Cross-domain alarm aggregation strategy self-adaption method and system under node image constraint

Abstract

The application provides a node image constraint cross-domain alarm fusion strategy self-adaption method and system, the method comprises the following steps: generating a security capability image, deriving an executable action set and a performance budget; collecting cross-domain alarms and normalizing them into a unified event model, forming an associated event cluster in an aggregation window, calculating a risk score and mapping it into an event level, decomposing the risk score input, outputting a main cause category and a confidence degree; according to the event level and the main cause category, selecting a strategy vector under the condition of meeting the capability and cost constraints, issuing the strategy to a target node and performing consistency verification based on the strategy abstract; verifying the treatment effect, executing an upgrade or fallback strategy and setting a cooling time when the verification fails or does not pass, and storing the audit records and evidence chain generated in the whole process. The application can realize cross-domain alarm fusion research and judgment, interpretable risk decomposition, strategy self-adaption under the condition of capability constraints, effectiveness consistency verification and closed-loop treatment.

Description

Technical Field

[0001] This invention relates to the field of cybersecurity and automated security operation technology for industrial control systems, and in particular to a self-adaptive method and system for cross-domain alarm fusion strategy under node profiling constraints. Background Technology

[0002] The power plant's DCS control area undertakes critical tasks such as unit operation control, measurement point acquisition and monitoring, interlocking protection, and operation and maintenance configuration. It requires high availability and strong real-time performance, while also meeting compliance requirements related to critical information infrastructure and security assessment. In actual projects, the control area typically deploys various security devices and systems, including network boundary protection, industrial security probes, host auditing, identity authentication and access control components, cryptographic devices / machines, asset management systems, and security management platforms. These devices continuously generate a large amount of heterogeneous alarm and event data. The operation and maintenance team needs to integrate, analyze, and classify this cross-domain data, and quickly control risks while ensuring business continuity.

[0003] However, existing control zone security operation and handling solutions typically have the following shortcomings: First, the formats and semantics of multi-source alarm data vary greatly, lacking a unified event model and a stable correlation clustering mechanism, making it difficult to form correlation event clusters oriented towards nodes, sessions, and business semantics, resulting in insufficient accuracy in judgment; Second, the capabilities of control zone node devices vary significantly, with different nodes having varying degrees of support for national cryptographic algorithms, strong authentication, transmission protection, audit retention, and performance overhead. Existing solutions lack an expression of an "executable action set" constrained by a single node capability profile, which can easily lead to situations where policies cannot be executed, are executed incompletely, or cause business disruptions after being issued; Third, many solutions only provide risk levels or alarm lists, lacking an interpretable decomposition of risk sources and a summary of "main cause categories," making automated handling difficult. The system suffers from several problems: First, it lacks targeted measures and makes it difficult to explain to auditors and operations staff why a specific strategy is chosen or why a particular strategy is selected. Second, the strategy selection lacks multi-dimensional quantification and budget constraints on expenses, making it impossible to establish verifiable constraints between security enhancement and real-time / resource consumption. This results in either overly aggressive measures that negatively impact business operations or underly aggressive measures that fail to effectively mitigate risks. Third, the lack of a consistency verification mechanism between strategy issuance and implementation creates the potential for inconsistencies between the issued strategy and the actual effective strategy at the node, leading to ineffective measures. Fourth, the lack of a mechanism for verifying the effectiveness of measures, escalating / rollback, and cooling-off convergence makes it prone to ineffective or fluctuating measures. Fifth, the lack of an evidence chain that runs through the entire process of "normalization—clustering—judgment—issuance—verification—convergence" hinders compliance checks and post-event traceability.

[0004] Therefore, there is an urgent need for a closed-loop method for the DCS control area of ​​power plants, which can introduce single-node capability profiles and performance budget constraints on the basis of cross-domain alarm fusion analysis, and achieve self-adaptive policy selection through interpretable main cause mapping and multi-dimensional overhead constraints; at the same time, it can achieve automatic implementation and handling that is scalable / rollbackable, convergent, and auditable through policy summary consistency verification and effect verification. Summary of the Invention

[0005] The purpose of this invention is to provide a self-adaptive method and system for cross-domain alarm fusion strategies under node profiling constraints, aiming to solve the problems existing in the prior art, such as "difficulty in unified modeling and correlation clustering of cross-domain alarms, failure to combine node capabilities leading to unexecutable strategies or disruption of business, lack of explainable decomposition of risk sources and main cause summarization, lack of multi-dimensional cost quantification and budget constraints, lack of consistency verification of strategy effectiveness, lack of verification of handling effects and escalation / rollback convergence mechanism, and lack of evidence chain storage and audit traceability capabilities".

[0006] In a first aspect, the present invention provides a self-adaptive method for cross-domain alarm fusion strategy under node profile constraints, the method comprising: A single-node security capability profile is generated for the target node within the control area, and the set of executable actions and performance budget of the node are derived from the single-node security capability profile. Collect cross-domain alarm data and normalize it into a unified event model. Based on the set of association keys, form a cluster of related events in the aggregation window. Calculate the risk score based on the cluster of related events, decompose the input items of the risk score into contribution, and output the event level and an interpretable decomposition field containing the main cause category and its confidence level. Based on the event level and the main cause category, and under the premise of satisfying the capability constraints of the executable action set and the overhead constraints of the performance budget, a strategy vector is selected from the strategy library and a set of distribution strategies and actions is generated. The strategy is then distributed to the target node or compensation node, an execution receipt is obtained, and a consistency check is performed based on the strategy summary. The check result is then output. The effectiveness of the policy after it takes effect is verified based on the verification results. If the verification fails or fails, the policy is upgraded or rolled back and a cooldown period is set. Audit records and evidence chains are generated and stored throughout the process.

