A federated learning network defense method based on multi-modal verification and counterfactual deduction

Abstract

The application provides a federated learning network defense method and system based on multi-modal verification and counterfactual deduction, an electronic device and a storage medium. On the edge side, the semantic structuring of massive logs is efficiently completed through streaming clustering, representative sampling and label broadcasting mechanism. A high-trust attack causal graph is constructed by adopting a ternary verification mechanism of statistics, semantics and threat intelligence. Further, the causal graph is converted into a structured causal model, the dual influence of defense measures on attack blocking and business interruption is quantitatively evaluated through counterfactual deduction, and the optimal strategy based on the benefit-cost ratio is generated. Through secure ontology mapping and differential privacy protection, each node realizes cross-domain causal knowledge federated aggregation and sharing under the premise that local data does not leave the domain by using the minimax regret algorithm. The scheme realizes a complete closed loop of efficient processing on the edge side, accurate inference of attack chains, scientific quantification of defense decisions and collaborative evolution under privacy protection.

Description

Technical Field

[0001] The embodiments of the present invention relate to the fields of cyberspace security and artificial intelligence technology, and in particular to a federated learning network defense method, system, electronic device and storage medium based on multimodal verification and counterfactual inference. Background Technology

[0002] Currently, with the widespread deployment of cloud computing, edge computing, and the Internet of Things, cyberattacks are becoming increasingly complex and covert, making traditional cybersecurity defense methods inadequate to cope with Advanced Persistent Threats (APTs). First-generation defense methods rely on rule matching and cannot identify unknown attacks; second-generation methods use statistical anomaly detection, which has a high false alarm rate and easily leads to alarm fatigue; although third-generation methods introduce graph correlation analysis, they are still based on correlation rather than causation, making it difficult to accurately identify the real attack chain.

[0003] Existing technologies face the following prominent challenges in achieving intelligent network defense: First, in edge environments, real-time semantic parsing of massive heterogeneous logs requires significant computing resources, and traditional methods struggle to achieve high throughput on low-power devices. Second, attack graph generation methods based on Large Language Models (LLMs) are prone to generating "illusions," i.e., generating attack paths lacking real-world basis. Third, existing Security Orchestration, Automation and Response (SOAR) systems lack quantitative assessments of the side effects of defense measures, leading to blind decision-making. Fourth, in cross-organizational collaborative defense, the heterogeneous network topology makes it difficult to effectively share causal knowledge.

[0004] The aforementioned technical deficiencies make it difficult to accurately and efficiently detect complex attacks such as advanced persistent threats, leading to blind defense decisions and hindering cross-domain collaboration. This not only reduces the effectiveness and reliability of network security defenses but may also disrupt core business operations due to improper defense practices, seriously affecting the secure and stable operation of enterprise IT infrastructure and business continuity. Summary of the Invention

[0005] This invention provides a federated learning network defense method, system, electronic device, and storage medium based on multimodal verification and counterfactual inference, to solve the technical problems of low processing efficiency, high false alarm rate, blind decision-making, and difficulty in cross-domain collaboration in existing network defense technologies.

[0006] In a first aspect, embodiments of the present invention provide a federated learning network defense method based on multimodal verification and counterfactual inference, comprising: S1. Perform streaming clustering on heterogeneous security logs at edge nodes to obtain log template clusters. Extract representative samples from each log template cluster, perform semantic annotation through a quantized large language model, and broadcast the annotated semantic labels to all logs within the corresponding log template cluster to generate a time-series event-attribute matrix.

[0007] S2. Based on the aforementioned time-series event-attribute matrix, a network attack causal graph is constructed by sequentially performing semantic prior filtering using a large language model, statistical verification using a restricted PCMCI algorithm, and external threat intelligence support verification.

[0008] S3. Instantiate the network attack causal graph into a structured causal model. Based on the currently observed alarm evidence, infer the posterior distribution of exogenous variables in the structured causal model. By simulating intervention operations on defense variables, calculate the decrease in the probability of achieving the attack target and the increase in the probability of interruption of critical business services in a counterfactual scenario. Based on the quantitative ratio of security benefits to business costs, generate a local defense strategy for the edge node.

[0009] S4. Each edge node will map the local network attack causal graph verified by S3 to a unified security ontology layer to eliminate topological heterogeneity, and perform differential privacy protection processing on the mapped causal graph structure. The processed causal graph structure data will be uploaded to the central server, which will use the minimum-maximum regret algorithm to aggregate and generate a global causal graph.

[0010] Secondly, embodiments of the present invention provide a distributed network defense system based on multimodal verification and counterfactual inference, including multiple edge nodes and a central server; The edge nodes include: The log processing module is used to perform streaming clustering on locally collected heterogeneous security logs to obtain log template clusters, extract representative samples from each log template cluster, perform semantic annotation through a quantized large language model, and broadcast the annotated semantic tags to all logs in the corresponding log template cluster to generate a time-series event-attribute matrix.

[0011] The causal analysis module is used to construct a network attack causal graph based on the time-series event-attribute matrix, through sequential semantic prior filtering of the large language model, statistical verification of the restricted PCMCI algorithm, and external threat intelligence support verification.

[0012] The local decision-making module is used to instantiate the network attack causal graph into a structured causal model, infer the posterior distribution of exogenous variables in the structured causal model based on currently observed alarm evidence, calculate the decrease in the probability of attack target achievement and the increase in the probability of critical business service interruption in a counterfactual scenario by simulating intervention operations on defense variables, and generate a local defense strategy for the edge node based on the quantified ratio of security benefits to business costs.

[0013] The collaborative preprocessing module is used to map the local network attack causal graph after decision verification to a unified security ontology layer to eliminate topological heterogeneity, and to perform differential privacy protection processing on the mapped causal graph structure.

[0014] The central server includes: The federated aggregation module receives the processed causal graph structure data uploaded by each edge node and aggregates it using the minimum-maximum regret algorithm to generate a global causal graph.

[0015] Thirdly, embodiments of the present invention provide an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the program, it implements the steps of the federated learning network defense method based on multimodal verification and counterfactual deduction as described in the first aspect of the present invention.

[0016] Fourthly, embodiments of the present invention provide a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the federated learning network defense method based on multimodal verification and counterfactual inference as described in the first aspect of the present invention.

