Layered topology aggregation visual display method for network threat associated data

Abstract

The invention discloses a hierarchical topology aggregation visual display method for network threat associated data, and the hierarchical topology of threat association refers to the associated data of mechanisms, devices, software and threats, and the method comprises the following steps: (10) determining four layers of network topologies, i.e., dividing data into four categories according to a platform layer, a logic layer, an application layer and a threat layer; (20) determining a specific node classification display icon of each layer and performing four-layer visualization; (30) determining node and edge aggregation display of the application layer and the threat layer; (40) determining expansion of aggregation nodes and edges of the application layer and the threat layer; (50) determining a red marking and hiding visualization method of important and non-important nodes of the logic layer and the application layer; and (60) determining a visual layout algorithm and a visual tool of each layer. According to the method, the problem that rendering is too slow due to the fact that the data size of nodes of an application layer and a threat layer is too large during network topology visual display and multi-layer display is solved, and therefore a user can obtain network topology information including a platform, equipment of the platform, software on the equipment and threats on the software more visually and rapidly; and displaying through a graphic visualization tool g6.

Description

Technical Field

[0001] The invention belongs to the computer field and is an efficient hierarchical aggregation presentation method suitable for quickly locating threat-related devices and mechanisms with high efficiency, fast speed and good viewing effect. Background Art

[0002] With the rapid advancement of computer technology, the information age is currently in a rapid development stage, and the importance of network security has become increasingly significant. Network security incidents occur frequently, and the means of network attacks are becoming more complex and diverse, which has brought huge challenges to the cyberspace security work of individuals, organizations and even the entire country. Recently, foreign organizations have repeatedly launched cyber attacks on domestic security departments. It is worth noting how to quickly analyze the crux of the problem through scanning threats, and visualization technology can effectively increase the efficiency of analysis. This technology turns abstract data into easy-to-understand graphics and provides interactive methods, allowing users to quickly discover and summarize information through limited screen space.

[0003] The node and relationship data associated with network threats are characterized by clear hierarchy, large quantity, and complex relationships. When visualizing this relational data, you need to pay attention to the following issues:

[0004] 1. How to clearly present the hierarchical relationship of network threat-related data; a good hierarchical relationship presentation can help users understand the meaning of the data more quickly.

[0005] 2. How to quickly present node relationship graphs of network-related data; as the number of nodes and relationships increases, fast visualization can improve user experience.

[0006] 3. How to assist users to quickly locate threat devices from associated data; assisted positioning can speed up users’ perception of threat devices. Summary of the invention

[0007] The purpose of the present invention is to provide a hierarchical topology aggregation visualization display method for network threat association, so as to improve the efficiency and visualization experience of users in analyzing threat association data.

[0008] (10) Determine the four-layer network topology, that is, divide the data into four categories according to the platform layer, logic layer, application layer and threat layer. The scanned vulnerability-related data is first divided according to the relationship within the layer and outside the layer, where the layer contains nodes and intra-layer relationship data, and the inter-layer relationship data is stored between layers. Finally, the node data within the layer is classified according to the platform layer, logic layer, application layer and threat layer and stored in the corresponding array.

[0009] (20) Determine the icons for displaying specific node classifications at each layer and the four-layer visualization. According to the specific classification of nodes at each layer, different icons with characteristics are assigned, and the display area is divided into four layers, and the nodes are placed on the corresponding layers, so that more node information can be displayed in a limited area.

[0010] (30) Determine the node and edge aggregation display of the application layer and the threat layer. Due to the huge amount of data in the application layer and the threat layer, and the lack of obvious display of specific nodes, a node and edge aggregation visualization method is adopted. Nodes of the same type and nested classification are presented as larger multi-level aggregate nodes, and the relationships between aggregate nodes are integrated to present them as more obvious aggregate edges, where the aggregate nodes include the number of root nodes.

[0011] (40) Determine the node and edge expansion of the application layer and the threat layer. Provide interactive functions for the expansion of aggregate nodes and edges. Control the node and edge expansion and rollback operations through the data structure characteristics of the stack. When the expansion operation is performed, visualize the points and edges inside the expanded aggregate nodes and edges, and reconstruct the inter-layer relationship.

[0012] (50) Determine the visualization method of marking or hiding important and unimportant nodes in the logic layer and application layer. Nodes that are associated with threat layer nodes are screened through threat association data. Nodes that are associated with the logic layer are marked as important nodes and marked in red, while unimportant nodes are hidden. The application layer adopts a visualization method of hiding or not hiding.

