85 results about "Threat perception" patented technology

The invention discloses an internet space security test method and system based on network equipment microscopic data, and solves the problem that the existing method lacks attention to microscopic data of single network equipment and security protection of associated equipment. The method comprises the following steps: acquiring microscopic data of network equipment, including physical attributes, connection characteristics, communication behaviors and historical use modes, modeling the microscopic data into a tensor, and determining an acquisition frequency through a sampling boundary; collecting behavior characteristic data according to the collection frequency, and extracting and marking abnormal communication characteristics through an abnormal detection method; calculating a risk score based on the abnormal communication characteristics, generating a risk level label, and carrying out real-time early warning and deep analysis on high-risk equipment; and at the same time, threat perception index calculation is carried out on associated equipment, priority ranking is carried out, protection resources are allocated, and it is ensured that potential threats are comprehensively protected. According to the invention, accurate risk assessment and dynamic protection can be realized, and the security of the internet space is improved.

The invention discloses a dynamic honey point collaborative intelligent threat trapping system and method based on a genetic algorithm in the technical field of network security, and the system comprises a multi-source information collection and dual-mode output module, a reinforcement learning strategy engine, a graph neural network prediction module, a digital twin simulation environment, a strategy verification and optimization module, and a real network defense execution module. A dynamic honey point deployment strategy is generated in real time through a reinforcement learning strategy engine, and the problem of strategy stiffness is solved; a third-generation non-dominated sorting genetic algorithm (NSGA-III) multi-objective optimization algorithm is used for coordinating honey point density adjustment, trip line sensitivity calibration and other actions; attacking path risks are quantified based on a threat scoring formula, digital twin environment pre-verification and high-risk node precise protection are driven, closed-loop linkage of threat perception, strategy optimization and active trapping is finally achieved, and the intelligent defense capability capable of achieving autonomous evolution is formed.

The invention relates to the technical field of multi-modal data processing, and discloses a multi-modal threat perception method and system based on a space-time diagram neural network, and the method comprises the steps: obtaining a multi-modal original data set in a vehicle insurance claim settlement link, and carrying out the business relation mining and space-time dynamic analysis, and obtaining an entity space-time relation diagram; inputting the entity space-time relation graph into a space-time graph neural network for space-time fusion to obtain a node threat embedding vector; performing graph contrast learning and cross-modal feature discrimination on the node threat embedding vector to obtain a vehicle insurance threat feature vector; and carrying out fraud space-time propagation modeling based on the vehicle insurance threat feature vector, and generating a vehicle insurance threat blocking strategy, the method can accurately predict a propagation path and an influence boundary of gang fraud in a vehicle insurance ecological network, and identifies potential threats and starts prevention measures before a fraud behavior is completely displayed.

The invention relates to a data security processing method and system based on distributed storage, and relates to the technical field of computer information processing. The method comprises the following steps: cutting data into encryption fragments with a configurable number by adopting a dynamic fragmentation strategy, and generating a physically isolated dynamic check block in combination with a timestamp to realize tampering prevention; a dynamic threshold value is dynamically calculated based on the data sensitivity index and the node load, and the node is optimized through the reliability score for cooperative decryption; a database table is divided into independent marshalling storage according to main foreign key association, foreign key fields are encrypted by adopting cross keys, and cross-marshalling access needs to meet a multi-key threshold condition; an intelligent threat perception engine is constructed, access logs and threat intelligence are analyzed in real time, and key rotation, fragment replacement and joint defense response mechanisms are dynamically triggered. According to the invention, full life cycle protection of data is realized, and the problems of key leakage risk and cross-table association attack are effectively solved.

The invention discloses a multi-class network security threat perception and active and passive cooperative response processing system and method, and the system comprises a multi-class threat perception module which is used for perceiving a plurality of security threats existing in a network environment, and transmitting an obtained security event to a threat information association module; the threat information association module is used for analyzing and integrating various security events and extracting threat information from the security events; the attack graph-based threat path analysis module is used for mining vulnerability information in a network system, describing a network topology structure and an operation state, constructing an attack graph and obtaining active defense nodes in combination with a currently occurring security event and an analysis result of the attack graph; and the strategy generation module generates a corresponding response processing strategy according to the threat information and the property and the emergency degree of the security event, and generates an active defense strategy in combination with the active defense node, thereby realizing active defense and advanced deployment and control of potential threats. According to the invention, network security threats can be timely and effectively found and coped with.

