Dpu-based ethernet control chip network security method and system

Abstract

The present application relates to the technical field of network security, and particularly relates to a network security method and system based on an Ethernet control chip of a DPU. A message sequence extraction behavior trajectory and an interaction mode of network data flow are used to form a multi-dimensional traffic feature tensor, which is heterogeneously decomposed into a structured sub-feature and an unstructured behavior sequence. The structured sub-feature is threat-labeled to obtain a labeled heterogeneous combination. A semantic space is constructed for alignment and reasoning to identify attack intent and threat evolution path to generate a threat intelligence atlas. Based on the atlas and the label, a time sequence and resource relationship of a threat event are constructed in combination with chip load and buffer resources to generate a layered response strategy set. The control chip executes differentiated disposal at different protocol layers. The present application improves threat detection and response efficiency.

Description

Technical Field

[0001] This invention relates to the field of network security technology, and in particular to a network security method and system for Ethernet control chips based on DPU. Background Technology

[0002] Currently, Ethernet control chips (such as smart NICs or integrated network controllers) generally employ rule-based or statistical threshold-based detection mechanisms for network security protection. A common practice is to deploy intrusion detection systems in the chip firmware or on the host side, identifying abnormal traffic through deep packet inspection (DPI) or flow signature statistics. These solutions rely on predefined attack signatures or fixed traffic baselines and typically delegate processing tasks to the host CPU or dedicated hardware acceleration units. Because Ethernet control chips need to handle line-speed traffic from high-speed network interfaces, existing practices tend to set simple filtering rules at the data link layer or network layer, such as access control lists (ACLs) based on MAC addresses, IP addresses, or port numbers, or abnormal pattern matching for specific protocol types. Furthermore, in cloud data centers or high-performance computing scenarios, some solutions introduce programmable network hardware (such as FPGAs or smart NICs), allowing users to customize state machines or matching logic, but still primarily rely on single-layer protocol parsing and isolated signature detection.

[0003] Current conventional methods suffer from limited detection dimensions and lack cross-layer correlation capabilities. Traditional rule or threshold models only target static features at fixed protocol layers (such as IP or TCP), failing to effectively capture complex interactions across multiple protocol layers (such as between the application and transport layers) and struggling to analyze session-level behavioral patterns. Since attack activities often involve coordinated anomalies across multiple layers within the protocol stack—for example, slow attacks or covert channels require combining time series data with protocol field perturbations for identification—existing methods suffer from high false positive and false negative rates due to a lack of modeling for cross-layer interaction patterns. Furthermore, conventional methods struggle to balance processing performance and real-time capabilities. Directly performing complex statistical learning or deep analysis on Ethernet control chips consumes significant computational resources, impacting network throughput; while relying on host CPUs for offline analysis introduces significant latency, failing to meet the timeliness requirements of online threat response. When network load fluctuates, fixed-threshold detection strategies are prone to response delays or resource contention due to static resource configuration, making it difficult to guarantee a balance between security isolation effectiveness and network performance. The aforementioned limitations render existing conventional methods inadequate in dealing with multi-stage, highly covert cyberattacks. Summary of the Invention

[0004] This invention provides a network security method and system for Ethernet control chips based on DPU, which can solve the problems in the prior art.

[0005] A first aspect of this invention provides a network security method for an Ethernet control chip based on a DPU, comprising:

[0006] Obtain the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction mode of the message sequence, and form a multi-dimensional traffic feature tensor;

[0007] The multidimensional flow feature tensor is distributed to the DPU, and the DPU performs heterogeneous decomposition based on the topological relationship of flow features to deconstruct the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors.

[0008] Threat labeling based on statistical distribution deviation is performed on the structured sub-feature set to obtain labeled heterogeneous feature combinations;

[0009] A semantic space of network behavior is constructed and the labeled heterogeneous feature combination is used as input. In the semantic space, cross-modal alignment and causal chain reasoning are performed on the structured sub-feature set and the unstructured behavior sequence to identify implicit attack intent patterns and multi-stage threat evolution paths, and generate a semantically labeled threat intelligence map.

[0010] Based on the threat intelligence map and the threat labels, the temporal dependencies and resource competition relationships between threat events are constructed. Combining the current load status and available buffer resources of the Ethernet control chip, a set of hierarchical response strategies that balances threat isolation effectiveness and network performance costs is generated through a constraint satisfaction solution mechanism.

[0011] The Ethernet control chip is controlled to perform differentiated processing at different protocol layers according to the set of hierarchical response strategies.

[0012] Obtain the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction pattern of the message sequence, and form a multi-dimensional traffic feature tensor including:

[0013] The packet sequence of the network data stream is collected through the physical layer interface of the Ethernet control chip, and the arrival timestamp and physical layer link status parameters are recorded synchronously to form a physical layer packet stream with time sequence annotation.

[0014] The physical layer message stream with timing annotations is parsed through the data link layer interface of the Ethernet control chip, and the communication association between nodes is established based on the extracted source MAC address and destination MAC address to form a data link layer communication topology.

[0015] The physical layer message stream with time sequence annotation and the data link layer communication topology are segmented according to a fixed time window. The message sequence in each time window is aggregated according to the source MAC address and the destination MAC address to form the session-level behavior trajectory containing time sequence evolution information.

[0016] Cross-layer protocol analysis is performed on the session-level behavior trajectory. By parsing the network layer protocol type, transport layer port number and application layer protocol characteristics in the message sequence, the protocol stack usage mode and protocol switching sequence of each session are identified, forming the cross-layer protocol interaction mode.

[0017] The session-level behavior trajectory is associated and fused with the cross-layer protocol interaction mode to generate a multi-dimensional traffic feature tensor that includes the physical layer link state parameters, the data link layer communication topology, the session-level behavior trajectory, and the cross-layer protocol interaction mode.

[0018] The multidimensional flow feature tensor is distributed to the DPU, and the DPU performs heterogeneous decomposition based on flow feature topology to deconstruct the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors, including:

[0019] Based on the dimension identifier in the multidimensional traffic feature tensor, the multidimensional traffic feature tensor is distributed to multiple parallel processing cores of the DPU;

[0020] In the parallel processing core, the data link layer communication topology in the multidimensional traffic feature tensor is modeled as a graph structure, the source MAC address and the destination MAC address are mapped as graph nodes, the communication association is mapped as graph edges, and the graph edges are assigned time-series weights according to the message arrival time sequence in the session-level behavior trajectory, forming a communication topology graph with time-series weights.

[0021] By calculating the connectivity and centrality metric of each graph node, node clusters are identified, and the time-weighted communication topology graph is decomposed into multiple subgraph structures based on the node clusters.

[0022] Topological features are extracted from the multiple subgraph structures respectively, and feature fusion is performed with the physical layer link state parameters associated with the corresponding subgraphs in the multidimensional traffic feature tensor to form the structured sub-feature set;

[0023] A temporal behavior sequence is constructed based on the session-level behavior trajectory, a protocol evolution sequence is constructed based on the cross-layer protocol interaction mode, and the temporal behavior sequence and the protocol evolution sequence are combined to form the unstructured behavior sequence.

[0024] Threat labeling based on statistical distribution deviation is performed on the structured sub-feature set to obtain labeled heterogeneous feature combinations, including:

[0025] Construct a multidimensional feature space and establish a baseline statistical distribution in the multidimensional feature space;

[0026] In the multidimensional feature space, the deviation of the feature vector corresponding to each subgraph structure in the structured sub-feature set from the statistical distribution of the baseline statistical distribution is calculated.

[0027] Based on the statistical distribution deviation, a threat assessment decision boundary is constructed. The threat assessment decision boundary divides the multidimensional feature space into multiple threat level regions. By analyzing the distribution density and gradient change direction of the statistical distribution deviation in the multidimensional feature space, abnormal density clustering regions and gradient abrupt boundary in the multidimensional feature space are identified.

