10542 results about "Attack" patented technology

A network mapping behavior anomaly detection method and system based on machine learning is provided. The method includes: collecting dual-source traffic data, generating a structured log data set through dual-source log fusion engine; performing subgraph matching calculation to obtain a mapping behavior deviation degree; generating communication data containing a watermark identifier in a session corresponding communication path; verifying whether attack events carry the watermark identifier; generating a network mapping behavior anomaly detection report. According to the disclosure, an adaptive attack behavior model is constructed through a multi-modal feature vector based on structured logs and a graph protocol mapping rule base, so that the cognitive robustness to protocol camouflage and path drift is fundamentally enhanced, a real-time verification chain of detection results is built, and traditional passive detection is transformed into self-proof active defense through cross verification of watermark carrying state and behavior trajectory.

The present disclosure generally relates to a two-stage system for detecting malicious nodes in Wireless Sensor Networks (WSNs), enhancing network security and resilience. The system employs a distributed approach, leveraging Cluster Heads (CHs) and a central server for efficient and accurate detection. Initially, sensor nodes are monitored for comprehensive node and network metrics, statistically ranked by significance in identifying malicious behavior. CHs perform a resource-aware first-stage detection based on their resource weight, filtering potential threats locally. Results are then aggregated at a server for a second-stage analysis using a hybrid Machine Learning (ML) and Deep Learning (DL) approach. This advanced analysis, combined with statistically relevant metrics, significantly improves detection accuracy. By integrating resource-conscious CH operation with powerful server-side ML / DL, this system offers a scalable, energy-efficient, and highly effective solution for securing WSNs against malicious node attacks, surpassing traditional detection methods in both speed and precision.

The invention relates to the field of security surveying and mapping, in particular to a network security space surveying and mapping method, system and device based on multi-source data fusion, and the method comprises the steps: obtaining network security data in real time, and constructing a dynamic network topological graph; calculating a time-varying vulnerability score based on the topological graph and a historical attack log, and predicting an attack path and a propagation probability through a Bayesian network; performing cross-domain fusion on equipment, service and user behavior characteristics by adopting a federated learning framework to generate a dynamic asset portrait; generating a risk thermodynamic diagram in combination with spatial autocorrelation analysis and a multi-index fusion algorithm; a defense strategy effect is simulated based on an attack graph reconstruction engine, a Pareto optimal strategy combination is generated through an NSGA-II algorithm, and closed-loop verification and dynamic parameter correction are realized by utilizing honeypot deployment and flow traction. Therefore, the problems of topology update lag, single risk assessment dimension, cross-domain threat association fracture, defense strategy static stiffness, non-closed loop of a verification system and the like in the traditional technology are solved.

The invention provides a network security penetration detection method and system based on artificial intelligence, and the method comprises the steps: firstly obtaining real-time network flow data containing multi-dimensional communication behavior records and protocol metadata of a target network system, and then extracting network behavior sequence features capable of describing communication behavior time relevance and a protocol interaction mode from the network flow data; inputting the network behavior sequence features into a pre-trained multi-modal threat prediction model, generating a potential attack vector prediction result containing an attack intention label, penetration path probability distribution and a threat level score, and dynamically verifying the potential attack vector prediction result based on a threat knowledge base, and finally, generating a self-adaptive defense strategy according to the penetration threat detection result, triggering defense interface deployment of a target network system, updating attack mode characteristics and a defense rule set of a threat knowledge base, and realizing intelligent and efficient network security penetration detection and defense.

The invention provides an analyzable anti-attack network security method and system based on an AI unified model. The method comprises the following steps: S1, carrying out attack source tracing and attack mode identification on an input data stream; s2, performing protocol structure analysis and grammar element extraction on the input data stream in a grammar verification layer, and starting a grammar rule matching process to obtain a grammar exception perception set; s3, fusing attack vector information on the basis of a grammar anomaly perception set in a semantic analysis layer, constructing a semantic relation graph, and outputting a semantic risk vector; s4, taking the semantic risk vector as input, combining a business scene, resource constraint and strategy preference, modeling a defense target, and outputting an optimal response path; and S5, forming a model evolution path based on local feedback and global collaboration. Through a three-layer full-information analysis mechanism and behavior feedback driving, interpretable recognition of attack intentions and collaborative optimization of defense paths are realized, attack recognition is comprehensive, response decision is accurate, and strategy evolution is controllable.