The invention discloses an enterprise information security management method and system based on artificial intelligence, and belongs to the technical field of information management, and the method comprises the steps: inputting original data, integrating the original data into a first behavior graph structure, and constructing an attribute vector for a user node; threat perception and behavior risk assessment are carried out through a graph learning model, and the threat probability of each edge is output; identifying and quantifying attack paths in the graph, and generating an attack path set and a path risk score set; generating a protection strategy candidate set for each path, performing evaluation to obtain a grading result of the protection strategies, and sorting the protection strategies according to the grading result; and a protection strategy is deployed, the deployment state and protection feedback are monitored, after strategy deployment is completed, the state of a deployment target is recorded, a lightweight monitoring assembly is installed on the deployment target, and deployment feedback information is collected. According to the method, potential security threats are identified in real time in a mode of combining intelligent prediction and simulation, and the security policy is dynamically adjusted according to the change of the threats.

The invention relates to the technical field of TEM models, provides a pilot dynamic evaluation method, system and device based on a TEM model and a storage medium, and solves the problems of low accuracy of flight training evaluation and poor adaptability of a training scheme. The method comprises the steps that flight control, physiological monitoring and cockpit voice data are acquired, and a multi-modal data stream is formed through time synchronization; performing threat perception, error management and non-technical skill three-level evaluation on the feature vector by using a TEM model, generating corresponding indexes, and fusing the indexes into a comprehensive feature vector; respectively processing the time sequence and cognitive features by means of a dual-channel long-short-term memory network, and extracting deep features; performing decision tracing by adopting an SHAP value so as to locate a capability defect node; finally, defect types are matched through a personalized improvement scheme recommendation mechanism, and self-adaptive training content is generated. According to the invention, the accuracy of flight training evaluation and the adaptability of the training scheme are improved.

The invention provides a method and a system for dynamically optimizing a security defense strategy based on an AI Agent, and aims to solve the problems that the traditional network security defense strategy is static and cannot adapt to a dynamic network environment and novel network threats, and the processing efficiency of massive security data is low and the response is not timely. The method comprises the following steps: firstly, realizing whole network node data acquisition through a distributed AI Agent, performing accurate identification in combination with a multi-dimensional threat perception and fusion detection mechanism, and establishing a threat parameter quantitative evaluation model; secondly, the AI Agent generates a dynamic defense strategy according to the analysis result of the intelligent threat detection and the real-time state of the network in combination with threat features and risk assessment; and finally, according to the dynamic defense response result, realizing attack path tracking, accurate vulnerability positioning, automatic repair execution and traceability information retention processing. According to the method, real-time sensing and quick response to network threats can be realized, and the hysteresis of a traditional static defense strategy is overcome.

The invention provides a vehicle-mounted network security threat sensing system and method based on edge and cloud collaboration, and belongs to the technical field of vehicle network security. Comprising the following steps: S1, collecting vehicle multi-modal data through an edge layer; s2, preprocessing the multi-modal data of the vehicle; s3, performing feature extraction on the preprocessed vehicle multi-modal data to obtain a high-dimensional feature vector; s4, calculating a threat confidence score based on the high-dimensional feature vector; s5, performing hierarchical response decision based on the threat confidence score and a predefined response strategy library, and generating hierarchical response data; s6, extracting threat metadata based on the hierarchical response data; s7, performing global association analysis based on the threat metadata, and upgrading a defense system; and S8, based on the global threat intelligence and the upgraded defense system, carrying out edge layer updating, and then skipping to S1. The method is beneficial to eliminating response delay, relieving network bandwidth pressure and optimizing cloud computing resource load.

The invention relates to the technical field of network security, in particular to a network security threat perception recognition response method based on a security knowledge graph, and the method comprises the steps: obtaining data; determining temporary nodes and concerned nodes; determining a marked node; determining risk nodes and suspicious nodes; obtaining a corrected risk node; connecting map edges; determining an abnormal node; adjusting the threshold value and giving an alarm. According to the method, various key indexes are obtained in real time, marked nodes are determined according to the flow change rate in combination with the inlet and outlet flow ratio and the source I P address, risk nodes and suspicious nodes are further determined, the suspicious nodes are corrected through the inlet and outlet flow ratio, map edges are connected, abnormal nodes are determined, and then the threshold value is dynamically adjusted. And finally, giving an alarm based on the abnormal node, and optimizing the judgment standard in real time according to the change of the network environment, thereby effectively solving the problems of low danger identification accuracy and slow response speed caused by overlarge data volume and excessive dependence on the model.

