685 results about "Cyber Space" patented technology

The invention discloses a visual language navigation method for cross-modal alignment in a dynamic shielding environment, and the method comprises the steps: collecting multi-modal data through a visual sensor, an inertial measurement unit, a laser radar and the like, and carrying out the preprocessing and time synchronization; sensing the dynamic shielding object through a model composed of a convolutional neural network and a long-short-term memory network, and estimating the future change of the dynamic shielding object in combination with a space-time sequence prediction algorithm; a double-branch convolutional neural network and a Transform based on a dynamic attention mechanism are adopted to respectively extract visual and semantic features and fuse the visual and semantic features; on the basis of occlusion prediction, potential occlusion region features are extracted in advance from a time dimension, an occluded image is repaired by using a generative adversarial network and geometric constraints in a space dimension, and cross-modal feature alignment is optimized through an attention mechanism; planning a path by using a hybrid reinforcement learning algorithm based on a deep Q network-space and a fast exploration random tree, and dynamically adjusting according to real-time shielding; according to the method, the accuracy, adaptability and reliability of visual language navigation in a dynamic shielding environment are improved.

The invention provides an electric power monitoring system network space surveying and mapping method and device, and the method comprises the steps: initializing a plurality of agents based on the structural features and surveying and mapping demands of a target electric power monitoring system network, and distributing surveying and mapping tasks covering different network regions for each agent; based on the surveying and mapping task, each agent collects network dynamic information of different areas of the target power monitoring system network, and obtains a global dynamic network topology based on the network dynamic information of the different areas; based on the global dynamic network topology, the threat knowledge base and the attack mode base, analyzing potential safety hazards and potential threats of the target power monitoring system network through a deep learning algorithm, and generating a threat positioning result and a vulnerability repair suggestion; and formulating a linkage defense strategy based on the threat positioning result and the vulnerability repair suggestion in combination with the state data of the plurality of regional networks and a cooperation mechanism of the plurality of agents. According to the invention, the efficiency and accuracy of the power monitoring system to deal with complex network threats are improved.

The invention discloses a network space security situation awareness detection analysis system and method, and the system comprises a heterogeneous network flow feature deep extraction unit which obtains a flow feature vector through a distributed probe array and an adaptive sampling strategy; the edge computing gateway multi-dimensional threat feature mapping unit realizes feature space mapping through a multi-dimensional feature mapping matrix; the dynamic weight multi-head attention feature fusion unit fuses features by using an optimized multi-head attention mechanism; the time-space sequence security situation evolution modeling unit constructs an evolution model in combination with the time sequence and the fusion features; the security threat risk quantitative evaluation unit carries out risk quantification; and the heterogeneous security policy collaborative response unit generates a response instruction. According to the method, flow collection, feature mapping, fusion, modeling, quantification and response operation are sequentially executed based on all units of the system. According to the method, efficient perception and accurate response of the network space security situation are realized through a multi-unit cooperation and innovation model.

The invention discloses a large language model retrieval enhancement generation method oriented to cyberspace security emergency intelligent analysis. The retrieval and generation capability of a large language model in knowledge questions and answers in professional fields is enhanced through a knowledge graph. The method comprises a knowledge base construction module and a knowledge enhancement response generation module. The method mainly comprises the following steps: collecting multi-source data and preprocessing to construct a basic data set; defining an entity type and a relationship type, and performing entity recognition and relationship extraction based on a large language model to construct a knowledge graph; designing a graph-based hierarchical retrieval strategy to perform knowledge retrieval; and generating professional answers through a knowledge enhancement generation framework. According to the method, the accuracy of knowledge questions and answers in the professional field is remarkably improved, the accuracy of the professional field in experimental evaluation reaches 86.7%, the coverage rate of retrieval knowledge reaches 81.2%, and the interpretation quality score is 4.35 score. According to the method, the limitation of a traditional large language model in professional field application is overcome, and good expandability and adaptability are achieved.

The invention provides a self-adaptive network security early warning system and method based on deep learning, and aims to continuously update a threat recognition model through an advanced autonomous learning mechanism to adapt to a rapidly changing network environment. The system establishes a dynamic behavior baseline by integrating multi-source data including network traffic, system logs, user behaviors and the like, and realizes real-time monitoring of network behaviors and accurate identification of abnormal behaviors; once potential threats are detected, the system can automatically trigger preset response measures, such as suspicious traffic isolation and access request blocking, so that actions can be taken quickly before damage caused by the threats; according to the design of the system, the dependence on manual intervention is reduced, the real-time performance and effectiveness of early warning are improved, and the recognition accuracy of unknown attacks is remarkably improved; through the automatic and intelligent early warning mechanism, more reliable and intelligent protection is provided for network space security, and high efficiency and accuracy of network security management are ensured.