[0007] In some embodiments, the step of generating a single-node security capability profile for a target node within the control area, and deriving a set of executable actions and a performance budget from the single-node security capability profile, includes: Establish an asset ledger for the control area, collect one or more of the following from each node: national cryptographic algorithm capabilities, identity authentication capabilities, transmission protection capabilities, log auditing capabilities, trustworthiness, and performance budget, and generate a single node security capability profile. The set of executable actions for a node is derived from the single-node security capability profile. The derivation rules include: allowing log level upgrades when log auditing capabilities meet the upper limit of log level; allowing strong authentication upgrades when identity authentication capabilities meet strong authentication capabilities; allowing enhanced transmission protection when transmission protection capabilities meet transmission protection capabilities; allowing access control tightening or read-only access when the node has an access control interface; and allowing blocking or isolation when the node has an isolation interface or can be controlled by the boundary.

[0008] In some embodiments, the steps of collecting cross-domain alarm data and normalizing it into a unified event model, forming a cluster of related events within an aggregation window based on a set of association keys, calculating a risk score based on the clusters of related events, decomposing the input items of the risk score into contribution, and outputting the event level and an interpretable decomposition field containing the main cause category and its confidence level include: Collect alarm data from at least one type of device, including network boundary protection equipment, industrial security probes, host auditing systems, identity authentication and access control systems, cryptographic devices, asset management systems, or security management platforms, and convert the collected alarm data into a unified event model that includes event type, timestamp, source identifier, target identifier, severity, confidence level, scope of impact, and evidence summary. Based on at least one association key from the device dimension, session dimension, business semantic dimension and time dimension, the unified event model is associated and aggregated within the aggregation window to form associated event clusters, and the clustering density and homology clustering degree are calculated. The risk score is calculated by fusing alarm severity, alarm confidence, cluster density, homogeneity clustering, node credibility penalty, and the hit status of sensitive objects or sensitive write operations. The risk score is normalized to the range of 0 to 1, and mapped to an event level according to a preset threshold set. The event level includes at least four levels: general, attention, severe, and emergency. Calculate the contribution vector for each input item of the risk score, output the top k items with the largest contribution as the basis for interpretation, map the risk source to the main cause category based on the contribution vector and the main cause category threshold set, and calculate the main cause confidence.

[0009] In some embodiments, the step of selecting a policy vector from the policy library and generating a set of policies and actions to be issued, based on the event level and the cause category, while satisfying the capability constraints of the set of executable actions and the overhead constraints of the performance budget, includes: Select the corresponding policy vector from the contingency plan library based on the event level and the cause category. The policy vector includes at least one or more of the following: audit enhancement, access control tightening, strong authentication upgrade, transmission protection enhancement, rate limiting, read-only, isolation, work order triggering, or alarm suppression. Prioritize strategies based on the primary cause category: when the primary cause category includes identity and permission anomalies, choose strong authentication upgrade and access control tightening; when the primary cause category includes network and traffic anomalies, choose rate limiting and isolation; when the primary cause category includes host and process anomalies, choose host-side handling and isolation; when the primary cause category includes password and certificate anomalies, choose certificate-related policies and blocking; when the primary cause category includes audit gaps, choose audit enhancement. The estimated cost of the strategy vector is calculated using a multi-dimensional cost weighting function. The cost includes at least the latency increment, the number of interactions increment, the CPU usage increment, and the log increment. When the estimated cost exceeds the performance budget or the latency increment exceeds the upper limit of latency, it is automatically replaced with a combination of cost reduction strategies.

[0010] In some embodiments, the steps of issuing the policy to the target node or compensation node, obtaining an execution receipt, performing a consistency check based on the policy digest, and outputting the check result include: The policy is issued to the target node or compensation node. The issued policy shall include at least the policy identifier, target node, parameter set, effective time window, version number, rollback conditions and recovery conditions. The SM3 algorithm is used to generate strategy summaries. Obtain the execution receipt returned by the target node or the compensation node. The execution receipt includes at least the policy identifier, the target node, the execution result, the effective time, and the policy summary calculated on the node side. The policy digest calculated by the node is compared with the policy digest generated by the sending side. If they match, the consistency check is considered to have passed. Otherwise, the consistency check is considered to have failed, and at least one of the following is triggered: retry, execution by the compensation node, or policy upgrade.

