239 results about "Adaptive security" patented technology

The invention relates to the technical field of vulnerability management, and discloses a vulnerability management method and system based on an adaptive security platform. The method comprises the following steps: constructing an asset information database based on all IT assets in an organization network environment, and calculating a time sensitivity parameter set; based on the asset information database and the time sensitivity parameter set, executing aperiodic time stratification vulnerability data collection and dynamic self-shaping processing to obtain a standardized structure vulnerability data set; performing vulnerability utilization chain topology analysis through the bidirectional adversarial neural network model to generate a vulnerability risk score and a vulnerability association relationship graph; and generating vulnerability risk decision information according to the vulnerability risk score and the vulnerability association relationship graph, and performing constraint perception adaptive repair arrangement based on the vulnerability risk decision information to generate an optimal vulnerability repair scheme. The vulnerability discovery process is more efficient and accurate, the repair success rate is improved, the service interruption time is shortened, and continuous optimization of the repair process is achieved.

The invention provides a method and a system for detecting and defending cross-domain threats of a power system. The method comprises the following steps: after carrying out anomaly identification on operation monitoring data of a physical domain node in a target power grid region to obtain an anomaly identification result and carrying out denial of service attack identification according to network flow data of an information domain node to obtain an attack identification result, carrying out abnormal event association analysis on the anomaly identification result and the attack identification result to obtain an attack cross-domain anomaly identification result; according to key nodes and key risk propagation paths in a cross-domain attack chain generated based on a graph theory algorithm, generating an attack tracing atlas, and according to vulnerability information of the key nodes in the atlas, obtaining a corresponding power system topological graph and a corresponding communication network topological graph; and iteratively generating an active defense rule based on a game theory algorithm and a reinforcement learning algorithm, and issuing the active defense rule to the node. According to the method, the cross-domain attack risk is accurately perceived in real time and adaptive security defense is executed through cross-domain abnormal event association analysis, so that the comprehensiveness and reliability of security protection of the power system are improved.

The invention belongs to the field of network security, and relates to a trusted management and control network platform construction method and device, electronic equipment and a storage medium, the method comprises the following steps: constructing a basic security architecture and a trusted base, the basic security architecture being used for providing a unified root of trust and a management core for collaborative operation of upper security components; based on the basic security architecture and the trusted base, implementing multi-dimensional trusted verification and dynamic access control; an intelligent boundary protection and depth detection system is deployed and is used for constructing an intelligent, three-dimensional and self-adaptive security defense line at the boundary of each region of the network, and various known and unknown threats can be identified and blocked; constructing a unified secure communication tunnel and a cross-domain transmission guarantee; defining and realizing a standardized security function interface and a collaboration protocol; and a continuous trust evaluation and automatic operation management and control closed loop is established. The overall security is enhanced, the secure transmission of data is ensured, the compatibility and collaboration of the system are improved, and the security operation intelligence is realized.

The invention discloses an image encryption system and method in an intelligent power grid environment, and aims to solve the problem that an encryption strategy is static and lacks self-adaptive capability in the prior art. The image encryption system comprises terminal equipment, edge equipment and central equipment, and a dynamic key generation unit on the terminal equipment generates a dynamic key by cooperatively utilizing a physical unclonable feature (PUF) of the equipment and a real-time load of a power grid; the hierarchical encryption unit performs encryption of different intensities based on image content complexity. A topology sensing transmission module of the system analyzes power grid topology by using a graph neural network (GNN) and dynamically optimizes transmission. In addition, the image encryption system further integrates low-density parity check code encoding and decoding and a self-adaptive decryption strategy so as to enhance the anti-interference capability. According to the invention, by constructing a sensing, decision-making and execution integrated adaptive security system, the security, high efficiency and robustness of smart grid image data transmission are significantly improved.

The invention provides a cross-park enterprise data collaborative analysis method based on federated learning, and relates to the technical field of distributed machine learning and data security, and the method comprises the steps that a central server distributes an initial global model and configuration parameters to each park node; the nodes execute local data feature alignment to generate standardized feature vectors; calculating dynamic collaborative factors of local data and global distribution; adjusting a training strategy based on the collaborative factors and updating model parameters; collecting model updating through an encrypted channel, and screening effective updating by adopting a dynamic aggregation offset threshold value; performing weighted aggregation to generate a new global model; and terminating the process when the cross-park convergence condition is met or the maximum round is reached. According to the method, heterogeneous data differences are eliminated through a dynamic feature alignment mechanism, dual-channel collaborative evaluation and adaptive security protection are combined, multi-park collaborative modeling efficiency and robustness are remarkably improved on the premise of guaranteeing data sovereignty, and the problems of feature space splitting, weak attack protection and node contribution imbalance are solved.

