to obtain the status change anchor set.

[0056] Another root cause of time window misalignment is that asset configurations change within the collection interval. Without specifying the actual time of the change, it's impossible to determine whether each record describes the state before or after the change. Different data sources may have semantic differences in the recording range of the same asset configuration field (e.g., a vulnerability scanning system records externally open ports while an endpoint security management system records local listening ports). If configuration fields are directly compared across data sources, this semantic difference will be misjudged as an asset configuration change, generating false change anchors. This step locates candidate change times by comparing the configuration fields of adjacent collection records within the same data source, and then performs cross-source aggregation on the candidate anchors generated by each data source to eliminate false anchors caused by noise from a single data source through multi-source verification.

[0057] Specifically, the asset configuration fields include a port list, a component version number, and a protection policy identifier. The port list is a string array, the component version number is a version number string, and the protection policy identifier is a policy number string.

[0058] For all records corresponding to each asset physical identifier, first group them by data source type code, then sort them in ascending order by collection timestamp within each data source group, and compare the asset configuration fields of two adjacent records in the same data source one by one.

[0059] If any field in the port list, component version number, or protection policy identifier of two adjacent records within the same data source has a different value, it is determined that the data source detected a configuration change within that time period. The arithmetic mean of the collection timestamps of two adjacent records within the data source group is taken as the candidate change anchor time of the data source. The candidate change anchor time is a triple (asset physical identifier, data source type code, candidate anchor time).

[0060] After aggregating candidate change anchor points generated by all data source groups across all asset physical identifiers, for candidate anchor points from two different data sources under the same asset physical identifier, the element values ​​corresponding to the row and column positions of the two data sources in the data source collection period difference matrix are used as the aggregation tolerance window. Candidate anchor points whose absolute difference in time does not exceed this aggregation tolerance window are aggregated. The arithmetic mean of the times of each candidate anchor point in the aggregation cluster is taken as the final state change anchor point time. The state change anchor point is a tuple (asset physical identifier, anchor point time). For isolated candidate anchor points that fail to aggregate with other data source candidate anchor points, their candidate anchor point time is retained as the state change anchor point time, also included in the form of a tuple (asset physical identifier, anchor point time). See also Figure 4 This is a schematic diagram of cross-source aggregation of candidate change anchor points provided in an embodiment of this application. For example... Figure 4 As shown, two candidate anchor points are distributed along the horizontal time axis. The diamond-shaped marker represents the candidate anchor point time 1717999850 of the vulnerability scanning system, and the square marker represents the candidate anchor point time 1718000000 of the cloud platform asset center. The two candidate anchor points are encompassed by an aggregation cluster enclosed by a dashed ellipse. The aggregation cluster is merged by a downward arrow to produce the final anchor point time 1717999925, represented by a solid circle. This figure presents the process of using the element values ​​of the corresponding row and column positions of the two data sources in the data source collection period difference matrix as the aggregation tolerance window, aggregating candidate anchor points whose absolute value of the difference in time does not exceed the aggregation tolerance window, and taking the arithmetic mean of the times of each candidate anchor point in the aggregation cluster as the final state change anchor point time. This multi-source mutual verification eliminates false anchor points caused by noise from a single data source.

[0061] By aggregating all the final determined state change anchor points on the physical identifiers of all assets, a set of state change anchor points is obtained, which is a list of binary tuples.

[0062] For example, if a cloud host's cloud platform asset center record port list is [80, 443] at timestamp 1717999800, and changes to

[8443] at timestamp 1718000200, then this data source generates a candidate change anchor point. Seconds; if the vulnerability scanning system detects a port list change in adjacent records at 1717999400 seconds and 1718000300 seconds, a candidate change anchor time is generated. Seconds, the time difference between the two candidate anchor points The time interval shall not exceed the maximum median collection period of 900 seconds for all data sources. The final anchor point time after aggregation is [time value missing]. Second.

[0063] S23: Using the data source acquisition period difference matrix and the set of state change anchor points as joint inputs, calculate the difference between the acquisition timestamp of each data source record and the time of the most recent state change anchor point within the time window near each state change anchor point for each data source pair, and organize the time offset of all data source pairs at all anchor points into a time offset quantization matrix.

[0064] The data source acquisition cycle difference matrix output by S21 characterizes the inherent frequency differences of the data sources, and the set of state change anchor points output by S22 identifies the actual time of asset changes. However, these two do not yet jointly reflect how far each data source record deviates from the change time in a specific change event. This step uses both as joint inputs to calculate the time series offset record by record within a time window near each state change anchor point, generating a time series offset quantization matrix. This provides a record-by-record time series positioning basis for the validity confidence calculation in S3. The width of the time window is taken as the median acquisition cycle of the corresponding data source, making the window width adaptive with the data source frequency.

[0065] Further, step S23 includes: S231: Traverse each anchor point in the state change anchor point set, and extract all records of the asset corresponding to the anchor point from the normalized asset record set under each data source, where the collection timestamp falls within one collection period before and after the anchor point time.

[0066] The time-series offset is only meaningful near the state change anchor point; records far from the change time are not included in the window calculation to avoid irrelevant records interfering with the offset statistics. This step determines the extraction window based on the median acquisition period of each data source.

[0067] Specifically, iterate through the set of state change anchors, and for the currently traversed state change anchor, read the asset physical identifier and anchor time from its tuple.

[0068] For each data source type code, obtain the median acquisition period of the data source from S21, and determine the extraction window with the anchor point time as the center and the median acquisition period of the data source as the radius. The extraction window is a closed interval [anchor point time minus median acquisition period, anchor point time plus median acquisition period].

[0069] From the normalized asset record set, select all records whose asset physical identifier is equal to the physical identifier of the current state change anchor asset and whose collection timestamp falls within the extraction window of the corresponding data source, and use them as the extraction record set for the current state change anchor.

[0070] S232: For each extracted record, calculate the difference between its collection timestamp and the anchor point time to obtain a signed offset value. A negative value indicates that the collection time is earlier than the anchor point, and a positive value indicates that the collection time is later than the anchor point.

[0071] Subsequently, S31 needs to differentiate the state of the record based on whether it was before or after the change, as the absolute value of the time difference alone cannot express directional information. This step preserves the sign of the difference, allowing the offset value to simultaneously carry both directional and distance information.

[0072] Specifically, for each extracted record in the extracted record set output by S231, a signed offset value is calculated. The signed offset value is equal to the collection timestamp of the extracted record minus the anchor time of the current traversal state change anchor point.

[0073] When the signed offset value is negative, it indicates that the acquisition time of the extracted record is earlier than the anchor point time, and the extracted record describes the state before the change; when the signed offset value is positive, it indicates that the acquisition time of the extracted record is later than the anchor point time, and the extracted record describes the state after the change.

