CN117763492A - Network security tool intelligent recommendation method and device based on time sequence spatial characteristics and preference fluctuation - Google Patents

Abstract

The invention discloses an intelligent recommendation method and device for network security tools based on time-series spatial characteristics and preference fluctuations. It constructs the user's historical behavior sequence based on the collected data of users using network security tools, and obtains the user's use of network security captured through an improved spatiotemporal GRU algorithm. For the long-term preference of tools, the improved spatiotemporal GRU algorithm discretizes the continuous time factor and introduces a specific time transformation matrix and distance transformation matrix; then captures the user's short-term preference for using network security tools through a multi-head attention mechanism; and then calculates the preference fluctuation value ; Finally, the learned long-term and short-term preference features, user feature vectors, and preference fluctuation vectors are combined to predict the next recommended position. Compared with the existing technology, the present invention uses temporal spatial characteristics and user preference fluctuations to better understand users' network security tool usage habits, thereby more accurately recommending network security tools suitable for users, and helping to improve network security. .

Description

Intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations and devices

Technical field

The invention belongs to the technical field of network security and recommendation, and particularly relates to a method and device for intelligent recommendation of network security tools based on temporal spatial characteristics and preference fluctuations.

Background technique

In today's digital age, cybersecurity is one of the ongoing challenges facing organizations and individuals. As cyberattacks and threats continue to evolve and increase, choosing the right cybersecurity tools becomes critical. Traditional network security tool selection methods often rely on the recommendations of security professionals, or select tools based on static rules and specific network scenarios. These approaches may not adequately take into account the actual needs and preferences of users and organizations. Therefore, it is necessary to recommend suitable network security tools based on users' historical interaction sequences.

In the field of network security, there are relatively few applications of recommendation technology, especially for the selection of network security tools. Current network security tool selection is often limited by static rules and professional recommendations, with less consideration of users' historical interaction information and the inability to more comprehensively understand user preferences and needs and provide more personalized, real-time network security tool recommendations. Moreover, the existing sequence recommendation technology does not make sufficient use of spatiotemporal information, the interactivity of mining user item features is not comprehensive, the effect of processing long sequence data is not ideal, and the next recommendation generated is not personalized enough, and the quality and accuracy of the recommendation need to be improve.

In view of the above situation, an intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations is proposed. By adding a time transformation matrix and a distance transformation matrix to the traditional GRU network, the time transformation matrix can capture the influence of recent elements in history, and can better understand and predict changes in user behavior in different time periods; distance transformation matrix calculation It measures the Euclidean distance between the user's two geographical locations in the coordinate system. It measures the user's movement distance in different locations and can help the model consider the user's behavioral changes from a spatio-temporal perspective. By considering time and space factors, the user's long-term behavioral characteristics can be more accurately captured; and then the user's recent characteristics are captured as short-term preferences through the attention mechanism; user characteristics, long-term and short-term preferences, and preference fluctuation vectors are integrated to avoid the need for feature representation. A single question can more comprehensively understand user preferences and needs, obtain complete user preference characteristics, and make personalized, high-quality recommendations.

Contents of the invention

Purpose of the invention: Aiming at the existing sequence recommendation system pointed out in the background technology that the spatio-temporal information is insufficiently utilized, the interactivity of mining user item features is not comprehensive, the effect of processing long sequence data is not ideal, and the quality and accuracy of recommendations need to be improved, etc. problem, a method and device for intelligent recommendation of network security tools based on temporal spatial characteristics and preference fluctuations are disclosed. The continuous time factor is discretized through the improved GRU algorithm, and a specific time conversion matrix and distance conversion matrix are introduced to output the vector Incorporates richer features such as preferences, location, and time to more accurately capture users' long-term behavioral characteristics.