The invention discloses a self-adaptive safety control method of a nonlinear MIMO system under intermittent DoS attack, which comprises the following steps: establishing a nonlinear MIMO system model suffered from intermittent DoS attack, and the system model is in a strict feedback form and comprises an unknown nonlinear function and bounded external disturbance; the DoS attack causes periodic interruption of a communication link from a sensor to a controller, so that actual measurement data is unavailable in an attack activation period; designing a switching type adaptive state estimator; coordinate transformation is carried out by introducing a filter, and a system error is decomposed into a tracking error and a dynamic surface filtering error; a Lyapunov function is constructed; performing stability analysis in stages; designing an adaptive law to update unknown parameter estimation values of the FLS; and a final event triggering controller is designed, and the event triggering controller is combined with a virtual controller to track an error compensation term and an FLS approximation term. The problem that the state cannot be measured is solved.

The invention discloses a real-time multi-dimensional sensitivity evaluation and self-adaptive safety prevention and control method and system for natural resource geographic information. The method comprises the following steps: acquiring real-time natural resource geographic information data; obtaining a preset behavior graph model; updating a preset behavior graph model according to the real-time natural resource geographic information data so as to obtain an updated behavior graph model; acquiring an updated node risk vector according to the updated behavior graph model; obtaining a trained Bayesian risk prediction model; inputting the updated node risk vector into a trained Bayesian risk prediction model so as to obtain a real-time abnormal behavior identification result; and generating a personalized prevention and control strategy scheme according to the real-time abnormal behavior recognition result. According to the method, intelligent identification, dynamic evaluation and active protection of natural resource geographic information in a full life cycle are realized by constructing a multi-dimensional sensitivity quantitative model, a dynamic risk perception mechanism based on a graph structure and a safety prevention and control strategy capable of being updated in real time.

The invention belongs to the technical field of intelligent electric power internet of things, and particularly relates to an unmanned aerial vehicle heterogeneous terminal self-adaptive security access method for electric power edge computing, which comprises the following specific steps: terminal registration and credible anchoring: binding a hardware-level identity, collecting a multi-mode fingerprint and constructing a security behavior portrait; self-adaptive access authentication is carried out; dynamic behavior monitoring and baseline adjustment: establishing an identity authentication and management system, synchronously carrying out multi-dimensional real-time monitoring, carrying out linkage treatment on abnormal behaviors, and adopting a baseline evolution mechanism to avoid misjudgment; the multi-dimensional real-time monitoring comprises terminal service trend monitoring and flow situation analysis; and performing safe closed loop and cooperative response. According to the invention, unified risk detection of the unmanned aerial vehicle can be realized, real-time monitoring of vulnerabilities, access authority and operation states of the unmanned aerial vehicle is carried out, a dynamic behavior monitoring model is constructed in combination with unmanned aerial vehicle terminal information, business data, environment data and the like, and real-time monitoring and early warning of the unmanned aerial vehicle terminal are realized.

Systems, computer program products, and methods are described herein for AI-based adaptive security parameter calculation in license key generation with quantum-resistant protections. The present disclosure is configured to utilize advanced cryptographic techniques, including elliptic curve cryptography and SHA-3 hashing, to produce secure digital signatures for license keys. An AI-driven engine analyzes historical security data to adaptively adjust key generation parameters, ensuring enhanced protection against current and emerging threats. This adaptive approach allows for continuous learning and improvement of security measures, making the system robust against both classical and quantum cryptographic attacks. The disclosed methods integrate the generation, assessment, and validation of keys into a streamlined process that promotes high security while maintaining efficiency.

A network security script arrangement method based on LLM enhanced RL comprises the following steps: 1) LLM dynamically expands a to-be-selected strategy atom set based on a security threat scene: firstly, performing semantic similarity retrieval on input security threat intelligence by using a vector library, and matching an optimal defense strategy atom in a knowledge library; the context understanding capability of the LLM is then utilized to implement semantic understanding and reasoning on the candidate atom set, generating new policy atoms complementary to the defense. 2) RL refers to LLM atomic action preference to optimize a script generation strategy, and self-adaptive security arrangement of a complex network environment is realized: firstly, a security script graph model based on strategy atoms is adopted, and multiple constraints corresponding to nodes and edges in the graph model are abstracted on the basis of security arrangement definition; and then, a composite reward function is adopted to model a linear programming function for the multi-constrained security script arrangement problem, so that multi-dimensional optimization of defense efficiency and execution cost is realized.