The invention belongs to the technical field of network management, and particularly relates to a road toll collection system network security task dynamic allocation and load balancing method, which comprises a road toll collection system, and the road toll collection system comprises a network security task dynamic allocation system and a load balancing system. The network security task dynamic allocation system serves as an intelligent security protection scheduling center, is used for coping with continuous evolution threats, and comprises a real-time threat perception and response scheduling integration, a resource elastic scaling system and a strategy self-adaptive adjustment system. The load balancing system serves as a foundation stone of service continuity and performance, ensures stable operation of high-concurrency transactions, and comprises an intelligent flow distribution system, an automatic fault isolation and recovery system and a load balancing system. The method can deal with sudden security events, optimize the resource utilization rate, improve the protection precision, guarantee high availability, improve the user experience and support the elastic expansion of the system.

The invention provides a public network-oriented global threat perception method and system, and relates to the technical field of advanced persistent attack threat detection, and the specific technical scheme is as follows: setting a network trip line and a domain name trip line of a public network to establish honey point equipment, and establishing honey court equipment based on an IP address reputation mechanism; building a honey hole device based on a camouflage traceability technology and a reverse chain technology, and building a sub-honey array based on a honey point device, a honey court device and the honey hole device; generating a honey point template based on the sub-honey array to deploy honey point equipment, obtaining public network traffic based on a honey yard equipment preposition and combining with the honey point equipment, and detecting the public network traffic to obtain a detection result; and making a countering strategy of the honey hole device based on the behavior of the attacker in the detection result, obtaining threat intelligence of the attacker, and updating IP address resources of the honey point device and the honey court device based on the threat intelligence. According to the invention, a low-intrusive threat probing mechanism and a high-universality global threat sensing system are established through four-honey equipment.

The invention relates to the technical field of network situation awareness, in particular to a network situation intelligent awareness security system based on multi-source data analysis, which accurately acquires a perception threat confidence vector, a service interruption risk vector, an attack chain complete vector and a user behavior deviation vector based on multi-source data fusion and targeted analysis. According to the method, network situation key information can be comprehensively and accurately captured, a reliable basis is provided for subsequent decision making, the comprehensiveness and real-time performance of threat perception are improved, dynamic balance of safety protection, service efficiency and operation and maintenance cost is achieved by relying on a multi-target game mechanism and a network space digital twinning technology, and the safety and reliability of threat perception are improved. A simulation deduction deviation value is introduced as a core index of strategy evaluation, a real network situation is simulated through a digital twin environment, the difference between a strategy execution effect and an expected target is quantified, and in combination with reproduction of an attack scene by the twin environment, deviation value analysis is ensured to be more fit with the real network environment.

The invention discloses a mine clearing simulation training method and system based on virtuality and reality combination, and relates to the technical field of simulation training. Behavior situations and physiological feedback of trainees are analyzed through real-time monitoring data, and a training data set is generated; and calculating the auditory pressure and threat perception ability of the trainee based on the environment information and behavior data in the data set so as to construct a comprehensive auditory intensity coefficient # imgabs0 # and a pressure coefficient Ylxs, inputting the data into a mine elimination prediction model, and calculating the threatening perception ability of the trainee according to the calculation result of the auditory immersion index Tczs. According to the method, parameters such as sound source intensity and sound effect complexity in a training environment are dynamically adjusted, so that a student is always in a proper immersion state, the nervous emotion of the student caused by too high pressure can be avoided, the influence of insufficient immersion on a training effect can be prevented, personalized environment adjustment is realized, and the training efficiency is improved. And the overall experience of students is improved.