Technical solution: The present invention proposes an intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations, which includes the following steps:

Step 1: Clean and preprocess the collected data of users using network security tools, and construct the user's historical behavior sequence, including a user embedding matrix and a user behavior sequence embedding matrix. The user embedding matrix and user behavior sequence embedding matrix are included in the matrix. Including user feature vectors and user behavior sequence embedding vectors respectively;

Step 2: Taking the user behavior sequence embedding matrix as input, learn the user's long-term preference for using network security tools through the improved spatiotemporal GRU algorithm; the improved spatiotemporal GRU algorithm discretizes the continuous time factors and introduces a specific time transformation matrix and distance transformation matrix;

Step 3: Using the user behavior sequence embedding matrix as input, use the multi-head attention machine to learn the user’s recent preference for using network security tools to represent the user’s short-term preference;

Step 4: Calculate the user’s preference fluctuation value F _u for using network security tools;

Step 5: Integrate the user's long-term preferences, short-term preferences, user feature vectors and preference fluctuation vectors to obtain a comprehensive feature expression of the user's behavior of using network security tools and make recommendations.

Further, the specific method of step 1 is:

Step 1.1: Define the user set U = {u ₁ ,u ₂ ,...,u _a ,...u _len(U) }, u _a is the a-th information data to be cleaned in U, where, len(U ) is the number of data in U, variable a∈[1,len(U)];

Step 1.2: Define the network security tool set I={i ₁ ,i ₂ ,...,i _b ,...i _len(I) }, i _b is the b-th information data to be cleaned in I, where, len (I) is the number of data in I, variable b∈[1,len(I)];

Step 1.3: Perform deduplication and null operations on the data in data sets U and I;

Step 1.4: Obtain the cleaned data set U1={u ₁ ,u ₂ ,...,u _a ,...u _len(U) }, u _a is the a-th information data in U1, where, len( U) is the number of data in U, variable a∈[1,len(U)] and data set I1={i ₁ ,i ₂ ,...,i _b ,...i _len(I) },i _b is the b-th information data in I1, where len(I1) is the number of data in I1, and the variable b∈[1,len(I1)];

Step 1.5: Define the user’s historical behavior sequence as Among them/> Represents network security tools that the user has interacted with before, /> The subscript i represents the order in which network security tools appear in the sequence;

Step 1.6: For the user set U1, the user embedding matrix is obtained as E _u by embedding high-dimensional sparse one-hot codes into low-dimensional dense feature vectors. e _u is a vector in the user embedding matrix E _u , representing the user feature vector. ;

Step 1.7: For the user’s historical behavior sequence By embedding high-dimensional sparse one-hot codes into low-dimensional dense feature vectors, the user behavior sequence embedding matrix is obtained as E _x ∈R ^n×k , where n×k represents the dimension of the matrix, and e _x is the user behavior sequence embedding matrix. A vector in represents the user behavior sequence embedding vector.

Further, the specific method of step 2 is:

Step 2.1: Input the user behavior sequence embedding matrix E _x ∈R ^n×k ;

Step 2.2: Define loop variable i, and assign i an initial value of 1;

Step 2.3: If i≤len(X ^u ), jump to step 2.4, otherwise jump to step 2.13;

Step 2.4: Obtain the i-th row vector e _x in the user behavior sequence embedding matrix E _x ∈R ^n×k ;

Step 2.5: Obtain the embedding vector _ex according to the user behavior sequence The vector representing the access location of user u at time t defines the hidden state vector of the user at the previous time t-1 as h _t-1 ;

Step 2.6: Define a specific temporal transformation matrix Used to represent the time interval tt _i between two time points t and t _i , where t _i represents the historical time point;

Step 2.7: Define a specific distance transformation matrix It is used to express the Euclidean distance between two geographical coordinates. The calculation formula is/> Among them,/> and/> Represents the coordinates of the location visited by user u at time t,/> and/> Represents the coordinates of the location visited by user u at historical time t _i ;

Step 2.8: Calculate the input gate Among them, W _i1 and W _i2 are transformation matrices, and W _i3 and W _i4 are/> and/> The transfer matrix of , b _i is the bias vector, σ is the activation function, h _t-1 is the hidden state vector of GRU at the previous moment;

