The invention relates to the technical field of
data processing, in particular to a
backtracking analysis model construction method based on an
attack chain, which comprises the following steps that: a kernel layer security agent acquires process, file and
network behavior characteristics in a hardware isolation environment, and generates an event tuple; the
tensor network pipeline performs three-dimensional decoupling mapping on the tuple into a behavior
fingerprint vector, an
orthogonalization noise feature and an asymmetric adjacent
tensor, and compresses the behavior
fingerprint vector, the
orthogonalization noise feature and the asymmetric adjacent
tensor into a space-time topology tensor block; the
reinforcement learning controller constructs a
directed acyclic graph based on the tensor blocks, calculates
connectivity loss and outputs an
event risk score; the dynamic routing engine constructs a
decision tree model according to the risk mark, the
burst frequency and the
correlation entropy, and implements three-level
shunting and a multiple
simulation system to generate an anti-interference index; and when the deviation between the physical trajectory and the digital model exceeds the tolerance, the closed-loop feedback
weight coefficient updates the
loss function parameter and adjusts the
channel resource weight. And the problem of
threat discovery
delay caused by
attack chain breakage under massive events is solved.