The invention relates to the field of internet security, and discloses a big data risk early warning and evaluation method based on artificial intelligence, comprising the following steps: step S1, collecting original security data from a heterogeneous data source; s2, constructing a global causal model; s3, constructing and evolving an event causal evolution diagram so as to establish directed edges with weights among the nodes; s4, dynamically evaluating the ability level of the attacker; s5, performing adversarial intention projection; s6, calculating a dynamic risk score; and generating an early warning when the score exceeds an early warning threshold. According to the method, asymmetric information flows among event types are quantified through transfer entropy, and a context evidence fusion mechanism is combined, so that a real causal relationship and a simple statistical correlation can be distinguished; the defect that a high false alarm rate is easily generated based on rule or simple threshold matching is overcome, so that the event causal evolution diagram can accurately reflect the internal logic and time sequence characteristics of an attack behavior, and the accuracy of complex threat perception is improved.

The invention relates to a personnel identification and behavior detection method and device and a security robot, and the method achieves the whole-process intelligent processing from threat perception to precise intervention through a multi-module cooperative working mechanism and an innovative algorithm design. According to the method, the problem of balance between threat detection precision and real-time performance in the prior art is solved, and accurate three-dimensional positioning and tracking of a threat target are realized through effective integration of depth information. According to the method, through technologies of deep learning algorithm optimization, three-dimensional space positioning and the like, the threat detection capability, the response speed and the intervention accuracy of the security robot in a complex environment are comprehensively improved, powerful technical support is provided for high-risk scene safety prevention and control, and the method has remarkable practical value and popularization prospects.

The invention belongs to the technical field of network security management and control, and particularly relates to a network security threat perception and adaptive defense system based on artificial intelligence. Comprising a data acquisition preprocessing module, a threat feature intelligent mining module, a threat situation comprehensive evaluation module, a self-adaptive defense strategy generation module, a defense effect dynamic feedback module and a background supervision terminal. The data acquisition and preprocessing module acquires various data from a network environment and performs related preprocessing operation, the threat feature intelligent mining module mines potential network security threat features, and the threat situation comprehensive evaluation module comprehensively evaluates the network security threat situation. The self-adaptive defense strategy generation module generates a self-adaptive defense strategy based on the threat level and the influence range, and the defense effect dynamic feedback module monitors and evaluates the implementation effect of the self-adaptive defense strategy in real time, thereby providing an omnibearing, intelligent and self-adaptive guarantee for network security.

The invention discloses a power grid vulnerability micropatch generation method, system and device based on call chain backtracking and a medium, and belongs to the technical field of network security, and the method comprises the following steps: based on a dynamic probe, realizing kernel layer protocol analysis, lock-free acquisition of system call and user state call chain reconstruction; key path marking is realized through LLVM-IR semantic analysis and power business feature matching; generating a security micropatch based on the metadata and realizing isolated hot loading; and the patch compatibility is ensured by adopting digital simulation verification and a layered release mechanism. The method has the advantages that a five-dimensional cooperative power grid active defense system of observation-modeling-reasoning-evaluation-arrangement is constructed, millisecond observation is achieved through eBPF collection synchronized with PTP, a multi-domain ontology atlas supports cross-domain reasoning, a GNN-RL model predicts an attack path, protection logic is verified through double-target-range simulation, and the method is high in reliability and high in reliability. The intention-driven mechanism realizes second-level response, and a complete closed loop from threat perception to adaptive protection is formed.

The invention relates to a network security active defense honeypot system, which comprises a centralized management and control module and a threat sensing module, and is characterized in that the centralized management and control module is used for monitoring, maintaining and querying honeypots in a centralized manner and providing an access entrance; the threat sensing module comprises a honeynet management module, a threat analysis module, a report generation module and a linkage cooperative defense module; the honeynet management module is used for managing a honeypot simulation scene, a honeypot virtual machine, a honeypot mirror image, trapping node equipment, disguise agent node equipment, network asset equipment and honeypot bait release; the threat analysis module is used for analyzing threat data reported by the honeypot; the report generation module makes a report according to the analysis data; and the linkage cooperative defense module shares the threat data with the third-party security system for cooperative defense. According to the method, the high-sweetness honeypot is deployed in an enterprise network, the emergency response and defense level is improved by means of disguising, zero false alarm, high handling and traceability, and multi-scene independent deployment can be realized without influencing services.

