An artificial intelligence-based cross-platform network security threat intelligent early warning system

Abstract

The application discloses an intelligent early warning system for cross-platform network security threats based on artificial intelligence, which comprises a data acquisition module, a data standardization module, a feature extraction module, a threat detection module, an attack chain restoration module and an early warning generation module. The data acquisition module collects security data of each platform through acquisition agents deployed on different platforms; the data standardization module unifies the format and aligns the semantics of heterogeneous security data; the feature extraction module extracts multi-dimensional threat features; the threat detection module cooperatively detects based on multiple artificial intelligence models, and identifies isolated threat events in each local platform; the attack chain restoration module cross-platformally connects isolated threat events in time sequence and causal correlation, and restores complete attack chains; and the early warning generation module generates early warning information containing attack full paths according to the complete attack chains, replacing local alarms of each platform. The application solves the technical problem that attack chains cannot be completely restored in cross-platform springboard attacks.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and more specifically to a cross-platform intelligent early warning system for network security threats based on artificial intelligence. Background Technology

[0002] In recent years, with the deep integration and development of cloud computing, the Internet of Things, and mobile internet, the network environment has evolved into a complex mega-system with multiple sources and heterogeneity. The security data generated by different network security platforms suffers from fundamental data heterogeneity in terms of protocol standards, format definitions, and semantic expressions, posing a severe challenge to global network security situational awareness.

[0003] Currently, mainstream cybersecurity threat early warning systems typically employ an independently deployed, vertically-responding operational model. For each specific cybersecurity platform, the system deploys dedicated data collection probes and independent rule-matching engines or single-task machine learning models. Each probe only collects exclusive logs and traffic data within its respective platform, which are then analyzed and anomaly detected by the local engine. If a preset threshold is triggered or a known malicious signature is matched, a single-point alert event is generated within that local system, ultimately handled separately by security personnel on each platform. However, when attackers exploit cross-platform data semantic differences to launch springboard attacks, each local system can only detect isolated anomalies, failing to correlate attack behaviors scattered across different platforms into a complete attack chain. The direct consequence is that a massive number of low-value single-point alerts overwhelm the real threat, making it difficult for the system to effectively identify and warn of advanced persistent threats across platforms, significantly weakening the overall early warning capability. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent early warning system for cross-platform cybersecurity threats based on artificial intelligence, in order to solve the technical problem that when attackers launch springboard attacks by taking advantage of cross-platform data semantic differences, each local system can only detect isolated abnormal fragments and cannot associate attack behaviors scattered across different platforms into a complete attack chain.

[0005] The technical solution of this invention is implemented as follows:

[0006] An AI-based cross-platform intelligent early warning system for cybersecurity threats includes:

[0007] The data acquisition module is used to collect security data from different network security platforms through acquisition agents deployed on different network security platforms.

[0008] The data standardization module is used to unify the format and align the semantics of heterogeneous security data collected from various platforms, generating standardized security data.

[0009] The feature extraction module is used to extract multi-dimensional threat features from the standardized security data;

[0010] The threat detection module is used to collaboratively detect the multi-dimensional threat features based on multiple artificial intelligence models and identify isolated threat events within each local platform.

[0011] The attack chain reconstruction module is used to connect the isolated threat events detected by each local platform in chronological order and causal relationship across platforms to reconstruct the complete cross-platform attack chain.

[0012] The early warning generation module is used to generate early warning information including the full attack path information based on the complete cross-platform attack chain, in order to replace the local alarms issued separately by each platform.

[0013] A further technical solution is that the data acquisition module includes:

[0014] The plugin management submodule is used to store and manage data collection plugins corresponding to various types of network security platforms, and to distribute collection plugins corresponding to the type of the target platform to the collection agent deployed on the target platform according to the type of the target platform to be collected.

[0015] The protocol adaptation submodule is used to identify the transmission protocol type used by the security data of each platform, and load the protocol parser corresponding to the identified transmission protocol type to establish a data flow channel with each platform.

[0016] The data acquisition and scheduling submodule is used to dynamically adjust the data acquisition frequency and granularity of each platform based on the network bandwidth and data processing capabilities of each platform.

[0017] The data preprocessing submodule is used to perform preliminary filtering and desensitization processing on the raw security data collected at the acquisition agent end, and transmit the processed data to the data standardization module through an encrypted channel.