[0011] In some embodiments, the step of verifying the effect of the policy after it takes effect based on the verification result, and executing an upgrade or rollback policy and setting a cooldown time when the verification fails or fails, includes: The effectiveness of the handling is verified based on the set of verification items and the achievement criteria. The verification items include at least one or more of the following: alarm convergence rate, abnormal indicator decrease, access control hit rate change, node health improvement, and sensitive write operation interception ratio. The achievement criteria include that the verification items reach the threshold within the duration and the key business disturbance does not exceed the upper bound. When the consistency check passes and the set of verification items and the achievement criteria pass the verification of the handling effect, the handling process ends and enters the audit record generation stage; When consistency verification fails or fails, the triggering conditions are determined: if the alarm density increases, the risk score rises above the threshold, or a highly sensitive write operation is hit, an upgrade strategy is executed. The upgrade action includes at least one of isolation, strong authentication upgrade, or further tightening of access control. When business disturbances exceed the upper limit, performance overhead exceeds the performance budget, or the event level drops below the threshold and remains below the preset time, a rollback strategy is executed.

[0012] In some embodiments, the step of storing the audit records and evidence chain generated throughout the entire process further includes: Generate an evidence package, which includes at least a normalized event model, association key hit status, cluster density and homology clustering degree, risk score and event level, contribution decomposition and main cause category and confidence level, strategy selection basis and cost assessment, strategy issuance and execution receipt, strategy summary and consistency verification results, verification results, and upgrade or rollback trajectory. Generate a digest of the evidence package and sign and store it as evidence or write it into trusted storage; Output audit logs, which at least include target node identifier, timestamp, associated event cluster identifier, risk score, event level, interpretable decomposable field, main cause category and confidence level, policy identifier, estimated cost, policy summary, execution receipt, consistency check result, verification result, upgrade or rollback identifier, and evidence package hash value.

[0013] Secondly, this invention provides a self-adaptive system for cross-domain alarm fusion strategies under node profiling constraints, the system comprising: The profile generation module is used to generate a single-node security capability profile for target nodes within the control area, and derive the set of executable actions and performance budget of the node from the single-node security capability profile. The risk assessment module is used to collect cross-domain alarm data and normalize it into a unified event model. Based on the set of association keys, it forms a cluster of related events in the aggregation window, calculates the risk score based on the cluster of related events, decomposes the input items of the risk score into contribution, and outputs the event level and an interpretable decomposition field containing the main cause category and its confidence level. The verification module is used to select a strategy vector from the strategy library and generate a set of deployment strategies and actions based on the event level and the cause category, under the premise of satisfying the capability constraints of the set of executable actions and the overhead constraints of the performance budget, deploy the strategy to the target node or compensation node, obtain the execution receipt, perform consistency verification based on the strategy summary, and output the verification result. The verification module is used to verify the effect of the policy after it takes effect based on the verification result. When the verification fails or fails, the module executes the upgrade or rollback policy and sets a cooldown time. The module also generates audit records and evidence chains for the entire process and stores them.

[0014] Thirdly, the present invention provides a storage medium that stores one or more programs, which, when executed by a processor, implement the above-mentioned self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints.

[0015] Fourthly, the present invention provides an electronic device, the electronic device comprising a memory and a processor, wherein: The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the above-mentioned self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints.

[0016] Compared with the prior art, the present invention has the following advantages: This invention establishes a control zone asset ledger and generates a single-node security capability profile for each target node, based on the set of executable actions and performance budget of the derived nodes. It collects alarm or event data from cross-domain security devices and systems and normalizes it into a unified event model. Based on a set of association keys including device, session, business semantic, and time dimensions, it forms associated event clusters within an aggregation window, calculating cluster density and homogeneity. Based on the associated event clusters, it calculates a risk score by fusing severity, confidence, clustering indicators, node credibility penalty items, and sensitivity hit indicators. The risk score input items are decomposed into contribution values. Based on the contribution value and threshold set, the risk source is mapped to the main cause category, and the main cause confidence is calculated. Under the premise of satisfying capability constraints and performance budget constraints, it determines the risk score based on event level. The system selects a strategy vector based on the root cause category and applies budget constraints using a multi-dimensional overhead weighting function that includes latency increment, interaction increment, CPU usage increment, and log increment to generate a set of distribution strategies and actions. It then distributes the strategies to target nodes or compensation nodes and obtains execution receipts. A strategy summary is generated based on a national cryptographic hash algorithm and its consistency is verified with the node side. The system verifies the effectiveness of the strategy after it takes effect, and if the consistency verification fails or the verification fails, it triggers an upgrade / rollback and sets a cooldown time to prevent oscillations in the handling process. Finally, it forms an evidence package from normalized events, cluster analysis, explainable root causes, strategy selection and overhead assessment, distribution and consistency verification, verification results, and upgrade / rollback trajectories, and performs summary storage and audit output, thereby achieving an interpretable, implementable, verifiable, and convergent closed-loop automatic handling process. Attached Figure Description

[0017] Figure 1 This is a flowchart of a self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints in one embodiment of the present invention; Figure 2 This is a schematic diagram of the structure of a self-adaptive system for cross-domain alarm fusion strategy under node profiling constraints according to an embodiment of the present invention.

[0018] The following detailed description, in conjunction with the accompanying drawings, will further illustrate the present invention. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention. Unless otherwise defined, the technical or scientific terms used herein should have the ordinary meaning understood by those skilled in the art. The terms "comprising" and similar expressions used herein mean that the element or object preceding the word covers the element or object listed after the word and its equivalents, but does not exclude other elements or objects.

