Botnet propagation prediction method based on network security knowledge graph

Abstract

The application discloses a botnet propagation prediction method based on a network security knowledge graph, and the steps include: 1) constructing a network security knowledge graph based on network security data, and marking nodes involved in each botnet event in historical network security data on the network security knowledge graph; 2) calculating the state of each node in the network security knowledge graph, and generating a botnet propagation topology graph of a corresponding botnet according to the state of each node in each botnet event; 3) layering nodes in the botnet propagation topology graph of a target botnet, and setting a corresponding influence value Ks for nodes in each layer; 4) constructing a propagation model of the target botnet according to the state of each node in the target botnet and the corresponding influence value Ks; and 5) generating a dynamic topology graph of a propagation process of the target botnet according to the propagation model, and predicting the propagation situation of the target botnet at the next moment.

Description

Technical Field

[0001] This invention relates to the field of network security, and specifically to a method for predicting botnet propagation based on network security knowledge graphs. Background Technology

[0002] Botnets are a major security threat to the internet. Attacking organizations or individuals can spread botnets through various means, infecting numerous hosts on the internet. They then issue various operational commands to the infected hosts via a control channel, either continuing the botnet propagation or acting as botnets to participate in other types of attacks. This creates a one-to-one, one-to-many, or many-to-one control network between the controller and the infected hosts. Most botnets can grow and expand under the attacker's control through botnet propagation, controlled hosts connecting back, and more hosts being infected. Once an attacking organization or individual controls a botnet of a certain size, they can utilize the resources controlled by the botnet to create a destructive attack capability on the network, allowing them to gain economic benefits by selling resources or providing services, thus endangering cyberspace security.

[0003] Extensive literature has studied the propagation mechanisms of botnets, with most studies categorizing all hosts into infected and vulnerable types before investigating the propagation mechanisms. However, in actual botnet propagation, once a vulnerable host is infected, it typically cannot remain infected indefinitely. Furthermore, existing botnet propagation models do not integrate single botnet attacks with past cybersecurity incidents, and the calculation of a bot's propagation capability does not consider the various network resource elements associated with that host. Summary of the Invention

[0004] To address the aforementioned problems, the present invention aims to provide a botnet propagation prediction method based on a network security knowledge graph. This invention, based on a network security knowledge graph, hierarchically categorizes botnet host nodes with different propagation capabilities and calculates the infection capability of each botnet host node based on its associated network space entity nodes, forming a dynamic topology graph capable of depicting the botnet propagation process. To accurately observe the dynamic propagation process of botnet behavior, this invention first constructs a knowledge graph based on multi-source heterogeneous network security data (known historical network security event data, including identified botnet event data). Entity nodes involved in known botnet events are labeled on the knowledge graph. Then, using the K-shell algorithm and the SIR infectious disease model, the infection capability of each node in the graph is calculated, constructing a botnet propagation model, thereby forming a dynamic topology graph capable of depicting the botnet propagation process. The main steps include:

[0005] Step 1: Construct a cybersecurity knowledge graph based on cybersecurity data.

[0006] To fully explore the connections between cybersecurity entities and conduct correlation analysis, it is necessary to define cybersecurity ontology and the relationships between ontology from a cybersecurity protection perspective based on cybersecurity data, and then construct a cybersecurity knowledge graph.

[0007] Step 2: Identify the host IP status involved in the botnet based on the SIR model.

[0008] The botnet should be analyzed within the broader context of cybersecurity events. To obtain the propagation model of this botnet, the status of the botnet host IPs needs to be identified in the knowledge graph, such as susceptible hosts, infected hosts, and hosts that have been patched after infection. This will allow for the identification of the botnet's topology within a vast amount of cybersecurity events.

[0009] Step 3: Classify IP nodes based on the K-shell algorithm.

[0010] The traditional SIR model only calculates the propagation ability of nodes in the network and does not determine the influence of nodes from the perspective of the global topology, which has certain limitations. In order to determine the importance of IP nodes in the knowledge graph network, the K-shell method is used to coarsely decompose the global topology of the botnet and assign influence values ​​Ks to nodes at different levels.

[0011] Step 4: Calculate the infection capacity of each node in the graph.