Step 2.9: Calculate the forget gate Where W _f1 and W _f2 are transformation matrices, W _f3 and W _f4 are/> and/> The transfer matrix of , b _f is the bias vector;

Step 2.10: Transform matrix based on time and distance transformation matrix/> Calculate new GRU candidate hidden state vector/> Among them, h _t-1 represents the hidden state vector of GRU at the previous moment, W _c1 and W _c4 are transformation matrices and W _c2 and W _c3 are/> and/> The transfer matrix, b _c is the bias vector;

Step 2.11: According to the input gate i _t and the candidate hidden state vector Update hidden state vector

Step 2.12: Increase the value of loop variable i and jump to step 2.4;

Step 2.13: End the loop and obtain the final GRU output, that is, the user's long-term preference g _t =tanh(C _t ), through the tanh nonlinear activation function.

Further, the specific method of step 3 is:

Step 3.1: Input the user behavior sequence embedding matrix E _x ∈R ^n×k ;

Step 3.2: Loop variable i ₂ and assign i ₂ an initial value of 1;

Step 3.3: If i ₂ ≤ len(X ^u ), jump to step 3.4, otherwise jump to step 3.10;

Step 3.4: Obtain the i _2nd row vector e _x in the user behavior sequence embedding matrix E _x ∈R ^n×k ;

Step 3.5: In the head space h, map the user behavior embedding vector _ex to the query vector through three different linear transformations key vector/> sum vector/> The calculation formula is:/> in Represents a trainable parameter matrix;

Step 3.6: Calculate the query vector using dot product and key vector/> similarity between them, and obtain the similarity score function where d _h is the dimension of the head space;

Step 3.7: Convert the scoring function to Obtain attention weights through softmax normalization

Step 3.8: Value vector through attention weight a _i,j Perform weighted summation to obtain the high-order feature representation of e _x in the head space h/>

Step 3.9: Increase the value of loop variable i ₂ and jump to step 3.4;

Step 3.10: End the loop, concatenate all the high-order feature vectors learned in the head space, and then perform linear transformation to obtain the user's short-term preference representation. where N is the headspace number, and ^W is the linear projection matrix.

Further, the specific method of step 4 is:

Step 4.1: Define the time interval set T = {E, W, M, S} to represent days, weeks, months, and seasons respectively;

Step 4.2: Define the user set U, the item set I, and define user u’s rating of network security tool items within time t as r _ui ;

Step 4.3: Define loop variable i ₃ and assign i ₃ an initial value of 1;

Step 4.4: If i ₃ ≤len(T), jump to step 4.4, otherwise jump to step 4.8;

Step 4.5: Calculate the frequency of weighted ratings of user u on network security tool category j within time interval t Among them, I ^t represents the set of network security tools that user u has rated in the time interval t, and B _ij represents whether i belongs to category j. It is 1 if it is, and 0 if it is not;

Step 4.6: Calculate the variance of user u’s ratings of network security tools of each category within time interval t Among them/> Represents the weighted rating of category j by user u, and C is the number of categories;

Step 4.7: Increase the value of loop variable i ₃ and jump to step 4.4;

Step 4.8: End the loop, average the rating variances in different time intervals, and obtain the overall rating variance of user u. where P represents the size of the time interval set T;

Step 4.9: The user’s preference fluctuation value is

Further, the specific method of step 5 is:

Step 5.1: Map the preference fluctuation value F _u to a vector F _u _vec, use a fully connected layer to perform vector conversion, and obtain F _u _vec with the same length;

Step 5.2: Perform multi-modal fusion of the user's long-term preferences, short-term preferences, user feature vectors and preference fluctuation values to obtain the target feature vector Among them, Concat represents the splicing operation,/> represents the user's short-term preference, g _t represents the user's long-term preference, e _u represents the user feature vector, and F _u _vec represents the user's preference fluctuation vector;

Step 5.3: Input the target feature vector G into the fully connected neural network for nonlinear transformation;

Step 5.4: The hidden layer of the network uses the Dice activation function to learn nonlinear relationships;

Step 5.5: The output layer uses the Softmax function to calculate the predicted probability Where W _H is the trainable parameter matrix, b _H is the bias vector, D _H is the hidden layer output of layer H,/> Indicates the probability of recommending the next network security tool.