[0028] The threat assessment decision boundary is adaptively adjusted based on the abnormal density clustering region and the gradient mutation boundary, so that the threat assessment decision boundary can dynamically adapt to the spatial distribution characteristics of the statistical distribution deviation. Threat level identifiers are assigned to the subgraph structures based on the position of the feature vector of each subgraph structure in the structured sub-feature set in the threat level region divided by the threat assessment decision boundary.

[0029] The threat level identifier is associated and bound with the corresponding subgraph structure in the structured sub-feature set to form a structured sub-feature set with threat annotation;

[0030] The structured sub-features with threat annotations are combined with the unstructured behavior sequence to form the labeled heterogeneous feature combination.

[0031] A semantic space for network behavior is constructed, and the labeled heterogeneous feature combination is used as input. Cross-modal alignment and causal chain reasoning are performed on the structured sub-feature set and the unstructured behavior sequence within the semantic space to identify implicit attack intent patterns and multi-stage threat evolution paths, generating a semantically labeled threat intelligence map, including:

[0032] Establish cross-modal alignment mapping relationships in the semantic space;

[0033] A causal chain reasoning graph structure is constructed, wherein the causal chain reasoning graph structure uses structured sub-features and unstructured behavioral sequences as graph nodes, and the cross-modal alignment mapping relationship and temporal causal association as graph edges;

[0034] In the causal chain reasoning graph structure, initial threat nodes and candidate threat nodes are selected based on the threat level identifier of the graph nodes;

[0035] In the causal chain reasoning graph structure, multi-hop path traversal is performed. Based on the threat level identifier of the graph node and the temporal weight of the temporal causal association edge, the cumulative path threat value and temporal coherence metric from the initial threat node to the candidate threat node are calculated. Paths whose cumulative path threat value exceeds the path threat threshold and whose temporal coherence metric satisfies the temporal constraint are traversed first. Multi-stage threat evolution paths that are temporally coherent and continuously escalate in threat level are identified. Attack intent patterns are extracted based on the semantic features of the threat behavior node sequence in the multi-stage threat evolution path.

[0036] The attack intent pattern and the multi-stage threat evolution path are semantically annotated in the causal chain reasoning graph structure to form the semantically annotated threat intelligence graph.

[0037] Based on the threat intelligence map and the threat annotations, the temporal dependencies and resource contention relationships between threat events are constructed. Combining the current load status and available buffer resources of the Ethernet control chip, a set of hierarchical response strategies that balance threat isolation effectiveness with network performance costs is generated through a constraint satisfaction solution mechanism. These strategies include:

[0038] Threat event nodes and associated threat labeling information are extracted from the semantically labeled threat intelligence graph. The temporal dependency relationship between threat events is constructed based on the temporal causal relationship edges of the threat event nodes in the threat intelligence graph. The resource competition relationship between threat events is constructed based on the network bandwidth resources and buffer queue resources required by the threat event nodes.

[0039] Obtain the current load status and available buffer resources of the Ethernet control chip;

[0040] A constraint satisfaction solution mechanism is constructed, which includes threat isolation effect constraints and network performance cost constraints. The threat isolation effect constraints determine the blocking requirements of the response strategy for threat events based on the threat level identifier in the threat labeling information and the temporal dependency relationship. The network performance cost constraints determine the resource consumption limit of the response strategy based on the current load status and the available buffer resources.

[0041] The constraint satisfaction solution mechanism is used to solve the response strategy allocation for the threat event nodes. Based on the resource competition relationship, the threat event node group that needs to coordinate resource allocation is determined. For the threat event node group, resource priority is sorted and allocated under the premise of satisfying the threat isolation effect constraint. For non-competitive threat event nodes, resources are directly allocated under the premise of satisfying the threat isolation effect constraint, minimizing the resource consumption of the network performance cost constraint, and generating a hierarchical response strategy set for different threat levels.

[0042] A second aspect of this invention provides a network security system for an Ethernet control chip based on a DPU, comprising:

[0043] The feature extraction unit is used to acquire the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction mode of the message sequence, and form a multi-dimensional traffic feature tensor.

[0044] The heterogeneous decomposition unit is used to distribute the multidimensional flow feature tensor to the DPU, and the DPU performs heterogeneous decomposition based on the topological relationship of the flow features to decompose the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors.

[0045] The threat labeling unit is used to perform threat labeling on the structured sub-feature set based on statistical distribution deviation, to obtain a labeled heterogeneous feature combination;

[0046] The alignment reasoning unit is used to construct a semantic space of network behavior and take the labeled heterogeneous feature combination as input. In the semantic space, it performs cross-modal alignment and causal chain reasoning on the structured sub-feature set and the unstructured behavior sequence to identify implicit attack intent patterns and multi-stage threat evolution paths, and generate a semantically labeled threat intelligence map.

[0047] The strategy generation unit is used to construct the temporal dependency and resource competition relationship between threat events based on the threat intelligence map and the threat labels, and generate a set of hierarchical response strategies that take into account both threat isolation effect and network performance cost by combining the current load status and available buffer resources of the Ethernet control chip through the constraint satisfaction solution mechanism.

[0048] The strategy execution unit is used to control the Ethernet control chip to perform differentiated processing at different protocol layers according to the hierarchical response strategy set.

[0049] A third aspect of the present invention provides an electronic device, comprising:

[0050] processor;

[0051] Memory used to store processor-executable instructions;

[0052] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0053] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0054] The beneficial effects of this application are as follows:

[0055] Significantly improves the detection accuracy and real-time response capability of Ethernet control chips against complex network attacks. Multi-dimensional traffic feature tensors fuse session behavior and cross-layer protocol interaction information to fully characterize the structural and unstructured attributes of traffic. The DPU's distributed heterogeneous decomposition deconstructs the feature tensor into structured sub-features and unstructured sequences, fully leveraging the advantages of parallel computing to reduce single-chip processing latency to the microsecond level. Statistical distribution deviation threat labeling, combined with flow feature topology relationships, effectively filters out noise from normal traffic.

[0056] The constructed semantic space enables cross-modal alignment of structured features and unstructured sequences, as well as causal chain reasoning, automatically extracting attack intent and multi-stage evolution paths from scattered threat annotations. This semantic-based threat intelligence map not only reveals previously undiscovered covert attack patterns but also traces attack sources and propagation chains through causal reasoning, providing chips with a panoramic view of threat evolution. Compared to traditional rule-matching methods, it improves the recognition rate of unknown threats and reduces the time consumed in a single inference to milliseconds, meeting the real-time analysis requirements of Ethernet control chips for high-speed data streams.

[0057] A set of hierarchical response strategies based on time-dependent and resource-competitive relationships achieves a dynamic balance between threat isolation effectiveness and network performance costs. Through a constraint satisfaction solution mechanism, the chip can adaptively select to perform differentiated actions at different protocol layers based on the current load state and buffer resources. For example, it can quickly block broadcast flooding attacks at the data link layer while selectively discarding malicious sessions at the transport layer. Attached Figure Description

[0058] Figure 1 This is a flowchart illustrating a network security method for Ethernet control chips based on a DPU.

[0059] Figure 2 A flowchart illustrating the process of generating a hierarchical response strategy set. Detailed Implementation

[0060] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0061] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0062] Figure 1 This is a flowchart illustrating the network security method for an Ethernet control chip based on a DPU according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0063] Obtain the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction mode of the message sequence, and form a multi-dimensional traffic feature tensor;

[0064] The multidimensional flow feature tensor is distributed to the DPU, and the DPU performs heterogeneous decomposition based on the topological relationship of flow features to deconstruct the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors.

[0065] Threat labeling based on statistical distribution deviation is performed on the structured sub-feature set to obtain labeled heterogeneous feature combinations;

[0066] A semantic space of network behavior is constructed and the labeled heterogeneous feature combination is used as input. In the semantic space, cross-modal alignment and causal chain reasoning are performed on the structured sub-feature set and the unstructured behavior sequence to identify implicit attack intent patterns and multi-stage threat evolution paths, and generate a semantically labeled threat intelligence map.