[0017] This invention provides a federated learning network defense method, system, electronic device, and storage medium based on multimodal verification and counterfactual inference. On resource-constrained edge devices, through a pipeline of "streaming clustering - representative sampling - label broadcasting," the cost of expensive LLM semantic parsing is reduced from O(N) to O(M), achieving efficient real-time structuring of massive heterogeneous logs and resolving the contradiction between computational power and depth. In the causal discovery phase, an innovative "statistical-semantic-intelligence" three-element verification mechanism is introduced. This involves sequentially filtering through logical priors of a large language model, statistical significance testing using a restricted PCMCI algorithm, and support matching and fusion judgment based on a vectorized threat intelligence database. This layered filtering eliminates spurious correlations and large model illusions, constructing a highly reliable attack causal graph. In the decision-making phase, the causal graph is transformed into a structured causal model. Based on a counterfactual inference framework, the dual impact of different defensive interventions on "attack blocking probability" and "business interruption risk" is quantified and simulated. This generates a scientific strategy based on the ratio of security gains to business costs, transforming blind responses into precise game theory. During the collaboration phase, by mapping specific assets to a unified security ontology role and combining it with differential privacy protection, and under the premise of "data not leaving the domain," the minimum-maximum regret algorithm is used to aggregate the experience of each node, generating a highly generalizable global graph. This achieves the evolution of collective intelligent defense under privacy compliance. It significantly improves the throughput and energy efficiency of edge-side log semantic parsing, substantially enhances the accuracy and credibility of attack causal chain inference, provides quantifiable "benefit-cost" assessment criteria for defense decisions, avoids accidental damage to business operations, overcomes the challenge of efficient and secure sharing of security knowledge between heterogeneous networks, and forms a complete defense closed loop from local precise autonomy to global collaborative evolution. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1 This is a flowchart of a federated learning network defense method based on multimodal verification and counterfactual inference according to an embodiment of the present invention; Figure 2 This is a schematic diagram of the end-edge-cloud collaboration process according to an embodiment of the present invention; Figure 3 This is a flowchart of an efficient log parsing process based on tag broadcasting according to an embodiment of the present invention; Figure 4 This is a ternary hybrid causal discovery and verification logic diagram according to an embodiment of the present invention; Figure 5 This is a block diagram of a distributed network defense system based on multimodal verification and counterfactual deduction according to an embodiment of the present invention; Figure 6 This is a schematic diagram of the physical structure according to an embodiment of the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] In the embodiments of this application, the term "and / or" is merely a description of the relationship between related objects, indicating that there can be three relationships. For example, A and / or B can represent three situations: A exists alone, A and B exist simultaneously, and B exists alone.

[0022] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0023] This invention provides a federated learning network defense method based on multimodal verification and counterfactual inference, such as... Figure 1 , Figure 2 As shown, it includes: S1. Perform streaming clustering on heterogeneous security logs at edge nodes to obtain log template clusters. Extract representative samples from each log template cluster, perform semantic annotation through a quantized large language model, and broadcast the annotated semantic labels to all logs within the corresponding log template cluster to generate a time-series event-attribute matrix.

[0024] Among them, streaming clustering refers to using an improved tree edit distance algorithm (such as a variant of the Drain algorithm) to group structurally similar logs into dynamically maintained log template clusters online (e.g., User...). Login failed from IP address This is done by creating a template cluster to greatly reduce the diversity of entries to be processed. Representative samples refer to 1-3 of the most representative logs (of moderate length and rich variables) extracted from a new cluster when its size reaches a threshold. A quantized large language model refers to a lightweight model (such as Llama-3-8B-Quantized) compressed using 4-bit / 8-bit quantization, deployed at the edge, used for deep semantic annotation of samples, extracting standardized event types, attack techniques (MITRE ATT&CK ID), entities, and severity levels to form semantic labels. Tag broadcasting refers to batch assigning tags to all historical and future logs of the cluster, and combining this with variables in the logs (such as specific IP addresses) to ultimately generate a unified time-series event-attribute matrix (behavior time steps, columns representing event type strength).

[0025] To address the challenge of processing massive amounts of heterogeneous logs (such as Syslog, NetFlow, and audit logs) in real time in edge computing environments (such as branch gateways of industrial enterprises and IoT gateways) with limited computing power, this embodiment reduces the LLM (Large Language Model) inference overhead from being proportional to the total amount of logs (O(N)) to being proportional to the number of templates (O(M)) through an asymmetric pipeline of "clustering-sampling-inference-broadcasting". This enables real-time, high-throughput semantic structuring of tens of thousands of EPS (Events Per Second) log streams on low-computing edge devices, solving the bottleneck of "efficiency and depth being mutually exclusive".

[0026] S2. Based on the aforementioned time-series event-attribute matrix, a network attack causal graph is constructed by sequentially performing semantic prior filtering using a large language model, statistical verification using a restricted PCMCI algorithm, and external threat intelligence support verification.

[0027] The first part of the invention involves semantic prior filtering using the domain common sense of LLM to determine the logical rationality between event pairs (such as printer paper shortage and domain controller privilege escalation), generating a prior adjacency matrix to constrain the search space. The second part, the constrained PCMCI (Peter-Clark Momentary Conditional Independence) algorithm statistical verification, involves performing the PC (conditional independence test) and MCI (time-delay causality test) stages under the constraints of this prior matrix to identify candidate causal edges with statistical significance and time delay. The third part, external threat intelligence support verification, is a core innovation of this invention. It involves converting the semantics of candidate edge nodes into vectors, retrieving similar TTPs (Tactics, Techniques and Procedures) transition patterns in a local vectorized CTI (Cyber ​​Threat Intelligence) database (such as MITRE ATT&CK), and calculating intelligence support scores (such as maximum cosine similarity). The fourth part, fusion judgment, involves weighted fusion of this score and the statistical significance score to obtain the final confidence level.

[0028] Step S2 employs a three-layer funnel-style verification mechanism of semantic prior, statistical verification, and intelligence verification. This effectively filters out false correlations caused by business coincidences and illusory connections that may be generated by LLM, and constructs a high-confidence network attack causal graph based on practical experience and data-driven approaches, significantly improving the accuracy and credibility of attack link inference.

[0029] S3. Instantiate the network attack causal graph into a structured causal model. Based on the currently observed alarm evidence, infer the posterior distribution of exogenous variables in the structured causal model. By simulating intervention operations on defense variables, calculate the decrease in the probability of achieving the attack target and the increase in the probability of interruption of critical business services in a counterfactual scenario. Based on the quantitative ratio of security benefits to business costs, generate a local defense strategy for the edge node.

[0030] In this context, instantiation into a structured causal model refers to transforming the causal graph into an SCM (Structural Causal Model) composed of endogenous variables (observed events), exogenous variables (unobserved noise), and structural equations (describing the functional relationships between variables). Inferring the posterior distribution of exogenous variables involves estimating the noise state under a specific attack scenario based on currently observed alarm evidence (such as SQL injection alarms), using variational inference or MCMC (Markov Chain Monte Carlo) sampling. Simulating intervention operations on defense variables involves applying Pearl's Do (Do-operator) operator to cut off all incoming edges of variables such as firewall state variables in the model and fix their values ​​to blocked, constructing a counterfactual scenario. Security benefits are calculated as the reduction in the probability of achieving the attack target (such as data breach); business costs are calculated as the increase in the probability of critical service (such as ERP (Enterprise Resource Planning) system) interruption. The defense ROI score is calculated as the ratio of these two values.