[0018] A further technical solution is that the plug-in management submodule includes:

[0019] The plug-in storage unit is used to classify and store multiple data acquisition plug-ins according to platform type, and to configure a corresponding platform type label for each data acquisition plug-in.

[0020] The platform identification unit is used to identify the type information of the target platform for the security data to be collected.

[0021] The version management unit is used to manage the version information of each data acquisition plugin and send an update notification to the acquisition agent when a new version of the data acquisition plugin is detected.

[0022] The execution unit is used to search for the data acquisition plugin corresponding to the platform type tag that matches the type information in the plugin storage unit based on the type information identified by the platform identification unit, and to send the data acquisition plugin to the acquisition agent deployed on the target platform.

[0023] A further technical solution is that the threat detection module includes:

[0024] The feature distribution submodule is used to distribute the multi-dimensional threat features to each of the artificial intelligence models;

[0025] The parallel detection submodule is used to enable each of the aforementioned artificial intelligence models to run in parallel, independently detect the received multi-dimensional threat features, and generate their respective local detection results.

[0026] The result fusion submodule is used to receive the local detection results output by each of the artificial intelligence models, and to perform weighted fusion of the local detection results to generate a comprehensive threat detection result.

[0027] The collaborative scheduling submodule is used to monitor the running status and detection confidence of each of the artificial intelligence models, and dynamically adjust the collaborative strategy between the artificial intelligence models based on the running status and detection confidence.

[0028] A further technical solution is that the result fusion submodule includes:

[0029] The input parsing unit is used to receive the local detection results output by each of the artificial intelligence models, and extract threat category labels, confidence scores and model identifiers from each of the local detection results;

[0030] The confidence correction unit is used to correct the confidence scores of each artificial intelligence model based on the historical detection accuracy of each model, and generate the confidence coefficient of each artificial intelligence model.

[0031] The dynamic weight allocation unit is used to normalize each credibility coefficient according to the dynamic credibility weighted fusion algorithm, and to allocate fusion weights to each artificial intelligence model according to the normalized credibility coefficients, wherein the fusion weights are positively correlated with the credibility coefficients.

[0032] The weighted fusion execution unit is used to perform a weighted summation of the detection scores of each of the artificial intelligence models according to the fusion weights, and generate the comprehensive threat detection result.

[0033] A further technical solution is that the dynamic weight allocation unit includes:

[0034] The basic probability assignment subunit is used to construct a basic probability assignment function for each of the artificial intelligence models based on the credibility coefficient of each model and the local detection results.

[0035] The evidence synthesis subunit is used to perform pairwise iterative synthesis of the basic probability assignment functions of each of the artificial intelligence models according to the synthesis rules of DS evidence theory, so as to generate a fused basic probability assignment function.

[0036] The conflict detection subunit is used to detect the degree of conflict between the two basic probability assignment functions participating in the synthesis during the pairwise iterative synthesis process of the evidence synthesis subunit. When the degree of conflict exceeds a preset threshold, the two basic probability assignment functions are reassigned.

[0037] The fusion decision subunit is used to determine the final comprehensive threat category and comprehensive threat confidence level according to the fusion basic probability assignment function and preset decision rules.

[0038] A further technical solution is that the attack chain reconstruction module includes:

[0039] The time alignment submodule is used to convert the timestamps of each isolated threat event into a unified time base, and sort each isolated threat event according to the unified time base to generate a time-series event sequence.

[0040] The causal correlation submodule is used to extract the attack characteristics of each isolated threat event, calculate the causal correlation degree between any two isolated threat events based on the attack characteristics, and establish a causal correlation edge between the two isolated threat events when the causal correlation degree exceeds a preset threshold.

[0041] The path search submodule is used to construct a cross-platform attack graph with each isolated threat event as a node and the causal relationship edge as an edge, and to search for the complete path from the initial intrusion node to the final attack target node from the cross-platform attack graph.

[0042] The chain filtering submodule is used to perform causal logic verification on the complete path, and output the complete path that passes the verification as the complete cross-platform attack chain to the warning generation module.

[0043] A further technical solution is that the causal correlation submodule includes:

[0044] An attack feature extraction unit is used to extract multi-dimensional attack features from each of the isolated threat events and generate an event feature vector for each of the isolated threat events. The multi-dimensional attack features include attack source address, attack target address, attack method type, attack resource consumption mode, and attack payload features.