The invention discloses a network space security risk intelligent identification method and system. The method comprises the following steps: deploying traffic collection equipment at key network nodes and boundary equipment, and collecting network traffic data and log data; extracting network behavior features and log key fields, and constructing a data feature model; performing vectorization processing based on the data feature model, performing traffic classification by using a deep neural network, and identifying a device type and a device identifier; carrying out noise reduction, redundant information removal and standardization processing on flow data in the data feature model to generate standardized data and storing the standardized data in a vector database; entity extraction is carried out on the standardized data, a knowledge graph is constructed, data distribution is analyzed through a Gaussian mixture model, the probability of abnormal behaviors is calculated in combination with historical data, and attack risks are calculated based on Bayesian decision; and generating an alarm according to the calculated attack risk, tracing the historical record of the attack risk in the knowledge graph, sending a blocking instruction, and identifying the security risk of the cyberspace.

The invention discloses a causal association privacy protection cyberspace surveying and mapping threat detection method and system, and relates to the technical field of information security and cyberspace surveying and mapping. The method specifically comprises the following steps: constructing a causal incidence matrix based on a multi-modal network space surveying and mapping data dynamic fusion method of multi-scale convolution and causal reasoning to realize cross-modal surveying and mapping data feature fusion; according to the dynamic Gaussian noise privacy protection method based on GCN importance evaluation, privacy budget is dynamically allocated by utilizing causal association importance, and fusion feature privacy is protected; according to the self-adaptive pre-training model gradient protection method based on the self-supervised dual disturbance mechanism, the privacy and availability of the model are dynamically protected; according to the network space surveying and mapping threat detection method based on the stacked LSTM model, abnormal modes in multi-scale traffic are learned, and high-precision threat detection is achieved. According to the invention, through causal association modeling and dynamic privacy protection, the threat detection capability in a complex network environment is improved while the data security is guaranteed.

The invention provides a data security method and system fusing an MIN and a unified AI theory, and the method comprises the steps: S1, completing the multi-dimensional identification registration and synchronization of a data space in a multi-identification network MIN based on a data space identity identification DSID and an ontology semantic mapping frame; s2, acquiring a data acquisition record from a multi-identifier network MIN, and constructing an access control atlas in combination with a semantic vector of a data subject identifier DSID-Item; s3, analyzing the access request and verifying the authority, identifying the sensitivity level of the access request, and triggering a privacy enhancement mechanism when the sensitivity level is marked as medium-high-level privacy data; and S4, judging whether the data object reaches a value end point in the life cycle of the data object or not by taking a data space identity (DSID) registered in the multi-identifier network (MIN) as a retrieval anchor point, and if so, executing a verifiable multi-stage destruction operation. According to the invention, a full-life-cycle trusted data security technical scheme can be realized, and intelligent, explainable and efficient security management of data streams in a network space is realized.

The invention discloses a network space map surveying and mapping method and system based on multi-source data fusion, and the method comprises the steps: obtaining a multi-source data set in a unified format based on network flow data, equipment information data and geographic position data; obtaining a network asset entity and an incidence relation graph thereof through entity identification and correlation analysis based on the multi-source data set with the uniform format; obtaining a network space three-dimensional map model through three-dimensional space mapping and visual rendering based on the network asset entity and the association relationship map thereof; based on the network space three-dimensional map model, performing dynamic updating according to the accessed real-time data flow to obtain real-time network space situation data; and obtaining a network security risk assessment result through anomaly detection and threat identification based on the real-time network space situation data. According to the invention, visual display and security situation awareness of the network space are realized, and a brand new decision support tool is provided for network security management.

The invention discloses an urban cross-domain multi-mode network space modeling method, and belongs to the technical field of traffic simulation. In order to solve the problem that urban traffic cross-domain spatial modeling is complex, the method comprises the steps that road, hub and track BIM models are classified, traffic semantics in different BIM objects in the BIM models are recognized, and traffic elements are extracted; geometric element abstraction is carried out, spatial topology connection relations and attribute information of geometric elements are defined, and single-mode traffic network model modeling is carried out; coordinate conversion is carried out, and the relative position coordinates of the single-mode traffic network model are converted into 1984 world geodetic surveying geographic coordinates; a walking traffic network is used as an intermediate network, a walking traffic mode and transfer rules of roads, rails, buses and hubs are used as strategies, network fusion is achieved through a map matching algorithm, and a multi-mode network space is modeled; and carrying out topological structure verification on the obtained multi-mode network space. According to the invention, full-link calculation from design to simulation is realized.