The invention also discloses an intelligent recommendation device for network security tools based on temporal spatial characteristics and preference fluctuations, which includes a memory, a processor and a computer program stored in the memory and executable on the processor. The computer program is loaded into the processor The above-mentioned intelligent recommendation method of network security tools based on temporal spatial characteristics and preference fluctuations can be implemented in real time.

Beneficial effects:

This invention mainly uses the spatiotemporal GRU algorithm, attention mechanism and preference fluctuation technology to learn the user's long-term preference, short-term preference and preference fluctuation value to learn the user's overall preference, so as to recommend the next location more accurately and efficiently. Specifically, the continuous time factors are discretized through the improved GRU algorithm, and specific time transformation matrices and distance transformation matrices are introduced. By considering time and space factors, the user's long-term behavioral characteristics can be captured more accurately and traditional loops can be avoided. Gradient descent problem in neural network models. At the same time, through the multi-head attention mechanism, we are able to extract the most relevant features from the user's short-term behavior to accurately represent the user's short-term interests. Preference fluctuation analyzes user preference change trends at different times to more accurately predict users' current interests; most importantly, it comprehensively integrates spatiotemporal information, user characteristics, long-term and short-term preferences, and preference fluctuation vectors to generate comprehensive user interest characteristics. Personalized, high-quality network security tool recommendations can be made more accurately, further improving network security.

Description of the drawings

Figure 1 is an overall flow chart of the present invention;

Figure 2 is the data preprocessing flow chart;

Figure 3 is a flow chart of the spatiotemporal GRU algorithm for learning users’ long-term preferences;

Figure 4 is a flow chart of the multi-head attention machine learning user’s short-term preferences;

Figure 5 is a flow chart for calculating the fluctuation value of user preferences for using network security tools.

Detailed ways

The present invention will be further clarified below with reference to specific examples. It should be understood that these examples are only used to illustrate the present invention and are not intended to limit the scope of the present invention. After reading the present invention, those skilled in the art will be familiar with various equivalent forms of the present invention. All modifications fall within the scope defined by the appended claims of this application.

The present invention discloses a method and device for intelligent recommendation of network security tools based on temporal spatial characteristics and preference fluctuations. Details are as follows:

Step 1: Clean and preprocess the collected data on users’ use of network security tools to construct the user’s historical behavior sequence.

Step 1.1: Define the user set U = {u ₁ ,u ₂ ,...,u _a ,...u _len(U) }, u _a is the a-th information data to be cleaned in U, where, len(U ) is the number of data in U, variable a∈[1,len(U)].

Step 1.2: Define the network security tool set I={i ₁ ,i ₂ ,...,i _b ,...i _len(I) }, i _b is the b-th information data to be cleaned in I, where, len (I) is the number of data in I, and the variable b∈[1,len(I)]. In this embodiment, network security tools are various software, hardware or services (such as anti-virus software) used to protect the security of computers and network systems. , vulnerability scanners, data encryption tools, authentication tools, etc.).

Step 1.3: Perform deduplication and null operations on the data in data sets U and I.

Step 1.4: Obtain the cleaned data set U1={u ₁ ,u ₂ ,...,u _a ,...u _len(U) }, u _a is the a-th information data in U1, where, len( U) is the number of data in U, variable a∈[1,len(U)] and data set I1={i ₁ ,i ₂ ,...,i _b ,...i _len(I) }, i _b is the b-th information data in I1, where len(I1) is the number of data in I1, and the variable b∈[1,len(I1)].

Step 1.5: Define the user’s historical behavior sequence as Among them/> Represents network security tools that the user has interacted with before, /> The subscript i of X _u represents the order in which network security tools appear in the sequence.

Step 1.6: For the user set U1, the user embedding matrix is obtained by embedding the high-dimensional sparse one-hot code into the low-dimensional dense feature vector as E _u , where _eu represents the user feature vector.