[0045] The cross-event association calculation unit is used to calculate the association weight between any two isolated threat events by taking the event feature vector of each isolated threat event as input and using an attention mechanism. The association weight is used to characterize the degree of matching between the two isolated threat events in attack semantics.

[0046] The causal determination unit is used to determine the causal correlation degree between any two isolated threat events based on the correlation weight and the preset causal determination rule, and to determine whether to establish a causal correlation edge based on the relationship between the causal correlation degree and the preset threshold.

[0047] The associated edge annotation unit is used to annotate the established causal associated edges with attributes, including attack direction, attack method evolution relationship and attack time interval.

[0048] A further technical solution is that the path search submodule includes:

[0049] The attack graph construction unit is used to construct a cross-platform attack graph using each of the isolated threat events as nodes and the causal relationship edges as edges.

[0050] The attack entry identification unit is used to identify nodes with an in-degree of zero as initial intrusion nodes and nodes with an out-degree of zero as final attack target nodes from the cross-platform attack graph.

[0051] The path search unit is used to traverse all reachable paths in the cross-platform attack graph using a depth-first search algorithm, starting from the initial intrusion node and ending at the final attack target node, and to calculate the path confidence of each reachable path.

[0052] The optimal path determination unit is used to sort all the reachable paths according to the path confidence, and select the reachable path with the highest path confidence as the complete path output.

[0053] A further technical solution is that the early warning generation module includes:

[0054] The attack chain parsing submodule is used to parse the complete cross-platform attack chain and extract the platform information, attack time nodes and attack method types involved in each attack link;

[0055] The early warning and classification submodule is used to calculate the threat level score based on the length of the attack chain, the number of platforms involved, and the complexity of the attack method, and to determine the early warning level based on the threat level score.

[0056] The cross-platform alarm suppression submodule is used to generate alarm suppression instructions based on each isolated threat event included in the complete cross-platform attack chain. The alarm suppression instructions are used to suppress local alarms issued individually by each local platform for the isolated threat event.

[0057] The warning content generation submodule is used to generate cross-platform warning information, including the initial intrusion point, attack propagation path, attack methods at each stage, and final attack target, based on the complete cross-platform attack chain and the warning level.

[0058] The beneficial effects of this invention are as follows:

[0059] The cross-platform, multi-source heterogeneous data acquisition module enables unified data collection from various network security platforms, including cloud platforms, enterprise intranets, IoT, and mobile terminals, overcoming the data isolation issues inherent in traditional solutions. The data standardization module unifies the format and aligns the semantics of heterogeneous data, providing a foundation for cross-platform correlation analysis of security data that was previously incompatible due to differences in protocol standards and field definitions. This provides data support for subsequent cross-platform attack chain reconstruction. The feature extraction and threat detection modules utilize a multi-AI model collaborative detection mechanism to effectively identify isolated threat events within each local platform, avoiding missed detections due to insufficient detection capabilities of a single model. The attack chain reconstruction module connects isolated threat events detected by each local platform according to chronological order and causal relationships, reconstructing a complete cross-platform attack chain, allowing security operations personnel to clearly understand the entire attack evolution process. The early warning generation module generates early warning information containing the entire attack path, replacing individual platform-issued local alerts. This effectively reduces the interference of massive amounts of low-value alerts on security personnel and improves security operation efficiency. Attached Figure Description

[0060] Figure 1 The present invention provides a flowchart of a cross-platform intelligent early warning system for cybersecurity threats based on artificial intelligence. Detailed Implementation

[0061] To better understand the technical content of this invention, specific embodiments are provided below, and the invention will be further described in conjunction with the accompanying drawings.

[0062] See Figure 1This invention provides an AI-based cross-platform intelligent early warning system for cybersecurity threats, comprising a data acquisition module, a data standardization module, a feature extraction module, a threat detection module, an attack chain reconstruction module, and an early warning generation module. The data acquisition module collects security data from various cybersecurity platforms through acquisition agents deployed on different platforms. The acquisition agents adopt a plug-in architecture, deploying corresponding acquisition agent programs for different platforms such as cloud platforms, enterprise intranets, IoT gateways, and mobile terminals. The types of security data collected by each acquisition agent include network traffic data, system log data, terminal behavior data, application access data, and external threat intelligence data. The collected data is transmitted to the data standardization module. The data standardization module unifies the format and aligns the semantics of the heterogeneous security data collected from various platforms, generating standardized security data.