[0020] Example 1 like Figure 1 As shown, an embodiment of the present invention proposes a self-adaptive method for cross-domain alarm fusion strategy under node profile constraints. The method includes steps S101 to S104, wherein: Step S101: Generate a single-node security capability profile for the target node in the control area, and derive the set of executable actions and performance budget of the node from the single-node security capability profile; It should be noted that the security capabilities of different nodes in the power plant's DCS control area vary significantly. Some nodes support national cryptographic algorithms and strong authentication, while others have limited capabilities; some nodes possess complete log auditing capabilities, while others have limited storage capacity. Without modeling node capabilities, subsequent policy deployments may fail or cause business disruptions due to nodes not supporting certain actions. Therefore, this embodiment first establishes an asset ledger for each target node within the control area, collecting information such as the node's national cryptographic algorithm capabilities, identity authentication capabilities, transmission protection capabilities, log auditing capabilities, trustworthiness, and performance budget, generating a single-node security capability profile. Based on this profile, the system further derives a set of executable actions for the node, clarifying what the node "can and cannot do." For example, if a node has strong authentication capabilities, it is allowed to execute the "strong authentication upgrade" action; if a node has an access control interface, it is allowed to execute the "access control tightening" action. Simultaneously, the system extracts the node's performance budget (such as maximum tolerable latency overhead and CPU usage limits) as an overhead constraint for subsequent policy selection. The set of executable actions and performance budget output by this step will serve as the core constraints for strategy selection, ensuring that the selected strategy can be actually implemented on the node without exceeding its performance capacity.

[0021] Furthermore, in some embodiments, a set of executable actions for the node needs to be derived from the profile, with the derivation rules bound to the specific capabilities of the node: when the log auditing capability meets the upper limit of the log level, the "log level upgrade" action is allowed; when the identity authentication capability meets the strong authentication capability, the "strong authentication upgrade" action is allowed; when the transmission protection capability meets the transmission protection requirements, the "transmission protection enhancement" action is allowed; when the node has an access control interface, the "access control tightening" or "read-only" action is allowed; when the node has an isolation interface or can be controlled by a boundary device, the "blocking" or "isolation" action is allowed. For actions that the target node does not have the capability to execute, the system does not directly abandon them, but selects a compensating node to execute an equivalent action. The compensating node can be an access gateway, a boundary protection device, or a security management platform, for example, replacing "node-side strong authentication upgrade" with "access gateway-side strong authentication upgrade". Finally, the set of executable actions for the node and the performance budget are used as the capability constraints and overhead constraints inputs for subsequent policy selection to ensure that the selected policy can be implemented on the node without exceeding the node's performance capacity.

[0022] Step S102: Collect cross-domain alarm data and normalize it into a unified event model. Based on the set of association keys, form a cluster of related events in the aggregation window. Calculate the risk score based on the cluster of related events, decompose the input items of the risk score into contribution, and output the event level and an interpretable decomposition field containing the main cause category and its confidence level. In this step, the power plant's DCS control area typically deploys various types of security devices, such as boundary protection devices, industrial security probes, host auditing systems, cryptographic devices, and asset management systems. These devices generate alarms with varying formats and inconsistent semantics, and many alarms may point to the same security event. Therefore, the system first collects raw alarm data from these devices and converts it into a standardized event model that includes event type, timestamp, source identifier, target identifier, severity, confidence level, impact scope, and evidence summary, eliminating semantic differences between multi-source data. Then, based on association keys such as device dimension, session dimension, business semantic dimension, and time dimension, alarms with the same source, target, or business context are grouped into related event clusters within an aggregation window, and cluster density and homogeneity are calculated. Based on these related event clusters, the system integrates alarm severity, confidence level, cluster density, homogeneity, node credibility penalty, and sensitive object hit status to calculate and normalize a risk score. This score is then mapped to an event level based on preset thresholds, with at least four levels: general, concerning, severe, and urgent. To ensure the interpretability of decision-making, the system decomposes the contribution of each input item in the risk score, outputs the top few items with the largest contribution as the basis for explanation, and maps the risk source to the main cause category and its confidence level based on the contribution.

[0023] Specifically, in some embodiments, risk scoring The following indicators were combined and normalized to obtain the results. :

[0024] in, To score the risk, For normalization function, The severity level of the alarm is extracted from the severity level field in the alarm data, reflecting the degree of harm caused by the alarm itself. The alarm confidence level, extracted from the confidence field in the alarm data, reflects the reliability of the alarm as being true. Cluster density represents the number or frequency of events within a clustering window. Higher density indicates more related events within the same time period, potentially suggesting higher risk. Homogeneity clustering indicates the proportion of hits from the same source identifier or the same subset of association keys. A higher clustering degree indicates that the alarm sources are more concentrated. Based on node credibility Exported credibility penalty item, The indicator was hit for sensitive objects or sensitive write operations. As weight and .

[0025] Next, a contribution vector is calculated for each input item in the risk score, and the top k items with the largest contributions (k ranges from 1 to 5) are output as the basis for interpretation. Finally, based on the contribution vector and the set of thresholds for the main cause categories, the risk sources are mapped to the main cause categories, including five categories: identity and permission anomalies, network and traffic anomalies, host and process anomalies, password and certificate anomalies, and audit gaps or untraceability. The confidence level of the main cause is then calculated (obtained by aggregating the contribution ratio of the main cause and the confidence level of the event).

