企业网络故障预测与威胁识别的多模态自监督蒸馏方法

Enterprise Network Fault Prediction and Security Threat Identification via Multimodal Self-Supervised Representation and Cross-Domain Knowledge Distillation

摘要:

为解决现代企业网络中故障预测与安全威胁识别面临的数据稀缺、模型泛化能力弱及部署效率低等问题,本文提出一种基于多模态自监督表征与跨域知识蒸馏(Multimodal Self-Supervised Knowledge Distillation, MM-SSKD)的企业网络故障预测与安全威胁识别统一框架。具体地,提出包含跨模态一致性约束的增强型多模态掩码自编码(Augmented MM-MAE)并引入随机模态丢弃以提升缺模态鲁棒性；同时提出类条件相关性对齐(C-CORAL),结合置信筛选与类别重权重实现类别粒度的二阶统计对齐。在目标域上以少量标注进行多任务联合学习,并配合温度缩放完成概率校准与阈值决策。实验显示,相对最佳公开基线在数据集上RMSE下降约15.8%、F1提升约4.0%,低标注比例更具优势,并在缺模态与跨域场景中保持稳定。同时,蒸馏得到的轻量学生模型便于部署到边缘与资源受限环境,在保持主要精度指标的条件下,对缺模态与跨域漂移表现出较好的稳健性；配合t-SNE/CKA与ECE/Brier等分析与KPI模拟(MTTD/MTTR),验证了该方法在实际应用中的高效性与可行性。

Abstract:

To address the challenges of data scarcity, weak model generalization, and low deployment efficiency in modern enterprise networks, this paper proposes a unified framework for fault prediction and security threat identification based on Multimodal Self-Supervised Knowledge Distillation (MM-SSKD). Specifically, we design an Augmented Multimodal Masked Autoencoder (Augmented MM-MAE) with cross-modal consistency constraints, and introduce random modality dropout to enhance robustness under missing modalities. In addition, we propose Class-Conditional Correlation Alignment (C-CORAL), which achieves class-level second-order statistical alignment through confidence-based filtering and class re-weighting. On the target domain, multi-task joint learning with limited annotations is performed, combined with temperature scaling for probability calibration and threshold-based decision-making. Experimental results demonstrate that compared with the best public baselines, our approach reduces RMSE by about 15.8% and improves F1-score by about 4.0%, with greater advantages under low-label conditions, while maintaining stability in both missing-modality and cross-domain scenarios. Furthermore, the distilled lightweight student model is deployment-friendly for edge and resource-constrained environments, preserving key accuracy metrics while exhibiting strong robustness against modality absence and domain shift. Comprehensive analyses using t-SNE/CKA and ECE/Brier metrics, together with KPI simulations (MTTD/MTTR), further verify the efficiency and practicality of the proposed method in real-world applications.