[0063] Specifically, the data standardization module converts all security data of different formats generated by different platforms into a unified intermediate data format, maps fields from different data sources to corresponding fields in a unified data model, and performs time synchronization and spatial coordinate alignment. The feature extraction module extracts multi-dimensional threat features from the standardized security data, including traffic features, behavioral features, temporal features, and statistical features. The threat detection module uses multiple artificial intelligence models to collaboratively detect multi-dimensional threat features and identify isolated threat events within each local platform. The attack chain reconstruction module connects isolated threat events detected by each local platform according to time sequence and causal relationships across platforms to reconstruct a complete cross-platform attack chain. The early warning generation module generates early warning information including full attack path information based on the complete cross-platform attack chain, replacing the local alerts issued individually by each platform.

[0064] Taking a real-world cross-platform hop attack as an example, the attacker's attack path was as follows: First, they compromised an IoT camera device on a company's office network, using this device as a hop to move laterally to the company's intranet OA server. Then, through intranet penetration, they ultimately accessed the core business database on the cloud platform to steal sensitive data. Throughout the attack, the security systems of the IoT platform, the company's intranet platform, and the cloud platform, each operating independently, detected different anomalies. The IoT platform detected abnormal SSH login activity from the camera device at 2:15 AM; the company's intranet platform detected abnormal remote command execution activity from the OA server at 2:23 AM; and the cloud platform detected abnormal sensitive data query activity from the database at 2:30 AM. However, each of the three platforms issued alerts independently, and no single system could correlate these three scattered anomalies into a complete attack.

[0065] Furthermore, the data acquisition module includes a plugin management submodule, a protocol adaptation submodule, an acquisition scheduling submodule, and a data preprocessing submodule. The plugin management submodule stores and manages data acquisition plugins corresponding to various types of network security platforms, and, based on the type of the target platform for the security data to be collected, distributes the acquisition plugins corresponding to the target platform type to the acquisition agent deployed on the target platform.

[0066] Specifically, the plugin management submodule includes a plugin storage unit, a platform identification unit, a version management unit, and a distribution execution unit. The plugin storage unit categorizes and stores multiple data acquisition plugins according to platform type, and configures a corresponding platform type tag for each plugin. For example, it configures an IoT log acquisition plugin for an IoT platform, a Syslog acquisition plugin for an enterprise intranet platform, and a cloud monitoring API acquisition plugin for a cloud platform. The platform identification unit identifies the type information of the target platform for the security data to be collected. When the acquisition agent is deployed on an IoT camera device, the platform identification unit identifies the platform as an IoT platform. The version management unit manages the version information of each data acquisition plugin and sends an update notification to the acquisition agent when a new version of the data acquisition plugin is detected. The distribution execution unit, based on the type information identified by the platform identification unit, searches the plugin storage unit for the data acquisition plugin corresponding to the platform type tag that matches the type information, and distributes the data acquisition plugin to the acquisition agent deployed on the target platform, such as distributing an IoT log acquisition plugin to an IoT camera device. The protocol adaptation submodule identifies the transmission protocol type used for security data on each platform and loads the corresponding protocol parser to establish a data flow channel between the platform and the platform. For example, if the IoT platform uses the MQTT protocol, the MQTT protocol parser is loaded. The data acquisition and scheduling submodule dynamically adjusts the data acquisition frequency and granularity for each platform based on its network bandwidth and data processing capabilities. When the enterprise intranet bandwidth occupancy exceeds 80%, the acquisition frequency is adjusted from once per second to once every five seconds. The data preprocessing submodule performs preliminary filtering and anonymization on the raw security data collected at the acquisition agent end. For example, it filters out normal system heartbeat logs, retaining only security-related logs such as login authentication and command execution logs, and transmits the processed data to the data standardization module through an encrypted channel.