Systems and processes enhance cybersecurity by dynamically generating a decoy sub-application that operates parallel to the primary application using generative design and a large language model. The core feature involves real-time anomaly detection within application traffic, utilizing AI to assess threats and orchestrate appropriate responses. Upon identifying potential security threats, the system employs generative design principles to architect a restricted-functionality sub-application, deploying it instantly to engage and analyze the attack vectors without compromising sensitive production data. The sub-application is isolated through software-defined networking, ensuring that its operations do not affect the primary application's functionality. Additionally, sophisticated traffic redirection mechanisms are employed to divert suspicious traffic from the primary to the decoy application, thereby protecting the integrity while allowing detailed threat analysis. This dual-capability system not only safeguards against disruptions but also enhances adaptive security measures through continuous learning and system adjustments.

The invention discloses an energy internet intelligent key node identification and elasticity enhancement method and system, and the method comprises the steps: 1, constructing and dynamically maintaining a semantic enhanced energy internet digital twin super network and a multi-modal knowledge graph, fusing multi-dimensional information, and achieving the self-evolution and dynamic reasoning capability; 2, based on the model, fusing multi-time scale prediction data, and adaptively evaluating the dynamic comprehensive criticality of the node through an intention-function-resource-vulnerability four-layer penetrating traceability model; 3, aiming at the key nodes, generating an intelligent attack strategy by utilizing a generative adversarial network, deducing an information physical cascade failure process by combining multi-agent deep reinforcement learning, and quantitatively evaluating the system elasticity; and step 4, based on an evaluation result, generating a self-adaptive security reinforcement and dynamic reconstruction decision oriented to active immunity and elastic optimization. According to the method, the accuracy and the dynamism of key node identification can be remarkably improved.

The invention relates to the technical field of cloud computing and identity authentication security, and discloses a cloud environment intelligent identity authentication cross-domain docking method and system.The cloud environment intelligent identity authentication cross-domain docking method comprises the steps that heterogeneous identity data of multiple cloud platforms is collected and preprocessed, and a standardized identity data set is obtained; constructing a unified identity semantic model based on the standardized identity data set and generating a feature embedding vector; performing identity mapping conversion on the feature embedding vector by using a deep neural network to obtain a mapped identity feature vector; performing multi-factor adaptive trust evaluation in combination with the mapped identity feature vector and the real-time behavior data to obtain a dynamic trust evaluation result; generating an adaptive security token based on the dynamic credibility evaluation result; according to the method, the problems of cross-domain isomerism and dynamic trust evaluation of identity authentication in a cloud environment can be solved, and an effective solution is provided for cloud computing security.

The invention relates to the technical field of intelligent construction, and discloses an intelligent construction collaborative management platform and method based on digital twinning, and the method comprises the steps: firstly obtaining the practical operation data of a target engineering machine, analyzing the data safety level of the practical operation data to generate a distributed storage path, extracting storage node identifiers in the path, and deploying the storage node identifiers to a digital twinning platform; analyzing a node storage state index, querying a data backup demand and constructing a storage backup framework; then identifying an access request of the storage security framework, verifying a user identity, calculating an authority level index, analyzing an access range, and determining a platform multi-layer access regulation; then monitoring a permission change event, collecting a log, identifying a risk access behavior and calculating an access risk index; and finally, adjusting node encryption configuration according to the risk index, identifying an authority control key, and generating a self-adaptive security policy of the target engineering machinery on the platform. According to the invention, the integrity and safety of construction management can be improved.

The invention relates to the technical field of wireless communication protection, in particular to a wireless communication self-adaptive safety protection method and system based on edge computing. Capturing physical layer channel state information when the Internet of Things terminal equipment accesses the network gateway for the first time, a functional area semantic identifier of the network gateway and a current timestamp, and generating an anonymous session voucher; tracking operation track data of the anonymous session voucher, and constructing a track operation fragment; obtaining a privacy risk assessment value based on trajectory uniqueness, spatial information sensitivity and behavior association analysis of the trajectory operation fragment; when the privacy risk assessment value exceeds a preset risk threshold value, triggering a track link breaking mechanism; obtaining privacy enhanced trajectory data based on privacy protection processing and a trajectory broken link mechanism; training a virtual data generation model through the privacy enhancement trajectory data; and after the virtual data generation model converges, driving a virtual data generator in the virtual data generation model to generate a virtual operation and maintenance data stream so as to realize self-adaptive protection of wireless communication data.