[0031] In step S3, a counterfactual reasoning framework of extrapolation-action-prediction is used to quantify the security effectiveness and business risks of different defense actions (such as blocking IPs and isolating containers). This generates a local defense strategy based on objective ROI, transforming the static and blind response of traditional SOAR (Security Orchestration, Automation and Response) into a quantifiable and cost-balanced scientific decision-making process, thus solving the game dilemma of missed defenses and collateral damage.

[0032] S4. Each edge node will map the local network attack causal graph verified by S3 to a unified security ontology layer to eliminate topological heterogeneity, and perform differential privacy protection processing on the mapped causal graph structure. The processed causal graph structure data will be uploaded to the central server, which will use the minimum-maximum regret algorithm to aggregate and generate a global causal graph.

[0033] Mapping to a unified security ontology layer refers to each edge node replacing concrete assets (e.g., IP: 192.168.1.5) in the causal graph with abstract security ontology roles (e.g., Role: Core_Database) according to a predefined mapping table, thus eliminating network topology heterogeneity. Differential privacy protection processing involves adding Laplace noise to the mapped causal graph structure (e.g., adjacency matrix) to prevent the original network topology from being inferred from the shared structure. The processed causal graph structure data refers to privacy-preserving data containing only abstract roles and their causal relationships. The minimum-maximum regret algorithm is a federated aggregation algorithm whose optimization objective is to find a global causal graph that minimizes the maximum performance regret (i.e., the performance loss compared to using its local optimal graph) for all participants when using the graph.

[0034] In S4 of this embodiment, semantic layer unification is achieved through ontology alignment, and data security is ensured by combining differential privacy. The central server uses the above algorithm to aggregate the local knowledge uploaded by each node, generating a highly generalized global graph that can cover various attack variants without excessively favoring any particular local data. This achieves privacy-compliant collaboration where data remains within the domain and knowledge is shared across the entire network, overcoming the challenge of effectively sharing and co-evolving security knowledge across organizations due to network heterogeneity and privacy concerns.

[0035] Based on the above embodiments, as a preferred implementation method, such as Figure 3 As shown, S1 specifically includes: S11. Log preprocessing: Extracting basic metadata such as timestamps, hostnames, and severity levels from heterogeneous security logs, and removing interfering characters. Log preprocessing is the initial standardized operation after edge nodes receive multi-source heterogeneous security logs. It is suitable for edge gateways in zero-trust architectures that process logs in different formats such as Syslog, NetFlow, and Auditd. Heterogeneous security logs refer to raw security logs from different devices with inconsistent formats, serving as the raw data carriers of network attack behavior. Basic metadata is the core identifying information of the logs. The timestamp records the precise time of the event, the hostname identifies the source device, and the severity level classifies the urgency (e.g., low, medium, high). This information forms the basis for subsequent log classification and analysis. Interfering characters refer to irrelevant characters in the logs that do not affect the core information, typically such as ANSI color codes and other formatting characters. S11 performs preliminary cleaning and key information extraction on the messy raw logs. Addressing the shortcomings of existing technologies, such as heterogeneous raw log formats and excessive redundant information leading to low parsing efficiency and poor accuracy, S11 achieves preliminary log organization by extracting core metadata. At the same time, it removes interfering characters to prevent irrelevant information from affecting subsequent clustering and semantic understanding. Ultimately, it simplifies log data and provides high-quality input for subsequent streaming clustering, ensuring that subsequent processing can accurately focus on the core semantics of the logs.

[0036] S12. An improved tree edit distance algorithm is used to perform streaming clustering on the preprocessed heterogeneous security logs, generating multiple log template clusters. The improved tree edit distance algorithm is a log clustering algorithm optimized from the traditional tree edit distance algorithm. Specifically, the improved Drain algorithm is used, which constructs a fixed-depth parse tree and calculates the token similarity between new logs and tree nodes to achieve efficient matching. This is suitable for scenarios where edge nodes process massive log streams in real time. Streaming clustering refers to a clustering method where logs are input and grouped in real time as a stream, without waiting for full log collection, meeting the processing needs of tens of thousands of EPS (Events Per Second) log traffic. A log template cluster is a collection of similar logs formed after clustering. Logs within a cluster contain unchanging constant parts (such as fixed field descriptions) and changing variable parts (such as IP addresses and port numbers). Each cluster corresponds to a unified log template. S12 utilizes an optimized clustering algorithm to group preprocessed logs in real time, specifically addressing the shortcomings of existing technologies where the large volume and heterogeneous formats of logs lead to low efficiency and high resource consumption per log entry. By automatically identifying constants and variables in the logs, it groups massive heterogeneous logs into a small number of similar template clusters, significantly reducing the scale of subsequent semantic annotation processing objects and achieving an order-of-magnitude improvement in log processing efficiency. At the same time, it ensures the semantic consistency of similar logs, laying the foundation for subsequent tag broadcasting mechanisms.

[0037] S13. When a new log template cluster is generated or the accumulated log volume of an existing log template cluster reaches a preset threshold, 1 to 3 logs are extracted from the corresponding log template cluster as representative samples. The sampling triggering conditions include two scenarios: first, the first generation of a new log template cluster; and second, the accumulated log volume of an existing log template cluster reaches the preset threshold. N samlpe (For example, every 1000 accumulated logs) is suitable for scenarios where edge nodes dynamically control the timing of semantic annotation triggering; the preset threshold is a quantitative standard dynamically configured based on the edge node's computing power and log traffic, used to balance annotation timeliness and computing power consumption; the representative sample is a small number of logs selected from the log template cluster that can best reflect the log characteristics within the cluster. The selection criteria are that the length is close to the average value of logs within the cluster and the variable character set is the richest, with a fixed number of 1 to 3 logs. S13 selects only a small number of representative samples for subsequent semantic annotation through a dynamic trigger sampling mechanism. In response to the shortcomings of existing technologies, which would lead to insufficient computing power and excessive processing latency for edge nodes if semantic annotation is performed on every log, the sampling strategy of using a small number of samples to represent the entire cluster reduces the workload of subsequent high-computing-power semantic inference tasks by several orders of magnitude while ensuring the accuracy of semantic annotation. This achieves efficient log processing at low computing power cost for edge nodes, while ensuring that the samples can completely cover the semantic features of logs within the cluster, avoiding the impact of sampling deviation on the quality of subsequent annotation.