Step 1.7: For the user’s historical behavior sequence By embedding high-dimensional sparse one-hot codes into low-dimensional dense feature vectors, the user behavior sequence embedding matrix is obtained as E _x ∈R ^n×k , where n×k represents the dimension of the matrix, and e _x represents the user behavior sequence embedding vector. .

Step 2: Learn users’ long-term preferences for using network security tools through the spatiotemporal GRU algorithm. The spatiotemporal GRU algorithm has been improved to discretize the continuous time factors and introduce specific time transformation matrices and distance transformation matrices.

Step 2.1: Input the user behavior sequence embedding matrix E _x ∈R ^n×k .

Step 2.2: Define loop variable i, and assign i an initial value of 1.

Step 2.3: If i≤len(X ^u ), jump to step 2.4, otherwise jump to step 2.13.

Step 2.4: Obtain the i-th row vector e _x in the user behavior sequence embedding matrix E _x ∈R ^n×k .

Step 2.5: According to the user behavior sequence embedding vector _ex , we can get The vector representing the access position of user u at time t defines the hidden state vector of the user at the previous time t-1 as h _t-1 .

Step 2.6: Define a specific temporal transformation matrix It is used to represent the time interval tt _i between two time points t and _ti , where _ti represents the historical time point.

Step 2.7: Define a specific distance transformation matrix It is used to express the Euclidean distance between two geographical coordinates. The calculation formula is/> Among them,/> and/> Represents the coordinates of the location visited by user u at time t,/> and/> Represents the coordinates of the location visited by user u at historical time t _i .

Step 2.8: Calculate the input gate Among them, W _i1 and W _i2 are transformation matrices, and W _i3 and W _i4 are/> and/> The transfer matrix of , b _i is the bias vector.

Step 2.9: Calculate the forget gate Where W _f1 and W _f2 are transformation matrices, W _f3 and W _f4 are/> and/> The transfer matrix of , b _f is the bias vector;

Step 2.10: Transform matrix based on time and distance transformation matrix/> Calculate new GRU candidate hidden state vector/> Among them, h _t-1 represents the hidden state vector of GRU at the previous moment, W _c1 and W _c4 are transformation matrices and W _c2 and W _c3 are/> and/> The transfer matrix, b _c is the bias vector.

Step 2.11: According to the input gate i _t and the candidate hidden state vector Update hidden state vector

Step 2.12: Increase the value of loop variable i and jump to step 2.4.

Step 2.13: End the loop and obtain the final GRU output, that is, the user's long-term preference g _t =tanh(C _t ), through the tanh nonlinear activation function.

Step 3: Use the multi-head attention machine to learn the user’s recent preferences for using network security tools to represent the user’s short-term preferences.

Step 3.1: Input the user behavior sequence embedding matrix E _x ∈R ^n×k .

Step 3.2: Loop variable i ₂ , and assign i ₂ an initial value of 1.

Step 3.3: If i ₂ ≤ len(X ^u ), jump to step 3.4, otherwise jump to step 3.10.

Step 3.4: Obtain the i _2nd row vector e _x in the user behavior sequence embedding matrix E _x ∈R ^n×k .

Step 3.5: In the head space h, map the user behavior embedding vector _ex to the query vector through three different linear transformations key vector/> sum vector/> The calculation formula is:/> in Represents a trainable parameter matrix.

Step 3.6: Calculate the query vector using dot product and key vector/> similarity between them, and obtain the similarity score function where d _h is the dimension of the head space.

Step 3.7: Convert the scoring function to Obtain attention weights through softmax normalization

Step 3.8: Value vector through attention weight a _i,j Perform weighted summation to obtain the high-order feature representation of e _x in the head space h/>

Step 3.9: Increase the value of loop variable i ₂ and jump to step 3.4.

Step 3.10: End the loop, concatenate all the high-order feature vectors learned in the head space, and then perform linear transformation to obtain the user's short-term preference representation. where N is the headspace number, and ^W is the linear projection matrix.