[0026] Step S103: Based on the event level and the main cause category, and under the premise of satisfying the capability constraints of the executable action set and the overhead constraints of the performance budget, select a strategy vector from the strategy library and generate a set of distribution strategies and actions. Distribute the strategy to the target node or compensation node, obtain the execution receipt, perform consistency verification based on the strategy summary, and output the verification result. It should be noted that the issued policy must include at least a policy identifier (uniquely identifying the policy), target node (the target device on which the policy applies), parameter set (the specific execution parameters of the policy), effective time window (the time range within which the policy is effective), version number (the version identifier of the policy), and rollback and recovery conditions (the triggering conditions when the policy needs to be rolled back or recovered). Secondly, the system uses the SM3 national cryptographic digest algorithm to generate the policy digest, and the calculation formula is as follows: ,in, For strategy summary, It uses the SM3 national cryptographic digest algorithm. For strategy identification, Identify the target node. This is a set of parameters, containing the specific parameters required for policy execution, such as rate limiting rate and isolation duration. The effective time window refers to the time range within which the policy takes effect, used to verify whether the policy takes effect within the expected time. This serves as the version identifier for the strategy.

[0027] Next, the policy identifier, target node, parameter set, effective time window, and version number are concatenated to calculate a hash value, which uniquely identifies the policy content. Then, the system obtains the execution receipt returned by the target node or compensation node. The execution receipt includes at least the policy identifier (the identifier corresponding to the issued policy), the target node (the node executing the policy), the execution result (success or failure), the effective time (the actual time the policy takes effect), and a second policy digest calculated by the node (a digest recalculated by the node based on the received policy content). Finally, the system compares the second policy digest calculated by the node with the policy digest generated by the sending side: if they match, the consistency check passes, indicating that the issued policy and the effective policy of the node are completely consistent; otherwise, the consistency check fails, indicating that the policy has been tampered with or erroneous during transmission or effectiveness. In this case, at least one of the following actions is triggered: retry, execution by the compensation node, or policy upgrade.

[0028] After obtaining the event level and root cause category, the system needs to automatically select a strategy that can effectively handle the current risk, while ensuring that the selected strategy can be actually executed on the target node without exceeding its performance budget. First, the system selects the corresponding strategy vector from the strategy library based on the event level and root cause category, and determines the strategy priority based on the root cause category. For example, strong authentication upgrades are prioritized for identity anomalies, and rate limiting and isolation are prioritized for traffic anomalies. Then, the system uses a multi-dimensional cost weighting function to calculate the estimated cost of the strategy vector, including latency increment, interaction increment, CPU usage increment, and log increment, and compares it with the performance budget. If the estimated cost exceeds the budget or the latency increment exceeds the upper bound, it is automatically replaced with an alternative strategy combination that reduces cost. Simultaneously, the system selects actions that meet the capability constraints from the set of executable actions on the node, generating a set of deployment strategies and actions. The system deploys the strategy to the target node or compensation node, obtains execution receipts, and uses the SM3 algorithm to generate a strategy summary, which is compared with the strategy summary calculated on the node side to verify whether the "deployed strategy" and the "effective strategy" are consistent. This consistency verification mechanism addresses the hidden risk of "policies being issued but not actually taking effect," ensuring that policies are truly implemented.

[0029] Specifically, based on the event level and root cause category, a corresponding policy vector is selected from the policy library. The policy vector must include at least one or more of the following: audit enhancement, access control tightening, strong authentication upgrade, transmission protection enhancement, rate limiting, read-only, isolation, ticket triggering, or alarm suppression. Then, policy priorities are determined based on the root cause category: when the root cause category includes identity and permission anomalies, strong authentication upgrade and access control tightening are prioritized; when the root cause category includes network and traffic anomalies, rate limiting and isolation are prioritized; when the root cause category includes host and process anomalies, host-side handling and isolation are prioritized; when the root cause category includes password and certificate anomalies, certificate-related policies and blocking are prioritized; when the root cause category includes audit gaps, audit enhancement is prioritized. The estimated overhead of the policy vector is then calculated using the following formula, where the overhead includes latency increment, interaction count increment, CPU usage increment, and log increment, with the sum of each overhead weight being 1. When the estimated overhead exceeds the performance budget or the latency increment exceeds the upper limit of latency, it is automatically replaced with a combination of overhead reduction policies.

[0030] in, This represents the estimated cost of the policy vector, used to assess the resource consumption required to execute the policy combination. A smaller value indicates lower consumption. The latency increment represents the additional time delay added to message or service processing after the policy is executed. This refers to the increment of interaction count, i.e., the additional communication interactions that occur after the strategy is executed. This refers to the CPU usage increment, i.e., the increase in CPU resource consumption after the policy is executed. This refers to the log increment, which is the increase in the number of log records or storage overhead after the policy is executed. For cost weight and .

[0031] Step S104: Verify the effect of the policy after it takes effect based on the verification result. If the verification fails or fails, execute the upgrade or rollback policy and set a cooldown time. Generate audit records and evidence chains for the entire process and store them.

