An fttr master-slave cooperative behavior collection and cross-device behavior chain construction method

Abstract

The application relates to the technical field of network security and embedded gateways, and discloses an FTTR master-slave cooperative behavior collection and cross-device behavior chain construction method, which solves the problems of scattered and fragmented behavior data under FTTR distributed networking, the incapability of cross-gateway event association, and the difficulty of generating complete behavior sequences due to fragmented behavior events. The method adopts a master-slave distributed architecture, a lightweight collection unit is arranged in a subnet gateway to collect terminal access, local area network communication and local process behavior, a central data collection unit is arranged in a master gateway to collect login authentication, external network access and system running state data; the subnet gateway encapsulates original data into standardized behavior events, reports the master gateway according to multiple reporting strategies, buffers events and supports retransmission when the network is abnormal. The master gateway performs data fusion and time sorting on the converged multi-source behavior events, and constructs a cross-device behavior chain in combination with identity association, time association and logical association.

Description

Technical Field

[0001] This invention relates to the fields of network security and embedded gateway technology, and in particular to a method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains. Under the collaborative architecture of FTTR master gateway and sub-gateway, network behavior modeling is achieved through distributed behavior collection, unified event reporting, global behavior association, and cross-device behavior chain construction. Background Technology

[0002] With the rapid development of smart home and IoT applications, home network architecture has gradually evolved from a single gateway to a distributed network architecture consisting of a main gateway and multiple sub-gateways. By connecting the main gateway to the external network and the sub-gateways covering terminal devices in each room, higher bandwidth, lower latency, and more stable home network coverage can be achieved.

[0003] In an FTTR network, different terminals connect to different sub-gateways, each handling local area network communication, terminal access, and some local service processing functions, while the main gateway assumes core functions such as unified authentication, external network connection, and global control. While this distributed networking approach improves network performance and management flexibility, it also introduces problems such as fragmented behavioral data and disjointed behavior across devices.

[0004] In existing technologies, the collection and analysis of network behavior mostly still adopts a single-node approach, that is, collecting behavioral data from a single gateway, a single terminal, or a single security device. This type of solution has the following problems:

[0005] (1) Behavioral data is scattered and lacks unified aggregation capability:

[0006] In an FTTR scenario, different sub-gateways each monitor the access behavior, LAN communication behavior, and local process behavior of the terminals they cover, while the main gateway monitors login authentication behavior, external network access behavior, and system running status behavior. Due to the lack of a unified data aggregation mechanism, behavioral events on different nodes are often fragmented, making it difficult to form a complete global behavioral view.

[0007] (2) Lack of cross-device behavior correlation capabilities:

[0008] Traditional behavior analysis methods typically process events based on a single device, a single node, and a single log source. They cannot perform unified time sorting and logical association of behavior events distributed across different sub-gateways, main gateways, and different terminals, making it difficult to identify continuous behavior paths with cross-device characteristics.

[0009] (3) The behavioral events are fragmented, making it difficult to form a complete behavioral sequence:

[0010] In an FTTR network, the same actor may first access the network at sub-gateway A, then initiate communication on the path connected to sub-gateway B, and finally complete the login, access, or control behavior through the main gateway. If analysis is based solely on local events, the events are independent of each other, making it impossible to construct a complete sequence that describes the evolution of the behavior.

[0011] (4) It is difficult to provide high-quality input for subsequent intrusion detection:

[0012] Many existing intrusion detection systems, while possessing rule matching capabilities, still rely on discrete logs or single-point events as inputs. They fail to capture unified behavioral chains across devices, nodes, and time, making it difficult for subsequent detection models to identify complex attack paths, such as lateral movement, multi-stage access, and cross-node collaborative behavior.

[0013] For example, in a real FTTR environment, an attacker might first access the network through a terminal on the sub-gateway G1, and then, within a short period, initiate external access or resource probing from a terminal connected to the sub-gateway G2, ultimately resulting in login authentication via the main gateway. These actions manifest as access events, communication events, and login events on different gateway nodes. Without a unified collection and correlation analysis mechanism, it is difficult to identify continuous behavioral processes belonging to the same actor.