The invention provides a power system network space precision linkage defense control method and device, and belongs to the field of power system management. The method comprises the following steps: generating a network topology structure and a key asset distribution diagram based on real-time dynamic mapping of a power system network space by a space mapping technology, extracting operation state data and potential risk information of network nodes, integrating data sources of different levels of a power system, and performing association analysis by using a deep learning algorithm, so as to obtain a key asset distribution diagram; obtaining a network threat classification result and generating a dynamic defense strategy by integrating the network operation state; wherein the strategy comprises defense path selection, response node scheduling and risk isolation measures; and executing the generated dynamic defense strategy, evaluating the effectiveness of defense measures according to a feedback mechanism, collecting historical defense records, threat features and response effects, and updating a threat knowledge base and a defense rule base based on a data analysis technology. According to the invention, the accuracy and efficiency of network space defense can be improved.

The invention relates to the technical field of network space supervision, in particular to a large-model-driven social platform cognitive adversarial perception method and system based on dynamic cooperative detection, and the method comprises the steps: constructing single social relation feature networks according to user behaviors in social network data, and combining the single social relation feature networks, obtaining a social relation feature composite network; coupling the social relation feature composite networks in different time slices to obtain community distribution on each time slice; according to the community distribution and the social text content in each community, utilizing a large language model to detect the narrative theme of each community; on the basis of the narrative themes of the communities and by utilizing a site detection model, obtaining sites of the communities for the specified event; and constructing a cognitive confrontation perception picture according to the cognitive confrontation process of each community on the full-time dimension of a specified event by taking the community as a perception object. According to the method, enterprises and institutions can be helped to better understand the cognitive situation of the network space, and support is provided for making a network purification decision.

The invention relates to the technical field of network space security, and provides a DoH malicious tunnel traffic detection method and system based on feature fusion, and the method comprises the steps: carrying out the preprocessing of obtained to-be-detected DoH traffic data, carrying out the sequence segmentation processing, obtaining a Token sequence, and extracting features based on a byte sequence feature extractor; statistical features are extracted and standardized, features are extracted through a statistical feature extraction sub-network, and statistical feature vectors are obtained; fusing the byte sequence feature vector with the statistical feature vector to obtain a classification result; the byte sequence feature extractor and the statistical feature extraction sub-network extract features, and training is carried out by adopting a semi-supervised learning framework of dynamic pseudo-tag screening for non-tag training samples. According to the method, multi-modal features are fused, a semi-supervised learning mechanism is introduced, malicious DoH traffic generated by multiple DNS tunnel tools is effectively identified under a limited annotation data set, and the detection precision and generalization ability are improved.

The invention discloses a network security attack and defense confrontation scene generation system for a novel power system. The scene editor module receives user interaction and constructs or modifies an attack and defense scene; the network simulation module generates real network environment data based on a network space surveying and mapping technology, constructs a simulation network environment and manages simulation data through a simulation database; the AI automatic control module integrates an AI algorithm to simulate an attack behavior, intelligently generates and adjusts a defense strategy, and manages an attack and defense rule through a rule engine; the security isolation module deploys security equipment to realize sensitive data isolation; the data flow direction is controlled through strategy configuration, and information leakage is prevented; the evaluation and feedback module is used for collecting data in the drilling process, carrying out multi-evaluation on the drilling effect and generating reports and suggestions; and the business module adopts a plug-in architecture, dynamically loads or unloads each functional module, constructs a multi-layer defense system, and realizes generation, evaluation and feedback of an intelligent confrontation strategy. According to the invention, the authenticity and effectiveness of attack and defense drilling are improved.