[0032] It's important to note that after the policy is issued and takes effect, the process cannot be considered complete. It's still necessary to verify whether the policy truly achieves the expected security goals and to automatically adjust the policy if the effect is unsatisfactory. This step first verifies the effectiveness of the policy based on a set of verification items and achievement criteria. Verification items include alarm convergence rate, the decrease in abnormal indicators, changes in access control hit rate, improvement in node health, and the proportion of sensitive write operations blocked. The achievement criteria specify the threshold conditions that each indicator must meet. When the consistency check passes and the policy effectiveness verification passes, the policy is considered successful, and the process ends. When the consistency check fails or the verification fails, the system determines the triggering conditions: if the alarm density increases, the risk score rises above a threshold, or a highly sensitive write operation occurs, an upgrade policy (such as isolation or strong authentication upgrade) is executed; if the business disturbance exceeds the upper limit, performance overhead exceeds the budget, or the event level drops below the threshold and remains below the preset time, a rollback policy is executed to revert the policy. To prevent frequent oscillations, the system sets a cooldown period, during which repeated upgrade or rollback operations are prohibited. Finally, the system generates evidence packages for normalized events, correlation clustering, risk scoring and interpretable decomposition, strategy selection and cost assessment, issuance receipts and consistency verification, verification results and upgrade rollback trajectory, performs summary storage and outputs audit records, forming a traceable and verifiable audit evidence chain to support compliance checks and post-event traceability.

[0033] Furthermore, in some embodiments, to ensure the traceability and verifiability of the entire handling process, an evidence package needs to be generated. This evidence package is a complete record of the entire handling process and includes at least the following: a normalized event model (standardized event records), association key hit information (used to trace how events are aggregated), cluster density and homogeneity (reflecting the characteristics of alarm aggregation), risk score and event level (quantifying risk results), contribution decomposition and main cause category and confidence level (interpretable basis), strategy selection basis and cost assessment (decision rationale), policy issuance and execution receipts (strategy execution records), strategy summary and consistency verification results (verification conclusions), verification results, and escalation or rollback trajectory (strategy adjustment records during the handling process). This information covers the entire link from alarm access to handling convergence, forming an indivisible evidence unit. Secondly, the system generates a summary of the evidence package and signs and stores it or writes it to trusted storage. Any tampering with the original data will result in a summary mismatch, thereby ensuring the integrity and non-repudiation of the evidence. Finally, the system outputs structured audit logs, which include at least the target node identifier, timestamp, associated event cluster identifier, risk score, event level, interpretable decomposable field, main cause category and confidence level, policy identifier, estimated cost, policy summary, execution receipt, consistency check result, verification result, upgrade or rollback identifier, and evidence package hash value.

[0034] In summary, compared with the prior art, this embodiment has at least the following beneficial effects: This invention establishes a control zone asset ledger and generates a single-node security capability profile for each target node, based on the set of executable actions and performance budget of the derived nodes. It collects alarm or event data from cross-domain security devices and systems and normalizes it into a unified event model. Based on a set of association keys including device, session, business semantic, and time dimensions, it forms associated event clusters within an aggregation window, calculating cluster density and homogeneity. Based on the associated event clusters, it calculates a risk score by fusing severity, confidence, clustering indicators, node credibility penalty items, and sensitivity hit indicators. The risk score input items are decomposed into contribution values. Based on the contribution value and threshold set, the risk source is mapped to the main cause category, and the main cause confidence is calculated. Under the premise of satisfying capability constraints and performance budget constraints, it determines the risk score based on event level. The system selects a strategy vector based on the root cause category and applies budget constraints using a multi-dimensional overhead weighting function that includes latency increment, interaction increment, CPU usage increment, and log increment to generate a set of distribution strategies and actions. It then distributes the strategies to target nodes or compensation nodes and obtains execution receipts. A strategy summary is generated based on a national cryptographic hash algorithm and its consistency is verified with the node side. The system verifies the effectiveness of the strategy after it takes effect, and if the consistency verification fails or the verification fails, it triggers an upgrade / rollback and sets a cooldown time to prevent oscillations in the handling process. Finally, it forms an evidence package from normalized events, cluster analysis, explainable root causes, strategy selection and overhead assessment, distribution and consistency verification, verification results, and upgrade / rollback trajectories, and performs summary storage and audit output, thereby achieving an interpretable, implementable, verifiable, and convergent closed-loop automatic handling process.

[0035] Example 2 like Figure 2 As shown, one embodiment of the present invention proposes a self-adaptive system for cross-domain alarm fusion strategy under node profiling constraints, the system comprising: The profile generation module 10 is used to generate a single-node security capability profile for the target node in the control area, and derive the set of executable actions and performance budget of the node from the single-node security capability profile. The risk assessment module 20 is used to collect cross-domain alarm data and normalize it into a unified event model. Based on the set of association keys, it forms a cluster of related events in the aggregation window, calculates the risk score based on the cluster of related events, decomposes the input items of the risk score into contribution, and outputs the event level and an interpretable decomposition field containing the main cause category and its confidence level. The verification module 30 is used to select a strategy vector from the strategy library and generate a set of distribution strategies and actions based on the event level and the cause category, under the premise of satisfying the capability constraints of the set of executable actions and the overhead constraints of the performance budget, distribute the strategy to the target node or compensation node, obtain the execution receipt, perform consistency verification based on the strategy summary, and output the verification result. The verification module 40 is used to verify the effect of the policy after it takes effect based on the verification result. When the verification fails or fails, the module executes the upgrade or rollback policy and sets a cooldown time. The module also generates audit records and evidence chains for the entire process and stores them.