[0014] Therefore, it is necessary to provide a behavior collection and correlation analysis method suitable for FTTR master-slave gateway architecture, which can perform collaborative collection, unified aggregation and global correlation among multiple sub-gateways and master gateway, thereby building a cross-device behavior chain and providing a reliable data foundation for subsequent network security analysis, intrusion detection and collaborative protection. Summary of the Invention

[0015] The technical problem to be solved by this invention is to provide a method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains, which solves the problems of fragmented behavior data, inability to associate events across gateways, and difficulty in generating complete behavior sequences due to fragmented behavior events under FTTR distributed networking.

[0016] The technical solution adopted by the present invention to solve the above-mentioned technical problems is as follows:

[0017] A method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains includes the following steps:

[0018] S1. Perform distributed behavior collection on the main gateway and each sub-gateway of FTTR. Sub-gateways collect local behavior data, and the main gateway collects core behavior data.

[0019] S2. Each sub-gateway encapsulates the collected behavioral data into standardized behavioral events and reports them to the main gateway. The main gateway aggregates behavioral events from all sub-gateways.

[0020] S3. The main gateway performs fusion processing on all aggregated behavioral events, performing time association, identifier association, and logical association to build a cross-device behavioral chain.

[0021] In this solution, the data processing flow scattered across multiple gateway nodes in FTTR is decoupled into three main stages: collection, reporting, and association. The collection stage acquires the original behavior of each node locally, the reporting stage centralizes the distributed data to the main gateway, and the association stage completes cross-gateway event processing in a unified data pool. This breaks away from the limitations of single-node data and enables the generation of cross-device behavior chains at the process level, providing a foundation for subsequent security analysis.

[0022] Furthermore, in step S1, the distributed behavior acquisition includes:

[0023] The sub-gateway collects terminal access behavior, LAN communication behavior, and local process behavior.

[0024] The main gateway collects login authentication behavior, external network access behavior, and system operation status data.

[0025] In this solution, the sub-gateway is responsible for collecting relevant behaviors of local terminals, while the main gateway is responsible for collecting core behaviors of global authentication external networks. This division of labor ensures that each gateway performs its own function and avoids the waste of computing power caused by a single gateway collecting all data.

[0026] Furthermore, in step S1, the distributed behavior acquisition method employs a combination of event-triggered acquisition and periodic scanning acquisition:

[0027] Terminal access behavior, login authentication behavior, and abnormal network communication behavior are collected in real time using an event-triggered method.

[0028] Process behavior and system operating status are collected through periodic scanning, and the time interval of the periodic scanning is dynamically adjusted according to the gateway system load.

[0029] This solution employs a combination of event-triggered data collection and load-adaptive periodic scanning. For sudden events (access, login), the timing of occurrence is clearly defined, allowing for immediate capture via event triggering. For processes and system states with gradual changes, periodic scanning is sufficient for coverage. The scanning cycle dynamically adjusts with the load, automatically lengthening under high load and shortening under low load. This balances the real-time nature of critical event collection with avoiding continuous high-frequency scanning that consumes the gateway's CPU and memory resources, thus balancing data collection integrity with the performance overhead of the embedded gateway.

[0030] Furthermore, in step S2, the standardized behavioral event includes at least a device identifier, event type, timestamp, and behavioral feature fields.

[0031] In this solution, since the original data collected by different sub-gateways have different formats, the problem of heterogeneous original data of each sub-gateway is eliminated by forcibly standardizing fields, so that the main gateway does not need to adapt to multiple types of original data formats.

[0032] Furthermore, in step S2, the reported behavior events include multiple reporting modes: real-time reporting, periodic batch reporting, threshold-triggered reporting, and adaptive reporting based on gateway load.

[0033] When the network is abnormal or the main gateway is unreachable, the behavior events to be reported locally on the sub-gateway are cached and retransmitted after communication is restored.

[0034] In this solution, real-time reporting of critical events ensures the timeliness of security incidents, while periodic batch reporting of non-critical events reduces the number of messages; adaptive load dynamic adjustment of the reporting frequency prevents reporting traffic from crowding out service bandwidth; and cached retransmission solves the problem of data loss due to brief link jitter in FTTR networking.

[0035] Furthermore, in step S3, the fusion process includes: performing a unified format conversion on the received multi-source behavioral events, sorting all behavioral events according to timestamps, and generating a time-ordered event sequence.

[0036] In this solution, the time base of events from different sub-gateways and the main gateway is uniformly based on timestamps. All events are sorted in a unified manner, which can eliminate the timing disorder caused by slight deviations in the local clocks of different nodes.

