## 1 Introduction  
Today, the internet has been deeply integrated into every facet of society, ranging from daily social entertainment to critical infrastructure operation, from commercial activities to government administration. With the extensive application of emerging technologies such as the Internet of Things, cloud computing, and big data, the network scale continues to expand, and the network architecture is becoming increasingly complex. A large number of intelligent devices has access to the network, which led to an explosive growth in the number of network nodes and a sharp increase in data traffic. Network boundaries have become increasingly blurred, and the traditional network security protection models face significant challenges. As a proactive defense measure, the importance of network security situational awareness has become increasingly prominent. Ivanti VPN Attack 1: A threat intelligence firm Volexity has discovered that more than 1700 ICS VPN devices have been compromised by the GIFTEDVISITOR webshell, with victims ranging from government and military departments worldwide, national telecommunications companies, defense contractors, technology firms, banks, financial and accounting institutions, global consulting firms, and aerospace, aviation and engineering companies. Microsoft Executive Account Compromise 1: Microsoft has stated that the Midnight Blizzard group initially gained access to its systems in late November through a 'password spraying' attack, which was not initially detected until late January, when the hackers gained access to the email addresses in question for a period of up to two months. SOHO Router Attack: The Volt Typhoon group hijacked 'hundreds' of small office/home office (SOHO) routers located in the U.S. and formed them into a botnet to launch an attack on critical infrastructure in the U.S. Change Healthcare Ransomware Attack: Blackcat (also known as Alphv), a Russian-speaking cybercriminal organization, claimed responsibility for the ransomware attack, which resulted in a $22 million ransom payment by UnitedHealth and the theft of data from potentially one-third of the US population, impacting the personal information of approximately 100 million people, with the total cost associated with the attack estimated to be in excess of $2.45 billion. Cyberattack leads to chaos at Seattle Airport 1: The attack, which affected several critical systems, including the passenger displays, Wi-Fi connectivity, self-check-in, ticketing, and baggage-handling systems, caused chaos among the travelers over the busy Labor Day weekend. The ransomware group, Rhysida, demanded $6 million in Bitcoin payments. Network security situational awareness (NSA), initially proposed by [PERSON] [1], refers to the application of a situational awareness technology to extract and compile information about network system elements, within a specified time and spatial scope, in complex and rapidly changing environments. It aims to comprehensively present the network characteristics within the target range, providing the decision-makers with a basis for support. [PERSON] [2] conducted research on battlefield wireless network situational awareness, threats node location, network traffic characteristics, and network topology as core elements, and investigated the data collection methods and situational construction models for these elements to elucidate key technologies in wireless network situational awareness. [PERSON] et al. [3] explored the technology for generating sea battlefield posture by integrating multi-platform intelligence information with the battlefield environment. [PERSON] et al. [4] employed an improved Bayesian network to realize the situational awareness of communication network information security, perceiving the current network by extracting the perception elements. And the future network security development trend has been predicted.