[0036] Example 3 An embodiment of the present invention also proposes a storage medium on which one or more programs are stored, which, when executed by a processor, implement the above-described self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints.

[0037] Example 4 An embodiment of the present invention also proposes an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor is used to execute the computer program stored in the memory to realize the above-mentioned self-adaptive method for cross-domain alarm fusion strategy under node profile constraints.

[0038] Those skilled in the art will understand that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution system, apparatus, or device (such as a computer-based system, a processor-included system, or other system that can fetch and execute instructions from, an instruction execution system, apparatus, or device). For the purposes of this specification, "computer-readable medium" can mean any means that can contain stored, communicated, propagated, or transmitted programs for use by, or in conjunction with, an instruction execution system, apparatus, or device.

[0039] More specific examples of computer-readable media (a non-exhaustive list) include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which the program can be printed, because the program can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0040] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution system. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0041] While embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations can be made to these embodiments. However, it should be understood that such modifications and variations fall within the scope and spirit of the invention as described in the embodiments. Furthermore, the present invention described herein may have other embodiments and can be implemented or carried out in various ways.

Claims

1. A self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints, characterized in that, The method includes: A single-node security capability profile is generated for the target node within the control area, and the set of executable actions and performance budget of the node are derived from the single-node security capability profile. Collect cross-domain alarm data and normalize it into a unified event model. Based on the set of association keys, form a cluster of related events in the aggregation window. Calculate the risk score based on the cluster of related events, decompose the input items of the risk score into contribution, and output the event level and an interpretable decomposition field containing the main cause category and its confidence level. Based on the event level and the main cause category, and under the premise of satisfying the capability constraints of the executable action set and the overhead constraints of the performance budget, a strategy vector is selected from the strategy library and a set of distribution strategies and actions is generated. The strategy is then distributed to the target node or compensation node, an execution receipt is obtained, and a consistency check is performed based on the strategy summary. The check result is then output. The effectiveness of the policy after it takes effect is verified based on the verification results. If the verification fails or fails, the policy is upgraded or rolled back and a cooldown period is set. Audit records and evidence chains are generated and stored throughout the process.

2. The self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints as described in claim 1, characterized in that, The steps of generating a single-node security capability profile for target nodes within the control area, and deriving the set of executable actions and performance budget for the node from the single-node security capability profile, include: Establish an asset ledger for the control area, collect one or more of the following from each node: national cryptographic algorithm capabilities, identity authentication capabilities, transmission protection capabilities, log auditing capabilities, trustworthiness, and performance budget, and generate a single node security capability profile. The set of executable actions for a node is derived from the single-node security capability profile. The derivation rules include: allowing log level upgrades when log auditing capabilities meet the upper limit of log level; allowing strong authentication upgrades when identity authentication capabilities meet strong authentication capabilities; allowing enhanced transmission protection when transmission protection capabilities meet transmission protection capabilities; allowing access control tightening or read-only access when the node has an access control interface; and allowing blocking or isolation when the node has an isolation interface or can be controlled by the boundary.

3. The self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints as described in claim 1, characterized in that, The steps of collecting cross-domain alarm data and normalizing it into a unified event model, forming a cluster of related events within an aggregation window based on the set of association keys, calculating a risk score based on the clusters of related events, decomposing the input items of the risk score into contribution, and outputting the event level and an interpretable decomposition field containing the main cause category and its confidence level include: Collect alarm data from at least one type of device, including network boundary protection equipment, industrial security probes, host auditing systems, identity authentication and access control systems, cryptographic devices, asset management systems, or security management platforms, and convert the collected alarm data into a unified event model that includes event type, timestamp, source identifier, target identifier, severity, confidence level, scope of impact, and evidence summary. Based on at least one association key from the device dimension, session dimension, business semantic dimension and time dimension, the unified event model is associated and aggregated within the aggregation window to form associated event clusters, and the clustering density and homology clustering degree are calculated. The risk score is calculated by fusing alarm severity, alarm confidence, cluster density, homogeneity clustering, node credibility penalty, and the hit status of sensitive objects or sensitive write operations. The risk score is normalized to the range of 0 to 1, and mapped to an event level according to a preset threshold set. The event level includes at least four levels: general, attention, severe, and emergency. Calculate the contribution vector for each input item of the risk score, output the top k items with the largest contribution as the basis for interpretation, map the risk source to the main cause category based on the contribution vector and the main cause category threshold set, and calculate the main cause confidence.