[0037] Furthermore, in step S3, the identification association includes grouping behavioral events scattered across different gateway nodes into the same behavioral subject based on device identification, IP address, or MAC address.

[0038] In this solution, the MAC address does not change when the same terminal switches to access different sub-gateways. By relying on the identification information, events belonging to the same terminal that are scattered in the logs of different sub-gateways are bound together. This can solve the problem of the fragmentation of the behavior subject caused by the terminal roaming access across sub-gateways and realize the identification of the same behavior subject across gateways.

[0039] Furthermore, in step S3, the time correlation is to filter behavioral events within a preset time window range to obtain a set of events with temporal continuity.

[0040] In this solution, since the steps of the same continuous behavior occur within a short time interval, a time window is set to filter out irrelevant events with excessively long time spans, thus narrowing the range of events to be associated. This reduces the participation of irrelevant events in the association calculation, lowers the computing power overhead of the main gateway for association calculation, and improves the efficiency of association processing.

[0041] Furthermore, in step S3, the logical association is based on the causal relationship or the order of operations between events, and performs logical matching on the merged event set within the time window.

[0042] In this solution, since attack and normal access behaviors have a fixed sequence logic, the business relationship between events is identified by logical causal relationship, rather than simply by time and device identifier. This can identify logically continuous behavior sequences that are interspersed with other unrelated device events, thus improving the accuracy of behavior chain construction.

[0043] Furthermore, in step S3, constructing the cross-device behavior chain involves sequentially assembling the event set after time association, identifier association, and logical association processing to form a behavior chain, and then outputting the behavior chain to the intrusion detection module.

[0044] In this solution, discrete single-point events are transformed into complete behavioral evolution paths, and the behavioral chain is delivered as input to upper-layer security detection. This can provide complete behavioral evidence across devices for intrusion detection, enabling intrusion detection to identify complex cross-gateway attack behaviors such as lateral movement and multi-stage attacks.

[0045] The beneficial effects of this invention are:

[0046] (1) Achieve distributed collaborative data collection in the FTTR network, collect local behavior of each sub-gateway nearby, and aggregate global data at the main gateway. This eliminates the need for each gateway to collect all network behaviors, reduces the computing power overhead of embedded devices in each sub-gateway, constructs a complete global behavior view of the home FTTR network, and overcomes the data silo problem of traditional single-node data collection.

[0047] (2) Multi-mode reporting combined with a cache retransmission mechanism takes into account the real-time reporting of security events while controlling network packet overhead; when the link is abnormal, the event is cached and retransmitted when communication is restored, which greatly reduces the probability of event loss and improves the reliability of data reporting.

[0048] (3) By using the triple association rules of time, device identification and behavior logic, fragmented events distributed on the main gateway and multiple sub-gateways are merged and spliced ​​to generate a complete behavior chain across gateways and terminals, thus solving the problem of behavior fragmentation caused by terminal roaming access across sub-gateways.

[0049] (4) The acquisition strategy dynamically adapts to the gateway load, the event triggers the acquisition of key mutation events, the periodic scan acquires steady-state information, the scanning interval is dynamically adjustable, adapts to the hardware constraints of the limited computing power of the FTTR embedded gateway, and reduces the system resource consumption while ensuring the acquisition quality.

[0050] (5) Output the complete cross-device behavior chain to the intrusion detection module. It no longer relies on discrete single-point logs and can identify complex cross-device attack paths such as lateral movement and multi-stage probing. It upgrades FTTR network security protection from single-point detection to network-wide collaborative detection and improves the attack identification capability of home FTTR networks. Attached Figure Description

[0051] Figure 1 This is a system architecture diagram of the application environment in an embodiment of the present invention.

[0052] Figure 2 This is a flowchart illustrating the distributed data collection and reporting process in an embodiment of the present invention.

[0053] Figure 3 This is the processing flow of the behavior association analysis module in this embodiment of the invention. Detailed Implementation

[0054] This invention aims to provide a method for FTTR master-slave collaborative behavior collection and cross-device behavior chain construction, solving the problems of fragmented and scattered behavior data, inability to correlate events across gateways, and fragmented behavior events making it difficult to generate complete behavior sequences in FTTR distributed networking. Its core idea is to adopt a holistic approach of distributed collection, standardized reporting, and global multi-dimensional association by the master gateway. Sub-gateways collect local terminal behavior data from nearby locations, uniformly encapsulate events, and report them to the master gateway. The master gateway aggregates data from all nodes and constructs a cross-device behavior chain by combining time, device identifier, and business logic triple association rules, outputting a complete behavior sequence for use by upper-layer security detection.