[0012] After stratifying the zombie host IP nodes, the infection capability of host nodes at different levels is calculated. Since we have already constructed a network security knowledge graph and possess a large amount of information related to this botnet, the infection capability of each zombie host IP may be related to the vulnerabilities and risks in its corresponding system. Furthermore, the infection capability of a zombie host IP itself is related to the infection capability of its neighboring nodes. This step requires calculating the infection capability of zombie host IPs based on massive amounts of information, forming a dynamic topology graph of the botnet propagation process changing over time t.

[0013] In summary, the technical solution of the present invention is as follows:

[0014] A botnet propagation prediction method based on network security knowledge graphs includes the following steps:

[0015] 1) Construct a cybersecurity knowledge graph based on cybersecurity data, and mark the nodes involved in each botnet event in historical cybersecurity data on the cybersecurity knowledge graph;

[0016] 2) Calculate the state of each node in the network security knowledge graph, and generate a botnet propagation topology graph of the corresponding botnet based on the state of each node in each botnet event;

[0017] 3) The nodes in the botnet propagation topology of the target botnet are divided into layers, and a corresponding influence value Ks is set for each node in each layer;

[0018] 4) Based on the state of each node in the target botnet and its corresponding influence value Ks, construct the propagation model of the target botnet;

[0019] 5) Generate a dynamic topology diagram of the propagation process of the target botnet based on the propagation model, and predict the propagation status of the target botnet at the next moment.

[0020] Furthermore, the state of each node in the network security knowledge graph is calculated based on the SIR model; the state includes susceptible nodes, infected nodes, and nodes that have been repaired after infection.

[0021] Furthermore, the K-shell algorithm is used to layer the nodes in the botnet propagation topology: First, nodes with a degree of 1 and their edges are deleted from the botnet propagation topology. At this point, all deleted nodes are assigned to the 1-shell layer and assigned a Ks value of 1. Then, nodes with a degree of 2 and their edges are deleted from the botnet. These deleted nodes are assigned to the 2-shell layer and assigned a Ks value of 2. The node degree is increased sequentially, and nodes with the corresponding degree are deleted and assigned the corresponding Ks value, until all nodes in the botnet propagation topology are layered and assigned the corresponding Ks value. The layer to which the node with the largest Ks value belongs is the core layer of the network, and nodes in the core layer have the greatest influence.

[0022] Furthermore, the propagation model is as follows: in, This represents the infection capability of node i at time t. L represents the infection capability of node i's neighbor node j at time t. ij Let L represent the hierarchical relationship between node i and node j, where the hierarchical difference between node i and node j is m. ij =m; Ki is the Ks value corresponding to node i, and Kj is the Ks value corresponding to node j; β i This indicates the ability of node i to infect other nodes.

[0023] Furthermore, M is the set maximum value, if L ij If the value of L is greater than M, then discard L. ij .

[0024] Furthermore, the network security data includes, but is not limited to: botnet data, phishing network data, and website malware data.

[0025] A server is characterized by comprising a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the methods described above.

[0026] A computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the steps of the above-described method.

[0027] Compared with the prior art, the positive effects of the present invention are as follows:

[0028] (1) Ranking the importance of zombie host nodes with different propagation capabilities can identify influential nodes in the network topology;

[0029] (2) The infection capability of a zombie host is associated with its network space entity nodes, such as host association vulnerabilities and the propagation capability of neighboring nodes. The infection capability of each zombie host node is calculated, which is more in line with the propagation capability of zombie network hosts in actual events. Attached Figure Description

[0030] Figure 1 A flowchart illustrating the method for constructing a botnet propagation model based on a cybersecurity knowledge graph.

[0031] Figure 2 This is a schema diagram for a cybersecurity knowledge graph ontology.

[0032] Figure 3 This is a hierarchical graph of zombie host IP nodes based on the K-shell algorithm. Detailed Implementation

[0033] To make the objectives, technical solutions, and advantages of the present invention clearer, the embodiments of the present invention will be described in further detail below.

[0034] Step 1: Construct a cybersecurity knowledge graph based on known cybersecurity incident data.