The invention discloses an urban network security multi-dimensional monitoring management system and method, and the system comprises threat sensing probes which are disposed at a monitored urban network unit center and each node bypass, and are used for carrying out the threat detection processing; the full-flow collector is deployed in a monitored urban network unit center and each node bypass and is used for evidence obtaining and source tracing processing; the threat sensing system is used for performing centralized management on the threat sensing probe and the full-flow collector of each node; the centralized management comprises unified monitoring, unified management, unified upgrading, centralized strategy issuing, threat analysis and threat hunting. Therefore, each security product is prevented from combating independently, centralized management is realized, threat detection capability is improved, tracing is realized, efficient management of various security products is realized, and multi-dimensional monitoring management of urban network security is realized.

The invention belongs to the technical field of avionics, and particularly discloses an airborne synthetic visual dynamic threat intelligent identification system based on multi-source fusion, which comprises a multi-source data acquisition module, an integrated GNSS unit, an IMU unit, a camera, a laser radar and a millimeter wave radar, and is used for acquiring images, point cloud and meteorological data of a flight environment through a space-time calibration mechanism; the dynamic threat analysis module is used for performing fusion processing on the multi-source data, identifying a dynamic threat target based on a target detection model and outputting a threat level; and the visual scene display module is used for dynamically adjusting the display content and the alarm mode of the synthetic visual scene according to the threat level in combination with the eye movement tracking data and the flight stage information. The problems that a traditional synthetic visual system is lagged in dynamic threat perception, insufficient in multi-source data fusion and low in man-machine interaction efficiency are solved, and the situation awareness and safety guarantee capability of an aircraft in a complex airspace environment is remarkably improved.

The invention discloses a threat sensing system based on active domain name generation and real-time malicious domain name detection, and belongs to the technical field of network security detection. The system comprises a historical threat sensing module, a real-time threat sensing module and a malicious detection module. In the historical threat sensing module, a domain name generation module constructs a similar domain name generation model by using an autoregression model based on Transform and generates a similar domain name list of a target enterprise, a risk assessment module detects whether similar domain names are registered or not, and if the similar domain names are registered and can be accessed, the similar domain names are added into a to-be-detected list; the real-time threat sensing module monitors newly registered domain names in real time, and adds the newly registered domain names into a suspicious domain name list if the similarity between the newly registered domain names and the target enterprise domain names is high; and the malicious detection module detects the list to be detected and the suspicious domain name list and identifies phishing websites. The domain name generated by the system can keep high similarity with the real domain name of an enterprise visually and semantically, and the potential domain name abuse risk can be quickly identified and evaluated.

The invention discloses a network security protection method for an electric power monitoring system, relates to the technical field of electric power network security operation and maintenance, and can more effectively identify high-concealment attacks which are dynamically renamed or permeated by using system vulnerabilities through a constructed risk instruction feature database. Then, the received network access request is subjected to multi-dimensional analysis, the defect of an existing system on multi-dimensional instruction verification is overcome, secondary biological feature authentication is introduced for high-risk operation in a benign process, a digital signature verification mechanism is started for file transmission, an endogenous safety barrier of the system is directly reinforced, and the safety of the system is improved. A machine learning algorithm is applied to analyze the compliance of an instruction sequence, and real-time risk early warning is performed on an instruction stream deviating from a normal mode, so that the problem of insufficient dynamic threat perception of an existing system is solved, and the dynamic defense capability and the full-life-cycle safety control level of the power monitoring system in a complex network environment are remarkably enhanced.

The invention discloses a network security threat perception device and method based on knowledge reasoning and algorithm service, and the device comprises a security threat perception and research and judgment subsystem which is configured to complete network security threat perception, and achieves the suspected threat research and judgment together with a knowledge extension subsystem, and generates a defense plan; the knowledge base knowledge extension and service subsystem is configured to extract knowledge from the network security threat field data for knowledge extension and provide knowledge service for the threat perception subsystem and knowledge base users; the intelligent algorithm model training and application subsystem is configured to perform intelligent enabling on a situation threat perception model uploaded by the threat perception subsystem, a knowledge reasoning model uploaded by the knowledge extension subsystem, a semantic association model uploaded by the semantic fusion subsystem and the like in the algorithm training subsystem; and the semantic knowledge fusion and application subsystem is configured to complete dynamic expansion, visual display and application service of the network security threat knowledge graph.