Step 4: Calculate the fluctuation value of the user's preference for using network security tools.

Step 4.1: Define the time interval set T = {E, W, M, S} to represent days, weeks, months, and seasons respectively.

Step 4.2: Define the user set U, the item set I, and define user u's rating of network security tool items within time t as r _ui .

Step 4.3: Define loop variable i ₃ and assign i ₃ an initial value of 1.

Step 4.4: If i ₃ ≤len(T), jump to step 4.4, otherwise jump to step 4.8.

Step 4.5: Calculate the frequency of weighted ratings of user u on network security tool category j within time interval t Among them, I ^t represents the set of network security tools that user u has rated in the time interval t, and B _ij represents whether i belongs to category j (yes is 1, no is 0).

Step 4.6: Calculate the variance of user u’s ratings of network security tools of each category within time interval t Among them/> represents the weighted rating of category j by user u, and C is the number of categories.

Step 4.7: Increase the value of loop variable i ₃ and jump to step 4.4.

Step 4.8: End the loop, average the rating variances in different time intervals, and obtain the overall rating variance of user u. where P represents the size of the time interval set T.

Step 4.9: The user’s preference fluctuation value is

Step 5: Integrate the user's long-term preferences, short-term preferences, user feature vectors and preference fluctuation vectors to obtain a comprehensive feature expression of the user's behavior of using network security tools and make recommendations.

Step 5.1: Map the preference fluctuation value F _u to a vector F _u _vec, use a fully connected layer to perform vector conversion, and obtain F _u _vec with the same length.

Step 5.2: Perform multi-modal fusion of the user's long-term preferences, short-term preferences, user feature vectors and preference fluctuation values to obtain the target feature vector Among them, Concat represents the splicing operation,/> represents the user's short-term preference, g _t represents the user's long-term preference, _eu represents the user feature vector, and F _u _vec represents the user's preference fluctuation vector.

Step 5.3: Input the target feature vector G into the fully connected neural network for nonlinear transformation.

Step 5.4: The hidden layer of the network uses the Dice activation function to learn non-linear relationships.

Step 5.5: The output layer uses the Softmax function to calculate the predicted probability Among them, W _H is the trainable parameter matrix, b _H is the bias vector, D _H is the hidden layer output of layer H,/> Indicates the probability of recommending the next network security tool.

For the above-mentioned intelligent recommendation method of network security tools based on temporal spatial characteristics and preference fluctuations, it is stored in the memory as a computer program, and together with the memory and the processor, constitutes an intelligent recommendation device for network security tools based on temporal spatial characteristics and preference fluctuations. , when the computer program is loaded into the processor, the above-mentioned intelligent recommendation method of network security tools based on temporal spatial characteristics and preference fluctuations is implemented.

The above embodiments are only for illustrating the technical concepts and features of the present invention. Their purpose is to enable those familiar with the technology to understand the contents of the present invention and implement them accordingly. This does not limit the scope of protection of the present invention. All equivalent transformations or decorations based on the spirit and essence of the present invention shall be included in the protection scope of the present invention.

Claims (7)

