Research and Development of a Deep Threat Detection and Attack Forensics System Based on Multi-source Heterogeneous Hosts in Power Monitoring Systems

This paper proposes a deep threat detection and attack forensics system based on multi-source heterogeneous hosts, aiming to solve the problem of advanced security threat detection and forensics in power monitoring systems. The system can perform in-depth analysis and forensics on security events on different operating system platforms by designing a set of solutions that integrate trace data collection, threat detection, attack event restoration and multi-source heterogeneous metadata processing. This paper studies the fixed feature intrusion trace detection model, multi-source heterogeneous metadata storage and parsing technology, attack event restoration model, and memory trojan-type advanced threat detection and sample restoration technology. For complex threats such as advanced memory trojans (such as ice scorpion memory trojans), the system combines deep learning models with feature-based detection technology to improve the accuracy and robustness of threat detection. At the same time, the system supports cross-platform data collection and forensics to ensure that it can adapt to multiple operating systems in the power monitoring system and accurately restore the attack path through efficient event reconstruction technology. The pilot application of the system in the power monitoring system shows that it significantly improves the emergency response capability of security incidents, effectively reduces the false alarm rate and missed alarm rate, and verifies the feasibility and practicality of the system.