[0013] (60) Determine the visualization layout algorithm and visualization tools for each layer. The logic layer adopts clustering layout so that nodes of the same classification are placed close to each other; the application layer and threat layer adopt force-directed layout, and the nodes of the platform layer are laid out according to their own longitude and latitude. Finally, the open source library g6 is used for graphics rendering.

[0014] Compared with the prior art, the present invention has the following significant advantages:

[0015] The present invention displays network threat-related data in a hierarchical and visual manner, and performs customized hierarchical display by node classification and importance, which greatly speeds up the user's understanding of the entire threat map; and displays node edges in aggregate for the application layer and threat layer of the threat map, cleverly using the data structure of the stack to solve the node expansion and aggregation problems, and accelerates the map rendering without losing accuracy; then selects different layout algorithms based on the characteristics of each layer, while taking into account the beauty and speed of the visual layout; finally, the graphics are rendered through an open source library. The present invention is suitable for visual analysis of threat-related data, and has the characteristics of high analysis efficiency, fast layout speed, and good presentation effect. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 The steps of the method of the present invention are shown in FIG.

[0017] Figure 2 Flow chart of the present invention

[0018] Figure 3 Display effect graphs for node and edge aggregation

[0019] Figure 4 Red marking and hiding effect diagram for important and unimportant nodes

[0020] Figure 5 Flowchart for node position calculation

[0021] Figure 6 The overall layout effect diagram Specific implementation methods

[0022] As attached Figure 1 As shown (see the flowchart in the attached Figure 2 ), the present invention is a hierarchical topology aggregation visualization display method for network threat association, comprising the following steps:

[0023] (10) Determine the four-layer network topology, that is, divide the data into four categories according to the platform layer, logic layer, application layer and threat layer. First, classify the nodes and store the nodes of threat-related data into the array of the corresponding layer. Then process the node relationship data and determine whether the edge belongs to the inter-layer or intra-layer through the endpoints of the node relationship. Store the relationship data into the corresponding array, and organize the entire network topology data according to the platform layer, logic layer, application layer and threat layer.

[0024] The specific steps of the above (10) layered processing of threat-related data are as follows:

[0025] (11) Traverse the entire threat-related node data, determine which layer the node belongs to through the node classification data, add the layer data to the node data, and build a node query table. The detailed process is as follows:

[0026] (111) Construct a simple identifier for each layer, [0, 1, 2, 3] corresponding to the platform layer, logic layer, application layer and threat layer respectively; encapsulate the method getNodeLayer whose input parameter is node classification and output is layer identifier to determine the layer to which the node belongs; provide a variable graph for storing nodes and edges of each layer, where the outermost layer of the variable is between layers and within layers, the within layer includes the nodes and associated relationship data contained in each layer, and the between layers are the inter-layer relationship data of each node.

[0027] (112) Traverse the node data, add the layer parameter to the node through the getNodeLayer method of the layer to which it belongs, store the node data in the corresponding position of the graph, and build a node query table at the same time, using the mapping relationship between the node id and the node idToNode. The idea used in this method is HashMap, which makes the complexity of node query O(1).

[0028] (12) Traverse the entire threat-related relational data, query the mapping relationship idToNode through the endpoint of the associated data, compare the layer to which the endpoint node belongs, and confirm that the relationship belongs to the inter-layer and intra-layer. If it belongs to the intra-layer, determine which layer it belongs to, and finally store it in the corresponding position of the graph.

[0029] (20) Determine the icons for displaying the specific node categories of each layer and the four-layer visualization. By adding statistics on the entire node class to the node traversal operation in (10) above, store the categories of all nodes in the variable nodeBaseTypesMap, with the category name as the key of the variable. Use the image corresponding to the category as the value to display the specific icon of the node; construct the layer nodes, add a background image to each layer, and realize the customized visualization of the four layers.

[0030] The specific steps of the above (20) node icons and four-layer visualization are:

[0031] (21) Construct a category table based on the node data associated with network threats, and add corresponding pictures to each category;

[0032] (22) Create four layers of nodes and add corresponding image data to each layer node.

