基于FFT-iTransformer的网络安全态势特征插补与预测  

FFT-iTransformer-Based Cybersecurity Situation Awareness Feature Imputation and Prediction

作　　者：张新有[1] 高志超 冯力 邢焕来[1] ZHANG Xinyou;GAO Zhichao;FENG Li;XING Huanlai(School of Computing and Artificial Intelligence,Southwest Jiaotong University,Chengdu 611756,China;Tangshan Institute,Southwest Jiaotong University,Tangshan 063000,China)

机构地区：[1]西南交通大学计算机与人工智能学院,成都611756 [2]西南交通大学唐山研究院,唐山063000

出　　处：《信息网络安全》2025年第2期228-239,共12页Netinfo Security

基　　金：国家自然科学基金[62172342]。

摘　　要：为解决当前网络安全态势预测精度低、指标采集缺失等问题,文章提出一种基于快速傅里叶变换改进的iTransformer模型(FFT-iTransformer)。该模型利用iTransformer架构对时间序列数据进行维度反转嵌入。通过快速傅里叶变换将一维时间序列扩展为二维空间,将周期内的近邻特征和周期间的远邻特征分别映射到二维张量的行与列。首先,模型将周期内特征输入编码器,通过注意力机制学习周期内的局部特征,从而有效捕捉网络安全指标间的动态关联性(如信息安全漏洞数量与感染主机数量间的关联)。然后,将编码器输出的周期内张量融合为二维,传入卷积模块进一步提取二维特征,以捕捉周期间的全局特征。最后,根据振幅所反映的周期相对重要性进行自适应聚合。实验结果表明,该模型预测拟合度可达0.995378,在10%的缺失率下,插补拟合度可达0.879,优于大多数现有模型,可准确插补网络安全态势指标的缺失值,并预测态势值。To address the issues of low prediction accuracy and missing metric collection in current network security situation forecasting,this paper proposed an improved iTransformer model based on fast Fourier transformation.The model utilized the iTransformer architecture to perform dimensional reversal embedding on time series data.By applying fast Fourier transform,the one-dimensional time series was transformed into two-dimensional space,where intra-period neighboring features and inter-period non-neighboring features were mapped to rows and columns of two-dimensional tensors.The model first inputs intra-period features into the encoder to use the attention mechanism to learn local features within the period,which effectively captured dynamic correlations among network security indicators(such as the relationship between the number of information security vulnerabilities and infected hosts).Next,the intra-period tensor output by the encoder was fused into the two-dimensional form and passed into the convolutional module to further extract two-dimensional features,which captured global features across periods.Finally,adaptive aggregation was performed based on the relative importance of the periods reflected by the amplitude.The experimental results show that the model achieves an imputation fitting degree of 0.879 with a 10%missing rate,and a prediction fitting degree of 0.995378,outperforming most existing models.It can accurately impute missing values for network security situation indicators and predict situation values.

关 键 词：网络安全 态势预测 插补 快速傅里叶变换 iTransformer 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]