[0067] Based on the threat intelligence map and the threat labels, the temporal dependencies and resource competition relationships between threat events are constructed. Combining the current load status and available buffer resources of the Ethernet control chip, a set of hierarchical response strategies that balances threat isolation effectiveness and network performance costs is generated through a constraint satisfaction solution mechanism.

[0068] The Ethernet control chip is controlled to perform differentiated processing at different protocol layers according to the set of hierarchical response strategies.

[0069] In one optional implementation, the packet sequence of the network data stream is obtained, and the session-level behavior trajectory and cross-layer protocol interaction pattern of the packet sequence are extracted to form a multi-dimensional traffic feature tensor, including:

[0070] The packet sequence of the network data stream is collected through the physical layer interface of the Ethernet control chip, and the arrival timestamp and physical layer link status parameters are recorded synchronously to form a physical layer packet stream with time sequence annotation.

[0071] The physical layer message stream with timing annotations is parsed through the data link layer interface of the Ethernet control chip, and the communication association between nodes is established based on the extracted source MAC address and destination MAC address to form a data link layer communication topology.

[0072] The physical layer message stream with time sequence annotation and the data link layer communication topology are segmented according to a fixed time window. The message sequence in each time window is aggregated according to the source MAC address and the destination MAC address to form the session-level behavior trajectory containing time sequence evolution information.

[0073] Cross-layer protocol analysis is performed on the session-level behavior trajectory. By parsing the network layer protocol type, transport layer port number and application layer protocol characteristics in the message sequence, the protocol stack usage mode and protocol switching sequence of each session are identified, forming the cross-layer protocol interaction mode.

[0074] The session-level behavior trajectory is associated and fused with the cross-layer protocol interaction mode to generate a multi-dimensional traffic feature tensor that includes the physical layer link state parameters, the data link layer communication topology, the session-level behavior trajectory, and the cross-layer protocol interaction mode.

[0075] Real-time acquisition of network data streams via the physical layer interface of the Ethernet controller chip requires synchronous writing of timestamps at the moment of packet arrival in hardware, rather than relying on delayed software-level stamping. Specifically, upon receiving the start delimiter of each Ethernet frame, the physical layer interface immediately reads the current count value from the local high-precision clock register and appends it to the packet descriptor, ensuring that the timestamp accuracy reaches the nanosecond level. Simultaneously, the acquisition of physical layer link status parameters covers dimensions such as signal strength, bit error rate, link negotiation rate, duplex mode, and link interruption event flags. These parameters, along with the timestamps, are appended to the metadata structure of each packet, forming a time-stamped physical layer packet stream. This physical layer packet stream is stored in a circular queue in the DPU's entry buffer, ensuring no packet loss under burst traffic conditions and providing a complete raw data foundation for subsequent cross-layer parsing.

[0076] During the data link layer parsing phase, the Ethernet frame header of each time-stamped physical layer packet stream is extracted to obtain the source MAC address and destination MAC address fields. These two fields are used as node identifiers, and a dynamically updated communication association hash table is maintained in the DPU's on-chip storage. Each record in the table corresponds to a pair of communication nodes and records statistics such as the first communication time, the most recent communication time, the cumulative number of packets, and the cumulative number of bytes between the node pair. When a new packet arrives, a hash lookup is performed using the combination of the source and destination MAC addresses as the key. If a match is found, the statistics of the corresponding record are updated; otherwise, a new record is created. Based on this, all node records and their associations are organized into a data link layer communication topology. This topology is stored in a hybrid form of adjacency matrix and edge attribute list. The adjacency matrix is ​​used to quickly determine whether a communication relationship exists between nodes, while the edge attribute list stores detailed traffic statistics. This topology can intuitively reflect the communication pattern between nodes within the local area network, providing a graph structure foundation for subsequent identification of abnormal node behavior.

[0077] The session aggregation phase introduces a fixed-length time window mechanism, dividing the continuous physical layer packet flow with time-series annotations into several discrete time segments. The length of each time window is configured based on network traffic density and threat detection latency requirements, and can be set from hundreds of milliseconds to several seconds in typical deployment scenarios. Within each time window, packets are grouped according to the combination of source and destination MAC addresses, with packets belonging to the same node pair grouped into the same session record. For each session record, the arrival time sequence, packet length sequence, frame interval sequence, and frame type distribution of packets within that time window are extracted to construct a temporal feature vector reflecting the behavioral evolution of the session within that time window. The temporal feature vectors of the same session corresponding to multiple consecutive time windows are concatenated in chronological order to form a session-level behavioral trajectory containing temporal evolution information. This trajectory not only retains fine-grained statistical information at the packet level but also captures the trend of session behavior changes over time through the sliding of the time window, effectively characterizing attack behavior patterns with long time spans, such as slow scanning and phased penetration.

[0078] Cross-layer protocol analysis extends beyond session-level behavior tracing to higher-layer protocol stacks. For each session's message sequence, the EtherType field of the Ethernet frame is parsed sequentially to determine the network layer protocol type (e.g., IPv4, IPv6, ARP), and then the protocol field in the IP header is parsed to determine the transport layer protocol type (e.g., TCP, UDP, ICMP), extracting the source and destination port numbers. For TCP sessions, the flag sequence (SYN, ACK, FIN, RST, etc.) is also extracted to reconstruct the TCP state machine transition process. Regarding application layer protocol feature extraction, pattern matching is performed on the first few bytes of the message payload to identify application layer protocol identifiers such as HTTP, DNS, TLS handshake characteristic bytes, and FTP command words, thereby determining the application layer protocol type used by each session. When a session experiences a protocol type switch during its lifecycle, the time of the switch and the combination of protocol types before and after the switch are recorded to form a protocol switch sequence. The protocol stack usage pattern of each session (i.e. the combination of protocol types at each layer) and the protocol switching sequence are jointly encoded into a cross-layer protocol interaction pattern vector, which can capture abnormal protocol usage behaviors such as protocol tunneling encapsulation and protocol spoofing.

[0079] In the association and fusion phase, session-level behavioral trajectories and cross-layer protocol interaction patterns are aligned according to session identifiers to ensure that the two types of features describe the behavior of the same session entity within the same time window. The fused feature vector is expanded based on physical layer link state parameters and data link layer communication topology. Link state parameters are added as global background features to each session feature record, and graph structure features of corresponding node pairs in the communication topology (such as node degree, number of neighboring nodes, topology centrality index, etc.) are added as graph context features to the session feature record. Finally, the dimensions of physical layer link state parameters, data link layer communication topology features, session-level behavioral trajectories, and cross-layer protocol interaction patterns are organized into a multi-dimensional traffic feature tensor. Each slice of this tensor corresponds to a session record within a time window. Different dimensions of the tensor carry different levels of protocol semantic information, forming a full-stack, multi-granular, and time-series structured expression of network traffic behavior, providing high-quality input data for subsequent DPU execution of heterogeneous decomposition and threat detection.

[0080] In practical deployments, the hardware offloading capability of the Ethernet controller chip allows the feature extraction operations at each stage to be completed without consuming host CPU resources. The timestamp writing of the physical layer interface, the hash table maintenance of the data link layer, the time window segmentation, and session aggregation can all be executed at line rate through the DPU's programmable pipeline. This ensures that the generation delay of the multidimensional traffic feature tensor meets the latency requirements of real-time security detection and does not cause any perceptible performance impact on normal business traffic.

[0081] In one optional implementation, the multidimensional flow feature tensor is distributed to a DPU, and the DPU performs heterogeneous decomposition based on flow feature topology to deconstruct the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors, including:

[0082] Based on the dimension identifier in the multidimensional traffic feature tensor, the multidimensional traffic feature tensor is distributed to multiple parallel processing cores of the DPU;

[0083] In the parallel processing core, the data link layer communication topology in the multidimensional traffic feature tensor is modeled as a graph structure, the source MAC address and the destination MAC address are mapped as graph nodes, the communication association is mapped as graph edges, and the graph edges are assigned time-series weights according to the message arrival time sequence in the session-level behavior trajectory, forming a communication topology graph with time-series weights.