The invention discloses an information security management method based on data processing, and particularly relates to the field of information security management, comprising multi-source heterogeneous data acquisition, multi-dimensional feature index calculation, comprehensive threat detection calculation and adaptive threat decision. According to the method, the covert communication channel is accurately identified by constructing the encrypted traffic multi-mode detection model and combining protocol fingerprint entropy and traffic self-similarity analysis; an improved entropy weight fusion algorithm is adopted, collaborative analysis of system process abnormity, network behavior offset and hardware degradation is achieved, and a cross-dimension attack chain is reconstructed; a storage medium physical feature-cryptographic module runtime joint monitoring mechanism is created for the first time, hardware layer physical attacks and cryptographic side channel vulnerabilities are synchronously defended through temperature-delay correlation evaluation and key derivation density analysis, a complete attack surface from a physical layer to an application layer is covered, and the security is improved. And the detection precision and the response real-time performance of the complex threats are obviously improved.

The invention relates to the technical field of network security, in particular to a network security big data state evaluation method based on pattern recognition, which comprises the following steps of: extracting multi-modal features from a network flow log, a system event log, a host behavior log and threat intelligence data, generating a feature matrix, performing feature dimensionality reduction by adopting an auto-encoding network, and obtaining a network security big data state evaluation result; carrying out attack behavior classification and abnormal mode identification in combination with unsupervised clustering and a graph neural network; constructing an attack transition probability matrix based on a Markov model; forming a time sequence attack chain; predicting an attack development trend; and a dynamic protection instruction is issued to the safety equipment. According to the method, the unknown attack detection capability can be improved, the time sequence attack traceability is enhanced, the security situation assessment is optimized, and the method is suitable for security situation awareness in cloud computing, industrial internet and large-scale network environments.

The invention discloses a security event log real-time monitoring and analyzing system and method for a power grid communication network, and relates to the technical field of network security management. The causal relationship graph building module is used for building a causal relationship graph of the target power grid communication network; the multi-dimensional correlation analysis module is used for collecting and analyzing multi-source heterogeneous log data in real time; the abnormal security event identification module is used for identifying an abnormal security event according to the causal relationship graph and the multi-dimensional correlation analysis result; and the attack chain tracking response module is used for tracking the attack chain. According to the method, the technical problem that the existing power grid communication network security monitoring lacks tracking of abnormal event evolution from the time dimension and cannot accurately identify and track a multi-stage attack chain is solved, and the effects of dynamically tracking the evolution process of the abnormal event and identifying a potential attack chain by establishing a time causal chain graph are achieved. And the detection precision and the response speed of the attack behavior are improved.

The invention provides a network traffic anomaly detection model training method and device and a readable storage medium, and the method comprises the steps: extracting a traffic statistical feature vector according to original network traffic data, and generating an initial mixed data set; generating a confrontation disturbance sample output enhanced feature matrix based on the initial mixed data set; constructing a self-adaptive feature fusion rule based on the enhanced feature matrix, embedding asset association degree parameters into an attention calculation layer of a feature encoder, and outputting encoding features fusing threat intelligence; inputting the coding features fused with the threat intelligence into a pre-constructed initial detection model, generating false report and missing report correction labels based on the suspicious traffic fragments, and outputting an adversarial sample correction data set; and performing adversarial training on the initial detection model through the adversarial sample correction data set to obtain an incremental detection model for network traffic anomaly detection. According to the invention, the detection precision, the anti-interference capability and the real-time defense response capability of the detection model to novel attacks can be improved.

The present application relates to the technical field of communications, and in particular to a network security threat processing method and apparatus, and an electronic device. The method comprises: on the basis of acquired local area network data, determining a network security attack type of a network attack event and an association relationship between entities in the network attack event; constructing a knowledge graph on the basis of the network security attack type, the association relationship between the entities in the network attack event and a configuration rule of an initial weight; using any node in the knowledge graph as an initial node, accessing each neighbor node of the initial node along adjacent edges of the initial node, and using a preset algorithm to calculate an initial weight of each neighbor node to obtain a degree-of-maliciousness weight of the initial node; and comparing the degree-of-maliciousness weight with a preset first threshold value, and deleting a node with a degree-of-maliciousness weight thereof being lower than the first threshold value in the knowledge graph, and also deleting the adjacent edges to obtain an updated knowledge graph. The solution can improve the network security threat processing efficiency.