[0038] S14. Using a quantized large language model deployed on edge nodes, semantic annotation is performed on the representative samples to obtain semantic tags containing attack intent, entity, attack stage, and MITRE ATT&CK technology ID. Among them, the quantized large language model is a finely tuned large language model (such as Llama-3-8B-Quantized) that has undergone 4-bit or 8-bit quantization processing. It is deployed locally on edge nodes without relying on cloud computing power and is suitable for semantic understanding scenarios of low-computing-power edge devices (such as NVIDIA T4, Jetson Orin accelerator cards or high-performance CPUs). Edge node deployment means that the model runs directly on edge devices in the gateway or server area of ​​the enterprise branch office, avoiding the bandwidth consumption, latency issues and privacy leakage risks caused by log transmission to the cloud. Semantic annotation is a process of deep parsing of logs based on the STIX 2.1 standard. It guides the model to output structured results by constructing a standardized Prompt. The Prompt includes the definition of security expert roles, log samples, JSON output format and field schema. Semantic tags are the structured information after annotation. The attack intent clearly indicates the purpose of the attack behavior corresponding to the log (such as brute force), the entity indicates the object related to the attack (such as the attack source IP, target host), the attack stage divides the life cycle stage of the attack (such as initial access, privilege escalation), and the MITRE ATT&CK technical ID corresponds to the standard number of the attack behavior (such as T1110). S14 utilizes a quantized large language model deployed at the edge to perform accurate semantic parsing of representative samples. Addressing the shortcomings of existing technologies, such as the inability of regular expressions to understand heterogeneous log semantics and the privacy leaks and high latency of large cloud models, S14 achieves LLM-level semantic understanding capabilities at the edge through a quantized model. This ensures both the depth and accuracy of semantic annotation while avoiding various problems caused by cloud dependencies. At the same time, the structured semantic tags provide a unified semantic foundation for subsequent causal graph construction.

[0039] S15. Broadcast the semantic labels obtained from semantic annotation to all logs within the corresponding log template cluster, and fill the identified variable information within the log template cluster into the specified fields of the semantic labels to generate a time-series event-attribute matrix. Here, label broadcasting is an efficient synchronization mechanism that batch maps the semantic labels and confidence scores of representative samples to all historical and future logs within the corresponding log template cluster. It is suitable for scenarios involving rapid semantic annotation of massive amounts of similar logs. Variable information refers to dynamic data that changes within the log template cluster, such as specific IP addresses, port numbers, and usernames. This information has been automatically identified as variables during the clustering stage. The time-series event-attribute matrix is ​​a standardized dataset organized along the time dimension, with a dimension of T×N (T represents time steps, N represents semantic event types). Each row in the matrix corresponds to a time point, and each column corresponds to the occurrence intensity of a semantic event type, serving as the core input data for subsequent causal relationship analysis. S15 extends the annotation results of a small number of samples to the entire cluster log. Addressing the shortcomings of existing technologies where full log semantic annotation consumes too much computing power and cannot meet the needs of real-time processing, it reduces the time complexity of LLM inference from O(N) (N is the total number of logs) to O(M) (M is the number of templates, M is much smaller than N) through a tag broadcasting mechanism, realizing real-time semantic structuring of massive logs. At the same time, by filling variable information, it ensures that the semantic tags of each log are complete and usable. The final generated time-series event-attribute matrix eliminates log format heterogeneity, providing standardized and highly reliable input data for subsequent causal discovery based on the PCMCI algorithm, ensuring the accuracy of the entire defense process.

[0040] Based on the above embodiments, as a preferred implementation method, such as Figure 4 As shown, S2 specifically includes: S21. Based on the aforementioned event-attribute matrix, a large language model is used to perform logical rationality judgment on the event types in the event-attribute matrix to generate a priori adjacency matrix. Here, event type refers to the specific security event represented in the event-attribute matrix (such as login failure, SQL injection, port scanning); logical rationality judgment is performed on any two pairs of event types in the matrix (…). E i , E j The core judgment process, specifically the logic of querying the model in network attack and defense scenarios, involves... E i Is it possible? E j The preliminary attack steps, such as determining that there is no logical connection between printer paper shortage and domain controller privilege escalation; the prior adjacency matrix is ​​a sparse binary matrix with matrix elements of... G prior [ i ][ jWhen ]=1, it indicates that there is a logical causal possibility between the corresponding event pairs. G prior [ i ][ j When ]=0, it indicates logical impossibility and is used to predefine the effective scope of causal search. S21 utilizes the domain common sense of the large language model to pre-judge the causal probability between events and quantify it into a matrix. Addressing the shortcomings of existing causal discovery algorithms that directly analyze all event pairs, resulting in a large search space and low efficiency, S21 uses logical filtering to eliminate obviously unreasonable event associations, significantly narrowing the processing scope of subsequent statistical tests. Simultaneously, it provides clear constraints for subsequent algorithms, reducing unnecessary computational consumption, and ultimately achieving a significant improvement in the efficiency of the causal discovery process, laying the logical foundation for constructing a precise attack causal graph.

[0041] S22. Based on the constraints of the prior adjacency matrix, perform the conditional independence test and time-delay causality test of the restricted PCMCI algorithm to identify candidate causal edges. The restricted PCMCI algorithm is a causal discovery algorithm incorporating logical constraints. Based on the Peter-Clark Momentary Conditional Independence theory, it consists of two core stages: the PC stage and the MCI stage. The conditional independence test (PC stage) calculates the conditional mutual information between event variables to determine whether there is an indirect relationship between two events given the existence of other parent node sets. p If the value is greater than the preset significance level, the connection is disconnected, thus constructing a preliminary causal framework; the time-delay causality test (MCI stage) is used to verify the time delay characteristics of the causal relationship and clarify the temporal sequence of causal effects between events (e.g., E j exist t-τ Does the occurrence of this moment lead to E j exist t (Events occur at any time); candidate causal edges are those events that have been determined to have statistically significant causal relationships after logical constraints and dual statistical tests, and are the core objects of subsequent intelligence verification. Within the scope of logical constraints, S22 mines quantitative causal relationships between events through phased statistical tests. Addressing the shortcomings of existing technologies in statistical anomaly detection that only focus on correlation and ignore conditional independence and time lag effects, leading to the misjudgment of many pseudo-correlated events such as "peak business concurrency" as causal relationships, S22 eliminates indirect correlations through conditional independence tests and clarifies temporal causality through time lag tests, accurately screening statistically credible potential causal relationships. This provides high-quality candidate objects for subsequent intelligence verification and improves the statistical credibility of the final causal graph.