[0067] Furthermore, the threat detection module includes a feature distribution submodule, a parallel detection submodule, a result fusion submodule, and a collaborative scheduling submodule. The feature distribution submodule distributes multi-dimensional threat features to various AI models, including a graph neural network detection model, a Transformer temporal detection model, and a large language model semantic analysis model. The parallel detection submodule enables each AI model to run in parallel, independently detecting the received multi-dimensional threat features and generating its own local detection results. The result fusion submodule receives the local detection results output by each AI model, weights and fuses them to generate a comprehensive threat detection result. The collaborative scheduling submodule monitors the running status and detection confidence of each AI model, dynamically adjusting the collaborative strategy between them based on the running status and detection confidence. The specific implementation of the result fusion submodule in this scenario is as follows: The result fusion submodule includes an input parsing unit, a confidence correction unit, a dynamic weight allocation unit, and a weighted fusion execution unit. The input parsing unit receives the local detection results output by each AI model and extracts threat category labels, confidence scores, and model identifiers from each local detection result. The confidence correction unit corrects the confidence scores of each AI model based on their historical detection accuracy, generating a confidence coefficient for each AI model. The dynamic weight allocation unit normalizes each confidence coefficient using a dynamic confidence-weighted fusion algorithm, and assigns fusion weights to each AI model based on the normalized confidence coefficients. These fusion weights are positively correlated with the confidence coefficients. The weighted fusion execution unit performs a weighted summation of the detection scores of each AI model according to the fusion weights, generating a comprehensive threat detection result. The specific implementation of the dynamic weight allocation unit is as follows: The dynamic weight allocation unit includes a basic probability assignment subunit, an evidence synthesis subunit, a conflict detection subunit, and a fusion decision subunit.

[0068] In one example, the basic probability assignment subunit constructs basic probability assignment functions for each AI model based on the credibility coefficients and local detection results. For instance, the graph neural network model outputs a probability of 0.85 for an event being an abnormal login, the Transformer model outputs a probability of 0.78, and the large language model outputs a probability of 0.92. Each of these three models corresponds to a different basic probability assignment function. The evidence synthesis subunit performs pairwise iterative synthesis of the basic probability assignment functions of each AI model according to the synthesis rules of the DS evidence theory. First, a fused basic probability assignment function is generated, meaning the basic probability assignment functions of the graph neural network model and the Transformer model are synthesized. Then, the synthesis result is combined with the basic probability assignment function of the large language model for a second synthesis. During the pairwise iterative synthesis process of the evidence synthesis subunit, the conflict detection subunit detects the degree of conflict between the two basic probability assignment functions involved in the synthesis. When the degree of conflict exceeds a preset threshold, such as when the conflict coefficient is greater than 0.7, the two basic probability assignment functions undergo conflict redistribution processing to prevent highly conflicting evidence from causing the synthesis result to fail. The fusion decision subunit determines the final comprehensive threat category and comprehensive threat confidence level according to the ultimately generated fusion basic probability assignment function and preset decision rules. Through the nonlinear evidence synthesis of the aforementioned DS evidence theory, the system detects abnormal SSH login events of camera devices on the IoT platform, remote command execution events of the OA server on the enterprise intranet platform, and abnormal data query events of the database on the cloud platform. These three events are the isolated threat events within each local platform.

[0069] Furthermore, the attack chain reconstruction module includes a time alignment submodule, a causal correlation submodule, a path search submodule, and a chain filtering submodule. The time alignment submodule converts the timestamps of each isolated threat event into a unified time base. For example, it converts the event timestamps recorded by the IoT platform from UTC+8 time zone to UTC time, and the event timestamps of the cloud platform from UTC+9 time zone to UTC time. After unifying all to the UTC time base, the event sequence is arranged chronologically: 2:15 AM abnormal SSH login by the IoT camera, 2:23 AM remote command execution by the enterprise intranet OA server, and 2:30 AM abnormal data query by the cloud platform database. The causal correlation submodule extracts the attack characteristics of each isolated threat event and calculates the causal correlation degree between any two isolated threat events based on the attack characteristics. When the causal correlation degree exceeds a preset threshold, a causal correlation edge is established between the two isolated threat events. The specific implementation of the causal correlation submodule is as follows: The causal correlation submodule includes an attack characteristic extraction unit, a cross-event correlation calculation unit, a causal determination unit, and a correlation edge labeling unit. The attack feature extraction unit extracts multi-dimensional attack features from each isolated threat event, generating an event feature vector for each isolated threat event. These multi-dimensional attack features include the attack source address, attack target address, attack method type, attack resource consumption pattern, and attack payload features. For example, for an abnormal SSH login event on an IoT platform, the source IP is extracted as 192.168.1.100, the target IP as 192.168.1.105, the attack method as brute-force, and the attack payload feature as a feature vector containing multiple common weak password dictionaries. The cross-event correlation calculation unit uses the event feature vectors of each isolated threat event as input and employs an attention mechanism to calculate the correlation weight between any two isolated threat events. This correlation weight characterizes the degree of semantic matching between the two isolated threat events. For example, the correlation weight between the abnormal SSH login event and the remote command execution event is calculated to be 0.82, and the correlation weight between the remote command execution event and the abnormal data query event is calculated to be 0.76. The causal determination unit determines the causal correlation between any two isolated threat events based on the correlation weight and the preset causal determination rules, and determines whether to establish a causal correlation edge based on the relationship between the causal correlation and the preset threshold.