[0074] For example, the record collected by the vulnerability scanning system at timestamp 1717999400, relative to the anchor time 1718000000, has a signed offset value of The second indicates that the record describes the state before the change.

[0075] S233: Fill the signed offset values ​​of each data source at the anchor point into the corresponding positions of the timing offset quantization matrix. If a data source has no record near the anchor point, mark it with a null value. After traversing all anchor points, output the complete timing offset quantization matrix.

[0076] The signed offset values ​​obtained from S232 are still discrete values ​​and need to be organized into a matrix according to the two-dimensional index of the data source and anchor point before they can be quickly queried by record by S3. This step completes the matrix filling of the offset values ​​and marks the data blind spots.

[0077] Specifically, a time-series offset quantization matrix is ​​defined, wherein the time-series offset quantization matrix uses the state change anchor point as the row index and the data source type code as the column index, and the matrix element is the signed offset value of the record extracted from the corresponding data source at the corresponding anchor point.

[0078] For the current state change anchor point, fill the signed offset values ​​of each data source calculated in S232 into the anchor point row and the corresponding data source column in the time-series offset quantization matrix; if a data source type code has no record in the extracted record set in S231, fill the anchor point row and the data source column with a null value NULL.

[0079] After traversing all anchor points in the state change anchor point set, output the complete timing offset quantization matrix. See also... Figure 5 This is a schematic diagram of the null value blind zone of the timing offset quantization matrix provided in the embodiments of this application. For example... Figure 5 As shown, the matrix uses the state change anchor points (anchor points one to four) as row indices and the data source type codes (1 to 4) as column indices. The matrix cells are filled with the signed offset values ​​of the records extracted from the corresponding anchor points by the data source, such as +45, -12, and +30. Cells marked with a gray background and NULL indicate null value locations where there are no records near the anchor point. Leader lines mark the acquisition blind zone and the signed offset values, respectively. This diagram illustrates that because the extraction window width is strictly equal to the median acquisition period of the data source, null values ​​only appear when the acquisition interval of the data source covers the anchor point. Therefore, the null value locations and acquisition blind zones are mathematically correlated one-to-one. This hidden defect, making change events completely invisible from the data source's perspective, is structurally exposed and triggers the null value compensation logic in S31.

[0080] The temporal offset quantization matrix uses the difference matrix of data source acquisition cycles to determine the extraction window width and the set of state change anchor points to determine the row index. Both determine the value of each cell, and its original design goal is only to quantify the offset of each data source record relative to the change time. However, the distribution of null value markers in the matrix naturally points to a hidden defect that those skilled in the art have not associated with offset quantization, without the need to introduce an additional detection module: when a state change event happens to fall within the interval between two acquisitions of a certain data source, there are no records in that data source within a median acquisition cycle window before and after the anchor point. The change event is completely invisible from the perspective of that data source, and traditional systems mapped by fixed timestamps are completely unaware of this invisibility. Since the extraction window width is strictly equal to the median acquisition cycle of the data source, null values ​​only appear when the acquisition interval of the data source covers the anchor point. Therefore, the null value positions and acquisition blind spots are mathematically one-to-one. The null value distribution is identified as a data blind spot in S31 and triggers the null value compensation logic, which structurally exposes and compensates for the hidden defect of the complete absence of change records. This ability to identify blind spots is not the original design goal of the time-series offset quantization matrix, but rather the effect of its window width adaptive structure naturally emerging in the state change scenario.

[0081] S3: Based on the temporal offset quantization matrix and the set of state change anchor points, calculate the validity confidence score for each record in the normalized asset record set, perform conditional branch fusion based on the validity confidence score, and output the temporal aligned asset attribute fusion table.

[0082] The time-series offset quantization matrix and state change anchor set output by S2 have quantified the offset of each record relative to the change time, but have not yet converted the offset into a confidence metric that can be used for fusion decisions, nor have they provided rules for selecting conflicting attributes. If multi-source records are fused indiscriminately, lagging vulnerability records will be mixed with real-time configuration records with equal weight, generating asset profiles with conflicting attributes. This step converts the time-series offset into a validity confidence score and performs conditional branch fusion based on the confidence score, ensuring that real-time records after the change dominate the fusion result while lagging records before the change are suppressed.

[0083] Further, step S3 includes: S31: For each record in the normalized asset record set, query the signed offset value at the corresponding data source and anchor point in the time-series offset quantization matrix, calculate the validity confidence based on the positive and negative direction and absolute value of the signed offset value, and trigger null value compensation for null value positions.

[0084] The signed offset values ​​in the temporal offset quantization matrix simultaneously encode the direction and distance of the record relative to the time of change. This dual information needs to be converted into a single confidence metric to drive the selection of subsequent fusion branches. This step defines the segmented calculation rules for the validity confidence score.

[0085] Specifically, for each record in the normalized asset record set, the record's asset physical identifier and acquisition timestamp are used to locate its most recent status change anchor point, and the record's data source type code is used to locate the column index. The signed offset value at the corresponding position in the time-series offset quantization matrix is ​​then queried, denoted as... Simultaneously, the median acquisition period of the data source to which the record belongs is obtained from S21, denoted as... .

[0086] Preset baseline value Low confidence threshold and penalty value The benchmark value is the standard confidence level of the valid record after the change, the low confidence threshold is the lowest confidence boundary for the record to participate in fusion, and the penalty value is the extremely low confidence assignment of the record far exceeding the collection period. The method for determining the three is as follows: the average confidence ratio of the historically confirmed real-time records after the change in manual verification is used as the benchmark value, the upper quartile of the confidence level corresponding to the historical false association records when they are removed is used as the low confidence threshold, and one-third of the low confidence threshold is taken as the penalty value. For example, the benchmark value is 0.8, the low confidence threshold is 0.3, and the penalty value is 0.1.