[0042] S23. Based on the external threat intelligence database, the candidate causal edges are vectorized similarity matching intelligence support verification. The obtained intelligence support score is fused with the statistical significance score. Based on the fusion result, valid causal connections are determined and retained to construct the network attack causal graph. The external threat intelligence database is a multi-source knowledge base with real-time updates. Its core includes authoritative attack tactics and techniques databases such as MITREATT&CK and CAPEC, and can also be extended to open-source threat intelligence (OSINT) databases like VirusTotal, CVE / CNNVD vulnerability databases, and internal enterprise historical attack replay data. Vector indexes are updated regularly through an intelligence vectorization pipeline to ensure timeliness, making it suitable for scenarios providing practical evidence to verify causal relationships. Vectorized similarity matching uses the Sentence-BERT model to convert the semantic labels of the starting and target events of candidate causal edges into vector representations, which are then compared with the vectors of attack tactics and techniques (TTPs) in the intelligence database. The intelligence support score is the product of the maximum cosine similarity between the candidate causal edge vector and the vectors of similar attack patterns in the intelligence database, reflecting the probability of the causal relationship existing in a real-world attack scenario. The statistical significance score is a quantitative indicator output by a constrained PCMCI algorithm, representing the statistical credibility of the causal relationship. Fusion refers to the process of using preset weight coefficients... λ 1 and λ 2. Calculate the weighted sum of the two scores (final confidence level = ...). λ 1×Statistical significance score+ λ The system combines statistical logic with practical experience (2× intelligence support score). Effective causal connections refer to candidate causal edges whose fusion scores exceed a preset threshold. A network attack causal graph is a graph composed of effective causal connections, representing the true relationships between attack steps. S23 provides practical evidence verification for candidate causal edges through multi-source threat intelligence, and then fuses it with statistical scores to filter effective connections. Addressing the shortcomings of existing technologies that rely solely on large language models or statistical algorithms, which are prone to generating illusionary attack chains and lack practical support, the intelligence verification layer filters out false associations without practical evidence, while also eliminating statistically significant but unsupported coincidental correlations. Ultimately, a high-confidence network attack causal graph with both statistical credibility and practical adaptability is constructed, providing accurate attack chain evidence for subsequent counterfactual defense decisions.

[0043] Based on the above embodiments, as a preferred implementation, step S23 specifically includes: The starting event type and target event type corresponding to the candidate causal edge are converted into vector representations. The starting event type refers to the security event that serves as a pre-attack stage in the candidate causal edge (such as a brute-force attack attempt), and the target event type refers to the subsequent attack stage (such as domain controller privilege escalation). The semantic tags of both contain core information such as attack intent, entity, stage, and MITRE ATT&CK technical ID. The vector representation is a numerical vector obtained by embedding the semantic tags of the two types of events using the Sentence-BERT model. This process can transform the textual attack semantics into quantifiable mathematical features and maintain a unified data format with the Tactical Technical Procedures (TTPs) text description vectors stored in the vectorized threat intelligence knowledge base, ensuring the feasibility of subsequent similarity comparison.

[0044] In a vectorized threat intelligence knowledge base, attack behavior patterns similar to the vector representations are retrieved. Attack behavior patterns refer to standard attack step sequences recorded in the knowledge base, specifically manifested as typical transition patterns from source event type to target event type during the attack process (i.e., TTPs transition patterns, such as "vulnerability scanning → remote code execution" or "account theft → data theft"). By using intelligence retrieval to find corresponding prototypes in real-world attack and defense scenarios for candidate causal edges, their existence in actual attacks is verified, significantly reducing the risk of false causality caused by large-scale model "illusions" and improving the practical adaptability of subsequent causal relationship determination. The maximum semantic similarity between the candidate causal edge and the retrieved attack behavior patterns is calculated as the intelligence support score for the corresponding candidate causal edge. The maximum semantic similarity is the maximum similarity between the vector combination of the candidate causal edge and the vector combinations of each attack behavior pattern in the knowledge base. Its calculation follows a specific logic: First, using a cosine similarity algorithm, the similarity between the starting event vector of the candidate causal edge and the source event vector of the attack behavior pattern, and the similarity between the target event vector of the candidate causal edge and the target event vector of the attack behavior pattern are calculated respectively. Then, the two similarity results are multiplied to obtain the combined similarity corresponding to a single attack behavior pattern. Finally, the maximum combined similarity is extracted from all retrieved attack behavior patterns. The intelligence support score is the quantified result of this maximum combined similarity, and its calculation formula is as follows:

[0045] in, V A As the initial event vector, V B For the target event vector, For the first k The source event vector of the attack mode, Let K be the target event vector of the k-th attack mode. SimThe cosine similarity score is calculated, with a score ranging from 0 to 1. A higher score indicates a higher degree of fit between the candidate causal edge and the actual attack pattern, reflecting a higher probability of the existence of the causal relationship in real-world scenarios.

[0046] The intelligence support score is weighted and fused with the significance score obtained from the statistical test to obtain the fused score. The significance score is the restricted score. PCMCI The quantitative index output by the algorithm (denoted as ) W pcmci The ), characterizing the statistical credibility of candidate causal edges, reflects the significance level of conditional independence and time-delay causal effects between events; weighted fusion is achieved through preset weight coefficients. λ 1 and λ 2. Intelligence support score (denoted as S cti The process of linearly combining the significance score and the final confidence score (i.e., the fusion score) is calculated using the following formula: W final = λ 1 W pcmci + λ 2 S cti ,in, λ 1 represents the weight of the statistical significance score. λ 2 represents the weight of the intelligence support score. The weight coefficient can be flexibly adjusted according to the needs of the actual application scenario. If the emphasis is on statistical rigor, it can be increased. λ 1. If the focus is on practical adaptability, it can be increased. λ 2; The fusion score comprehensively reflects the credibility of candidate causal edges in two dimensions: statistical logic and practical experience, realizing the complementary advantages of statistical quantitative analysis and practical intelligence support.

[0047] If the fusion score is lower than the preset threshold, the candidate causal edge is determined to be an invalid connection and a pruning operation is performed. The preset threshold is a critical value for the validity of causal relationships determined after verification in numerous attack and defense scenarios. It is used to accurately distinguish between credible attack causality and coincidental correlation / model illusion, and can be flexibly configured according to the defense needs of different industries and network environments. Invalid connections refer to candidate causal edges with a fusion score lower than the preset threshold. These connections either lack sufficient statistical significance or are not supported by actual attack patterns. Even if they are statistically significant, if their intelligence support is 0, they will still be judged as coincidental correlations and cannot constitute a true attack causal relationship. The pruning operation is the process of completely removing invalid connections from the candidate causal edge set, ensuring that the subsequently constructed causal graph only retains high-confidence connections, avoiding invalid connections interfering with the accurate presentation of the attack chain.

[0048] The candidate causal edges that have been verified and retained are used as valid causal connections to construct the network attack causal graph.

[0049] The candidate causal edges retained after verification are those with a fusion score higher than a preset threshold. These connections possess both statistical conditional independence and time-delayed causal effects, and are fully supported by real-world attack patterns, representing genuine and reliable attack causal relationships. Each retained edge is accompanied by a corresponding fusion score (final confidence level), which intuitively reflects its credibility. Valid causal connections are qualitative descriptions of these retained edges, indicating that they accurately reflect the real correlation between attack steps and conform to real-world attack logic and statistical laws. The network attack causal graph is a graph composed of all valid causal connections. Nodes in the graph correspond to security event types, and directed edges correspond to valid causal connections, clearly presenting the evolution path and causal relationships of attack behavior. Each directed edge can also be labeled with its final confidence level for intuitive reference in subsequent defense decisions.