The invention relates to the technical field of cyberspace asset surveying and mapping, in particular to a cyberspace asset dynamic fusion drawing method based on knowledge graph enhancement, which constructs an asset attribute co-reference resolution mechanism based on asset information quality and defines asset information data quality measurement indexes based on real network environment asset information data. And the asset information data quality is comprehensively evaluated, and network semantic co-reference attribute resolution in the multi-source asset information data is guided. A network space asset mapping knowledge domain ontology structure of a six-tuple structure is designed, a network asset entity and asset relation is extracted through asset attribute representation and asset protocol analysis, and the network asset entity and relation are accurately represented in combination with the ontology structure. The extensive resolution domain name asset entity range in the asset information data is identified by using a misreported domain name asset entity alignment algorithm, and effective public main domain assets are extracted to align misreported asset entities, so that network asset fusion drawing noise can be eliminated, and the accuracy of network asset knowledge representation results is improved.

The invention belongs to the technical field of network space cognitive domains, and discloses a text generation method and system for text, image and video multi-modal fusion. According to the method, on the basis of images, videos and text contents published by a user, important features in multiple modes are extracted through a large model, related descriptions are generated, description information sharing is promoted, key information and core concepts are extracted to achieve deep integration among different modes, and finally an accurate text conforming to the context is generated on the basis of the large model. According to the method, multi-modal fusion is realized, clear and accurate visual information is provided, the problem of single text generation content angle is solved, and the problem of expression fuzziness in text generation is reduced.

The invention belongs to the technical field of cyberspace surveying and mapping, and particularly relates to a visual position identification method. According to the method, a trained global feature extraction network is utilized to perform feature extraction on a to-be-queried image and each reference image in a reference library to obtain respective global descriptors, and the similarity between the to-be-queried image and each reference image is calculated according to the respective global descriptors. Identifying the position of the to-be-queried image according to the geographic position of the reference image with the highest similarity; wherein the global feature extraction network firstly extracts features of different scales of an input image, and fuses the features of different scales to obtain a fused feature; carrying out feature enhancement and redundant noise suppression processing on the fusion features by utilizing relation perception global attention to obtain enhanced features; and finally, carrying out feature coding on the enhanced features by utilizing MixVPR so as to generate global descriptors. According to the method, the effect of integrally improving the robustness and generalization in coping with factors such as image view angle and complex appearance environment change and the like can be achieved.

The invention provides a method and a system for ensuring credibility and security of a network space. The method comprises the following steps of: S1, realizing multi-identifier addressing of embedded identity authentication and packet signature based on a multi-identifier network; s2, defining a digital customs, a digital passport and a digital visa based on the multi-identification network; s3, performing calculation based on the time data, the digital visa key and the hash function to obtain a digital visa based on the multi-identification network; s4, according to the hash value of the digital visa and the transnational passport key, calculating to obtain a digital passport based on the multi-identification network; s5, realizing a digital customs through a multi-identifier network router, and using and maintaining an exit table through the digital customs; and S6, verifying the digital passport by using an entry table through the digital customs, and updating the entry table. According to the method, the credibility and the security of the network space can be effectively guaranteed, the blockchain log support is traceable, and a better foundation is provided for guaranteeing the orderliness, the handling and the peaceability of the network space.

The invention provides a building identification method and system based on three-dimensional point cloud, and particularly relates to the technical field of computer vision and three-dimensional target identification, and the method comprises the steps: carrying out the undersampling, oversampling and data enhancement preprocessing of inputted building roof point cloud data, and carrying out the T-net network space alignment to output the aligned data. Then, an NEWPCT model is obtained by improving a PCT model, aligned data are input into the NEWPCT model, a point cloud feature matrix is generated through a linear coding layer, query, key and value matrixes are obtained through linear transformation, multi-head attention output is calculated by introducing an offset matrix, intermediate correlation features are obtained after splicing and fusion, and a global feature vector is generated through global maximum pooling; and finally, inputting the vector into a classifier, and outputting a building roof type, and the method solves the technical problems of geometric transformation sensitivity and local feature loss while improving the precision and robustness of three-dimensional point cloud building identification, thereby effectively improving the identification precision and robustness.

The invention discloses a system and a method for monitoring abnormal network traffic of class imbalance, and belongs to the technical field of network space security. The system comprises a flow preprocessing module, a data enhancement module and a monitoring module. The method comprises the following steps: for known class imbalance network traffic data containing normal traffic and partial abnormal traffic, firstly ensuring data quality through a traffic preprocessing module, and extracting features related to anomaly detection; then the data enhancement module carries out undersampling and oversampling on the preprocessed traffic data, and balances the proportion of normal traffic and abnormal traffic in the data set; and finally, the monitoring module clusters the flow data after enhancement processing, evaluates a clustering result, calculates the distance between an unknown flow data sample and the centroid of the cluster to which the unknown flow data sample belongs, and judges whether the flow is abnormal or not. According to the method, the identification capability of the model on the abnormal traffic is enhanced, so that the model can more effectively distinguish the normal traffic from the abnormal traffic.