[0087] When the signed offset value satisfies When the record describes the state before the change and does not exceed the extraction window, the validity confidence is calculated as a decay value inversely proportional to the absolute value of the signed offset: When the signed offset value satisfies When the changed status is recorded and the data collection period has not expired, the validity confidence level is set as the baseline value. ; When the absolute value of the signed offset satisfies When this happens, the validity confidence level is set as the penalty value. ; The above three condition intervals , , The values ​​are completely mutually exclusive and cover the entire real number field. The signed offset value of each record falls exactly into one of these unique intervals, ensuring unambiguous calculation of the validity confidence score. See also Figure 6 This is a schematic diagram of the three-interval gating of validity confidence provided in an embodiment of this application. Figure 6As shown, the bottom time axis is centered on the anchor point (solid circle), with two interval boundaries, -Tm and +Tm, on the left and right sides respectively, dividing the axis into four intervals: the pre-change state interval with diagonal lines corresponds to the attenuation value, the post-change state interval with a pure white background corresponds to the baseline value, and the interval with circles on both sides corresponds to the penalty value; the vertical dashed line passes through the pre-change state interval and points to the null compensation indicator at the bottom. This figure presents the segmented calculation rules for taking the attenuation value, baseline value, or penalty value respectively when the signed offset value falls into three mutually exclusive condition intervals that cover the entire real number field. It also intuitively shows that the null compensation is interpolated by taking the negative value of half of the median acquisition period and falling into the pre-change state interval, so that the lagging record describing the old state has a lower confidence level than the real-time record after the change, thus fundamentally inhibiting the binding of old vulnerability data to the new port.

[0088] When the corresponding position in the time-series offset quantization matrix is ​​null, null compensation is triggered. The negative value of half the acquisition period in the data source is directly used as the interpolated signed offset value, i.e., let... This indicates that the data source has no collected records within the current change window. The most conservative estimate is that its most recent record falls approximately half a collection cycle before the anchor point. The validity confidence is then calculated according to the aforementioned segmentation rules. Because... satisfy The validity confidence level after null value compensation is This value is lower than the benchmark value. But higher than the penalty value Semantically, this reasonably reflects the situation where the data source has no records and its status is uncertain within this change window. It will not trigger a high-confidence fusion branch or be directly penalized and excluded. This compensation rule only depends on the median collection period of the data source itself and does not depend on the signed offset value at adjacent anchor points. When adjacent anchor points are also null, the compensation logic can still be executed normally, and there are no logical dead ends.

[0089] The design principle of the validity confidence calculation formula is as follows: the attenuation term uses the benchmark value as the numerator, and... The denominator is used to make the record before the change farther away from the anchor point. A larger denominator indicates a lower confidence level in validity. It also means that the earlier the record was made, the less accurately it reflects the physical state of the current asset. Adding 1 to the denominator helps avoid this. Degradation occurs at zero, and the attenuation value is guaranteed not to exceed the reference value; the median acquisition period is used. right Normalization allows the decay rate to adapt to the inherent frequency of the data source, and the lag of data sources with longer acquisition cycles is more tolerable; records that are positive and do not exceed the acquisition cycle are directly taken as the baseline value, so that the real-time records after changes have the highest confidence; if the absolute value exceeds the acquisition cycle, the record has fallen out of the effective range of the current acquisition batch and is directly given a penalty value to exclude it from the fusion.

[0090] For example, the cloud platform asset center records the sign offset value. The median acquisition period is 60 seconds, and the validity confidence level is taken as the baseline value of 0.8; the vulnerability scanning system records the signed offset value. The data acquisition cycle is 900 seconds, with a median acquisition period of 900 seconds. The validity confidence level is 1, which satisfies the first interval condition. This value gives lagging records describing vulnerabilities on older ports a lower confidence level than real-time records on the cloud platform, thus fundamentally preventing old vulnerability data from being bound to new ports.

[0091] S32: Perform conditional branch fusion based on the validity confidence level, and select the fusion method according to the confidence level distribution for multiple source records corresponding to the same asset physical identifier.

[0092] The validity confidence score output by S31 provides a degree of credibility for each record. However, the selection among multiple source records still needs to be handled on a case-by-case basis according to the overall distribution of confidence scores. A single weighted fusion cannot handle situations where all records are untrustworthy or only partially trustworthy. This step designs a three-branch conditional fusion structure.

[0093] Specifically, for all source records corresponding to the same asset physical identifier, the validity confidence level of each record is read by S31, and each validity confidence level is compared with the benchmark value. Low confidence threshold The relationship.

[0094] When there is a validity confidence level not lower than the benchmark value When recording, the asset configuration field of each record is weighted by the validity confidence score of each record. The weighted fusion is to perform a weighted summation on the numerical attributes of the same field after normalization according to the validity confidence score, and to take the value of the record with the highest validity confidence score for the string attributes (if there are multiple records with the same highest confidence score and different values, the value of the one with the largest collection timestamp is taken). When the confidence level of the validity of all source records is below the low confidence threshold At that time, the asset configuration field corresponding to the physical identifier of the asset will be marked as pending verification and will not be included in the subsequent integration. When each validity confidence level crosses the benchmark value With low confidence threshold When no record reaches the baseline value but some records are not below the low confidence threshold, the asset allocation field of the single-source record with the highest validity confidence is used as the representative value, and the asset allocation fields of the remaining records are retained as copies. See also Figure 7 This is a schematic diagram of three-branch condition fusion provided in an embodiment of this application. For example... Figure 7As shown, the multiple source records stacked on the left branch into three branches from the main trunk. The upper branch condition is that the validity confidence level is not lower than the benchmark value, corresponding to a weighted fusion output. The middle branch condition is that the validity confidence level spans between the benchmark value and the low confidence threshold, corresponding to a representative value output. The lower branch condition is that the validity confidence level is lower than the low confidence threshold, corresponding to a pending verification status output. This diagram presents a three-branch conditional fusion structure that selects the fusion method based on the comparison relationship between the validity confidence level and the benchmark value and the low confidence threshold for all source records corresponding to the same asset physical identifier. This ensures that the fusion method strictly switches according to the confidence level distribution, fundamentally cutting off the detection of false attack surfaces driven by lagging data.

[0095] The validity confidence calculation in S31 and the three-branch condition fusion in S32 constitute a two-level mechanism coupled in series, addressing different stages of the same temporal contradiction problem. S31 transforms the signed direction and distance in the temporal offset quantization matrix into a single confidence metric, and S32 then determines the fusion path based on the comparison between the confidence metric and two thresholds. If only S31 is executed without S32, although each record already carries a validity confidence metric, the fusion stage will still mix records according to fixed rules. The port and component versions of low-confidence records before the change will still pollute the fusion result with additive components, generating asset profiles with conflicting attributes. If only S32 is executed without S31, the three-branch structure lacks a criterion due to the lack of confidence input, all branch conditions cannot be triggered, and the fusion degenerates into indiscriminate merging. The coupling of the two-level mechanism ensures that the fusion method strictly switches according to the confidence level distribution: In the scenario of cloud host port change, the cloud platform records in real time that when the confidence level reaches the benchmark value, a weighted fusion branch is triggered, and the new port dominates the fusion result; when the change falls exactly within the vulnerability scanning interval, causing the confidence level of all records to fall below the low confidence threshold, the asset configuration field is marked as pending verification and is not forcibly fused, thus cutting off the lagging data-driven false attack surface judgment at the source. The output quality of S32 directly determines the field credibility of the S33 fusion table, and thus determines the input quality of the downstream S4 semantic inference. The absence of either level will cause attribute conflicts in the fusion table to propagate downstream.