[0035] To fully uncover the connections between cybersecurity incidents and enable correlation analysis of entities involved in various cybersecurity incidents, it is necessary to construct a cybersecurity knowledge graph based on cybersecurity data. This involves first analyzing cybersecurity knowledge, and then constructing the cybersecurity knowledge graph, such as... Figure 2 As shown, entity relation triples include:

[0036] <"System","Affiliated Unit","Unit">

[0037] <"System","Potential Hazards","Hazards">

[0038] <"System","Vulnerability Exists","Vulnerability">

[0039] <"System Domain","Associated URL","System URL">

[0040] <"IP","Affiliation","Organization">

[0041] <"System URL","IP Address","IP">

[0042] <"IP","Connection","IP">

[0043] <"System","System Domain","System Domain">

[0044] <"System","IP Address","IP">

[0045] <"System Domain Name","IP Address","IP">

[0046] The "connection" relationship between "IP" entities indicates that there is a wired or wireless connection between IPs.

[0047] Based on the ontology structure diagram, triples can be extracted from multi-source heterogeneous network security event data to construct a network security knowledge graph at the instance layer.

[0048] Step 2: Identify the host IP status involved in the botnet based on the SIR model.

[0049] For a botnet incident that has already occurred, the controller may only currently have information on a subset of the botnet's IP nodes. To understand the botnet's propagation process, the IP nodes involved are labeled in a knowledge graph. Specifically, we categorize the IP node states into the following three types:

[0050] 1) S state: Indicates a host IP that is susceptible to infection.

[0051] 2) I status: Indicates the IP address of the infected host.

[0052] 3) R status: Indicates that the host IP has been restored to normal after being infected through certain measures.

[0053] By labeling the IP addresses involved in this botnet using the three states mentioned above, we can obtain the current botnet propagation topology.

[0054] Step 3: Classify IP nodes based on the K-shell algorithm.

[0055] To determine the importance of IP nodes in a knowledge graph network, the K-shell method is used to coarsely decompose the botnet propagation topology, assigning Ks values ​​to nodes at different levels. First, nodes with a degree of 1 and their edges are deleted from the botnet. All deleted nodes are then classified into the 1-shell layer and assigned a Ks value of 1. Next, nodes with a degree of 2 and their edges are continuously deleted, classifying them into the 2-shell layer and assigning them Ks values. This process is repeated until all nodes in the botnet are layered and assigned Ks values. The layer to which the node with the highest Ks value belongs is the core layer of the network, and nodes in the core layer have the greatest influence.

[0056] Specifically, K-shell decomposition is performed on nodes in the botnet, such as... Figure 3 As shown, the controlled host IP nodes involved in the botnet are divided into different K layers. Controlled host IP nodes that are connected to more other nodes have higher Ks values ​​and are therefore more important.

[0057] Step 4: Calculate the infection capacity of each node in the graph.

[0058] In the SIR model, the propagation path is S→I→R. Susceptible host IPs are infected by already infected host IPs with a probability β. Infected host IPs are considered immune to reinfection after being repaired. Let S(t) represent the number of susceptible hosts among all IP nodes in the knowledge graph at time t, I(t) represent the number of hosts already infected by the botnet among all IP nodes in the knowledge graph at time t, and R(t) represent the number of botnet IPs in the knowledge graph at time t that were previously infected and subsequently repaired. Then the propagation dynamics differential equation can be expressed as:

[0059]

[0060] Where β represents the probability of a susceptible host IP being infected, and γ represents the probability that an infected zombie host IP will take certain measures to be restored to a normal host IP. The first equation in the propagation dynamics differential equation shows that S(t) is monotonically decreasing, and βS(t)I(t) is the number of newly infected people at time t. The second equation shows that the number of infected people at time t is the number of newly infected people minus the number of newly recovered people. The third equation represents the number of newly recovered people at time t. To more accurately calculate the infectivity of each zombie host in a botnet, it is necessary to comprehensively consider the K-shell hierarchy, the infectivity of the zombie host IP itself, and the infectivity of the zombie host IP's neighboring nodes, thereby calculating a more accurate propagation model, as follows:

[0061] 1) Host IP nodes within the same K layer have the same Ks value, indicating that K layer nodes have the same importance in the botnet;

[0062] 2) The calculation of the infection capability of the neighboring nodes of the zombie host IP is similar to that of the zombie host IP. However, when attributing the effect of its neighboring nodes to the infection capability of the zombie host IP, different Ks values ​​need to be assigned to the neighboring nodes according to different K layers.