The invention relates to a key link analysis method for a network security knowledge graph, and belongs to the field of network security knowledge graph calculation and analysis. According to the method, topological data of network space security knowledge graph nodes and relations are processed in a standardized mode, terrain tags of the network space security knowledge graph nodes are calculated through rules, association analysis is conducted on the nodes with important terrain tags, and the network space security knowledge graph nodes are obtained according to the analysis result. According to the method, vulnerable points, protection points, inevitable points and evasion points in a network are screened out, the nodes serve as input, path analysis is carried out based on graph analysis calculation, key links of the network space security knowledge graph are found and stored, and key link analysis results are arranged in a document report form to be presented. According to the method for analyzing the key links of the network security knowledge graph, the difficulty of analyzing the key links of the network security knowledge graph in the network security field is reduced, and meanwhile, the monitorability and security of a network space are also improved.

The invention discloses a network security named entity recognition model construction method based on a prompt learning thought, electronic equipment and a storage medium, and belongs to the technical field of network security named entity recognition. In order to solve the problem that extracted information is directly applied when facing a specific network security entity identification task, the method comprises the following steps: collecting network security data, obtaining a network space security data sequence, setting a labeling set based on a labeling rule, and generating a labeling sequence; the annotation rule comprises the entity type of the annotated data and the fact that the annotated data does not belong to any entity; based on an annotation rule, segmenting the cyberspace security data sequence, then correspondingly generating annotation subsequences, and obtaining processed cyberspace security data; defining a data augmentation rule, and carrying out data augmentation on the processed cyberspace security data to obtain a cyberspace security data set with data augmentation; and continuing pre-training and fine tuning operation in the pre-training model to obtain the network security named entity identification data extraction model.

The invention discloses a network space security intelligent monitoring and analysis system, and relates to the technical field of network security monitoring and analysis, and the system comprises a multi-source data collection module which collects multi-dimensional data in a full-link manner, and the collection frequency is dynamically adjusted along with a network load; the data preprocessing module cleans the fused data and generates a standardized analysis data set; the AI intelligent risk identification module identifies various safety risks in real time through a mixed deep learning model; the real-time response processing module starts differential processing according to a three-level mechanism; the threat traceability analysis module traces an attack link and generates a report; the security situation visualization module displays the security state in multiple dimensions; the data encryption storage module encrypts and protects data and performs double backup; and the system self-optimization module dynamically optimizes the strategy through incremental learning. The method is accurate in risk identification, timely in response processing, reliable in traceability and evidence storage, and efficient in cross-domain cooperation; terminal protection and third-party access control are enhanced, and network space security and stable service operation are comprehensively guaranteed.

The invention relates to a cyberspace anti-mapping method and device, computer equipment and a storage medium, and relates to the technical field of network security. The method comprises the following steps: inputting real-time network flow data in a network space into a trained anomaly detection model, and determining an anomaly detection result of the network flow data; the anomaly detection model is obtained through training based on annotation data in a network security knowledge graph; if the abnormal detection result is abnormal, determining an abnormal mode corresponding to the abnormal request in the network flow data, analyzing the potential attack path according to the abnormal mode and a topological structure of a network space, and determining a predicted attack scheme; the exception request is an access request initiated by the network flow data whose exception detection result is exception to each piece of resource data in a network space; and updating the security policy based on the predicted attack scheme to obtain an updated security policy, and executing the security policy. By adopting the method, the surveying and mapping security of the network space can be improved.

The invention relates to the technical field of network content security, network space security and the like, and discloses a self-adaptive multi-mode false message detection method and model based on double features, which are realized by adopting the self-adaptive multi-mode false message detection model based on the double features. The self-adaptive tweet processing module is used for obtaining natural language content, visual content and mark information of a tweet; the data enhancement module obtains natural language content of the tweet and inputs the natural language content into a large language model of the data enhancement module to rewrite the text; the multi-modal feature construction module is used for obtaining multi-modal mode features and fact features; the false message detection module combines a multi-expert network aggregation tweet feature containing a gating network to realize classification of false messages, finally achieves the beneficial effect of accurately performing false message detection, and aims at improving the accuracy of an existing false message detection method in a real scene.