[0096] S33: Organize the output of conditional branch fusion into a two-dimensional table with asset entities as rows and attribute fields as columns. Attach the weight vector of each source record used to generate the value of each attribute field to each attribute field cell to obtain a temporally aligned asset attribute fusion table.

[0097] The fusion result output by S32 loses the source composition information of each attribute value after fusion. If the source weights are not retained, subsequent steps will not be able to trace back to the specific source record when there is an attribute dispute. This step adds a weight vector to each field cell of the two-dimensional table to preserve source traceability.

[0098] Specifically, a two-dimensional table is constructed using the asset physical identifier as the row identifier and the asset configuration field name as the column identifier. Each cell of the two-dimensional table stores the fusion value obtained by S32 for the corresponding asset entity in the corresponding attribute field.

[0099] For each cell, the validity confidence of each source record involved in generating the fused value during the S32 fusion process is recorded and organized into a weight vector according to the data source type code. The weight vector is a numerical vector with a length equal to the number of data sources involved in the fusion, and the vector components are the validity confidence of the corresponding source record. Missing sources are placed with 0.

[0100] The two-dimensional table with the added weight vector is output as a temporally aligned asset attribute fusion table. Each attribute field in the temporally aligned asset attribute fusion table contains both a fusion value and a weight vector. See also Figure 8 This is a schematic representation of the weight vector appending fusion provided in the embodiments of this application. For example... Figure 8 As shown, the two-dimensional table above uses the asset physical identifier as the row identifier and the asset configuration field names such as port list, component version number, and protection policy identifier as the column identifier. A cell in the component version number column is enlarged by a leader line, dividing the enlarged cell into two parts: the upper part is the fused value, and the lower part is the weight vector, represented by a row of small squares indicating the validity confidence components of each source record. This diagram illustrates the structure of the weight vectors of each source record used to generate the value of each attribute field, appended to each attribute field cell. This allows subsequent semantic inference to perceive the source confidence distribution of each attribute field and enables disputed attributes to be traced back to the source record contributing the value along the weight vector, fundamentally avoiding the untraceability defect caused by the loss of source information after attribute fusion.

[0101] By adding weight vectors to each attribute field cell in the temporally aligned asset attribute fusion table, the semantic inference of S4 can perceive the source confidence distribution of each attribute field, and the knowledge graph of S5 can trace back to the specific source record in case of attribute disputes. In scenarios where there are temporal contradictions in multi-source data, if the weight vectors are not retained after attribute fusion, when conflicts are found between the fused port list and component version number in subsequent verification, operations personnel cannot determine which data source and which collection batch the conflicting attribute originates from, and the disputed attribute cannot be located and verified because its source is untraceable. After adding weight vectors, each fused value carries the validity confidence of its source record, and the disputed attribute can be traced back to the source record that contributed the value along the weight vector, fundamentally avoiding the untraceability defect caused by the loss of source information after attribute fusion.

[0102] S4: Using the temporally aligned asset attribute fusion table as input, the implicit relationships between asset entities are inferred using a large language model to obtain a set of candidate triples for asset relationships.

[0103] While the attribute fields of each asset entity in the temporally aligned asset attribute fusion table are temporally aligned, implicit relationships such as network reachability and component dependencies between asset entities are not explicitly recorded in any structured fields. Methods based on fixed field matching cannot discover these deep relationships that require semantic understanding. This step introduces a large language model, leveraging its semantic reasoning capabilities for structured text to infer implicit relationships.

[0104] Further, step S4 includes: S41: Extract the set of attribute fields for each asset entity from the temporally aligned asset attribute fusion table, serialize the set of attribute fields into structured text, and use it as the context input for the large language model.

[0105] The large language model takes text sequences as input, while the temporal aligned asset attribute fusion table has a two-dimensional table structure. Therefore, the attributes in the table must first be converted into a text format that the model can process. This step completes the serialization of attribute fields into structured text.

[0106] Specifically, for each asset entity in the temporally aligned asset attribute fusion table, its attribute field set is extracted. The attribute field set includes a port list, component version number, protection policy identifier, and network area identifier. The network area identifier is obtained from the asset partition interface of the cloud platform asset center and has been incorporated into the fusion table.

[0107] The attribute field set of each asset entity is serialized into structured text in key-value pair format. The structured text adopts JSON format, with the asset physical identifier as the object key, the name of each attribute field as the subkey, and the merge value as the subvalue.

[0108] Concatenate the structured text of all asset entities into the context input of the large language model.

[0109] S42: Submit the inference task to the large language model. For each pair of asset entities, the large language model outputs the estimated type of association, direction of association, and strength of association, which together form a candidate triplet.

[0110] This step requires a large language model to perform implicit association inference without relying on local training. Therefore, the task is submitted via API call and the output format is constrained. This step explains the API call and prompt word construction.

[0111] Specifically, the large language model is a general-purpose large language model service called through a network interface. The core capabilities upon which this model is selected are the semantic understanding of entity attributes in structured text and the reasoning of relationships between multiple entities. For example, domestic large language model service providers such as Deepseek, Tongyi Qianwen, and Zhipu can be selected.

[0112] The interface request payload is constructed, and the prompts in the payload consist of four parts: system instructions, task description, context injection, and output format constraints. The system instructions define the role of the large language model as a network asset relationship analyzer, requiring it to make inferences based solely on input attributes and not to fabricate assets that do not exist in the input. The task description requires the large language model to identify the types of relationships that may exist between asset entities, which are limited to four categories: network reachability, component dependency, shared protection strategy, and port exposure and transmission. Context injection concatenates the structured text output by S41 after the task description. The output format constraints require the large language model to return the results as a JSON array, where each element contains five fields: source asset physical identifier, target asset physical identifier, relationship type, relationship direction, and relationship strength estimate. The relationship strength estimate ranges from 0 to 1.

[0113] The interface call parameters are set as follows: temperature parameter is set to 0.1, kernel sampling parameter is set to 0.9, and maximum output length is set to 14096. The temperature parameter is chosen to be low because asset association inference is a factual extraction task, requiring suppression of the randomness in the output of the large language model to ensure consistency of inference results under the same input, and to avoid high randomness causing the association type to drift between multiple calls. The kernel sampling parameter limits the cumulative probability range of candidate words, further constraining the output to fall within high-confidence candidates. The maximum output length is estimated and determined based on the number of asset entities and the length of the output field for each pair of relationships to accommodate the relationship output of all asset pairs.