[0050] Based on the above embodiments, as a preferred implementation, step S3, which instantiates the network attack causal graph into a structured causal model, specifically includes: The nodes in the network attack causal graph are transformed into endogenous variables of the structured causal model. The nodes in the network attack causal graph are valid security event types and network asset states (such as SQL injection alerts, firewall status, data breaches, etc.) determined through ternary verification, suitable for quantitative simulation scenarios of Advanced Persistent Threat (APT) defense decisions under a zero-trust architecture. The structured causal model (SCM) is a mathematical model containing endogenous variables, exogenous variables, and structural equations; its core structure is defined as... Endogenous variables (V) are directly observable variables in the model, corresponding to the specific state values ​​of nodes in the causal graph (such as SQL injection, "occurred" or "not occurred", "firewall status", "on" or "off"). These variables are the core objects that can be monitored and intervened in the process of attack and defense interaction.

[0051] Exogenous variables representing unobserved noise are introduced into the structured causal model. These exogenous variables (U) are unobserved variables introduced into the structured causal model, suitable for accurately characterizing uncertainties during an attack. They specifically include unobserved noise such as the attacker's hidden intent, random system fluctuations, and undetected environmental interference. Although these variables cannot be directly obtained, they significantly affect the strength of causal interactions between endogenous variables. Exogenous and endogenous variables together constitute the core variable system of the structured causal model. Exogenous variables provide random perturbation inputs to the model, while endogenous variables are the model's observed outputs, and the two are linked through structural equations. By introducing exogenous variables to recreate the complexity and uncertainty of the attack process, the model's fit to real-world attack scenarios is improved, laying the foundation for subsequent parameter calibration based on observational evidence and accurate simulation of defense effectiveness.

[0052] Based on the directed connections between nodes in the network attack causal graph, a set of structural equations describing the functional relationships between the endogenous variables is constructed. The directed connections between nodes in the network attack causal graph represent the causal orientation of the attack evolution logic (e.g., ...). SQL Injection → Data Leakage, Port Scanning → Vulnerability Exploitation) reflects the dependencies between endogenous variables; structural equations (F) are a set of mathematical expressions describing the quantitative relationships between endogenous variables and between endogenous and exogenous variables. For example, the structural equation for a data breach event can be expressed as:

[0053] in, for SQL Inject the endogenous variables corresponding to the event. These are endogenous variables corresponding to the firewall state. For exogenous noise variables, the function f The influence weights of each variable on the probability of a data breach event were quantified.

[0054] Based on the currently observed alarm evidence, the probability distribution of the exogenous variables is inferred to determine the current attack scenario. Here, the currently observed alarm evidence refers to specific security alarm information monitored in real time by edge nodes (such as detected...). SQL Injection alerts, abnormal port access alerts, etc., are denoted as E = e This is the core basis for reflecting the current attack situation; the probability distribution of exogenous variables is the probability of unobserved variable values ​​inferred from observed alarm evidence, and its calculation expression is: P ( U | V = e ), indicating that when the observed endogenous variable takes the value of e Under the condition of exogenous variables UThe posterior distribution; the inference method employs variational inference or MCMC Sampling techniques are used to reverse-calibrate the probability distribution of exogenous variables through observational evidence. The current attack scenario is determined by the specific attack scenario parameters (such as attacker intent, attack intensity, system latent vulnerability status, etc.) locked by the distribution of exogenous variables, thus adapting the general model to the specific attack scenario.

[0055] Based on the above embodiments, as a preferred implementation, in step S3, a local defense strategy for the edge node is generated according to the quantified ratio of security benefits to business costs, including: Intervention operations are performed on the defense variables in the structured causal model. These intervention operations are implemented based on the Do operator, used to cut off all incoming edges of the defense variables and fix their values ​​to a specified state. The defense variables are proactively adjustable security control parameters in the structured causal model, applicable to critical infrastructure defense decision-making scenarios, specifically including firewall operating status, port on / off status, IP blocking status, host isolation status, etc. The Do operator is a core intervention tool in Pearl causal theory; its mathematical logic is to eliminate interference from other variables by cutting off all incoming edges of the defense variable, and then forcibly fix its value to a specified state (such as blocked, open, or isolated). For example, intervention on firewall port defense variables can be represented as follows: do ( V FirewallStatus = Block Structured causal models are mathematical models that include endogenous variables, exogenous variables, and structural equations. Counterfactual models generated after intervention (denoted as...) M do (This is used to simulate a virtual scenario after a defense operation is carried out.)

[0056] In the counterfactual model after intervention, the reduction in the probability of achieving the attack target is calculated as a security gain. The counterfactual model is... Do The virtual scene model obtained after operator intervention shares the posterior distribution of exogenous variables with the original structured causal model, with only the state of the defense variables being fixed; the attack target is the event corresponding to the attacker's core intent, such as data leakage, theft of system privileges, or business system paralysis, corresponding to specific endogenous variables in the model (e.g., V DataLeak (This refers to a data breach incident); security gains are the reduction in the probability of an attack succeeding after implementing defensive interventions, and are calculated using the following formula:

[0057] in, e This is the current observed evidence of the warning. It is the probability of achieving an attack target without defensive intervention. It represents the probability of achieving the attack target after implementing defensive intervention; the larger the difference, the better the defense's effect in blocking the attack.

[0058] In the counterfactual model, the increase in the probability of disruption of critical business services is calculated as the business cost. Critical business services are those upon which the enterprise's core operations depend, such as ERP systems, customer management systems, web services, and payment settlement services, corresponding to business-related endogenous variables in the model (e.g., ...). (This refers to an event indicating business service unavailability). Business cost is the increase in the probability of critical business services being interrupted due to defensive operations after defensive intervention is implemented; its calculation formula is...

[0059] in, It represents the probability that business services will function normally without any defensive intervention. It represents the probability of business service interruption after defensive intervention is implemented. The larger the difference, the more severe the negative impact of the defense on the business. The counterfactual model provides scenario support for this calculation, which includes the impact of defensive intervention.

[0060] The defense investment return score is calculated based on the ratio of the security benefits to the business costs.

[0061] The defense ROI score is compared with a preset threshold, and a local defense strategy for the edge node is generated and output based on the comparison result.

[0062] The defensive return on investment score is a core indicator for comprehensively measuring the cost-effectiveness of a defensive strategy, and its calculation formula is as follows:

[0063] Wherein, ω is the business sensitivity weight, which is configured by the enterprise administrator according to the business priority (such as core business can be set to a higher ω), ε is a minimum constant, used to avoid the denominator being meaningless when the business cost is 0; security benefit and business cost are the quantitative results calculated in the first two steps respectively, and the ratio of the two directly reflects the security benefit obtained in exchange for a unit of business cost.