[0070] In one example, when the preset threshold is 0.6, the correlation between each of the three events exceeds the threshold, and the system establishes causal relationship edges between the events. The relationship edge annotation unit annotates the established causal relationship edges with attributes including attack direction, attack method evolution, and attack time interval. For example, it annotates the attack direction of abnormal SSH login to remote command execution as IoT camera to internal OA server, the attack method as evolving from brute force to command injection, and the time interval as 8 minutes. The path search submodule constructs a cross-platform attack graph with each isolated threat event as a node and causal relationship edges as edges, and searches for the complete path from the initial intrusion node to the final attack target node from the cross-platform attack graph.

[0071] The path search submodule includes an attack graph construction unit, an attack entry point identification unit, a path search unit, and an optimal path determination unit. The attack graph construction unit constructs a cross-platform attack graph using isolated threat events as nodes and causal edges as edges. The attack entry point identification unit identifies nodes with zero in-degree as initial intrusion nodes (i.e., abnormal SSH login events on IoT platforms) and nodes with zero out-degree as final attack target nodes (i.e., abnormal data query events on cloud platforms). The path search unit uses a depth-first search algorithm to traverse all reachable paths in the cross-platform attack graph, starting from the initial intrusion node and ending at the final attack target node, and calculates the path confidence for each reachable path. The path confidence is determined by the product of the causal relationships of the edges within the path. The optimal path determination unit sorts all reachable paths according to their path confidence and selects the reachable path with the highest confidence as the complete path output. The chain filtering submodule performs causal logic verification on the complete path, verifying the causal logic continuity between adjacent events in the complete path. For example, it verifies whether an attacker has the technical feasibility to move laterally from an IoT device to an intranet OA server after intrusion. The verified complete path is output as a complete cross-platform attack chain to the early warning generation module.

[0072] Furthermore, the early warning generation module includes an attack chain analysis submodule, an early warning classification submodule, a cross-platform alarm suppression submodule, and an early warning content generation submodule. The attack chain analysis submodule analyzes the complete cross-platform attack chain, extracting platform information, attack time points, and attack method types involved in each attack stage. For example, it extracts information on three platforms: an IoT platform, an enterprise intranet platform, and a cloud platform; three attack time points: 2:15, 2:23, and 2:30; and three attack method types: brute-force attack, command injection, and data theft. The early warning classification submodule calculates a threat level score based on the length of the attack chain, the number of platforms involved, and the complexity of the attack methods, and determines the early warning level based on the threat level score. In this scenario, the attack chain contains three attack stages, involves three different platforms, and includes three different attack methods, resulting in a threat level score of 92. The system determines the early warning level to be an emergency warning. The cross-platform alarm suppression submodule generates alarm suppression instructions based on the isolated threat events contained in the complete cross-platform attack chain. These instructions are used to suppress local alarms issued by each local platform for isolated threat events. Specifically, after generating cross-platform warning information, the system sends instructions to the IoT platform to suppress its local alarms for abnormal SSH login events, to the enterprise intranet platform to suppress its local alarms for remote command execution events, and to the cloud platform to suppress its local alarms for abnormal data query events. This ensures that security operations personnel are not disturbed by three separate single-point alarms. The warning content generation submodule generates cross-platform warning information based on the complete cross-platform attack chain and warning level. This information includes the initial intrusion point, attack propagation path, attack methods at each stage, and the final attack target. Specifically, the following warning information is generated: At 2:15 AM, the attacker intruded into the IoT camera device through brute-force attack. Using this device as a springboard, the attacker launched a command injection attack on the enterprise intranet OA server at 2:23 AM. After successfully gaining intranet access, the attacker accessed the cloud platform's core business database at 2:30 AM and stole sensitive data, forming a complete three-level cross-platform attack chain from the IoT device to the enterprise intranet to the cloud platform.