[0084] By calculating the connectivity and centrality metric of each graph node, node clusters are identified, and the time-weighted communication topology graph is decomposed into multiple subgraph structures based on the node clusters.

[0085] Topological features are extracted from the multiple subgraph structures respectively, and feature fusion is performed with the physical layer link state parameters associated with the corresponding subgraphs in the multidimensional traffic feature tensor to form the structured sub-feature set;

[0086] A temporal behavior sequence is constructed based on the session-level behavior trajectory, a protocol evolution sequence is constructed based on the cross-layer protocol interaction mode, and the temporal behavior sequence and the protocol evolution sequence are combined to form the unstructured behavior sequence.

[0087] Based on the dimension identifier information carried in the multidimensional traffic feature tensor, the tensor data is distributed to multiple parallel processing cores within the DPU according to the dimension affiliation. Each dimension identifier corresponds to a specific protocol layer attribute, including MAC address information at the data link layer, link state parameters at the physical layer, and behavioral trajectory data at the session layer. The distribution process determines the target processing core based on the hash mapping relationship of the dimension identifiers, ensuring that related dimension data for the same session are routed to the same core group, avoiding synchronization overhead caused by cross-core data dependencies. The multi-core parallel architecture of the DPU allows feature extraction tasks of different dimensions to overlap in time, thereby significantly improving processing throughput while maintaining feature integrity.

[0088] Within the parallel processing core, graph modeling is performed on the data link layer communication topology in the multidimensional traffic feature tensor. The source and destination MAC addresses extracted from the packet sequence are mapped to sets of nodes in the graph, with each unique MAC address corresponding to an independent node. When there are packet interaction records between the source and destination nodes, a directed edge is established between the two nodes, with the edge direction indicating the packet transmission direction. The strength of the communication relationship is characterized by edge attributes, including statistics such as the number of packets and the total number of bytes. Based on this, packet arrival time series are extracted from session-level behavioral trajectories, and the arrival time intervals of adjacent packets are... As the temporal weights of the corresponding graph edges, where Indicates the source node index. This represents the destination node index. The temporal weights reflect the rhythmic characteristics of the communication between the two parties. Burst communication and periodic communication exhibit significant differences in their temporal weight distributions, a difference that is crucial for subsequent anomaly detection. After the above processing, a communication topology map with temporal weights is formed, fully preserving the spatial topology and temporal dynamics of network communication.

[0089] Calculate the connectivity and centrality metrics for each node in a time-weighted communication topology graph. Connectivity Define as a node The sum of a node's in-degree and out-degree reflects its level of activity in communication. The centrality metric used is the betweenness centrality index. By statistically analyzing the nodes The pivotal role of a node in the network is quantified by the ratio of the number of shortest paths to the total number of shortest paths between all node pairs. Based on connectivity and centrality metrics, a graph-based clustering method is used to identify node clusters, grouping nodes with similar communication behaviors and topological proximity into the same group. The temporal weights of edges between nodes are comprehensively considered during clustering, ensuring that nodes with similar communication temporal patterns are grouped together. Based on the node clustering results, the time-weighted communication topology graph is decomposed into multiple subgraph structures. Each subgraph corresponds to a node cluster group and all its internal edge relationships. Cross-group edges between subgraphs are recorded separately as inter-subgraph interactions and are not included in any single subgraph.

[0090] Topological feature extraction is performed on the multiple subgraph structures obtained from the decomposition. For each subgraph, graph-level statistical features such as the number of nodes, edge density, average path length, and clustering coefficient are calculated, and local connectivity pattern feature vectors of each node are extracted. These topological features constitute a structured description that can characterize the network behavior patterns of different communication groups. After the topological feature extraction is completed, the physical layer link state parameters corresponding to each subgraph are retrieved from the multidimensional traffic feature tensor. The physical layer link state parameters include indicators reflecting physical transmission quality such as signal strength, bit error rate, and link utilization. The topological feature vectors of the subgraphs are fused with the corresponding physical layer link state parameter vectors. The fusion method uses a method of concatenation followed by linear transformation for dimensionality reduction, mapping the two types of heterogeneous features to a unified feature space, forming a structured sub-feature set that takes into account both logical topology and physical link state. Each record in the structured sub-feature set corresponds one-to-one with a subgraph structure, preserving the subgraph's identity for subsequent association with unstructured behavior sequences.

[0091] A time-series behavior sequence is constructed based on session-level behavior trajectories. The session-level behavior trajectory records the sequence of message interaction events during the establishment and termination of each network session, including event types such as connection requests, data transmission, acknowledgments, and connection closure, along with their occurrence times. These events are arranged chronologically to form a time-series behavior sequence with event type codes as elements. The sequence length is related to the session duration and message density. The time-series behavior sequence preserves the behavioral rhythm and state transition patterns within the session, reflecting the essential differences in behavioral timing between normal business traffic and abnormal attack traffic.

[0092] Protocol evolution sequences are constructed based on cross-layer protocol interaction patterns. These patterns describe the collaborative relationships between different protocol layers, such as physical layer signal changes triggering data link layer retransmissions, and transport layer congestion control affecting application layer request rates. These cross-layer interaction events are encoded into a protocol evolution sequence in chronological order, with each element labeled with the involved protocol layer combination and interaction type. The protocol evolution sequence reveals the dynamic coupling relationships of network traffic across different layers of the protocol stack. Certain attack behaviors leave unique cross-layer anomaly patterns in the protocol evolution sequence; for example, scanning attacks can cause a large number of TCP SYN packets to appear at the transport layer without accompanying application layer data interaction. This cross-layer inconsistency can be effectively captured in the protocol evolution sequence.

[0093] The temporal behavior sequence and protocol evolution sequence are aligned along the timeline and then combined to form an unstructured behavior sequence. The combination process preserves the semantic annotations of both types of sequences while establishing a correspondence along the temporal dimension, enabling joint analysis of behavioral events and protocol interaction events occurring at the same time. The unstructured behavior sequence is stored as a variable-length sequence, with the sequence length varying depending on the session complexity. This variable-length characteristic complements the fixed-dimensional features of the structured sub-feature set, jointly providing a complete input representation for subsequent cross-modal alignment and threat identification.

[0094] In one optional implementation, the structured sub-feature set is subjected to threat labeling based on statistical distribution deviation to obtain labeled heterogeneous feature combinations, including:

[0095] Construct a multidimensional feature space and establish a baseline statistical distribution in the multidimensional feature space;

[0096] In the multidimensional feature space, the deviation of the feature vector corresponding to each subgraph structure in the structured sub-feature set from the statistical distribution of the baseline statistical distribution is calculated.

[0097] Based on the statistical distribution deviation, a threat assessment decision boundary is constructed. The threat assessment decision boundary divides the multidimensional feature space into multiple threat level regions. By analyzing the distribution density and gradient change direction of the statistical distribution deviation in the multidimensional feature space, abnormal density clustering regions and gradient abrupt boundary in the multidimensional feature space are identified.

[0098] The threat assessment decision boundary is adaptively adjusted based on the abnormal density clustering region and the gradient mutation boundary, so that the threat assessment decision boundary can dynamically adapt to the spatial distribution characteristics of the statistical distribution deviation. Threat level identifiers are assigned to the subgraph structures based on the position of the feature vector of each subgraph structure in the structured sub-feature set in the threat level region divided by the threat assessment decision boundary.

[0099] The threat level identifier is associated and bound with the corresponding subgraph structure in the structured sub-feature set to form a structured sub-feature set with threat annotation;

[0100] The structured sub-features with threat annotations are combined with the unstructured behavior sequence to form the labeled heterogeneous feature combination.