The invention belongs to the field of network security, and discloses a network space vulnerability clustering method based on feature value similarity calculation. The method comprises the following steps: (10) vulnerability data acquisition and standardized storage; (20) designing a tagged vulnerability description method; (30) specific network space vulnerability calculation; (40) network security vulnerability data classification, tagging and feature extraction; (50) clustering network security vulnerabilities based on features and a clustering algorithm; and (60) carrying out visual display on the clustered network space vulnerability categories. The method has the beneficial effects that compared with a traditional method, the method provided by the invention does not need to construct a complex network security knowledge graph for huge vulnerability data, and potential association and common points among vulnerabilities can be revealed by systematically analyzing and understanding characteristics and influences of various vulnerabilities aiming at standardized and tagged vulnerability data. By means of the vulnerability clustering method, analysis can be more rapidly and accurately carried out on categories from a large amount of vulnerability data, and therefore the security risk faced by the system is evaluated.

The invention belongs to the technical field of network space security, and discloses a network unknown attack detection method, system and device and a storage medium, and the method comprises the steps: obtaining to-be-detected traffic data of a network, and extracting the features of the to-be-detected traffic data; obtaining an attack detection result through an unknown attack detection model according to the characteristics of the to-be-detected traffic data; the method comprises the following steps: acquiring training traffic data, extracting features of the training traffic data, and according to the features of the training traffic data, generating pseudo features of the training traffic data by adopting a preset sample generation model; and based on a generalized zero sample learning training mode, training a preset supervised classifier according to the features of the training traffic data and the pseudo features of the training traffic data to obtain an unknown attack detection model. The problems of small unknown attack samples and unbalanced training samples can be effectively solved, the defect of insufficient unknown attack detection capability is overcome, the detection accuracy is improved, and the network protection level is enhanced.

The invention discloses an Android application program vulnerability detection method and system based on multi-agent cooperation, and relates to the field of network space security, the method comprises the following steps: S1, vulnerability information arrangement; s2, a step of APK decompression and decompilation; S3, a step of APK intelligent scanning; s4, a vulnerability mining step; and S5, a vulnerability verification step. According to the Android application program vulnerability detection method and system based on multi-agent cooperation, security vulnerabilities in the Android application program can be effectively identified and verified, the vulnerabilities can be more accurately verified by using semantic analysis capabilities of the agents, the false alarm rate and the missing report rate of vulnerability scanning are reduced, and the vulnerability detection reliability is improved.

The invention relates to the technical field of power network space optimization management, and particularly discloses a power network space optimization analysis method and system based on a power grid GIS, and the method comprises the steps: firstly enabling a power grid GIS port to firstly match the space coordinates of a high-voltage side bus of a power transmission substation and a power distribution feeder starting node, building an electrical connection topology after verification, and evaluating a capacity coupling factor; dividing feeder segments according to topology, calculating a loss rate and a risk index, and correcting the risk index in combination with a capacity coupling factor, thereby realizing accurate quantification of the feeder state and improving risk assessment scientificity; secondly, feature vectors are constructed according to the GIS center points, the loss rates and the risk indexes of the feeder line sections for clustering, GIS layers with labels are output, feeder line clusters in the same state can be recognized conveniently, and support is provided for regional analysis; and finally, detecting a loop gap based on a layer, analyzing connectivity, identifying a weak link and optimizing feedback, accurately positioning a network short board, and providing a targeted reference for an optimization scheme.

The invention discloses a cyberspace advanced long-term threat (APT) trapping method based on a graph neural network, a storage medium and a cyberspace advanced long-term threat trapping device, and relates to the technical field of computers, and the method comprises the steps: carrying out the dimension reduction of original encrypted traffic data based on a hierarchical clustering algorithm, retaining an abnormal traffic cluster, and removing normal traffic redundant data; designing an E-ResGAT model to perform encrypted semantic modeling, and introducing a residual connection technology to retain original traffic features; and a dynamic trapping-protocol inference closed-loop system is further constructed, and a honeypot environment is utilized to simulate attack sample interaction behaviors and capture traffic. According to the scheme, efficiency balance of encrypted traffic data reduction and semantic reasoning is realized through collaborative optimization of hierarchical clustering and a graph neural network, the capture capability of the model on a hidden attack mode is enhanced in combination with a residual attention mechanism, and a multi-dimensional analysis basis is provided for high-security scenes such as a military private network; and an innovative solution is provided for improving the security defense capability of a military information system.