[0114] The large language model outputs an estimate of the association type, association direction, and association strength for each pair of asset entities. These three factors constitute a candidate triplet, and the data structure of the candidate triplet is a five-field object.

[0115] S43: Parse all candidate triples from the output of the large language model, filter candidate triples whose association strength estimates are lower than the preset screening threshold, and aggregate the remaining candidate triples into a set of candidate triples for asset association.

[0116] The output of a large language model contains weak associations with low strength. Including all of them would introduce a large number of low-confidence relationships, interfering with subsequent graph inference. This step preserves high-strength associations through parsing and threshold filtering.

[0117] Specifically, it receives a JSON array string returned by the large language model and parses the string into a list of candidate triples through JSON deserialization.

[0118] A preset screening threshold is used to eliminate weak associations. The screening threshold is determined by using the lower quartile of the association strength estimate of candidate triples that have been manually confirmed as valid associations in the past as the screening threshold. For example, the screening threshold is 0.4.

[0119] Traverse the candidate triple list, remove candidate triples whose association strength estimate is lower than the screening threshold, and aggregate the remaining candidate triples into an asset association candidate triple set, which is a candidate triple object list.

[0120] S44: For each candidate triplet in the asset association candidate triplet set, query the weight vector of the corresponding attribute field in the temporally aligned asset attribute fusion table, calculate the average weight of the attribute fields involved in the candidate triplet, attach the average weight as the source credibility label of the candidate triplet to the candidate triplet, and update the asset association candidate triplet set.

[0121] The candidate triples inferred by the large language model do not carry the credibility of the data source. If they are directly used for assigning edge weights to the knowledge graph, it will be impossible to distinguish between associations inferred from high-credibility attributes and those inferred from low-credibility attributes. This step propagates the weight vector of S33 to the candidate triples.

[0122] Specifically, for each candidate triple in the set of candidate triples for asset association relationships, the attribute fields on which the inference is based are determined: network reachability is based on the port list and the network area identifier; component dependency is based on the component version number; shared protection policy is based on the protection policy identifier; and port exposure and transmission is based on the port list.

[0123] From the temporal alignment asset attribute fusion table output by S33, query the weight vectors of the source asset physical identifier and the target asset physical identifier involved in the candidate triples currently being traversed in the corresponding attribute field cells, and take the arithmetic mean of the non-zero components of each weight vector to obtain the field average weight of that field.

[0124] The arithmetic mean of the average weights of all attribute fields involved in the currently traversed candidate triples is taken and used as the source confidence label, which is then appended to the candidate triples. The source confidence label has a value range of 0 to 1.

[0125] After traversing all candidate triples, output the updated set of candidate triples for asset association relationships.

[0126] Source credibility annotation propagates the weight vector from the temporally aligned asset attribute fusion table to candidate triples, ensuring that the relationships inferred by the large language model carry a quantitative label linked to the credibility of the data source before entering the knowledge graph. In multi-source temporal inconsistencies, if candidate triples do not carry source credibility annotations, relationships inferred from lagging low-confidence attributes and those inferred from real-time high-confidence attributes cannot be distinguished in the graph. The former will participate in attack surface path reasoning with equal weight, amplifying the risk of false positives. After the source credibility annotation is propagated layer by layer along the weight vector, S5 can assign weights to edges and divide virtual edges accordingly, providing a quantitative basis for the traceability of attack surface risk conclusions.

[0127] S5: Construct an asset knowledge graph based on the candidate triplet set of asset associations, perform graph traversal reasoning on the asset knowledge graph to discover hidden risk paths, and output attack surface risk assessment results by combining threat intelligence data.

[0128] The set of candidate triples for asset associations already carries source credibility labels, but the associations still exist in the form of discrete triples and have not yet been organized into a graph structure for executable path reasoning, nor are they associated with currently active threat intelligence. Alerts for a single association or a single asset dimension cannot discover attack chains composed of cross-asset portfolios. This step constructs an asset knowledge graph and performs cross-node graph traversal reasoning and threat intelligence matching, outputting attack surface risk assessment results.

[0129] Further, step S5 includes: S51: Construct an asset knowledge graph with asset entities as nodes, the relationship type and direction of candidate triples as directed edges, and the source credibility label as edge weights. Candidate triples with source credibility labels below the lower confidence limit are included as virtual edges and marked as edges to be confirmed.

[0130] The set of candidate triples for asset associations includes both high-confidence and low-confidence associations. If low-confidence associations are discarded directly, potential risk clues will be lost; if they are treated equally without distinction, low-confidence associations will pollute the main path reasoning. This step distinguishes between the two types of associations through a virtual edge mechanism.

[0131] Specifically, an asset knowledge graph is constructed using the physical identifier of the asset as the graph node, the association type and association direction of each candidate triple as the directed edge, and the source credibility label as the edge weight of the directed edge. The asset knowledge graph is a directed weighted graph, and the node attributes are inherited from the attribute fields of the corresponding asset entity in the temporally aligned asset attribute fusion table.

[0132] A preset confidence threshold is defined, which is directly taken as the low confidence threshold preset in step S31. For example, the confidence threshold is set to 0.3.

[0133] Candidate triples whose source credibility is labeled at or above the lower confidence limit are included in the asset knowledge graph as real edges; candidate triples whose source credibility is labeled below the lower confidence limit are included in the asset knowledge graph as virtual edges and marked as edges to be confirmed. Edges to be confirmed do not participate in the main path calculation of S52.

[0134] The virtual edge retention mechanism in S51, along with the main path calculation in S52 and the pending confirmation prompt output in S54, constitute a collaborative mechanism. These three mechanisms work together to balance risk coverage and conclusion credibility. S51 ensures that the asset knowledge graph simultaneously includes a high-confidence main graph structure composed of real edges and a low-confidence pending confirmation structure composed of virtual edges. If only real edges are retained and virtual edges are discarded, potential extension paths derived from lagging or weak associations will be completely lost. While ensuring the credibility of the main path, the system loses its ability to cover hidden risk clues. If real and virtual edges are not distinguished and all are included in the main path calculation, low-credibility associations will participate in path expansion on an equal footing with high-credibility associations. This causes the attack paths matched by S53 to be mixed with false paths supported by low-credibility edges, reintroducing false warnings. The collaboration of the two types of edge structures ensures that the main path reasoning in S52 extends only along the real edges to guarantee the credibility of the conclusion. Meanwhile, the virtual edges in S54 serve as confirmation prompts without losing risk clues. The two requirements of main path credibility and risk clue coverage are simultaneously satisfied in the same graph structure. Without the virtual edge mechanism, risk clues are lost, and without the distinction between real and virtual edges, the credibility of the conclusion decreases.