The invention provides a network security defense method and system based on intrusion modeling trapping, and the method comprises the steps: constructing a dynamic virtual asset atlas based on a real network topology, generating a virtual node and an interaction link through protocol fingerprint confusion, implanting an interface deformation rule in combination with a session context, and constructing a protocol stack controllable dynamic trapping interface. Extracting topology correlation degree parameters, triggering node recombination and attack path shunting rules, using a protocol stack mirror image tunnel confusion instruction flow path, constructing a dynamic attack path confusion network, and directionally transmitting an intrusion instruction to a trapping interface protocol stack. And when the parameters reach a threshold value, a node recombination strategy and an interface deformation rule are updated, a dynamic attack and defense game mechanism is formed, the attack behavior induction and feature capture capability is enhanced, and active interference and accurate traceability of network intrusion behaviors are realized. According to the technical scheme provided by the embodiment of the invention, active shunting of the attack path and accurate induction of the trapping interface can be realized, and the attack detection rate is improved.

The invention provides an intelligent vulnerability mining platform construction method and system based on a large model. The intelligent vulnerability mining platform systematically identifies and analyzes potential security risks, collects and identifies code snippets with the security risks, arranges the code snippets into risk code paragraphs, identifies target code paragraphs, determines known vulnerabilities, generates context information, captures key events in actual operation, and records real execution paths and state changes. The method comprises the steps of generating a dynamic execution track, simulating different paths, generating an attack vector path, predicting unknown vulnerabilities and credibility scores of the unknown vulnerabilities, testing prediction results of high-credibility scores, confirming and generating real vulnerability information, recording the information to a vulnerability knowledge base, and generating a security report containing vulnerability description, influence ranges, risk levels and repair suggestions. According to the technical scheme provided by the embodiment of the invention, the detection accuracy and efficiency of the security vulnerabilities in the software system are improved.

The invention discloses a network threat multi-modal detection method based on a large model, and belongs to the technical field of network security, and the method comprises the steps: collecting three types of heterogeneous data of NetFlow flow of a network layer, a system call chain sequence of a host layer and a protocol load of an application layer, and carrying out the desensitization processing and feature coding to generate a unified tensor format; the method comprises the following steps: through network security threat intelligence and MITRE ATTamp; performing supervision fine tuning on the large model by using a CK attack chain sample, and constructing a network threat identification special model; cross-device behavior characteristics are extracted through a model self-attention mechanism, and a dynamic behavior map is constructed; and finally, comprehensively evaluating an attack mode matching degree, a node vulnerability mean value, historical alarm association and an attack path risk by adopting a weighted fusion algorithm, and triggering a high-confidence alarm when a comprehensive score exceeds 0.8. According to the method, through multi-modal data fusion and dynamic graph analysis, the detection precision and response efficiency of the complex attack chain are improved.

The invention discloses a multi-level information security policy generation method based on a knowledge graph, and the method comprises the following steps: S1, collecting multi-modal data of a plurality of security data sources, and generating a standardized data set; s2, constructing and dynamically updating a multi-level knowledge graph based on the standardized data set; s3, based on the multi-level knowledge graph, a graph neural network is adopted to identify security threats and generate an evaluation report; s4, analyzing time-space characteristics of the security event, and predicting a threat evolution trend; s5, optimizing a protection strategy based on the graph attention network, and adjusting in combination with a real-time feedback mechanism; s6, simulating an attack scene by using a generative adversarial network, and optimizing a security protection strategy generation process; and S7, based on the optimized protection strategy, further adjusting and optimizing by adopting a meta-learning algorithm. Through combination of meta learning, the graph neural network and the generative adversarial network, an intelligent and dynamically adjusted network security protection strategy generation and optimization scheme is provided.

The invention relates to the technical field of network security, in particular to a network security dynamic early warning method and system based on a knowledge graph, and the method comprises the following steps: collecting real-time traffic data of a network, analyzing a data sequence by recognizing the characteristics of a state sequence and using a long and short-term memory network, and recognizing a behavior mode; and constructing a state time sequence model. According to the method, structured analysis of network behaviors is realized through time dependence analysis, refined mining of incidence relations between events, determination of a trigger chain and time relation of potential threats and reasoning process of a knowledge graph, abnormal behaviors and attack behaviors can be identified more accurately, global analysis capability of network threats is enhanced, and the network threats can be analyzed more accurately. The network environment change can be adapted in real time by dynamically adjusting the early warning threshold value and the early warning parameter, a more flexible and efficient threat response mechanism is realized, the combination of the early warning signal and the security event response is updated in real time, and the response speed and the processing efficiency of the security problem are optimized.