1. An intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations, which is characterized by including the following steps: Step 1: Clean and preprocess the collected data of users using network security tools, and construct the user's historical behavior sequence, including a user embedding matrix and a user behavior sequence embedding matrix. The user embedding matrix and user behavior sequence embedding matrix are included in the matrix. Including user feature vectors and user behavior sequence embedding vectors respectively; Step 2: Taking the user behavior sequence embedding matrix as input, learn the user's long-term preference for using network security tools through the improved spatiotemporal GRU algorithm; the improved spatiotemporal GRU algorithm discretizes the continuous time factors and introduces a specific time transformation matrix and distance transformation matrix; Step 3: Using the user behavior sequence embedding matrix as input, use the multi-head attention machine to learn the user’s recent preference for using network security tools to represent the user’s short-term preference; Step 4: Calculate the user’s preference fluctuation value F _u for using network security tools; Step 5: Integrate the user's long-term preferences, short-term preferences, user feature vectors and preference fluctuation vectors to obtain a comprehensive feature expression of the user's behavior of using network security tools and make recommendations. 2. The intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations according to claim 1, characterized in that the specific method of step 1 is: Step 1.1: Define the user set U = {u ₁ ,u ₂ ,...,u _a ,...u _len(U) }, u _a is the a-th information data to be cleaned in U, where, len(U ) is the number of data in U, variable a∈[1,len(U)]; Step 1.2: Define the network security tool set I={i ₁ ,i ₂ ,...,i _b ,...i _len(I) }, i _b is the b-th information data to be cleaned in I, where, len (I) is the number of data in I, variable b∈[1,len(I)]; Step 1.3: Perform deduplication and null operations on the data in data sets U and I; Step 1.4: Obtain the cleaned data set U1={u ₁ ,u ₂ ,...,u _a ,...u _len(U) }, u _a is the a-th information data in U1, where, len( U) is the number of data in U, variable a∈[1,len(U)] and data set I1={i ₁ ,i ₂ ,...,i _b ,...i _len(I) }, i _b is the b-th information data in I1, where len(I1) is the number of data in I1, and the variable b∈[1,len(I1)]; Step 1.5: Define the user’s historical behavior sequence as Among them/> Represents network security tools that the user has interacted with before, /> The subscript i of X _u represents the order in which network security tools appear in the sequence; Step 1.6: For the user set U1, the user embedding matrix is obtained as E _u by embedding high-dimensional sparse one-hot codes into low-dimensional dense feature vectors. e _u is a vector in the user embedding matrix E _u , representing the user feature vector. ; Step 1.7: For the user’s historical behavior sequence By embedding high-dimensional sparse one-hot codes into low-dimensional dense feature vectors, the user behavior sequence embedding matrix is obtained as E _x ∈R ^n×k , where n×k represents the dimension of the matrix, and e _x is the user behavior sequence embedding matrix. A vector in represents the user behavior sequence embedding vector. 3. According to claim 1, the network security tool intelligent recommendation method based on temporal spatial characteristics and preference fluctuations is characterized in that the specific method of step 2 is: Step 2.1: Input the user behavior sequence embedding matrix E _x ∈R ^n×k ; Step 2.2: Define loop variable i, and assign i an initial value of 1; Step 2.3: If i≤len(X ^u ), jump to step 2.4, otherwise jump to step 2.13; Step 2.4: Obtain the i-th row vector e _x in the user behavior sequence embedding matrix E _x ∈R ^n×k ; Step 2.5: Obtain the embedding vector _ex according to the user behavior sequence The vector representing the access location of user u at time t defines the hidden state vector of the user at the previous time t-1 as h _t-1 ; Step 2.6: Define a specific temporal transformation matrix Used to represent the time interval tt _i between two time points t and t _i , where t _i represents the historical time point; Step 2.7: Define a specific distance transformation matrix It is used to express the Euclidean distance between two geographical coordinates. The calculation formula is/> Among them,/> and/> Represents the coordinates of the location visited by user u at time t, and/> Represents the coordinates of the location visited by user u at historical time t _i ; Step 2.8: Calculate the input gate Among them, W _i1 and W _i2 are transformation matrices, and W _i3 and W _i4 are/> and/> The transfer matrix of , b _i is the bias vector, σ is the activation function, h _t-1 is the hidden state vector of GRU at the previous moment; Step 2.9: Calculate the forget gate Where W _f1 and W _f2 are transformation matrices, W _f3 and W _f4 are/> and/> The transfer matrix of , b _f is the bias vector; Step 2.10: Transform matrix based on time and distance transformation matrix/> Calculate new GRU candidate hidden state vectors Among them, h _t-1 represents the hidden state vector of GRU at the previous moment, W _c1 and W _c4 are transformation matrices and W _c2 and W _c3 are/> and/> The transfer matrix of , b _c is the bias vector; Step 2.11: According to the input gate i _t and the candidate hidden state vector Update hidden state vector Step 2.12: Increase the value of loop variable i and jump to step 2.4; Step 2.13: End the loop and obtain the final GRU output, that is, the user's long-term preference g _t =tanh(C _t ), through the tanh nonlinear activation function. 