The invention provides a cloud honey point dynamic arrangement method and system based on software-defined spoofing defense, and the system comprises a base construction control layer and an execution layer based on software-defined spoofing defense, the control layer comprises a threat sensing unit, a game decision unit and an arrangement control unit, the execution layer comprises a cloud native arrangement unit and a defense resource library; the threat sensing unit collects threat intelligence and generates a structured intelligence object; the game decision-making unit is used for game solving of an optimal response strategy; the arrangement control unit reads the defense strategy state data, generates a strategy configuration instruction according to the optimal response strategy, and issues the strategy configuration instruction to the cloud native arrangement unit; the cloud native arrangement unit responds to the instruction and dispatches a defense resource library to instantiate a Pod comprising a honey point container and a distributed feedback component; the defense resource library is used for maintaining honey point configuration files for generating honey point instances. By applying the system, self-adaptive closed-loop active defense can be realized.

The invention discloses a power system honey dynamic deployment defense method based on learning perception, and belongs to the technical field of network security. A traditional honey array static deployment method is insufficient in information acquisition and dynamic change ability, and the power system honey array dynamic deployment defense method based on learning perception disclosed by the invention performs intelligent interaction with an attacker based on a message passing neural network to improve the security threat perception ability. And a honey array dynamic deployment mechanism is established according to a depth deterministic strategy gradient algorithm to enhance the fraudulence of the simulation power system, and finally, the overall defense capability and the intelligent level of the network defense system are effectively improved.

This invention discloses a security threat perception and detection method for global network devices. It simultaneously collects three types of data: network traffic, behavior logs, and attack characteristics, forming multi-dimensional factual evidence. The method utilizes a firework algorithm to optimize the deployment of logical monitoring points (feature nodes) in the virtual network and calculates the dynamic intensity of threat propagation at each point, thereby constructing a node-level threat field that quantifies the spatial distribution of threats. Subsequently, peak, mean, and dispersion indicators are extracted, and behavioral load, threat polarization, and cumulative threat indicators are calculated from the raw data, forming a six-dimensional vector. This vector is input into a pre-trained global threat level classification model, outputting a discrete threat level. Finally, based on this level, firewall rules, intrusion detection feature libraries, and other protection strategies are dynamically adjusted to achieve automatic matching of security configuration and threat posture.

The present invention belongs to the field of network security technology, and discloses a network threat perception and defense strategy optimization system and method based on machine learning; the method comprises: obtaining traffic level data, log level data and user level data in a single session; constructing original samples based on the traffic level data, log level data and user level data, inputting the original samples into a pre-trained anomaly recognition model, and outputting corresponding network information categories; constructing adversarial samples based on the original samples; merging the adversarial samples and the original samples into an expanded training set, annotating the adversarial samples with the network information categories corresponding to the original samples, and then performing secondary training on the anomaly recognition model to obtain an adversarially optimized anomaly recognition model; the present invention effectively improves the protection capability of the network.

The invention discloses an industrial cloud side-end collaborative security situation awareness method and device, and relates to the technical field of industrial internet and information security, and the method comprises the steps: obtaining a device-level security event through anomaly detection and white list verification based on original security data reported by a terminal device; carrying out aggregation analysis on the events on the edge side by utilizing a lightweight rule base, and generating an edge domain level local security situation; fusing a multi-edge domain situation at a cloud end, and performing global association reasoning by means of a knowledge graph and a graph neural network to form a system-level security situation; and finally, generating a hierarchical early warning and response strategy according to the global situation, and supporting dynamic optimization of a rule base and a knowledge graph based on feedback. Through the above mode, efficient cooperative processing and intelligent analysis of industrial security data at three levels of end, edge and cloud are realized, and the real-time performance, the accuracy and the response capability of threat perception of a large-scale industrial system are improved.

The present invention discloses an Internet space security testing method and system based on network device micro data, which solves the shortcomings of existing methods in terms of lack of attention to micro data of a single network device and security protection of associated devices. The method includes obtaining micro data of network devices including physical properties, connection characteristics, communication behaviors and historical usage patterns, and modeling them as tensors, determining the acquisition frequency through sampling boundaries; collecting behavioral feature data according to the acquisition frequency, and extracting and marking abnormal communication features through anomaly detection methods; calculating risk scores based on abnormal communication features, generating risk level labels, and performing real-time early warning and in-depth analysis on high-risk devices; and calculating threat perception indexes for associated devices, prioritizing and allocating protection resources to ensure that potential threats are fully protected. The present invention can achieve accurate risk assessment and dynamic protection, and improve Internet space security.