[0135] S52: Perform a directed graph depth-first traversal on the asset knowledge graph, expanding layer by layer along directed edges whose weights are higher than the traversal confidence threshold, recording all internal asset nodes reachable from each exposed surface node and their corresponding paths, and generating a set of exposed surface reachable paths.

[0136] After the asset knowledge graph is constructed, it is necessary to trace the reachable internal assets starting from the externally exposed assets to characterize the lateral movement range of an attacker after entering from the outside. This step generates reachable paths through depth-first traversal.

[0137] Specifically, an exposed surface node is defined as an asset entity node in the asset knowledge graph that has externally open ports or services. The criteria for determining an exposed surface node are that the port list in the node attributes contains externally open ports or that the network area to which it belongs is identified as an externally reachable area.

[0138] A preset traversal confidence threshold is defined as the lowest allowed edge weight during the traversal process. This threshold is determined by taking the arithmetic mean of the confidence lower bound and the baseline value. For example, the traversal confidence threshold is... .

[0139] Starting from each exposed surface node, perform a directed graph depth-first traversal, expanding layer by layer only along real edges whose weights are higher than the traversal confidence threshold, and record all internal asset nodes reachable from the current exposed surface node and the reaching paths, where the reaching paths are node sequences.

[0140] All reachable paths to exposed surface nodes are aggregated to generate a set of reachable paths to exposed surfaces, which is a list of node sequences.

[0141] S53: Extract currently active vulnerability exploitation features from threat intelligence data, progressively match the attack chain step sequence with the path node attributes in the set of accessible paths on the exposed surface, identify paths that can be fully mapped, and mark them as high-risk attack paths.

[0142] The set of reachable paths on the exposure surface characterizes topological reachability, but topological reachability does not equate to actual exploitability. It is necessary to combine this with currently active threat intelligence to determine whether a path poses a real risk of being exploited by an attack chain. This step maps the attack chain sequence to path node attributes.

[0143] Specifically, the characteristics of currently active vulnerability exploits are extracted from threat intelligence data. The threat intelligence data is obtained from the threat intelligence interface of the situational awareness platform. The characteristics of currently active vulnerability exploits include vulnerability number, affected component version range, and attack chain step sequence. The attack chain step sequence is a list of step conditions arranged in the order of attack. Each step condition describes the component version or port condition required for that step.

[0144] For each path in the set of reachable paths of the exposed surface, the step conditions in the attack chain step sequence are matched step by step with the attribute fields of the path nodes in the order of the path nodes. The matching is to determine whether the component version required for the current step condition falls into the node component version number and whether the required port is included in the node port list.

[0145] If all the step conditions in an attack chain sequence can be completely mapped along consecutive nodes of a path, then that path is marked as a high-risk attack path, and all high-risk attack paths are aggregated into a high-risk attack path list. See also Figure 9 This is a schematic diagram of real-edge and virtual-edge attack chain matching for the asset knowledge graph provided in this application embodiment. For example... Figure 9As shown, the upper dashed box contains the attack chain sequence, consisting of three horizontally connected step blocks. Each step is connected to a path node in the high-risk attack path in the middle via a downward-pointing line. The middle section consists of exposed surface nodes and two internal asset nodes connected step-by-step by bold solid edges to form a high-risk attack path. The lower section shows internal asset nodes connected by dashed arrows marked as dashed edges or edges awaiting confirmation, extending downwards to form potential extended path branches. This diagram illustrates the process of constructing an asset knowledge graph using asset entities as nodes and directed edges representing relationship types and directions, and then progressively matching the attack chain sequence along the path nodes. The main path reasoning only extends along solid edges to ensure the reliability of the conclusion, while dashed edges serve as outputs for confirmation without losing risk clues. This fundamentally overcomes the deficiency of single-asset dimension threat matching in discovering cross-asset collaborative attack paths.

[0146] S53 maps the attack chain sequence of threat intelligence to path node attributes rather than single asset attributes, enabling a single attack chain to achieve a complete match across multiple asset nodes. In enterprise attack surface management scenarios, attributes on a single asset dimension often only satisfy part of the attack chain without triggering alerts. For example, an exposed surface node may only satisfy the port condition of the first step in the attack chain, and an internal node may only satisfy the component version condition of subsequent steps. If threat intelligence is matched one by one according to a single asset dimension, no single asset constitutes a complete attack chain and is judged as low risk, thus missing cross-asset collaborative attack paths. By using path node sequences as the matching object, the continuous nodes along the path of the attack chain sequence are mapped step by step. The combination of the first step condition matching an exposed surface node and subsequent conditions matching an internal node can be identified as a complete attack chain, fundamentally overcoming the deficiency of single-asset dimension threat matching in failing to discover cross-asset collaborative attack paths.

[0147] S54: For each node on a high-risk attack path, summarize the average confidence level of the validity of the corresponding asset entity and the average confidence level of the source, calculate the overall risk confidence level of the node, and generate the attack surface risk assessment results by sorting the nodes according to their overall risk confidence levels.

[0148] The list of high-risk attack paths has identified truly exploitable paths, but the risk credibility of each node on the path still varies. It is necessary to quantify the overall risk confidence of each node to support the assessment and handling decisions of operations personnel. This step calculates the overall risk confidence of each node and generates the final assessment result.

[0149] Specifically, for each node in the high-risk attack path list, the validity confidence of the source records of each attribute field of the corresponding asset entity is obtained from S31 and the arithmetic mean is taken to obtain the validity confidence mean; the source credibility label of the candidate triple involved in the node is obtained from S44 and the arithmetic mean is taken to obtain the source credibility label mean.

[0150] Calculate the overall risk confidence of the nodes using the following formula: in The mean of the validity confidence level. The average value is used to indicate the credibility of the source. The method for determining the tradeoff coefficient is as follows: using historically confirmed high-risk nodes as the target variable, and using the mean of the validity confidence level and the mean of the source credibility label as independent variables to construct a regression matrix, the solution with the smallest sum of squared residuals is taken as the tradeoff coefficient. For example, the tradeoff coefficient is 0.6.

[0151] The design principle of the node comprehensive risk confidence calculation formula is as follows: the mean validity confidence reflects whether the node attribute describes the current true state in time sequence, and the mean source credibility label reflects whether the data source on which the node association is based is credible. The two items respectively characterize the credibility of node risk from the two dimensions of temporal validity and source credibility. The use of weighted summation instead of product is to avoid the comprehensive confidence being excessively suppressed when either item is low. The tradeoff coefficient is biased towards the mean validity confidence because whether the attribute describes the current state is more decisive for risk assessment in the case of temporal contradictions. When the node attribute is fused from the real-time record after the change and the association is inferred from the high credibility attribute, both items being high will make the node comprehensive risk confidence approach 1.