[0073] This invention successfully links three isolated anomaly events, originally scattered across an IoT platform, an enterprise intranet platform, and a cloud platform, into a complete cross-platform jump attack chain. It replaces the individual local alerts issued by the three platforms with a clearly structured cross-platform early warning message containing the complete attack path. This solves the technical problem that when attackers launch jump attacks by exploiting cross-platform data semantic differences, each local system can only detect isolated anomaly fragments and cannot link attack behaviors scattered across different platforms into a complete attack chain.

[0074] The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A cross-platform intelligent early warning system for cybersecurity threats based on artificial intelligence, characterized in that, include: The data acquisition module is used to collect security data from different network security platforms through acquisition agents deployed on different network security platforms. The data standardization module is used to unify the format and align the semantics of heterogeneous security data collected from various platforms, generating standardized security data. The feature extraction module is used to extract multi-dimensional threat features from the standardized security data; The threat detection module is used to collaboratively detect the multi-dimensional threat features based on multiple artificial intelligence models and identify isolated threat events within each local platform. The attack chain reconstruction module is used to connect the isolated threat events detected by each local platform in chronological order and causal relationship across platforms to reconstruct the complete cross-platform attack chain. The early warning generation module is used to generate early warning information including the full attack path information based on the complete cross-platform attack chain, in order to replace the local alarms issued separately by each platform.

2. The system according to claim 1, characterized in that, The data acquisition module includes: The plugin management submodule is used to store and manage data collection plugins corresponding to various types of network security platforms, and to distribute collection plugins corresponding to the type of the target platform to the collection agent deployed on the target platform according to the type of the target platform to be collected. The protocol adaptation submodule is used to identify the transmission protocol type used by the security data of each platform, and load the protocol parser corresponding to the identified transmission protocol type to establish a data flow channel with each platform. The data acquisition and scheduling submodule is used to dynamically adjust the data acquisition frequency and granularity of each platform based on the network bandwidth and data processing capabilities of each platform. The data preprocessing submodule is used to perform preliminary filtering and desensitization processing on the raw security data collected at the acquisition agent end, and transmit the processed data to the data standardization module through an encrypted channel.

3. The system according to claim 2, characterized in that, The plugin management submodule includes: The plug-in storage unit is used to classify and store multiple data acquisition plug-ins according to platform type, and to configure a corresponding platform type label for each data acquisition plug-in. The platform identification unit is used to identify the type information of the target platform for the security data to be collected. The version management unit is used to manage the version information of each data acquisition plugin and send an update notification to the acquisition agent when a new version of the data acquisition plugin is detected. The execution unit is used to search for the data acquisition plugin corresponding to the platform type tag that matches the type information in the plugin storage unit based on the type information identified by the platform identification unit, and to send the data acquisition plugin to the acquisition agent deployed on the target platform.

4. The system according to claim 1, characterized in that, The threat detection module includes: The feature distribution submodule is used to distribute the multi-dimensional threat features to each of the artificial intelligence models; The parallel detection submodule is used to enable each of the aforementioned artificial intelligence models to run in parallel, independently detect the received multi-dimensional threat features, and generate their respective local detection results. The result fusion submodule is used to receive the local detection results output by each of the artificial intelligence models, and to perform weighted fusion of the local detection results to generate a comprehensive threat detection result. The collaborative scheduling submodule is used to monitor the running status and detection confidence of each of the artificial intelligence models, and dynamically adjust the collaborative strategy between the artificial intelligence models based on the running status and detection confidence.

5. The system according to claim 4, characterized in that, The result fusion submodule includes: The input parsing unit is used to receive the local detection results output by each of the artificial intelligence models, and extract threat category labels, confidence scores and model identifiers from each of the local detection results; The confidence correction unit is used to correct the confidence scores of each artificial intelligence model based on the historical detection accuracy of each model, and generate the confidence coefficient of each artificial intelligence model. The dynamic weight allocation unit is used to normalize each credibility coefficient according to the dynamic credibility weighted fusion algorithm, and to allocate fusion weights to each artificial intelligence model according to the normalized credibility coefficients, wherein the fusion weights are positively correlated with the credibility coefficients. The weighted fusion execution unit is used to perform a weighted summation of the detection scores of each of the artificial intelligence models according to the fusion weights, and generate the comprehensive threat detection result.