The invention discloses a cloud desktop security access control method based on a zero-trust architecture, belongs to the technical field of network security, and is used for solving the problems of difficulty in hidden attack detection, cross-cloud attack chain breakage and conflict between security control and service continuity in a multi-cloud environment. Firstly, user identity attributes, session metadata and service call logs are aggregated, an identity-resource-behavior triple dynamic graph is constructed, cross-session association features are extracted, and a multi-dimensional behavior baseline is generated. And quantifying the access deviation degree based on the behavior baseline, triggering sensitive operation traceability analysis, constructing a time sequence risk propagation model, identifying latent attack features, predicting a penetration path and outputting a risk propagation coefficient. And finally, dynamically generating a process-level micro-isolation strategy according to a risk result, gradually adjusting the authority through a nonlinear authority attenuation function, inserting a secondary authentication node when unexpected resource jump is detected, reconstructing a communication white list, and realizing collaborative optimization of security protection and service continuity.

The invention discloses a security risk autonomous sensing system and method based on a digital twin industrial control network. The method comprises the following steps: performing four-dimensional multi-modal modeling on an industrial control network, and constructing a twin model integrating entities, rules, services and behaviors; constructing a high-fidelity simulation network by utilizing a containerization technology based on the model; deploying a gateway at an actual network boundary, collecting traffic characteristics in real time and identifying suspicious behaviors; performing protocol restoration and behavior reconstruction on the suspicious traffic to generate a behavior sequence; performing anomaly recognition and attack classification on the behavior sequence through a deep learning model; evaluating a risk level; and matching and verifying a defense strategy according to an evaluation result, and automatically synchronizing the defense strategy to a master control network to realize a detection-response-protection closed loop. According to the invention, autonomous identification of suspicious behaviors in the industrial control network and intelligent decision-making of security policies are realized, and the method has the advantages of high simulation, low invasion, closed-loop controllability and the like.

A system and methods for implementing adversarial-robust compression and reconstruction using a vector quantized variational autoencoder (VQ-VAE) with secure latent space management. The system provides comprehensive protection against adversarial attacks through multi-channel threat detection, adaptive defensive parameters, and coordinated response mechanisms. Input data is continuously monitored for potential threats, and defensive parameters are dynamically adjusted based on detected threat levels. The system implements bounded constraints and hierarchical projections to maintain latent space security while preserving compression efficiency. Multi-stage reconstruction with progressive validation ensures reliable data recovery even under adversarial conditions. The system coordinates defensive responses across all compression and reconstruction processes, implementing various recovery mechanisms when security violations are detected. This approach enables robust compression and reconstruction of time-series data while maintaining protection against various forms of adversarial manipulation.

The invention relates to the technical field of network security, in particular to a computer network information security monitoring method, system and device and a medium, and the method comprises the steps: obtaining encrypted traffic data and application log data in a network environment, and constructing a space-time associated original data set based on the encrypted traffic data and the application log data; performing protocol analysis on the original data set with the time-space association to generate a protocol fingerprint feature vector; inputting the protocol fingerprint feature vector and the application log data into a preset heterogeneous multi-modal analysis model, and obtaining a multi-dimensional security situation assessment result containing a threat level and an attack path; and based on the multi-dimensional security situation assessment result, generating a dynamic defense strategy instruction set through a reinforcement learning algorithm, and issuing a strategy instruction to a network execution node in real time. The method and the device have the effects of realizing real-time accurate detection of encryption threats and constructing a dynamic defense system with balanced security and efficiency.

Systems and methods for generating predicted end-to-end cyber-security attack characteristics via bifurcated machine learning-based processing of multi-modal data are disclosed. The system accesses multi-modal data indicating a set of security information related to a computing system. The system then generates a set of extracted characteristics indicating a cyber-security attack on the computing system, via a supervised machine learning model, using the multi-modal data. Using this information, the system generates a revised set of extracted characteristics indicating the cyber-security attack, via an unsupervised machine learning model, using the extracted set of characteristics indicating the cyber-security attack, where the revised set of characteristics includes at least one new characteristic that was not included in the extracted set of characteristics indicating the cyber-security attack on the computing system. The system then generates for display a graphical representation of the revised set of extracted characteristics.