[0152] All nodes in the high-risk attack path list are sorted from high to low according to their overall risk confidence, and an attack surface risk assessment result is generated. The attack surface risk assessment result includes the high-risk attack path list, the overall risk confidence of each path node, and the potential extended path hints involved by the S51 unconfirmed edge.

[0153] The security operations platform executes response measures based on the attack surface risk assessment results: when a high-risk attack path exists where the overall risk confidence of a node exceeds the response trigger threshold, a port blocking or traffic blocking command for the corresponding exposed node is issued to the boundary protection device via the industrial communication bus or security orchestration interface; the response trigger threshold is determined by taking the arithmetic mean of a base value and 1, with an example response trigger threshold of... When dealing with potential extended paths involved in confirmation prompts, the security operations platform does not directly issue blocking commands, but instead pushes them to security operations personnel for manual verification to avoid false blocking of normal business triggered by low-confidence clues.

[0154] This embodiment forms a complete confidence propagation chain from data acquisition temporal information to the final attack surface risk conclusion: the temporal stamp and entity identification code of S1 provide the basis for record-by-record temporal indexing of S2; the temporal offset quantization matrix and state change anchor point set of S2 jointly drive the validity confidence calculation of S3; the distribution of validity confidence determines the selection of the three-branch fusion path of S3; the fusion path selection result is transmitted to the source confidence labeling of S4 through the weight vector of S33; the source confidence labeling is then transmitted to the edge weight assignment and virtual edge partitioning of S5; S4 uses a large language model to infer implicit associations so that the knowledge graph can cover deep semantic associations that cannot be found by structured field matching; the virtual edge retention mechanism and cross-node attack chain matching mechanism of S5 work together to ensure the credibility of the output conclusion while taking into account the ability to discover hidden risk clues, thus avoiding false warnings and false blocking caused by temporal contradictions of multi-source data from the root.

[0155] Example 2: This embodiment, based on Embodiment 1, provides a generative artificial intelligence asset intelligence multi-source fusion analysis system, such as... Figure 10 As shown, it includes: The data normalization module is used to collect multi-source raw asset data from multiple data interfaces, perform temporal annotation and multi-granularity entity normalization processing on the multi-source raw asset data, and obtain a normalized asset record set. The time-series offset quantization module is used to build an index based on the normalized asset record set, quantize the time window misalignment driven by the differences in the frequency of multi-source collection and state change events, and obtain the time-series offset quantization matrix and the set of state change anchor points between each data source pair. The conditional branch fusion module is used to calculate the validity confidence of each record in the normalized asset record set based on the temporal offset quantization matrix and the state change anchor point set, perform conditional branch fusion based on the validity confidence, and output a temporal aligned asset attribute fusion table. The implicit relationship inference module is used to infer the implicit relationship between asset entities using the temporally aligned asset attribute fusion table as input and a large language model to obtain a set of candidate triplets for asset relationship; The risk assessment result output module is used to construct an asset knowledge graph based on the set of candidate triples of asset association, perform graph traversal reasoning on the asset knowledge graph to discover hidden risk paths, and output attack surface risk assessment results in combination with threat intelligence data.

Claims

1. A generative artificial intelligence asset intelligence multi-source fusion analysis method, characterized in that, include: Multi-source raw asset data is collected from multiple data interfaces, and temporal annotation and multi-granularity entity normalization are performed on the multi-source raw asset data to obtain a normalized asset record set. An index is constructed based on the normalized asset record set. Quantization is performed on the time window misalignment driven by the differences in the collection frequency of multiple sources and the state change event to obtain the time offset quantization matrix and the set of state change anchor points between each data source pair. Based on the temporal offset quantization matrix and the state change anchor point set, calculate the validity confidence score for each record in the normalized asset record set, perform conditional branch fusion based on the validity confidence score, and output the temporal aligned asset attribute fusion table; Using the temporally aligned asset attribute fusion table as input, the implicit relationships between asset entities are inferred using a large language model to obtain a set of candidate triples for asset relationships; An asset knowledge graph is constructed based on the set of candidate triples for asset associations. Graph traversal reasoning is performed on the asset knowledge graph to discover hidden risk paths. Attack surface risk assessment results are output in combination with threat intelligence data.

2. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 1, characterized in that, The process of performing temporal annotation and multi-granularity entity normalization on multi-source original asset data to obtain a normalized asset record set includes: Raw data is retrieved from the endpoint security management system, cloud platform asset center, vulnerability scanning system, penetration testing interface, situational awareness platform, and perimeter protection equipment. A tuple is appended to each record according to the data source type and retrieval time to obtain the multi-source raw asset data. The tuple contains the data source type code and the collection timestamp. Perform multi-granularity entity normalization on the asset identifier field in the multi-source original asset data to obtain the normalized identifier vector of each identifier dimension layer; The normalized identifier vector is concatenated with the tuple to generate a globally unique entity identifier code for each record. The entity identifier code and the acquisition timestamp are then attached to the record as a temporal stamp, and a normalized asset record set carrying the temporal stamp and the entity identifier code is output.

3. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 2, characterized in that, The step of performing multi-granularity entity normalization on the asset identifier field in the multi-source original asset data to obtain the normalized identifier vector for each identifier dimension layer includes: Four identification dimension layers are predefined: IP address dimension layer, hostname dimension layer, instance ID dimension layer, and MAC address dimension layer; For each record in the multi-source original asset data, the asset identification field of the record is filled into the corresponding identification dimension layer according to the type. Missing fields in each identification dimension layer are filled with placeholders, and fields with format differences are uniformly converted into standard formats. The values ​​of the four identifier dimensions are concatenated in a fixed order into a quadruple string vector to obtain the normalized identifier vector of the record.

4. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 1, characterized in that, The obtained temporal offset quantization matrix and state change anchor point set between each data source pair include: Group the asset physical identifier substring in the entity identifier code from the normalized asset record set, extract the collection timestamp sequence of the same asset under each data source, calculate the median collection cycle difference between each pair of data sources, and generate the data source collection cycle difference matrix. In the normalized asset record set, the location where the asset configuration field changes between adjacent collection records within each data source under the same asset physical identifier is detected. After aggregating the candidate change anchor points, the status change anchor points are obtained. All change anchor points are then gathered to obtain the status change anchor set. Using the data source acquisition period difference matrix and the set of state change anchor points as joint inputs, the difference between the acquisition timestamp of each data source record and the time of the most recent state change anchor point is calculated within a time window near each state change anchor point for each data source pair. The time offset of all data source pairs at all anchor points is organized into the time offset quantization matrix.

5. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 4, characterized in that, The process of aggregating candidate change anchor points to obtain state change anchor points includes: For all records corresponding to each asset physical identifier, group them by data source type code and sort them in ascending order by collection timestamp within the group. Compare the asset configuration fields of two adjacent records within the same data source one by one. If any field in the port list, component version number, or protection policy identifier of two adjacent records within the same data source has a different value, the arithmetic mean of the collection timestamps of the two adjacent records within the data source group is taken as the candidate change anchor time of the data source. Candidate anchor points under the same asset physical identifier whose absolute value of the difference in time does not exceed the maximum value of the median collection period of all data sources are aggregated. The arithmetic mean of the times of each candidate anchor point in the aggregated cluster is taken as the final state change anchor point time. For isolated candidate anchor points, their candidate anchor points are retained as the final state change anchor point time.

6. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 1, characterized in that, The conditional branch fusion based on the validity confidence level, and the output of the temporally aligned asset attribute fusion table, include: For all source records corresponding to the same asset physical identifier, when there is a record with a validity confidence level not lower than the benchmark value, the asset configuration field of each record is weighted and fused. When the confidence level of the validity of all source records is lower than the low confidence threshold, the asset configuration field corresponding to the physical identifier of the asset is marked as pending verification and will not participate in subsequent fusion. When each validity confidence level spans between the benchmark value and the low confidence threshold, the asset configuration field of the single-source record with the highest validity confidence level is used as the representative value, and the asset configuration fields of the remaining records are retained in the form of copies. The output of conditional branch fusion is organized into a two-dimensional table according to the asset entity. The weight vector of each source record used to generate the value of the field is attached to each attribute field cell to obtain the temporally aligned asset attribute fusion table.

7. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 1, characterized in that, The calculation of the validity confidence level for each record in the normalized asset record set includes: Query the signed offset value at the corresponding data source and the corresponding anchor point in the time series offset quantization matrix. If the signed offset value is negative and its absolute value is less than or equal to the median acquisition period of the data source, calculate the validity confidence as a decay value that is inversely proportional to the absolute value of the signed offset value. If the signed offset value is positive and less than or equal to the median acquisition period of the data source, the validity confidence level is set as the baseline value; If the absolute value of the signed offset is greater than the median acquisition period of the data source, the validity confidence level is set as the penalty value. When the corresponding position of the time-series offset quantization matrix is ​​null, null compensation is triggered. The negative value of half of the acquisition period in the data source is used as the interpolated signed offset value and substituted into the calculation of the validity confidence.

8. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 1, characterized in that, The method of using a large language model to infer the implicit relationships between asset entities yields a candidate set of asset relationship triples, including: Extract the set of attribute fields for each asset entity from the temporally aligned asset attribute fusion table, and serialize the set of attribute fields into structured text as context input for the large language model; An inference task is submitted to the large language model, which outputs an estimate of the relationship type, relationship direction, and relationship strength for each pair of asset entities. The three factors constitute a candidate triplet. All candidate triples are parsed from the output of the large language model, and candidate triples whose association strength estimates are lower than a preset screening threshold are filtered out. The remaining candidate triples are then aggregated into a set of candidate triples for the asset association relationship.

9. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 8, characterized in that, After aggregating the remaining candidate triples into the set of candidate triples for asset association relationships, the method further includes: For each candidate triple in the set of candidate triples for asset association relationships, query the weight vector of the corresponding attribute field in the temporal aligned asset attribute fusion table; The average weight of a field is obtained by taking the arithmetic mean of the non-zero components of each weight vector. The arithmetic mean of the average weights of all attribute fields involved in the currently traversed candidate triples is taken as the source credibility label of the candidate triples and attached to the candidate triples, thus updating the set of candidate triples for asset association relationships.

10. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 1, characterized in that, The step of performing graph traversal reasoning on the asset knowledge graph to discover hidden risk paths includes: The asset knowledge graph is constructed using asset entities as nodes, the association type and direction of candidate triples as directed edges, and the source credibility label as edge weights. Candidate triples with source credibility labels lower than the lower confidence limit are included in the form of virtual edges and marked as edges to be confirmed. A directed graph depth-first traversal is performed on the asset knowledge graph, expanding layer by layer along directed edges whose weights are higher than the traversal confidence threshold to generate a set of reachable paths to exposed surfaces. The attack chain steps are extracted from the threat intelligence data and matched step by step with the path node attributes in the set of accessible paths on the exposure surface. Paths that can be fully mapped are identified and marked as high-risk attack paths.

11. The generative artificial intelligence asset intelligence multi-source fusion analysis method according to claim 1, characterized in that, The attack surface risk assessment results output by combining threat intelligence data include: For each node on a high-risk attack path, the average confidence level of the validity of the corresponding asset entity and the average source credibility label are summarized. The mean of the validity confidence score and the mean of the source credibility label are weighted and summed according to the trade-off coefficient to calculate the node comprehensive risk confidence score. All nodes are sorted from high to low according to their overall risk confidence, and an attack surface risk assessment result is generated, which includes a list of high-risk attack paths, the overall risk confidence of each node, and hints of potential extended paths involved in the edges to be confirmed.

12. A generative artificial intelligence asset intelligence multi-source fusion analysis system, used to implement the generative artificial intelligence asset intelligence multi-source fusion analysis method according to any one of claims 1 to 11, characterized in that, The system includes: The data normalization module is used to collect multi-source raw asset data from multiple data interfaces, perform temporal annotation and multi-granularity entity normalization processing on the multi-source raw asset data, and obtain a normalized asset record set. The time-series offset quantization module is used to build an index based on the normalized asset record set, perform quantization on the time window misalignment driven by the differences in the frequency of multi-source collection and state change events, and obtain the time-series offset quantization matrix and the set of state change anchor points between each data source pair. The conditional branch fusion module is used to calculate the validity confidence of each record in the normalized asset record set based on the temporal offset quantization matrix and the state change anchor point set, perform conditional branch fusion based on the validity confidence, and output a temporal aligned asset attribute fusion table. The implicit relationship inference module is used to infer the implicit relationship between asset entities using the temporally aligned asset attribute fusion table as input and a large language model to obtain a set of candidate triplets for asset relationship; The risk assessment result output module is used to construct an asset knowledge graph based on the set of candidate triples of asset association, perform graph traversal reasoning on the asset knowledge graph to discover hidden risk paths, and output attack surface risk assessment results in combination with threat intelligence data.

Images