6. The system according to claim 5, characterized in that, The dynamic weight allocation unit includes: The basic probability assignment subunit is used to construct a basic probability assignment function for each of the artificial intelligence models based on the credibility coefficient of each model and the local detection results. The evidence synthesis subunit is used to perform pairwise iterative synthesis of the basic probability assignment functions of each of the artificial intelligence models according to the synthesis rules of DS evidence theory, so as to generate a fused basic probability assignment function. The conflict detection subunit is used to detect the degree of conflict between the two basic probability assignment functions participating in the synthesis during the pairwise iterative synthesis process of the evidence synthesis subunit. When the degree of conflict exceeds a preset threshold, the two basic probability assignment functions are reassigned. The fusion decision subunit is used to determine the final comprehensive threat category and comprehensive threat confidence level according to the fusion basic probability assignment function and preset decision rules.

7. The system according to claim 1, characterized in that, The attack chain reconstruction module includes: The time alignment submodule is used to convert the timestamps of each isolated threat event into a unified time base, and sort each isolated threat event according to the unified time base to generate a time-series event sequence. The causal correlation submodule is used to extract the attack characteristics of each isolated threat event, calculate the causal correlation degree between any two isolated threat events based on the attack characteristics, and establish a causal correlation edge between the two isolated threat events when the causal correlation degree exceeds a preset threshold. The path search submodule is used to construct a cross-platform attack graph with each isolated threat event as a node and the causal relationship edge as an edge, and to search for the complete path from the initial intrusion node to the final attack target node from the cross-platform attack graph. The chain filtering submodule is used to perform causal logic verification on the complete path, and output the complete path that passes the verification as the complete cross-platform attack chain to the warning generation module.

8. The system according to claim 7, characterized in that, The causal correlation submodule includes: An attack feature extraction unit is used to extract multi-dimensional attack features from each of the isolated threat events and generate an event feature vector for each of the isolated threat events. The multi-dimensional attack features include attack source address, attack target address, attack method type, attack resource consumption mode, and attack payload features. The cross-event association calculation unit is used to calculate the association weight between any two isolated threat events by taking the event feature vector of each isolated threat event as input and using an attention mechanism. The association weight is used to characterize the degree of matching between the two isolated threat events in attack semantics. The causal determination unit is used to determine the causal correlation degree between any two isolated threat events based on the correlation weight and the preset causal determination rule, and to determine whether to establish a causal correlation edge based on the relationship between the causal correlation degree and the preset threshold. The associated edge annotation unit is used to annotate the established causal associated edges with attributes, including attack direction, attack method evolution relationship and attack time interval.

9. The system according to claim 7, characterized in that, The path search submodule includes: The attack graph construction unit is used to construct a cross-platform attack graph using each of the isolated threat events as nodes and the causal relationship edges as edges. The attack entry identification unit is used to identify nodes with an in-degree of zero as initial intrusion nodes and nodes with an out-degree of zero as final attack target nodes from the cross-platform attack graph. The path search unit is used to traverse all reachable paths in the cross-platform attack graph using a depth-first search algorithm, starting from the initial intrusion node and ending at the final attack target node, and to calculate the path confidence of each reachable path. The optimal path determination unit is used to sort all the reachable paths according to the path confidence, and select the reachable path with the highest path confidence as the complete path output.

10. The system according to claim 1, characterized in that, The early warning generation module includes: The attack chain parsing submodule is used to parse the complete cross-platform attack chain and extract the platform information, attack time nodes and attack method types involved in each attack link; The early warning and classification submodule is used to calculate the threat level score based on the length of the attack chain, the number of platforms involved, and the complexity of the attack method, and to determine the early warning level based on the threat level score. The cross-platform alarm suppression submodule is used to generate alarm suppression instructions based on each isolated threat event included in the complete cross-platform attack chain. The alarm suppression instructions are used to suppress local alarms issued individually by each local platform for the isolated threat event. The warning content generation submodule is used to generate cross-platform warning information, including the initial intrusion point, attack propagation path, attack methods at each stage, and final attack target, based on the complete cross-platform attack chain and the warning level.

Images