[0101] Multiple dimensions reflecting network traffic behavior characteristics are extracted from the structured sub-feature set, including statistics such as packet length distribution, protocol field value range, connection duration, load entropy, and port access frequency. The feature vector corresponding to each subgraph structure is formed by concatenating the statistics of these dimensions, creating a point in the high-dimensional feature space. The establishment of the baseline statistical distribution relies on long-term collection and statistical modeling of historical normal traffic data. For each feature dimension, its probability distribution is fitted. Gaussian mixture models or kernel density estimation methods can be used to characterize the marginal distributions of each dimension, and the covariance matrix is ​​used to capture the correlation structure between dimensions, thereby establishing a joint baseline distribution in the multi-dimensional feature space. This baseline distribution represents the statistical regularity of normal network behavior in the feature space and serves as the reference basis for subsequent deviation calculations.

[0102] The statistical distribution deviation is calculated by measuring the statistical distance between the feature vector corresponding to each subgraph structure in the structured sub-feature set and the benchmark statistical distribution. Specifically, Mahalanobis distance can be used to measure the degree of deviation of the feature vector from the mean of the benchmark distribution. This distance can automatically eliminate the differences in the dimensions of each feature dimension and take into account the covariance structure between dimensions. Let the feature vector be... The mean vector of the benchmark distribution is The covariance matrix is Then the Mahalanobis distance is For a multimodal baseline distribution, the deviation is taken as the minimum weighted distance from the eigenvector to each component distribution to avoid misclassifying normal but sparse traffic patterns as abnormal. The larger the deviation value, the more significant the difference between the traffic behavior of the corresponding subgraph structure and historical normal patterns, and the higher the potential threat.

[0103] The construction of the threat assessment decision boundary is based on the distribution of deviation in a multidimensional feature space. After projecting the eigenvectors of all subgraph structures and their corresponding deviation values ​​into the feature space, the spatial distribution density of deviation is analyzed to identify the clustering regions of high deviation points in the feature space, i.e., abnormal density clustering regions. Density estimation can be performed using a nonparametric method based on kernel functions to statistically analyze the density of high deviation samples in the local neighborhood of the feature space. Simultaneously, the gradient of the deviation field in each direction of the feature space is calculated. The gradient abrupt boundary corresponds to the location where the deviation abruptly transitions from a low-value region to a high-value region; these locations physically represent the interface between normal and abnormal traffic behavior. When dividing the multidimensional feature space into multiple threat level regions, the initial boundary can be set according to the quantile threshold of the deviation. For example, regions with deviation below the 75th percentile are designated as low threat level, those between the 75th and 90th percentiles as medium threat level, those between the 90th and 99th percentiles as high threat level, and those above the 99th percentile as severe threat level.

[0104] The adaptive adjustment mechanism of the decision boundary dynamically corrects the initial boundary position based on the real-time analysis results of abnormal density clustering regions and gradient abrupt change boundaries. When a new abnormal density clustering region is detected in a feature subspace, this region is included in the coverage of a higher threat level, and the decision boundary threshold in that direction is tightened accordingly. When the position of the gradient abrupt change boundary drifts, the level classification threshold in the corresponding dimension is updated synchronously, enabling the decision boundary to track the dynamic changes in traffic behavior distribution. A smoothing constraint is introduced during the adjustment process to avoid frequent and drastic fluctuations in the boundary due to short-term noise. Specifically, stable updates are achieved by performing an exponentially weighted average of historical boundary positions and current calculation results. The adaptively adjusted decision boundary can more accurately reflect the distribution boundaries of normal and abnormal traffic in the current network environment, improving the accuracy of threat level classification.

[0105] After adaptively adjusting the decision boundary, threat level labeling is performed on each subgraph structure in the structured sub-feature set. The feature vector corresponding to the subgraph structure is substituted into the adjusted multi-dimensional feature space to determine which threat level region it falls into, and the corresponding threat level label (e.g., low, medium, high, and severe) is assigned to that subgraph structure. For feature vectors falling near the level boundary, a confidence scoring mechanism is introduced. By calculating the ratio of the distance from the feature vector to the adjacent level boundary, the confidence level of its belonging to the current level is quantified, providing more granular reference information for subsequent decision-making. The threat level label and the confidence score together constitute the threat labeling information of the subgraph structure.

[0106] When associating a threat level identifier with the corresponding subgraph structure in the structured sub-feature set, the unique identifier of the subgraph structure is used as the key. The threat level identifier, confidence score, and deviation value are written as additional attribute fields into the metadata record of the subgraph structure, forming a structured sub-feature set with threat annotations. This binding operation maintains the integrity of the original topological information and feature vectors of the subgraph structure, only adding threat semantic information on top of it, without changing the content and format of the original feature data.

[0107] In the stage of forming labeled heterogeneous feature combinations, the structured sub-feature sets with threat annotations are combined with unstructured behavioral sequences according to timestamp alignment. The unstructured behavioral sequences retain their original temporal order and event records, while the threat annotation information of each subgraph structure in the structured sub-feature set is mapped to the corresponding behavioral sequence fragment within a time period through time window mapping. The combined heterogeneous feature combination simultaneously contains structured statistical features and threat level information, as well as unstructured behavioral event sequences, providing a complete input data foundation for subsequent cross-modal alignment and causal chain inference in the semantic space. This heterogeneous combination method preserves the informational characteristics of both types of data, while establishing a semantic connection bridge between them through threat annotation, enabling the subsequent inference process to simultaneously utilize the threat information contained in both structured statistical patterns and unstructured behavioral patterns.

[0108] In one optional implementation, a semantic space of network behavior is constructed, and the labeled heterogeneous feature combination is used as input. Cross-modal alignment and causal chain reasoning are performed on the structured sub-feature set and the unstructured behavior sequence within the semantic space to identify implicit attack intent patterns and multi-stage threat evolution paths, generating a semantically labeled threat intelligence map, including:

[0109] Establish cross-modal alignment mapping relationships in the semantic space;

[0110] A causal chain reasoning graph structure is constructed, wherein the causal chain reasoning graph structure uses structured sub-features and unstructured behavioral sequences as graph nodes, and the cross-modal alignment mapping relationship and temporal causal association as graph edges;

[0111] In the causal chain reasoning graph structure, initial threat nodes and candidate threat nodes are selected based on the threat level identifier of the graph nodes;

[0112] In the causal chain reasoning graph structure, multi-hop path traversal is performed. Based on the threat level identifier of the graph node and the temporal weight of the temporal causal association edge, the cumulative path threat value and temporal coherence metric from the initial threat node to the candidate threat node are calculated. Paths whose cumulative path threat value exceeds the path threat threshold and whose temporal coherence metric satisfies the temporal constraint are traversed first. Multi-stage threat evolution paths that are temporally coherent and continuously escalate in threat level are identified. Attack intent patterns are extracted based on the semantic features of the threat behavior node sequence in the multi-stage threat evolution path.

[0113] The attack intent pattern and the multi-stage threat evolution path are semantically annotated in the causal chain reasoning graph structure to form the semantically annotated threat intelligence graph.

[0114] A semantic space for network behavior is constructed, mapping structured sub-feature sets and unstructured behavior sequences to the same high-dimensional vector space, making the originally heterogeneous feature representations comparable and computable. Structured sub-feature sets originate from numerical or categorical features with clear semantic definitions, such as message header fields, flow statistics, and protocol state machine transition records. Unstructured behavior sequences, on the other hand, originate from raw data lacking a fixed format, such as payload content fragments, log text, and operation command streams. To achieve cross-modal alignment, independent encoders are constructed for the two types of data: for structured sub-feature sets, an attention-based feature embedding network is used to project each sub-feature vector to the structured representation subspace in the semantic space; for unstructured behavior sequences, a sequence encoder (such as a context encoding model based on the Transformer architecture) is used to compress variable-length behavior sequences into fixed-dimensional semantic vectors, projecting them to the behavior representation subspace in the semantic space. The two subspaces share the same coordinate system of the semantic space. By comparing and learning a loss function to constrain the distance between semantically similar structured features and behavior sequences in space, a cross-modal alignment mapping relationship is established. After alignment, each point in the semantic space corresponds to a structured sub-feature vector, or a semantic representation of a sequence of behaviors. The cosine similarity between the two can directly measure the strength of their semantic association.