The invention belongs to the technical field of artificial intelligence, and discloses an energy data acquisition encryption and privacy protection method and system. The power grid frequency deviation FREQ of a power line carrier communication system is obtained at the time of power grid data acquisition, and deviation information at different time points is combined into a random number sequence by using a hash function; a specific pulse signal is sent at a data acquisition point to obtain PLC channel pulse response CIR, a minimum mean square error estimation algorithm is used for processing, and key features such as the maximum pulse amplitude are extracted to serve as channel feature values. And then, inputting the random number sequence and the channel characteristic value into a deep reinforcement learning model trained by a large amount of historical data to generate an encryption key. And finally, encrypting the acquired energy data by adopting an AES algorithm based on the key, transmitting the energy data through an OFDM technology, and meanwhile, generating the key again according to the change of a channel characteristic value by setting a self-adaptive security mechanism. According to the method, the safety and privacy of energy data acquisition and transmission are remarkably improved.

The invention provides a self-adaptive transformation and migration method and system for an internal website, and relates to the technical field of website migration. Comprising the following steps: constructing a hierarchical credential adaptation architecture, establishing a dynamic authority-data mapping mechanism, realizing knowledge base-data migration linkage and deploying an adaptive security protection chain. The method is used for realizing collaborative improvement of compatibility, security and knowledge service efficiency of an internal website in a credential environment through hierarchical credential adaptation, dynamic permission and data association, knowledge base linkage and self-adaptive security protection; besides, through cooperative work of the hardware driving adaptation module and the software interface conversion module, automatic identification of hardware features and interface features, precise analysis of adaptation requirements and dynamic generation of configuration files are realized. The compatibility of an internal website to different models of servers, autonomous controllable components and software interfaces in a credential environment is remarkably improved, the adaptation period is shortened, and stable operation of the system is guaranteed.

The invention provides a cross-border data flow safety management method based on a block chain and dynamic risk assessment, and relates to the technical field of cross-border data processing, and the method comprises the steps: carrying out the data collection, and carrying out the classification extraction according to the sensitive information types of data; establishing and quantifying a multi-dimensional risk assessment index; performing dynamic cross-border risk assessment through a comprehensive risk calculation model according to the multi-dimensional risk assessment indexes to obtain a comprehensive risk score of the data to the transmission target; executing a self-adaptive security policy according to the comprehensive risk score; generating a security transaction abstract on the basis of the data subjected to the adaptive security policy processing, and performing uplink evidence storage; and sending the data after the execution of the adaptive security policy to a transmission target, and verifying the data by the transmission target. The cross-border data security management and control method has the advantage of improving intelligence, refinement and reliability of cross-border data security management and control.

The invention discloses an anti-quantum key management method for a vehicle-mounted domain centralized electronic and electrical architecture. Firstly, the invention provides a self-adaptive security policy generation method based on an analytic hierarchy process. Key factors influencing vehicle-mounted service safety are sorted through a system, a three-layer AHP hierarchical structure model with the purpose of selecting an optimal encryption mechanism is constructed, and therefore vehicle-mounted service safety modeling is achieved. According to the method, the most suitable security policy can be automatically matched according to the characteristics of different services, the self-adaptive security policy generation of the service granularity is realized, and the optimization of the system resource use efficiency is realized while the communication security is ensured. Secondly, the invention provides a fine-grained anti-quantum key management scheme based on the Chinese remainder theorem, and the fine-grained anti-quantum key management scheme is specially designed for adapting to a one-to-many communication scene widely existing in a vehicle-mounted network. The method supports efficient distribution and dynamic updating of group keys of service granularity, and has good quantum attack resistance.