[0055] More specifically, this includes the following aspects:

[0056] (1) Data collection level: A master-slave distributed data collection architecture is adopted. The sub-gateway deploys a lightweight data collection unit to collect terminal access, local area network communication and process behavior, while the master gateway collects login authentication, external network access and system status. Event-triggered data collection and periodic scanning data collection are distinguished. The periodic scanning interval is dynamically adjusted according to the gateway load to adapt to embedded gateway resource-constrained scenarios.

[0057] (2) Reporting level: Sub-gateways convert various types of raw collected data into standardized behavior events with unified fields; support real-time, periodic batch, threshold trigger, and adaptive reporting modes, and add local caching-network disconnection retransmission mechanism to ensure the reliability of behavior events transmitted from multiple sub-gateways to the main gateway.

[0058] (3) Correlation analysis level: The main gateway receives all events reported by the sub-gateways and the events it collects, completes format fusion and global time sorting; sequentially executes the identification association binding of the same behavior subject, the time window filtering of the time continuous event set, and the behavior logic association to identify the causal order of events; splices together to generate a complete behavior chain across gateways and terminals, delivers it to the intrusion detection module, and completes FTTR full network behavior modeling.

[0059] Example

[0060] This embodiment provides a method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains, and its operating environment is as follows: Figure 1 As shown, the overall architecture is a three-tiered distributed network architecture consisting of a main gateway, multiple sub-gateways, and terminals. The main gateway is at the top level, internally deploying a centralized data acquisition unit and a behavior correlation analysis module. The main gateway connects to the external wide area network and establishes communication links with multiple sub-gateways. The diagram uses three groups of sub-gateway branches as an example.

[0061] Each branch corresponds to a set of sub-gateways and the terminal devices under its jurisdiction: the sub-gateways are deployed in various rooms of the home, and are equipped with distributed data acquisition modules and behavior data reporting modules, and are responsible for providing network access services to home terminals in this area; each terminal connects to the local area network of the corresponding sub-gateway and accepts the network management of the sub-gateway.

[0062] The communication channel between the main gateway and each sub-gateway is used to receive standardized behavioral events reported by each sub-gateway; the local area network link between the sub-gateway and its subordinate terminals is used to obtain various raw behavioral data such as terminal access and local area network communication.

[0063] Based on the above system architecture, the process of the FTTR master-slave collaborative behavior acquisition and cross-device behavior chain construction method provided in this embodiment includes the following implementation steps:

[0064] S1. Perform distributed behavior collection on the main gateway and each sub-gateway of FTTR. Sub-gateways collect local behavior data, and the main gateway collects core behavior data.

[0065] In this step, a master-slave distributed data collection method is adopted, with local behavior collection performed on each sub-gateway side and core behavior collection performed on the master gateway side, so as to provide a data foundation for subsequent behavior correlation analysis.

[0066] The sub-gateway is equipped with a lightweight data acquisition unit for collecting terminal access behavior, local area network communication behavior, and local process behavior; the main gateway is equipped with a centralized data acquisition unit for collecting login authentication behavior, external network access behavior, and system operation status data.

[0067] In one exemplary implementation, the distributed data acquisition module includes the following sub-modules:

[0068] (1) Terminal access behavior collection submodule: By listening to the address resolution protocol cache table or dynamic host configuration protocol allocation event, the terminal device access information is obtained, including the terminal device's IP address, MAC address and access time.

[0069] (2) Network communication behavior collection submodule: By setting up data packet capture points in the network data forwarding path, the data packets passing through the sub-gateway are parsed to extract source address, destination address, port and protocol type information.

[0070] (3) Process behavior collection submodule, which obtains the identifier, permissions and execution command information of the currently running process by accessing the operating system process information interface.

[0071] (4) Login behavior collection submodule: listen to the gateway login authentication interface to obtain user login requests, authentication results and login time information.

[0072] (5) System status acquisition submodule: By reading the running status interface provided by the operating system kernel, the current system process status, port listening status and kernel module loading status are obtained.

[0073] Distributed behavior data collection employs a combination of event-triggered and periodic data collection methods:

[0074] Login behavior, terminal access behavior, and abnormal network communication behavior are collected in real time using an event-triggered method.