[0115] After establishing the cross-modal alignment mapping relationship, a causal chain reasoning graph structure is constructed using the semantic vectors of structured sub-features and unstructured behavioral sequences as graph nodes. The attributes of the graph nodes contain two types of information: first, a threat level identifier from the labeled heterogeneous feature combination, assigned during the statistical distribution deviation analysis stage, reflecting the degree to which the feature or behavior represented by the node deviates from the normal baseline in a statistical sense; second, the node's coordinate vector in the semantic space, used for subsequent semantic similarity calculation. Graph edges are divided into two categories: cross-modal alignment mapping relationship edges, connecting structured feature nodes and behavioral sequence nodes that are aligned and matched in the semantic space, with edge weights equal to the corresponding semantic similarity; and temporal causal association edges, connecting node pairs that have a sequential dependency relationship in the time dimension, with edge weights equal to the temporal weights. This is a comprehensive evaluation value reflecting the closeness of the time interval between adjacent events and the causal confidence level. Time series weighting The calculation comprehensively considers the time difference between the events and the causal propagation delay characteristics of the protocol layer. The smaller the time difference and the stronger the causal relationship at the protocol layer, the better. The larger the value, the better. The entire causal chain reasoning graph structure is organized in the form of a directed graph, where the direction of the edges represents the direction of causal propagation, that is, from the cause node to the result node.

[0116] Based on the threat level identifiers of the graph nodes, nodes with a threat level exceeding a preset high-threat threshold are marked as initial threat nodes, nodes with a threat level in the medium range are marked as candidate threat nodes, and nodes with a threat level below the low-threat threshold do not participate in path traversal. Initial threat nodes typically correspond to features or behaviors that have been explicitly marked as abnormal, such as port scanning features or abnormal authentication failure sequences; candidate threat nodes correspond to features or behaviors with statistical deviations in the suspicious range but not yet confirmed as attack behavior, such as abnormal data transmission volume fluctuations or unconventional protocol field combinations. After selecting initial and candidate threat nodes, multi-hop path traversal is performed in the causal chain reasoning graph structure, starting from the initial threat node.

[0117] Multi-hop path traversal employs a priority queue-driven heuristic search strategy. For paths starting from the initial threat node... Starting from, passing through several intermediate nodes to reach the candidate threat node path Define path threat accumulation value It is a weighted sum of the threat level identifiers of all nodes on the path, where the weights are determined by the temporal weights of the corresponding temporal causal edges. Decision, that is

[0118]

[0119] in For the first in the path Threat level identifier value for each node, Temporal weights of the temporally causal edges traversed to reach this node. Temporal coherence measure. Defined as the minimum temporal weight of all temporally causal edges on the path, i.e. This metric reflects the strength of the weakest link in the temporal correlation within the path. If there is an edge in the path with an excessively long time interval or a low causal confidence, then... The significant decrease indicates insufficient temporal coherence of the path. During traversal, priority is given to expanding... Exceeding the path threat threshold and Satisfy timing constraints (i.e.) ,in For paths that do not meet the above dual conditions (with a preset lower limit for temporal coherence), prune the path branches that do not meet the above dual conditions, thereby focusing on evolutionary paths that truly have escalation threat characteristics while ensuring computational efficiency.

[0120] After traversing multiple paths, a multi-stage threat evolution path that is temporally coherent and continuously escalates in threat level was identified. "Continuous escalation" refers to the monotonically unchanging threat level indicator value of nodes along the path, meaning that the threat level of subsequent nodes is no lower than that of preceding nodes, reflecting a typical pattern of gradual evolution of attack behavior from initial probing and privilege acquisition to lateral movement and data leakage. For each identified multi-stage threat evolution path, semantic features of the threat behavior node sequence in the path are extracted: the semantic vectors of each node on the path are concatenated in temporal order, input into an attack intent classifier, and the corresponding attack intent pattern label is output, such as "Distributed Denial-of-Service Attack Preparation Phase," "Credential Theft and Lateral Movement," and "Data Leakage Channel Establishment." The attack intent classifier is trained based on a known attack knowledge base and can map semantic vector sequences to structured attack intent descriptions.

[0121] The identification results of attack intent patterns and multi-stage threat evolution paths are semantically annotated within a causal chain reasoning graph structure. Each node on the path is labeled with an attack stage tag and its associated attack intent pattern identifier; each temporal causal relationship edge on the path is labeled with a causal propagation type tag (e.g., "trigger," "enable," "cover," etc.); and the entire path is annotated with a comprehensive threat rating and an attack intent pattern description. After annotation, the causal chain reasoning graph structure is transformed into a semantically annotated threat intelligence graph. This graph not only retains the original graph topology and feature vector information but also overlays rich semantic layer information on each node and edge. This allows subsequent threat response decisions to be directly based on structured attack intent descriptions and multi-stage evolution paths without re-parsing the original traffic data. The threat intelligence graph is persistently stored, supporting threat correlation analysis across time windows and comparison of historical attack patterns, providing complete semantic context support for the generation of layered response strategies.

[0122] In one optional implementation, based on the threat intelligence map and the threat annotations, the temporal dependencies and resource contention relationships between threat events are constructed. Combining the current load status and available buffer resources of the Ethernet control chip, a set of hierarchical response strategies that balances threat isolation effectiveness with network performance costs is generated through a constraint satisfaction solution mechanism. This includes:

[0123] Threat event nodes and associated threat labeling information are extracted from the semantically labeled threat intelligence graph. The temporal dependency relationship between threat events is constructed based on the temporal causal relationship edges of the threat event nodes in the threat intelligence graph. The resource competition relationship between threat events is constructed based on the network bandwidth resources and buffer queue resources required by the threat event nodes.

[0124] Obtain the current load status and available buffer resources of the Ethernet control chip;

[0125] A constraint satisfaction solution mechanism is constructed, which includes threat isolation effect constraints and network performance cost constraints. The threat isolation effect constraints determine the blocking requirements of the response strategy for threat events based on the threat level identifier in the threat labeling information and the temporal dependency relationship. The network performance cost constraints determine the resource consumption limit of the response strategy based on the current load status and the available buffer resources.

[0126] The constraint satisfaction solution mechanism is used to solve the response strategy allocation for the threat event nodes. Based on the resource competition relationship, the threat event node group that needs to coordinate resource allocation is determined. For the threat event node group, resource priority is sorted and allocated under the premise of satisfying the threat isolation effect constraint. For non-competitive threat event nodes, resources are directly allocated under the premise of satisfying the threat isolation effect constraint, minimizing the resource consumption of the network performance cost constraint, and generating a hierarchical response strategy set for different threat levels.

[0127] like Figure 2 As shown, the method includes:

[0128] Threat event nodes are extracted from the semantically labeled threat intelligence graph, and the threat labeling information carried by each node is read synchronously, including threat level identifiers, attack type classifications, and associated attack intent patterns. The temporal causal relationship edges in the threat intelligence graph record the sequential triggering relationships and causal dependency chains between threat events. By traversing these directed edges, the evolutionary order of threat events on the timeline can be reconstructed, thus constructing a complete temporal dependency structure. Specifically, if the temporal causal relationship edge of threat event node A points to threat event node B, it means that A occurred before B in time and has a causal contribution to the triggering of B. This dependency relationship will directly affect the determination of the handling priority in subsequent response strategy allocation.