The invention discloses an asynchronous federal self-adaptive security aggregation method based on heterogeneity perception, which comprises the following steps that: each client carries out training update on global model parameters based on a local data set to obtain each client model; selecting a gradient sensitive layer of the client model, and adding Laplace noise to an update gradient of the gradient sensitive layer to obtain a first disturbance update gradient of the client model; the server side calculates the maximum update difference of all client side models, and distributes privacy budget to each client side based on the maximum update difference; injecting Gaussian noise into the first disturbance update gradient of each client model according to the privacy budget to obtain a second disturbance update gradient of each client model; screening the clients to obtain an effective client set; calculating an aggregation weight of each client in the effective client set; and determining a weighted median of the effective client set according to the aggregation weight, and updating the global model according to a second disturbance updating gradient of the client corresponding to the weighted median.

The invention relates to the technical field of safety monitoring artificial intelligence, and discloses a safety management method and system based on artificial intelligence and big data. The method comprises the steps that multi-modal real-time monitoring data is collected through a distributed sensor array, and a standardized sequence is generated after preprocessing; the system accesses a historical security event library, adaptively divides risk category clusters by using an unsupervised clustering algorithm, and extracts key risk features and influence domains for each cluster. On the basis, a plurality of special self-adaptive security analysis engines are configured to perform parallel analysis on real-time data to generate a plurality of security analysis feature maps. And carrying out weighted fusion and enhancement on the feature maps through a feature fusion network to obtain a unified security situation feature vector, and finally outputting a security level and a management and control instruction through a decision model. According to the method, autonomous identification, dynamic evaluation and accurate response of complex risks are realized, and the intelligent level of safety management and the decision accuracy are improved.

The invention discloses a dynamic response method of a network attack defense strategy based on multi-head attention fusion, and relates to the technical field of network security, and the method comprises the steps: collecting network flow data and equipment state data of IIOT equipment, carrying out the time alignment, obtaining statistical features and frequency domain features through feature extraction, and generating a structured feature matrix; calculating a cross-domain association weight of statistical features and frequency domain features in the structured feature matrix through an attention mechanism, generating a fusion feature vector, carrying out time sequence modeling by using an LSTM model, calculating an abnormal probability score, and generating an abnormal event report; the method comprises the following steps: mapping spatio-temporal information in an abnormal event report into a quantum bit coding scheme in a digital twin environment, generating a Pareto optimal solution set by using a quantum annealing algorithm, screening a final network attack defense strategy, and coding the final network attack defense strategy into a quantum decision instruction. According to the invention, the adaptive security protection capability of the industrial Internet of Things system in a complex attack scene is effectively improved.

The invention discloses a dynamic encryption and security level adaptive adjustment method for flight data, particularly relates to the field of data security, and is used for solving the security and integrity problems of the flight data in an unstable network environment. According to the method, the mass of random seeds is quantified in real time in the mixing process, incremental seeds are added once the dispersion is reduced, and weak random source transmission is blocked; the historical track continuously provides threshold correction, so that the secret key updating rhythm and the link fluctuation are kept at the same frequency; a new secret key with sufficient safety margin is output by depending on a structured spin mixing and real-time source supplementing mechanism, and a secret key material keeps double characteristics of high discretization and high independence, so that randomness attenuation caused by packet missing, retransmission or node out-of-step is avoided; meanwhile, security level adjustment logic is deeply coupled with a key generation process, so that adaptive balance of encryption strength and operation load is realized, and the flight data is enabled to maintain collaborative excellent performance of confidentiality, integrity and real-time performance in a complex environment.

The present disclosure provides a method for secure message encryption and decryption using witness encryption. The method includes generating a master public key and a master secret key, generating common reference strings for a non-interactive zero-knowledge (NIZK) proof system and a commitment scheme, creating commitments using random values, and setting the master public and secret keys. A function key is generated by creating a dummy function tag and a NIZK proof. Message encryption involves generating a dummy input tag and creating a witness encryption ciphertext. The encrypted output includes attributes, the dummy input tag, and the witness encryption ciphertext. Decryption is performed using the function key and a witness decryption algorithm. The method enables secure message transmission with confidentiality and integrity throughout the encryption and decryption phases.

The invention discloses a self-adaptive security protection method for an internet of things terminal, and the method achieves the joint perception and collaborative response of security threats of a physical side and a network side through the construction of a lightweight cross-domain feature perception and resource dynamic adaptation mechanism. According to the method, the physical service criticality and the network attack threat are quantitatively associated, and the optimal security policy is dynamically selected according to the real-time computing power state of the terminal, so that the accurate balance between the protection strength and the service continuity is realized under limited resources. By introducing a resource-aware dynamic scheduling mechanism, the Internet of Things terminal can intelligently degrade or switch a protection strategy in a high-load or high-threat scene, and service interruption caused by resource exhaustion is avoided. Finally, the identification and defense capabilities for information-physical cross-domain hidden attacks are remarkably improved, stable operation and continuous protection of the terminal under harsh resource constraints are ensured, and finally, dual guarantee of security efficiency and service reliability is realized.