[0064] Based on the above embodiments, as a preferred implementation, step S4 specifically includes: S41. Each edge node will replace the local network attack causal graph, which has been verified by decision-making in S3, with a causal structure based on security ontology roles according to a predefined mapping relationship. The predefined mapping relationship is an asset-role mapping table maintained by the edge node, used to establish the correspondence between local specific assets and abstract security ontology roles. Security ontology roles are unified abstract semantic tags (such as Core_Database, Web_Gateway, Data_Server), which do not depend on specific asset configurations and are used to eliminate topological heterogeneity between different organizations (i.e., differences in configurations such as network asset IPs and deployment locations among enterprises). The causal structure based on security ontology roles is a standardized causal structure formed by replacing all specific asset nodes in the local causal graph with corresponding abstract ontology roles, retaining only the attack causal logic and stripping away specific asset identifiers. By abstracting role mapping to achieve semantic alignment of cross-domain causal structures, this approach addresses the shortcomings of existing technologies where there are significant differences in network topologies among different enterprises and the direct aggregation of causal structure semantics is ineffective. It transforms heterogeneous local causal graphs into homogeneous standardized structures, providing a unified data foundation for subsequent global aggregation. This breaks down the semantic barriers to cross-domain collaboration, ensuring that causal knowledge from different organizations can be effectively aggregated, while avoiding the leakage of specific local network topology information, thus balancing collaboration and privacy protection.

[0065] S42. Add Laplace noise to the causal structure based on the security ontology role to perform differential privacy protection; wherein, the causal structure based on the security ontology role is the standardized causal structure transformed in S41, and its core data form is an adjacency matrix representing the causal relationship between nodes; the Laplace noise is random noise to achieve differential privacy protection, and the noise generation follows a specific mathematical logic, specifically by adding Laplace noise to the adjacency matrix of the causal structure. A After adding noise, the result is A The calculation formula is: A ' =A+Lplace(0, / ε) in, The sensitivity of the adjacency matrix (characterizing the magnitude of changes in matrix data). ε For privacy budget ( ε The smaller the value, the stronger the privacy protection; this can be configured by the administrator. Differential privacy protection is a privacy protection technology that prevents attackers from inferring the local network topology or sensitive asset information of edge nodes through the aggregated causal structure by adding noise to interfere with the original data.

[0066] S43. Upload the privacy-protected causal structure data to the central server. The privacy-protected causal structure data is a standardized causal structure adjacency matrix data with added Laplace noise, suitable for cross-domain data transmission and global aggregation scenarios. The data only contains causal relationships and noise interference information between abstract ontology roles, and does not involve any local specific asset details. The central server is deployed in the enterprise headquarters data center or private cloud. Its core functions include maintaining the global threat intelligence (CTI) knowledge base, running federated aggregation algorithms, and distributing global defense strategies. It is the core hub for cross-domain collaborative defense.

[0067] S44. The central server uses a minimum-maximum regret algorithm to aggregate the data uploaded by each edge node to generate a global causal graph; wherein, the aggregation aims to minimize the maximum performance regret value; the maximum performance regret value refers to the maximum performance loss incurred by all participating nodes when using the global causal graph.

[0068] Among them, the minimum-maximum regret algorithm is a federated aggregation algorithm for non-independent identically distributed (Non-IID) data. It is suitable for cross-domain defense scenarios where the attack patterns of participating organizations differ. Its core optimization objective is to find a global causal graph. G This ensures that when any participating node k uses the global graph, it is more efficient than using its local optimal graph. G k The maximum value of the resulting performance loss (i.e., regret value) is minimized, and the calculation formula is:

[0069] in, For nodes k Using the global graph G The loss of defensive capabilities For nodes k Use the best local map The defensive performance loss; the global causal graph is an attack causal graph formed by aggregation with strong generalization ability, which can cover various attack variants encountered by different organizations (such as...). A Bank SQL Inject variants, B (A variant of a bank's phishing email); The maximum performance regret value is the upper limit of performance loss when all participating nodes use the global graph. Minimizing this value can ensure that the global graph has reliable defense adaptability for all participants.

[0070] This invention also provides a distributed network defense system based on multimodal verification and counterfactual inference, based on the federated learning network defense method based on multimodal verification and counterfactual inference in the above embodiments, such as... Figure 5As shown, the system includes multiple edge nodes 510 and a central server 520; The edge node 510 includes: Log processing module 51 is used to perform streaming clustering on locally collected heterogeneous security logs to obtain log template clusters, extract representative samples from each log template cluster, perform semantic annotation through a quantized large language model, and broadcast the annotated semantic tags to all logs in the corresponding log template cluster to generate a time-series event-attribute matrix. Causal analysis module 512 is used to construct a network attack causal graph based on the time-series event-attribute matrix, through sequential semantic prior filtering of a large language model, statistical verification of a restricted PCMCI algorithm, and external threat intelligence support verification. The local decision module 513 is used to instantiate the network attack causal graph into a structured causal model, infer the posterior distribution of exogenous variables in the structured causal model based on the currently observed alarm evidence, calculate the decrease in the probability of the attack target being achieved and the increase in the probability of the critical business service being interrupted in a counterfactual scenario by simulating the intervention operation on the defense variables, respectively; and generate a local defense strategy for the edge node based on the quantified ratio of security benefits to business costs. The collaborative preprocessing module 514 is used to map the local network attack causal graph after decision verification to a unified security ontology layer to eliminate topological heterogeneity and to perform differential privacy protection processing on the mapped causal graph structure. The central server 520 includes: The federated aggregation module 521 is used to receive the processed causal graph structure data uploaded by each edge node 510, and aggregate it using the minimum-maximum regret algorithm to generate a global causal graph.

[0071] Based on the same concept, this invention also provides a schematic diagram of a physical structure, such as... Figure 6 As shown, the server may include a processor 610, a communications interface 620, a memory 630, and a communication bus 640. The processor 610, communications interface 620, and memory 630 communicate with each other via the communication bus 640. The processor 610 can invoke logical instructions stored in the memory 630 to execute the steps of the federated learning network defense method based on multimodal verification and counterfactual inference as described in the above embodiments.

[0072] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0073] Based on the same concept, embodiments of the present invention also provide a non-transitory computer-readable storage medium storing a computer program containing at least one piece of code that can be executed by a master control device to control the master control device to implement the steps of the federated learning network defense method based on multimodal verification and counterfactual inference as described in the above embodiments.

[0074] Based on the same technical concept, this application also provides a computer program, which, when executed by a main control device, is used to implement the above-described method embodiments.

[0075] The program may be stored, in whole or in part, on a storage medium packaged with the processor, or in part or in whole on a memory not packaged with the processor.

[0076] Based on the same technical concept, this application also provides a processor for implementing the above-described method embodiments. The processor can be a chip.

[0077] The various embodiments of the present invention can be combined arbitrarily to achieve different technical effects.