[0129] In establishing resource contention relationships, the network bandwidth and buffer queue resources required by each threat event node during the handling process are assessed. The amount of network bandwidth required depends on the traffic volume and packet forwarding rate corresponding to the threat event, while the amount of buffer queue resources required is related to the number of packets that need to be temporarily stored and their average length. When two or more threat event nodes need to occupy the bandwidth resources of the same physical port or the storage space of the same buffer queue within the same time window, a resource contention relationship is formed between these nodes. By comparing the resource requirements of all threat event nodes pairwise, all combinations of nodes with resource contention can be identified and marked as threat event node groups requiring coordinated resource allocation.

[0130] To obtain the current load status of the Ethernet controller chip, it is necessary to read the chip's internal real-time monitoring registers and collect data on the bandwidth utilization of each port, the occupancy depth of the packet forwarding queue, and the overall processor load percentage of the chip. Obtaining available buffer resources requires querying the chip's buffer management unit to count the number and total capacity of currently free buffer blocks, as well as the remaining available space for each priority queue. This real-time status data forms the dynamic input basis for the resource constraints in the constraint satisfaction solution mechanism, ensuring that the generated response strategy matches the chip's actual available resources and preventing chip overload or buffer overflow due to strategy execution.

[0131] The constraint satisfaction mechanism is constructed around two core constraints. The threat isolation effect constraint requires that the response policy assigned to each threat event node must effectively block the attack behavior corresponding to that node. The stringency of the blocking requirement is determined by the threat level identifier in the threat labeling information: high-threat-level nodes require complete blocking, meaning the response policy must take effect simultaneously at all relevant protocol layers; medium-threat-level nodes require rate-limiting isolation, meaning the response policy must suppress the forwarding rate of the traffic corresponding to that node to below a safe threshold; low-threat-level nodes require marking and monitoring, meaning the response policy only needs to perform deep packet inspection marking and log recording on the traffic corresponding to that node. Temporal dependencies further constrain the order in which response policies take effect. For threat event node links with temporal dependencies, the response policy corresponding to the upstream node in the dependency chain must take effect before the response policy of the downstream node to prevent the attack link from being reactivated at some nodes due to incorrect processing order.

[0132] Network performance cost constraints set upper limits on resource consumption for each response strategy based on the current load status and available buffer resources. The resource consumption limit for the complete blocking strategy is determined by the number of currently free buffer blocks and the chip's remaining processing capacity. The bandwidth usage limit for the rate-limiting isolation strategy must not exceed a specific proportion of the currently available port bandwidth. The additional processing overhead of the marking and monitoring strategy must not cause the overall processor load of the chip to exceed the safe operating threshold. These two types of constraints together constitute the constraint set for the constraint satisfaction problem. A response strategy allocation scheme must satisfy all constraints simultaneously to be considered a feasible solution.

[0133] By employing a constraint-satisfaction solution mechanism to allocate response strategies, all threat event node groups with resource contention are identified. For these node groups, under the premise of satisfying threat isolation effect constraints, nodes within the group are prioritized according to their threat level: nodes with higher threat level values ​​receive resource allocation first. When nodes within a group have the same threat level, they are prioritized according to the principle that the upstream node in the temporal dependency relationship receives resource allocation first. After prioritization, bandwidth and buffer queue resources required for the response strategy are allocated to nodes within the group in sequence according to the ranking results. The remaining available resources are updated after each allocation to ensure that subsequent node resource allocation is based on the real-time updated resource status.

[0134] For non-contested threat event nodes without resource contention, corresponding response strategy resources are directly allocated to them, provided that the threat isolation effect constraint is met, without prioritization. Since there is no resource contention between non-contested nodes, their resource allocation processes are independent and can be processed in parallel to improve solution efficiency. After allocating response strategies for all nodes, the network performance cost of the overall solution is evaluated, calculating the total resource consumption of all allocated response strategies and verifying whether it meets the resource consumption upper limit specified in the network performance cost constraint. If the total consumption exceeds the upper limit, the response strategies for low-threat-level nodes are downgraded, either from a complete blocking strategy to a rate-limiting isolation strategy, or from a rate-limiting isolation strategy to a marking and monitoring strategy, until the total resource consumption meets the constraint requirements.

[0135] The final generated hierarchical response policy set is divided into three layers according to threat level: a complete blocking policy layer for high-threat nodes, a rate-limiting and isolation policy layer for medium-threat nodes, and a marking and monitoring policy layer for low-threat nodes. Each policy layer contains specific response policy entries, and each policy entry records the identifier of the target threat event node, the type of response action assigned, the effective parameters of the response action at each protocol layer, and the resource quota used. This hierarchical structure allows the Ethernet control chip to allocate and handle resources differently according to the threat level, effectively isolating high-risk threats while keeping the impact on normal network traffic forwarding performance within an acceptable range.

[0136] A second aspect of this invention provides a network security system for an Ethernet control chip based on a DPU, comprising:

[0137] The feature extraction unit is used to acquire the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction mode of the message sequence, and form a multi-dimensional traffic feature tensor.

[0138] The heterogeneous decomposition unit is used to distribute the multidimensional flow feature tensor to the DPU, and the DPU performs heterogeneous decomposition based on the topological relationship of the flow features to decompose the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors.

[0139] The threat labeling unit is used to perform threat labeling on the structured sub-feature set based on statistical distribution deviation, to obtain a labeled heterogeneous feature combination;

[0140] The alignment reasoning unit is used to construct a semantic space of network behavior and take the labeled heterogeneous feature combination as input. In the semantic space, it performs cross-modal alignment and causal chain reasoning on the structured sub-feature set and the unstructured behavior sequence to identify implicit attack intent patterns and multi-stage threat evolution paths, and generate a semantically labeled threat intelligence map.

[0141] The strategy generation unit is used to construct the temporal dependency and resource competition relationship between threat events based on the threat intelligence map and the threat labels, and generate a set of hierarchical response strategies that take into account both threat isolation effect and network performance cost by combining the current load status and available buffer resources of the Ethernet control chip through the constraint satisfaction solution mechanism.

[0142] The strategy execution unit is used to control the Ethernet control chip to perform differentiated processing at different protocol layers according to the hierarchical response strategy set.

[0143] A third aspect of the present invention provides an electronic device, comprising:

[0144] processor;

[0145] Memory used to store processor-executable instructions;

[0146] The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0147] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0148] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0149] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security method for Ethernet control chips based on DPU, characterized in that, include: Obtain the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction mode of the message sequence, and form a multi-dimensional traffic feature tensor; The multidimensional flow feature tensor is distributed to the DPU, and the DPU performs heterogeneous decomposition based on the topological relationship of flow features to deconstruct the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors. Threat labeling based on statistical distribution deviation is performed on the structured sub-feature set to obtain labeled heterogeneous feature combinations; A semantic space of network behavior is constructed and the labeled heterogeneous feature combination is used as input. In the semantic space, cross-modal alignment and causal chain reasoning are performed on the structured sub-feature set and the unstructured behavior sequence to identify implicit attack intent patterns and multi-stage threat evolution paths, and generate a semantically labeled threat intelligence map. Based on the threat intelligence map and the threat labels, the temporal dependencies and resource competition relationships between threat events are constructed. Combining the current load status and available buffer resources of the Ethernet control chip, a set of hierarchical response strategies that balances threat isolation effectiveness and network performance costs is generated through a constraint satisfaction solution mechanism. The Ethernet control chip is controlled to perform differentiated processing at different protocol layers according to the set of hierarchical response strategies.

2. The method according to claim 1, characterized in that, Obtain the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction pattern of the message sequence, and form a multi-dimensional traffic feature tensor including: The packet sequence of the network data stream is collected through the physical layer interface of the Ethernet control chip, and the arrival timestamp and physical layer link status parameters are recorded synchronously to form a physical layer packet stream with time sequence annotation. The physical layer message stream with timing annotations is parsed through the data link layer interface of the Ethernet control chip, and the communication association between nodes is established based on the extracted source MAC address and destination MAC address to form a data link layer communication topology. The physical layer message stream with time sequence annotation and the data link layer communication topology are segmented according to a fixed time window. The message sequence in each time window is aggregated according to the source MAC address and the destination MAC address to form the session-level behavior trajectory containing time sequence evolution information. Cross-layer protocol analysis is performed on the session-level behavior trajectory. By parsing the network layer protocol type, transport layer port number and application layer protocol characteristics in the message sequence, the protocol stack usage mode and protocol switching sequence of each session are identified, forming the cross-layer protocol interaction mode. The session-level behavior trajectory is associated and fused with the cross-layer protocol interaction mode to generate a multi-dimensional traffic feature tensor that includes the physical layer link state parameters, the data link layer communication topology, the session-level behavior trajectory, and the cross-layer protocol interaction mode.