The invention provides a zero-trust-based dynamic data secure transmission and processing channel construction device and method, and the method comprises the steps: S1, collecting to-be-transmitted data, and classifying the data to obtain a data classification result; s2, based on the data classification result, the user identity information and the environmental risk information, a dynamic security policy is generated, and the dynamic security policy comprises an encryption algorithm selection rule, a trust evaluation threshold and a data operation authority policy; according to the invention, the fine-grained security policy is generated and continuously adjusted by dynamically sensing the data sensitivity and the real-time trust state, so that the full-link self-adaptive security protection from transmission to processing is realized; according to the method, the security multi-party calculation is seamlessly integrated in a high-sensitivity scene, so that the end-to-end security and privacy protection level of data in a cross-domain and multi-participant environment are remarkably improved while the data mobility is guaranteed, and the problem that a traditional static security mechanism is difficult to adapt to dynamic risks is effectively solved.

One example method may be performed in the context of a data confidence fabric (DCF) and may include monitoring a data stream handled by a node, obtaining confidence information concerning the node, determining a data confidence score for the node, mapping the data confidence score to a security policy, and applying the security policy to the data stream. The particular security policy applied to a data stream can be varied in real time based on conditions at the node.

The invention discloses an artificial intelligence model-oriented black box adaptive security assessment method and system, and the method comprises the steps: enabling the system to dynamically generate an adversarial sample through integrating a plurality of black box adversarial assessment algorithms, carrying out the robustness enhancement of the adversarial sample through a robustness enhancement algorithm, and obtaining an enhanced adversarial sample; and adaptively evaluating the vulnerability of the visual model by using the adversarial sample and the enhanced adversarial sample, and automatically storing all operation and detection records. The invention aims at integrating an existing excellent black box confrontation evaluation algorithm and a robustness enhancement algorithm in a black box scene, and solving the problems that the confrontation evaluation algorithm is low in attack efficiency and the robustness of the confrontation evaluation algorithm is fragile for visual models of different internal structures, so that a user can better explore vulnerabilities of current visual models, and the robustness of the visual models is enhanced. And a method for improving the robustness is searched.

The invention relates to the technical field of vehicle control, in particular to a Bluetooth non-inductive vehicle control system and method, and the system comprises a broadcast connection module, a position analysis module, a starting control module, a locking management module and a safety adjustment module. According to the invention, by accurately tracking the RSSI trend and dynamically adjusting the encryption strength, the sensitivity and safety of the vehicle control system are improved, and by continuously measuring the signal strength and calculating the slope change of the signal strength in real time, the system can make a response immediately when a user gets close to or away from the vehicle, so that a more accurate and instant control instruction is realized, and the user experience is improved. According to the vehicle control system, the encryption level is dynamically adjusted by monitoring peripheral Bluetooth activity and unauthorized communication behaviors in real time, the protection capability of the vehicle control system to potential security threats is enhanced, the risk that data are intercepted or tampered is effectively reduced through the self-adaptive security strategy, and the security protection capability of the vehicle control system is optimized.

The invention discloses a large model adaptive security detection method and system based on four-order linkage, and the method achieves the security detection of the output content of a large model through four-stage collaborative linkage: in the context consistency reasoning stage, calculating the semantic consistency score of a generated text, a multi-round dialogue history, a user prompt word and an external knowledge base; marking a potential risk; in the causal chain risk detection stage, modeling multiple rounds of dialogues into a causal graph, calculating a risk path probability, matching an attack pattern library, and marking high risks; in the dynamic game optimization stage, a game space of a detector and an attacker is constructed, an optimal detection threshold value is solved, and parameters of each stage are linked and updated; in the cycle state switching stage, switching is carried out between a low-power-consumption monitoring state and a dynamic updating state according to system performance and a risk situation, and a risk level is output by integrating results of the four stages. According to the method, the problems of low hidden attack detection rate, high false alarm, risk non-traceability and resource waste in the prior art are solved, and self-adaption, low false alarm, traceability, high efficiency and energy conservation are realized.