4. The intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations according to claim 1, characterized in that the specific method of step 3 is: Step 3.1: Input the user behavior sequence embedding matrix E _x ∈R ^n×k ; Step 3.2: Loop variable i ₂ and assign i ₂ an initial value of 1; Step 3.3: If i ₂ ≤ len(X ^u ), jump to step 3.4, otherwise jump to step 3.10; Step 3.4: Obtain the i _2nd row vector e _x in the user behavior sequence embedding matrix E _x ∈R ^n×k ; Step 3.5: In the head space h, map the user behavior embedding vector _ex to the query vector through three different linear transformations key vector/> sum vector/> The calculation formula is:/> in Represents a trainable parameter matrix; Step 3.6: Calculate the query vector using dot product and key vector/> similarity between them, and obtain the similarity score function where d _h is the dimension of the head space; Step 3.7: Convert the scoring function to Obtain attention weights through softmax normalization Step 3.8: Value vector through attention weight a _i,j Perform weighted summation to obtain the high-order feature representation of e _x in the head space h/> Step 3.9: Increase the value of loop variable i ₂ and jump to step 3.4; Step 3.10: End the loop, concatenate all the high-order feature vectors learned in the head space, and then perform linear transformation to obtain the user's short-term preference representation. where N is the headspace number, and ^W is the linear projection matrix. 5. The intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations according to claim 1, characterized in that the specific method of step 4 is: Step 4.1: Define the time interval set T = {E, W, M, S} to represent days, weeks, months, and seasons respectively; Step 4.2: Define the user set U, the item set I, and define user u’s rating of network security tool items within time t as r _ui ; Step 4.3: Define loop variable i ₃ and assign i ₃ an initial value of 1; Step 4.4: If i ₃ ≤len(T), jump to step 4.4, otherwise jump to step 4.8; Step 4.5: Calculate the frequency of weighted ratings of user u on network security tool category j within time interval t Among them, I ^t represents the set of network security tools that user u has rated in the time interval t, and B _ij represents whether i belongs to category j. It is 1 if it is, and 0 if it is not; Step 4.6: Calculate the variance of user u’s ratings of network security tools of each category within time interval t Among them/> Represents the weighted rating of category j by user u, and C is the number of categories; Step 4.7: Increase the value of loop variable i ₃ and jump to step 4.4; Step 4.8: End the loop, average the rating variances in different time intervals, and obtain the overall rating variance of user u. where P represents the size of the time interval set T; Step 4.9: The user’s preference fluctuation value is 6. The intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations according to claim 1, characterized in that the specific method of step 5 is: Step 5.1: Map the preference fluctuation value F _u to a vector F _u _vec, use a fully connected layer to perform vector conversion, and obtain F _u _vec with the same length; Step 5.2: Perform multi-modal fusion of the user's long-term preferences, short-term preferences, user feature vectors and preference fluctuation values to obtain the target feature vector Among them, Concat represents the splicing operation,/> represents the user's short-term preference, g _t represents the user's long-term preference, e _u represents the user feature vector, and F _u _vec represents the user's preference fluctuation vector; Step 5.3: Input the target feature vector G into the fully connected neural network for nonlinear transformation; Step 5.4: The hidden layer of the network uses the Dice activation function to learn nonlinear relationships; Step 5.5: The output layer uses the Softmax function to calculate the predicted probability Where W _H is the trainable parameter matrix, b _H is the bias vector, D _H is the hidden layer output of layer H,/> Indicates the probability of recommending the next network security tool. 7. An intelligent recommendation device for network security tools based on temporal spatial characteristics and preference fluctuations, including a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that the computer program is loaded When the processor is used, the intelligent recommendation method for network security tools based on temporal spatial characteristics and preference fluctuations according to any one of claims 1-6 is implemented.