3. The method according to claim 2, characterized in that, The multidimensional flow feature tensor is distributed to the DPU, and the DPU performs heterogeneous decomposition based on flow feature topology to deconstruct the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors, including: Based on the dimension identifier in the multidimensional traffic feature tensor, the multidimensional traffic feature tensor is distributed to multiple parallel processing cores of the DPU; In the parallel processing core, the data link layer communication topology in the multidimensional traffic feature tensor is modeled as a graph structure, the source MAC address and the destination MAC address are mapped as graph nodes, the communication association is mapped as graph edges, and the graph edges are assigned time-series weights according to the message arrival time sequence in the session-level behavior trajectory, forming a communication topology graph with time-series weights. By calculating the connectivity and centrality metric of each graph node, node clusters are identified, and the time-weighted communication topology graph is decomposed into multiple subgraph structures based on the node clusters. Topological features are extracted from the multiple subgraph structures respectively, and feature fusion is performed with the physical layer link state parameters associated with the corresponding subgraphs in the multidimensional traffic feature tensor to form the structured sub-feature set; A temporal behavior sequence is constructed based on the session-level behavior trajectory, a protocol evolution sequence is constructed based on the cross-layer protocol interaction mode, and the temporal behavior sequence and the protocol evolution sequence are combined to form the unstructured behavior sequence.

4. The method according to claim 1, characterized in that, Threat labeling based on statistical distribution deviation is performed on the structured sub-feature set to obtain labeled heterogeneous feature combinations, including: Construct a multidimensional feature space and establish a baseline statistical distribution in the multidimensional feature space; In the multidimensional feature space, the deviation of the feature vector corresponding to each subgraph structure in the structured sub-feature set from the statistical distribution of the baseline statistical distribution is calculated. Based on the statistical distribution deviation, a threat assessment decision boundary is constructed. The threat assessment decision boundary divides the multidimensional feature space into multiple threat level regions. By analyzing the distribution density and gradient change direction of the statistical distribution deviation in the multidimensional feature space, abnormal density clustering regions and gradient abrupt boundary in the multidimensional feature space are identified. The threat assessment decision boundary is adaptively adjusted based on the abnormal density clustering region and the gradient mutation boundary, so that the threat assessment decision boundary can dynamically adapt to the spatial distribution characteristics of the statistical distribution deviation. Threat level identifiers are assigned to the subgraph structures based on the position of the feature vector of each subgraph structure in the structured sub-feature set in the threat level region divided by the threat assessment decision boundary. The threat level identifier is associated and bound with the corresponding subgraph structure in the structured sub-feature set to form a structured sub-feature set with threat annotation; The structured sub-features with threat annotations are combined with the unstructured behavior sequence to form the labeled heterogeneous feature combination.

5. The method according to claim 1, characterized in that, A semantic space for network behavior is constructed, and the labeled heterogeneous feature combination is used as input. Cross-modal alignment and causal chain reasoning are performed on the structured sub-feature set and the unstructured behavior sequence within the semantic space to identify implicit attack intent patterns and multi-stage threat evolution paths, generating a semantically labeled threat intelligence map, including: Establish cross-modal alignment mapping relationships in the semantic space; A causal chain reasoning graph structure is constructed, wherein the causal chain reasoning graph structure uses structured sub-features and unstructured behavioral sequences as graph nodes, and the cross-modal alignment mapping relationship and temporal causal association as graph edges; In the causal chain reasoning graph structure, initial threat nodes and candidate threat nodes are selected based on the threat level identifier of the graph nodes; In the causal chain reasoning graph structure, multi-hop path traversal is performed. Based on the threat level identifier of the graph node and the temporal weight of the temporal causal association edge, the cumulative path threat value and temporal coherence metric from the initial threat node to the candidate threat node are calculated. Paths whose cumulative path threat value exceeds the path threat threshold and whose temporal coherence metric satisfies the temporal constraint are traversed first. Multi-stage threat evolution paths that are temporally coherent and continuously escalate in threat level are identified. Attack intent patterns are extracted based on the semantic features of the threat behavior node sequence in the multi-stage threat evolution path. The attack intent pattern and the multi-stage threat evolution path are semantically annotated in the causal chain reasoning graph structure to form the semantically annotated threat intelligence graph.

6. The method according to claim 1, characterized in that, Based on the threat intelligence map and the threat annotations, the temporal dependencies and resource contention relationships between threat events are constructed. Combining the current load status and available buffer resources of the Ethernet control chip, a set of hierarchical response strategies that balance threat isolation effectiveness with network performance costs is generated through a constraint satisfaction solution mechanism. These strategies include: Threat event nodes and associated threat labeling information are extracted from the semantically labeled threat intelligence graph. The temporal dependency relationship between threat events is constructed based on the temporal causal relationship edges of the threat event nodes in the threat intelligence graph. The resource competition relationship between threat events is constructed based on the network bandwidth resources and buffer queue resources required by the threat event nodes. Obtain the current load status and available buffer resources of the Ethernet control chip; A constraint satisfaction solution mechanism is constructed, which includes threat isolation effect constraints and network performance cost constraints. The threat isolation effect constraints determine the blocking requirements of the response strategy for threat events based on the threat level identifier in the threat labeling information and the temporal dependency relationship. The network performance cost constraints determine the resource consumption limit of the response strategy based on the current load status and the available buffer resources. The constraint satisfaction solution mechanism is used to solve the response strategy allocation for the threat event nodes. Based on the resource competition relationship, the threat event node group that needs to coordinate resource allocation is determined. For the threat event node group, resource priority is sorted and allocated under the premise of satisfying the threat isolation effect constraint. For non-competitive threat event nodes, resources are directly allocated under the premise of satisfying the threat isolation effect constraint, minimizing the resource consumption of the network performance cost constraint, and generating a hierarchical response strategy set for different threat levels.

7. A network security system for an Ethernet control chip based on a DPU, used to implement the method as described in any one of claims 1-6, characterized in that, include: The feature extraction unit is used to acquire the message sequence of the network data stream, extract the session-level behavior trajectory and cross-layer protocol interaction mode of the message sequence, and form a multi-dimensional traffic feature tensor. The heterogeneous decomposition unit is used to distribute the multidimensional flow feature tensor to the DPU, and the DPU performs heterogeneous decomposition based on the topological relationship of the flow features to decompose the multidimensional flow feature tensor into a set of structured sub-features and a sequence of unstructured behaviors. The threat labeling unit is used to perform threat labeling on the structured sub-feature set based on statistical distribution deviation, to obtain a labeled heterogeneous feature combination; The alignment reasoning unit is used to construct a semantic space of network behavior and take the labeled heterogeneous feature combination as input. In the semantic space, it performs cross-modal alignment and causal chain reasoning on the structured sub-feature set and the unstructured behavior sequence to identify implicit attack intent patterns and multi-stage threat evolution paths, and generate a semantically labeled threat intelligence map. The strategy generation unit is used to construct the temporal dependency and resource competition relationship between threat events based on the threat intelligence map and the threat labels, and generate a set of hierarchical response strategies that take into account both threat isolation effect and network performance cost by combining the current load status and available buffer resources of the Ethernet control chip through the constraint satisfaction solution mechanism. The strategy execution unit is used to control the Ethernet control chip to perform differentiated processing at different protocol layers according to the hierarchical response strategy set.

8. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 6.

Images