[0063] 3) The infection capability β of the zombie host IP itself includes: vulnerabilities and hidden dangers in the system associated with the IP in the knowledge graph, the time when the zombie host IP was infected (the earlier the host was infected and the more unpatched it is, the stronger the infection capability of the zombie host is considered), etc. The degree of influence of different associated factors on the infection capability of the zombie host IP is determined based on the node relationship hierarchy, and the specific definitions are as follows:

[0064]

[0065] in, This represents the infection capability of the zombie host IP node i at time t. L represents the infection capability of neighboring node j of the zombie host IP node i at time t, where L ij This represents the hierarchical relationship between node i and node j. The lower the hierarchy, the stronger the relationship. (Weight) The larger the value, the greater the level difference between node i and node j, which is m. ij =m; the maximum relationship level is 5. If this threshold is exceeded, the influence of neighboring nodes will no longer be calculated; β represents the infectivity of each zombie host in the botnet to infect other hosts, n is the total number of neighboring nodes of node i, and Ki is the Ks value corresponding to node i.

[0066] In summary, the infection capability of a botnet host IP at time t can be dynamically calculated, the probability of a susceptible host IP being infected at time t+1 can be obtained, and a dynamic topology diagram of the botnet propagation process changing over time can be formed.

[0067] The foregoing description illustrates the technical approach of this invention, intended to enable those skilled in the art to understand and implement the invention, and should not be construed as limiting the scope of protection of this invention. All equivalent modifications or alterations made in accordance with the spirit and essence of this invention should be included within the scope of protection of this invention.

Claims

1. A botnet propagation prediction method based on network security knowledge graphs, comprising the following steps: 1) Construct a cybersecurity knowledge graph based on cybersecurity data, and mark the nodes involved in each botnet event in historical cybersecurity data on the cybersecurity knowledge graph; 2) Calculate the state of each node in the network security knowledge graph, and generate the botnet propagation topology graph of the corresponding botnet based on the state of each node in each botnet event; 3) Divide the nodes in the botnet propagation topology of the target botnet into layers, and set a corresponding influence value Ks for each node in each layer; 4) Based on the state of each node in the target botnet and its corresponding influence value Ks, construct a propagation model for the target botnet; the propagation model is as follows: ;in, M is the set maximum value, if If the value is greater than M, then discard it. ; Represents a node exist Its own infectivity at all times Represents the neighboring nodes of node i exist The ability to infect at any time Represents a node and nodes Relationship hierarchy, nodes With nodes If the hierarchical difference between them is m, then =m; It is the node i corresponding to value, It is the node j corresponding to value; This represents the infectivity of node i to other nodes; n is the total number of neighboring nodes of node i. 5) Generate a dynamic topology diagram of the propagation process of the target botnet based on the propagation model, and predict the propagation status of the target botnet at the next moment.

2. The method according to claim 1, characterized in that, The state of each node in the network security knowledge graph is calculated based on the SIR model; the state includes vulnerable nodes, infected nodes, and nodes that have been repaired after infection.

3. The method according to claim 2, characterized in that, The K-shell algorithm is used to layer the nodes in the botnet propagation topology: First, nodes with a degree of 1 and their edges are deleted from the botnet propagation topology. Then, all deleted nodes are assigned to the 1-shell layer and assigned... The value is 1; then, nodes with degree 2 and their edges are deleted from the botnet, the deleted nodes are assigned to the 2-shell layer, and they are assigned... The value is 2; the node degree is increased sequentially, the node with the corresponding degree is deleted, and a corresponding node is assigned to it. The value continues until all nodes in the botnet propagation topology are hierarchical and assigned corresponding values. Value; among which, The layer to which the node with the highest value belongs is the core layer of the network, and nodes in the core layer have the greatest influence.

4. The method according to claim 1, 2, or 3, characterized in that, The cybersecurity data includes, but is not limited to: botnet data, phishing network data, and website malware data.

5. A server, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing each step of the method of any one of claims 1 to 4.

6. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 4.

Images