[0078] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A federated learning network defense method based on multimodal verification and counterfactual inference, characterized in that, include: S1. Perform streaming clustering on heterogeneous security logs at edge nodes to obtain log template clusters. Extract representative samples from each log template cluster, perform semantic annotation through a quantized large language model, and broadcast the annotated semantic labels to all logs in the corresponding log template cluster to generate a time-series event-attribute matrix. S2. Based on the time-series event-attribute matrix, a network attack causal graph is constructed by sequentially performing semantic prior filtering of the large language model, statistical verification of the restricted PCMCI algorithm, and external threat intelligence support verification. S3. Instantiate the network attack causal graph into a structured causal model. Based on the currently observed alarm evidence, infer the posterior distribution of exogenous variables in the structured causal model. By simulating intervention operations on defense variables, calculate the decrease in the probability of the attack target being achieved and the increase in the probability of critical business service interruption in a counterfactual scenario. Based on the quantified ratio of security benefits to business costs, a local defense strategy is generated for the edge nodes; S4. Each edge node will map the local network attack causal graph verified by S3 to a unified security ontology layer to eliminate topological heterogeneity, and perform differential privacy protection processing on the mapped causal graph structure. The processed causal graph structure data will be uploaded to the central server, which will use the minimum-maximum regret algorithm to aggregate and generate a global causal graph.

2. The federated learning network defense method based on multimodal verification and counterfactual inference according to claim 1, characterized in that, S1 specifically includes: S11. Log preprocessing: Extract basic metadata such as timestamps, hostnames, and severity from heterogeneous security logs, and remove interfering characters. S12. An improved tree edit distance algorithm is used to perform streaming clustering on the preprocessed heterogeneous security logs to generate multiple log template clusters; S13. When a new log template cluster is generated or the accumulated amount of logs in an existing log template cluster reaches a preset threshold, 1 to 3 logs are extracted from the corresponding log template cluster as representative samples. S14. Using a quantized large language model deployed on edge nodes, the representative samples are semantically annotated to obtain semantic tags containing attack intent, entity, attack stage, and MITRE ATT&CK technology ID. S15. Broadcast the semantic tags obtained from semantic annotation to all logs in the corresponding log template cluster, and fill the identified variable information in the log template cluster into the specified fields of the semantic tags to generate a time-series event-attribute matrix.

3. The federated learning network defense method based on multimodal verification and counterfactual inference according to claim 1, characterized in that, S2 specifically includes: S21. Based on the time-series event-attribute matrix, use a large language model to make a logical rationality judgment on the event types in the time-series event-attribute matrix in order to generate a prior adjacency matrix. S22. Based on the constraints of the prior adjacency matrix, perform the conditional independence test and time-delay causality test of the restricted PCMCI algorithm to identify candidate causal edges; S23. Based on the external threat intelligence database, the candidate causal edges are vectorized similarity matching intelligence support verification. The obtained intelligence support score is fused with the statistical significance score. Based on the fusion result, valid causal connections are determined and retained to construct the network attack causal graph.

4. The federated learning network defense method based on multimodal verification and counterfactual inference according to claim 3, characterized in that, S23 specifically includes: Convert the starting event type and target event type corresponding to the candidate causal edge into vector representations; In a vectorized threat intelligence knowledge base, retrieve attack behavior patterns similar to the vector representation; The maximum semantic similarity between the candidate causal edge and the retrieved attack behavior pattern is calculated and used as the intelligence support score of the corresponding candidate causal edge. The intelligence support score is weighted and fused with the significance score obtained from the statistical test to obtain the fused score; If the fusion score is lower than the preset threshold, the candidate causal edge is determined to be an invalid connection and a pruning operation is performed. The candidate causal edges that have been verified and retained are used as valid causal connections to construct the network attack causal graph.

5. The federated learning network defense method based on multimodal verification and counterfactual inference according to claim 1, characterized in that, In step S3, the network attack causal graph is instantiated into a structured causal model, specifically including: The nodes in the network attack causal graph are transformed into endogenous variables of the structured causal model; To introduce exogenous variables representing unobserved noise into the structured causal model; Based on the directed connections between nodes in the network attack causal graph, construct a set of structural equations describing the functional relationships between the endogenous variables; Based on the currently observed alarm evidence, the probability distribution of the exogenous variables is inferred to determine the current attack scenario.

6. The federated learning network defense method based on multimodal verification and counterfactual inference according to claim 5, characterized in that, In step S3, a local defense strategy for the edge node is generated based on the quantified ratio of security benefits to business costs, including: An intervention operation is performed on the defensive variable in the structured causal model; the intervention operation is implemented based on the Do operator, which is used to cut off all incoming edges of the defensive variable and fix the value of the defensive variable to a specified state; In the counterfactual model after intervention, the reduction in the probability of achieving the attack target is calculated as a security gain; In the counterfactual model, the increase in the probability of critical business service interruption is calculated as a business cost; Calculate the defense investment return score based on the ratio of the security benefits to the business costs; The defense ROI score is compared with a preset threshold, and a local defense strategy for the edge node is generated and output based on the comparison result.

7. The federated learning network defense method based on multimodal verification and counterfactual inference according to claim 1, characterized in that, S4 specifically includes: S41. Each edge node will replace the local network attack causal graph after decision verification based on S3 with a causal structure based on security ontology roles according to the predefined mapping relationship. S42. Add Laplace noise to the causal structure based on the security ontology role to perform differential privacy protection; S43. Upload the privacy-protected causal structure data to the central server; S44. The central server uses a minimum-maximum regret algorithm to aggregate the data uploaded by each edge node to generate a global causal graph; wherein, the aggregation aims to minimize the maximum performance regret value; the maximum performance regret value refers to the maximum performance loss incurred by all participating nodes when using the global causal graph.

8. A distributed network defense system based on multimodal verification and counterfactual inference, characterized in that, Includes multiple edge nodes and a central server; The edge nodes include: The log processing module is used to perform streaming clustering on locally collected heterogeneous security logs to obtain log template clusters, extract representative samples from each log template cluster, perform semantic annotation through a quantized large language model, and broadcast the annotated semantic tags to all logs in the corresponding log template cluster to generate a time-series event-attribute matrix. The causal analysis module is used to construct a network attack causal graph based on the time-series event-attribute matrix, through sequential semantic prior filtering of a large language model, statistical verification of a restricted PCMCI algorithm, and external threat intelligence support verification. The local decision-making module is used to instantiate the network attack causal graph into a structured causal model, infer the posterior distribution of exogenous variables in the structured causal model based on currently observed alarm evidence, calculate the decrease in the probability of attack target achievement and the increase in the probability of critical business service interruption in a counterfactual scenario by simulating intervention operations on defense variables, and generate a local defense strategy for the edge node based on the quantified ratio of security benefits to business costs. The collaborative preprocessing module is used to map the local network attack causal graph after decision verification to a unified security ontology layer to eliminate topological heterogeneity and perform differential privacy protection processing on the mapped causal graph structure. The central server includes: The federated aggregation module receives the processed causal graph structure data uploaded by each edge node and aggregates it using the minimum-maximum regret algorithm to generate a global causal graph.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the federated learning network defense method based on multimodal verification and counterfactual deduction as described in any one of claims 1 to 7.

10. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by a processor, the computer program implements the steps of the federated learning network defense method based on multimodal verification and counterfactual deduction as described in any one of claims 1 to 7.

Images