The invention relates to the technical field of network security, and discloses a DDoS attack real-time detection and traceability analysis method based on a knowledge graph. The system comprises a data acquisition module, a dynamic knowledge graph construction module, a dynamic knowledge graph updating module, an anomaly detection module, an attack chain traceability module and a visualization module. Network flow data is collected in real time, a dynamic knowledge graph with a network entity as a node and a communication relation as an edge is constructed, a dynamic model is combined to analyze the node state change rate, abnormal nodes are accurately detected, and attack paths are identified and attack sources are positioned through reverse derivation and path weight optimization technologies. Visual results generated by the system support visual display and analysis of abnormal behaviors, and meanwhile, a structured report is provided, so that a manager can make a decision quickly and conveniently. According to the method, the real-time performance of DDoS attack detection, the traceability accuracy and the operability of result analysis in the complex network are improved.

The invention relates to the technical field of intelligent security operation and maintenance, in particular to an artificial intelligence network security system based on multi-modal large model training, which comprises a server fault diagnosis module, a network attack detection module, an endpoint security monitoring module, a key management optimization module and a threat analysis feedback module. According to the method, the fault prediction accuracy is improved through multi-dimensional data analysis, service interruption caused by sudden hardware faults is reduced, the network access frequency, source and instruction features are evaluated based on the server abnormality, the attack detection accuracy is improved, the misjudgment risk is reduced, the endpoint equipment execution behavior, resource calling and behavior sequence are extracted, and the service performance of the terminal equipment is improved. Fine-grained security monitoring is realized, attack traceability is enhanced, a key strategy is dynamically adjusted, security adaptability is improved, strategy lag risk is reduced, multi-level data is integrated to calculate threat behavior and attack fitting degree, threat assessment fineness and response speed are enhanced, and global security situation awareness is improved.

The invention discloses a network security intelligent management and control system based on big data, and relates to the field of network security management. Comprising a data acquisition processing module, an intelligence fusion analysis module, a threat dynamic detection module, an attack deduction prediction module, a virtual mapping simulation module, an edge collaborative defense module, a defense strategy optimization module, an automatic decision execution module and a threat intelligence sharing module. According to the method, the detection capability of complex network attacks is improved, the attack path in the network environment can be visually presented, the security operation and maintenance efficiency is improved, the attack path is accurately blocked, and the attack success rate is reduced; comprehensive security event priority ranking can be realized, the scientificity of defense decision is improved, meanwhile, the system can adapt to different attack scenes, the defense efficiency is improved, it is ensured that a defense strategy always adapts to the current security situation, resource waste is avoided, and the defense cost-benefit ratio is improved.

An illustrative method includes scanning a compute environment associated with an entity and identifying one or more attack paths from a network to one or more datasets associated with the entity. The one or more attack paths each include a series of risk artifacts within the compute environment that can be exploited by an attacker to access the one or more datasets. The method further includes generating one or more attack path risk scores associated with the one or more attack paths and indicative of one or more levels of risk that the one or more attack paths could be exploited to access the one or more datasets. A risk mitigation operation associated with the one or more attack paths is performed based on the one or more attack path risk scores.

The invention relates to the technical field of information security data processing, and discloses an information security analysis method and system based on big data, and the method comprises the steps: S1, collecting multi-source heterogeneous security related data which comprises a business log, a user behavior track, network traffic, an application program interface calling record, an identity authentication log and a real-time security data flow, preprocessing the collected data to obtain standardized data; and S2, performing entity identification, event extraction and relationship mining based on the standardized data, and constructing a cross-modal threat knowledge graph containing security entity nodes and associated edges. The method solves the problem of monitoring blind areas caused by lack of dynamic association mining capability among data in a traditional method, and particularly aims at distributed, low-frequency and multi-stage hidden attacks, the scheme can accurately recover an attack chain and identify high-risk threats through dynamic matching and path reasoning of a knowledge graph, and the method has a good application prospect. And the detection coverage rate and accuracy in a complex attack scene are remarkably improved.