4. The self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints according to claim 1, characterized in that, The step of selecting a strategy vector from the strategy library and generating a set of deployment strategies and actions based on the event level and the cause category, while satisfying the capability constraints of the set of executable actions and the overhead constraints of the performance budget, includes: Select the corresponding policy vector from the contingency plan library based on the event level and the cause category. The policy vector includes at least one or more of the following: audit enhancement, access control tightening, strong authentication upgrade, transmission protection enhancement, rate limiting, read-only, isolation, work order triggering, or alarm suppression. Prioritize strategies based on the primary cause category: when the primary cause category includes identity and permission anomalies, choose strong authentication upgrade and access control tightening; when the primary cause category includes network and traffic anomalies, choose rate limiting and isolation; when the primary cause category includes host and process anomalies, choose host-side handling and isolation; when the primary cause category includes password and certificate anomalies, choose certificate-related policies and blocking; when the primary cause category includes audit gaps, choose audit enhancement. The estimated cost of the strategy vector is calculated using a multi-dimensional cost weighting function. The cost includes at least the latency increment, the interaction number increment, the CPU usage increment, and the log increment. When the estimated cost exceeds the performance budget or the latency increment exceeds the upper limit of latency, it is automatically replaced with a combination of cost reduction strategies.

5. The self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints according to claim 1, characterized in that, The steps of issuing the policy to the target node or compensation node, obtaining an execution receipt, performing a consistency check based on the policy digest, and outputting the check result include: The policy is issued to the target node or compensation node. The issued policy shall include at least the policy identifier, target node, parameter set, effective time window, version number, rollback conditions and recovery conditions. The SM3 algorithm is used to generate strategy summaries. Obtain the execution receipt returned by the target node or the compensation node. The execution receipt includes at least the policy identifier, the target node, the execution result, the effective time, and the policy summary calculated on the node side. The policy digest calculated by the node is compared with the policy digest generated by the sending side. If they match, the consistency check is considered to have passed. Otherwise, the consistency check is considered to have failed, and at least one of the following is triggered: retry, execution by the compensation node, or policy upgrade.

6. The self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints according to claim 1, characterized in that, The step of verifying the effect of the policy after it takes effect based on the verification result, and executing an upgrade or rollback policy and setting a cooldown time when the verification fails or fails, includes: The effectiveness of the handling is verified based on the set of verification items and the achievement criteria. The verification items include at least one or more of the following: alarm convergence rate, abnormal indicator decrease, access control hit rate change, node health improvement, and sensitive write operation interception ratio. The achievement criteria include that the verification items reach the threshold within the duration and the key business disturbance does not exceed the upper bound. When the consistency check passes and the set of verification items and the achievement criteria pass the verification of the handling effect, the handling process ends and enters the audit record generation stage; When consistency verification fails or fails, the triggering conditions are determined: if the alarm density increases, the risk score rises above the threshold, or a highly sensitive write operation is hit, an upgrade strategy is executed. The upgrade action includes at least one of isolation, strong authentication upgrade, or further tightening of access control. When business disturbances exceed the upper limit, performance overhead exceeds the performance budget, or the event level drops below the threshold and remains below the preset time, a rollback strategy is executed.

7. The self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints according to claim 1, characterized in that, The step of storing the audit records and evidence chains generated throughout the entire process also includes: Generate an evidence package, which includes at least a normalized event model, association key hit status, cluster density and homology clustering degree, risk score and event level, contribution decomposition and main cause category and confidence level, strategy selection basis and cost assessment, strategy issuance and execution receipt, strategy summary and consistency verification results, verification results, and upgrade or rollback trajectory. Generate a digest of the evidence package and sign and store it as evidence or write it into trusted storage; Output audit logs, which at least include target node identifier, timestamp, associated event cluster identifier, risk score, event level, interpretable decomposable field, main cause category and confidence level, policy identifier, estimated cost, policy summary, execution receipt, consistency check result, verification result, upgrade or rollback identifier, and evidence package hash value.

8. A self-adaptive system for cross-domain alarm fusion strategy under node profiling constraints, characterized in that, The system includes: The profile generation module is used to generate a single-node security capability profile for target nodes within the control area, and derive the set of executable actions and performance budget of the node from the single-node security capability profile. The risk assessment module is used to collect cross-domain alarm data and normalize it into a unified event model. Based on the set of association keys, it forms a cluster of related events in the aggregation window, calculates the risk score based on the cluster of related events, decomposes the input items of the risk score into contribution, and outputs the event level and an interpretable decomposition field containing the main cause category and its confidence level. The verification module is used to select a strategy vector from the strategy library and generate a set of deployment strategies and actions based on the event level and the cause category, under the premise of satisfying the capability constraints of the set of executable actions and the overhead constraints of the performance budget, deploy the strategy to the target node or compensation node, obtain the execution receipt, perform consistency verification based on the strategy summary, and output the verification result. The verification module is used to verify the effect of the policy after it takes effect based on the verification result. When the verification fails or fails, the module executes the upgrade or rollback policy and sets a cooldown time. The module also generates audit records and evidence chains for the entire process and stores them.

9. An electronic device, characterized in that, The electronic device includes a memory and a processor, wherein: The memory is used to store computer programs; When the processor executes the computer program stored in the memory, it implements the self-adaptive method for cross-domain alarm fusion strategy under node profile constraints as described in any one of claims 1-7.

10. A storage medium, characterized in that, The storage medium stores one or more programs, which, when executed by a processor, implement the self-adaptive method for cross-domain alarm fusion strategy under node profiling constraints as described in any one of claims 1-7.

Images