[0075] For process behavior and system running status, a periodic scanning method is used for data collection.

[0076] The time interval of the periodic scan is dynamically adjusted according to the current system load of the gateway, thereby ensuring the integrity of data collection while reducing the impact on system performance.

[0077] In one exemplary implementation, the sub-gateway performs local behavior collection, acquiring raw behavior data of terminal access behavior, LAN communication behavior, and local process behavior through its internal collection sub-modules. The collection employs a combined event-triggered and periodic scanning mechanism. Real-time collection is triggered by sudden events such as terminal access and abnormal communication, while process data is collected periodically according to a dynamically adjusted scanning cycle. After acquiring the raw behavior data, the sub-gateway generates corresponding behavior events and sends them to the behavior data reporting link.

[0078] S2. Each sub-gateway encapsulates the collected behavioral data into standardized behavioral events and reports them to the main gateway. The main gateway aggregates behavioral events from all sub-gateways.

[0079] In this step, each sub-gateway uses a data reporting mechanism to standardize and reliably transmit heterogeneous raw collected data to the main gateway, thereby achieving centralized aggregation of distributed data.

[0080] Each sub-gateway is equipped with a behavior data reporting module, which converts locally collected terminal access behavior, network communication behavior, and process behavior into behavior event data in a unified format and sends it to the main gateway. The main gateway receives behavior event data from multiple sub-gateways and uses it as input for subsequent behavior correlation analysis.

[0081] The behavior data reporting module specifically includes the following implementation units:

[0082] (1) Event encapsulation unit, used to convert the collected raw behavior data into behavior events in a unified format, wherein the behavior events include at least device identifier, event type, timestamp and behavior feature fields.

[0083] (2) A communication transmission unit, used to send behavioral event data to the main gateway through a network communication interface, wherein the communication method includes socket-based long connection transmission or connectionless message transmission.

[0084] (3) Send control unit, used to control the reporting method of behavioral events according to preset strategy, including real-time reporting and periodic reporting modes.

[0085] (4) Cache management unit, used to cache the behavioral event data to be reported when the network is abnormal or the main gateway is unreachable, and to retransmit it after the communication is restored.

[0086] The behavioral events are encapsulated using a unified communication protocol during transmission to ensure the consistency of data format uploaded by different sub-gateways.

[0087] The behavior data reporting module employs multiple reporting strategies to balance real-time performance and system resource consumption, including:

[0088] (1) Real-time reporting strategy: Report immediately when a critical behavioral event is detected.

[0089] (2) Periodic reporting strategy: Non-critical behaviors are packaged in batches and reported periodically.

[0090] (3) Threshold triggering strategy: When the same type of behavior reaches the preset threshold, a report is triggered.

[0091] (4) Adaptive strategy: dynamically adjust the reporting frequency according to the current system load of the gateway.

[0092] In an FTTR network environment, multiple sub-gateways continuously report behavioral event data to the main gateway through the behavior data reporting module. The main gateway aggregates the data from different sub-gateways to form a cross-gateway behavior data set, providing a data foundation for subsequent cross-device behavior correlation analysis and realizing a collaborative processing mechanism from distributed collection to centralized analysis.

[0093] The distributed data acquisition and reporting process in this embodiment is described in [reference]. Figure 2 .

[0094] S3. The main gateway performs fusion processing on all aggregated behavioral events, performing time association, identifier association, and logical association to build a cross-device behavioral chain.

[0095] In this step, the main gateway constructs a cross-device behavior chain by performing time and logical correlation on the distributed collected behavioral events, providing a basis for intrusion detection.

[0096] The main gateway is equipped with a behavior correlation analysis module, which is used to receive behavior event data reported from multiple sub-gateways and behavior data collected locally by the main gateway, and to perform fusion processing on the behavior data to generate a unified behavior event sequence.

[0097] The behavior correlation analysis module includes the following processing units:

[0098] (1) Data fusion unit, used to receive and aggregate behavioral event data from different gateway nodes and perform unified format conversion.

[0099] (2) Time sorting unit, used to sort events according to the timestamp of the behavioral event to form a time-ordered event sequence.

[0100] (3) Identification and association unit, used to merge behavioral events based on device identifier, IP address or MAC address, and establish cross-gateway event association relationship.

[0101] (4) Behavior chain construction unit, used to combine multiple behavioral events into a behavior chain based on a preset time window and association rules.