The invention provides an industrial control network security service security guarantee system based on behavior analysis, which belongs to the technical field of industrial control network security, and comprises a multi-source data fusion acquisition module, a dynamic behavior modeling engine, a federal learning analysis cluster, an attack chain prediction module, a self-adaptive protection strategy executor and a model evolution feedback ring, wherein the multi-source data fusion acquisition module synchronously acquires industrial control network flow (including OPC UA / Modbus / DNP3 protocol analysis), equipment operation logs, user operation behavior fingerprints and physical interface state data, and the physical interface state data comprises electrical characteristic fluctuation monitoring of USB / network interfaces. According to the scheme, through multi-technology fusion and closed-loop design, the problems of static performance, single-dimension analysis defects and response lag of a traditional industrial control security scheme are effectively solved, a comprehensive protection system with dynamic modeling, intelligent decision making, privacy protection and continuous optimization is constructed, and the security and service reliability of an industrial control network are remarkably improved.

The invention discloses a network security defense method and system based on incremental network attack analysis learning. The method comprises the following steps: collecting initial network flow data, and extracting a feature vector; and collecting real-time network flow data, performing segmentation processing based on a sliding time window, extracting time sequence association features from the segmented data, and matching the time sequence association features with the feature library to identify potential attacks or abnormal behaviors. And when the time sequence correlation feature is not matched with the feature library, marking the time sequence correlation feature as a candidate novel attack feature, calculating a mahalanobis distance between the time sequence correlation feature and a known attack feature to determine the attack variability, and dynamically adjusting the weight of the time sequence correlation feature. And inputting the adjusted feature weight and the real-time flow feature into a deep reinforcement learning detection model, and generating and updating a network security defense strategy. The scheme of the invention can effectively identify novel attack behaviors, dynamically respond and optimize defense strategies, and improve network security.

This invention relates to the field of security encryption management technology, and more particularly to a computer software security encryption management system and method. The method includes the following steps: acquiring software data and extracting privacy files; then performing interleaved layering transformations on the privacy files to generate basic encryption units; the basic encryption units are mapped through grid encoding to form an encrypted grid encoding matrix; a virtual identity index is generated based on this matrix; a fake retrieval channel is simulated based on the virtual identity index and the basic encryption units to monitor computer access to data; simultaneously, illegal attacks are induced and visitor behavior patterns are recorded; potential internal threats are deduced using the collected behavior patterns and fake retrieval channels; and the basic encryption units are progressively encrypted and solidified to improve the security and effectiveness of data protection, thus constructing a comprehensive security management system. This invention achieves a more flexible and secure computer software security encryption management method.

The invention discloses a network attack AI detection analysis method and system based on the smart Internet, and belongs to the technical field of network security protection, and the method comprises the steps: building an attack feature library through distributed edge nodes in a cooperative manner, generating feature parameters of each node based on a local attack event, and transmitting the feature parameters to a central server for dynamic fusion through encryption; constructing a multi-modal interaction graph, identifying a potential attack link based on association strength among graph nodes, and deducing an attack intention to generate a defense strategy; deploying a virtualized network environment, dynamically injecting induction characteristics, and adjusting an induction strategy in real time according to the interaction behavior of an attacker; and monitoring an abnormal mode of the user behavior sequence, triggering an AI interaction verification process and storing a defense strategy. According to the method, rapid collection and fusion of network attack features are realized, the detection delay of network attacks is reduced, the accuracy of attack prediction is improved, the flexibility and effectiveness of network attack confrontation are enhanced, and the defense intelligence and adaptive ability of the whole network are improved.

The invention discloses a high-accuracy threat intelligence assisted network threat tracing method, which comprises the following steps: S1, collecting and preprocessing multi-source network security data, and constructing a time-marked event sequence set; s2, constructing an optimized Transform network model, and processing an attack event sequence by using position coding and time embedding; s3, a black swan optimization algorithm is initialized, and a Transform structure hyper-parameter is dynamically optimized; s4, outputting an attack event semantic vector, and constructing an attack path semantic map; s5, the intelligence information vector is embedded into a Transform hidden space; s6, calculating semantic similarity and dependency intensity, and generating an attack source candidate set and a traceability path; s7, outputting an attack traceability path, a starting point node and an information label, and generating a structured traceability report; and S8, according to the traceability result feedback, updating the black swan algorithm and the Transform model. The method is used for realizing intelligent modeling of multi-source network attack events and high-accuracy traceability analysis of attack source nodes.