[0102] The processing flow of the behavior association analysis module in this embodiment is as follows: Figure 3 It fully demonstrates the entire process of behavioral data reception, data fusion, time sorting, identification association, and behavioral chain construction.

[0103] In a specific implementation, the behavior chain construction unit generates the behavior chain in the following manner:

[0104] Iterate through the time-sorted sequence of behavioral events;

[0105] Extract the set of events that satisfy the time continuity condition using a preset time window as a constraint;

[0106] Based on the logical relationships between behavioral events, the event set is connected sequentially to form a behavioral chain;

[0107] The logical associations include, but are not limited to, behaviors generated by the same terminal device, access behaviors corresponding to the same IP address, and operation behaviors in the same session context.

[0108] The behavior association analysis module uses multidimensional association rules to associate behavior events, including:

[0109] (1) Time association rule: When multiple behavioral events occur within a preset time window, they are considered to have time association.

[0110] (2) Identification association rule: When behavioral events have the same device identifier, IP address or MAC address, they are considered to belong to the same behavioral subject.

[0111] (3) Behavioral logic association rule: When multiple behaviors have a causal relationship or a sequential relationship in logic, they are combined into a continuous behavior.

[0112] Compared to traditional single-device behavior analysis methods, this invention uses cross-gateway behavior correlation analysis to form a complete behavior sequence from behavior events scattered across different gateway nodes, thereby enabling the identification of intrusion behaviors that cannot be detected by a single device.

[0113] After completing the construction of the behavior chain, the behavior association analysis module outputs the generated behavior chain data to the intrusion detection module as input data for intrusion determination.

[0114] Although embodiments of the present invention have been described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the present invention, and all such changes and alterations shall not depart from the protection scope of the present invention.

Claims

1. A method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains, characterized in that, Includes the following steps: S1. Perform distributed behavior collection on the main gateway and each sub-gateway of FTTR. Sub-gateways collect local behavior data, and the main gateway collects core behavior data. S2. Each sub-gateway encapsulates the collected behavioral data into standardized behavioral events and reports them to the main gateway. The main gateway aggregates behavioral events from all sub-gateways. S3. The main gateway performs fusion processing on all aggregated behavioral events, performing time association, identifier association, and logical association to build a cross-device behavioral chain.

2. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 1, characterized in that, In step S1, the distributed behavior acquisition includes: The sub-gateway collects terminal access behavior, LAN communication behavior, and local process behavior. The main gateway collects login authentication behavior, external network access behavior, and system operation status data.

3. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 2, characterized in that, In step S1, the distributed behavior collection method uses a combination of event-triggered collection and periodic scanning collection: Terminal access behavior, login authentication behavior, and abnormal network communication behavior are collected in real time using an event-triggered method. Process behavior and system operating status are collected through periodic scanning, and the time interval of the periodic scanning is dynamically adjusted according to the gateway system load.

4. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 1, characterized in that, In step S2, the standardized behavior event includes at least the device identifier, event type, timestamp, and behavior feature fields.

5. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 4, characterized in that, In step S2, the reported behavior events include multiple reporting modes: real-time reporting, periodic batch reporting, threshold-triggered reporting, and adaptive reporting based on gateway load. When the network is abnormal or the main gateway is unreachable, the behavior events to be reported locally on the sub-gateway are cached and retransmitted after communication is restored.

6. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 1, characterized in that, In step S3, the fusion process includes: performing a unified format conversion on the received multi-source behavioral events, sorting all behavioral events according to timestamps, and generating a time-ordered event sequence.

7. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 1, characterized in that, In step S3, the identification association includes grouping behavioral events scattered across different gateway nodes into the same behavioral subject based on device identification, IP address, or MAC address.

8. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 1, characterized in that, In step S3, the time correlation is to filter behavioral events within a preset time window range to obtain a set of events with temporal continuity.

9. The method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in claim 1, characterized in that, In step S3, the logical association is based on the causal relationship or the order of operations between events, and performs logical matching on the merged event set within the time window.

10. A method for collecting FTTR master-slave collaborative behavior and constructing cross-device behavior chains as described in any one of claims 7 to 9, characterized in that, In step S3, constructing the cross-device behavior chain involves sequentially assembling the event set after time association, identifier association, and logical association processing to form a behavior chain, and then outputting the behavior chain to the intrusion detection module.

Images