[0033] (30) Determine the node and edge aggregation display of the application layer and the threat layer. In general data, the node data in the application layer and the threat layer is relatively large. If all nodes are rendered during the first display, not only will the user be unable to quickly understand the meaning of the graph at this layer, but it will also cause the rendering of the entire graph to slow down. The point aggregation display constructs a category tree with all nodes of threat-related data as leaf nodes of the tree, and displays all the father nodes of the tree as aggregation nodes. The edge aggregation display is constructed through the relationship between nodes in each two categories, and the concatenated string of the ids of the two node categories is used as the key for storing the edge graph; thereby greatly reducing the rendering time, and the aggregated classification and relationship can accelerate the user's understanding of the threat-related data. The effect diagram is shown in the attached figure. Figure 3 .

[0034] The specific steps for determining the node and edge aggregation display of the application layer and threat layer in (30) above are:

[0035] (31) constructing a classification tree according to the classification of application layer and threat layer nodes, inserting the constructed nodes into the application layer and threat layer node data, and adding distinguishing marks to the classification nodes;

[0036] (32) Recursively construct a classification tree containing the bottom-level nodes, and use the id of the classification node as the key and the nodes and edges under the classification as the value to construct the clusterMap;

[0037] (33) Traverse the intra-layer relationship data of the application layer and the threat layer, store the relationships whose endpoints are nodes of different categories into clusterMap, and use the concatenation of the ids of different categories as the key and the value as the included relationship. Finally, construct the edges between the relationships and store them in clusterMap;

[0038] (34) Add currentMap to the application layer and threat layer in the graph data, and give the default top-level graph data.

[0039] (40) Determine the expansion of nodes and edges of the application layer and the threat layer. This method stores the IDs of the currently displayed graphs of the application layer and the threat layer in two stacks, and queries the nodes and relationships to be displayed in the clusterMap according to the IDs. When the user performs an expansion operation, the new graph ID is pushed into the stack and popped out when rolling back, thereby achieving the expansion status management of the application layer and the threat layer.

[0040] The specific steps of (40) above to determine the nodes and edges of the application layer and threat layer are as follows:

[0041] (41) Build a stack of application layer and threat layer, and push the default state into the stack;

[0042] (42) When the user expands, the id to be expanded is pushed into the stack, and the id is queried in the clusterMap, and then the query result and the currentMap of the graph are replaced;

[0043] (43) When the user rolls back, the current ID is popped out; the nodes and edges of the entire application layer and threat layer are expanded.

[0044] (50) Determine the visualization method for marking and hiding important and unimportant nodes in the logic layer and the application layer. When visualizing the four-layer network threat nodes, the nodes with threat characteristics in the logic layer are marked in red, otherwise they are hidden, and the nodes without threat characteristics in the application layer are hidden; the threat characteristic nodes of the logic layer are judged by whether they have a direct or indirect relationship with the threat layer nodes; the threat characteristic nodes of the application layer are judged by whether they have a direct relationship with the threat layer nodes. The effect diagram is shown in the attached figure. Figure 4 .

[0045] The specific steps of the visualization method (50) for determining the red marking and hiding of important and unimportant nodes in the logic layer and the application layer are as follows:

[0046] (51) Find all threat layer nodes from the network association data, and obtain all threat layer nodes of the data in the layer from the graph constructed by (10).

[0047] (52) Obtain all inter-layer relationships from the graph constructed by (10), traverse the relationships to find all node IDs that are directly related to the threat layer (except the threat layer nodes), and classify the retrieved nodes according to the layer they belong to; among them, the nodes belonging to the logic layer and the application layer are the nodes with threats.

[0048] (53) Using the application layer nodes in the above manner, find the logical layer nodes that are directly associated with the points.

[0049] (54) Finally, the node with threat characteristics is added with the attribute of threaten=true.

[0050] (60) Determine the visualization layout algorithm and visualization tools for each layer. Since the platform layer nodes have longitude and latitude characteristics, the nodes of this layer are scaled to the platform layer according to the longitude and latitude information; the logic layer performs clustering layout according to the classification of nodes, so that this layer can have the clustering characteristics of the node network. The application layer and the threat layer adopt force-guided layout, taking into account both aesthetics and layout speed. The flow chart is shown in the attached figure. Figure 5 , the effect diagram is as attached Figure 6 , the algorithm is as follows.

[0051] The clustering layout algorithm is as follows:

[0052]

[0053] Among them, F repulsion_intral (i, j) is the repulsive force between nodes of the same category (i, j), F attraction_intral (i, j) is the attraction between nodes of the same category (i, j), F repulsion_inter (i,j) is the repulsion between nodes (i,j) of different classifications.

[0054] The force-directed layout algorithm is as follows:

[0055]

[0056] Where fr is the repulsive force, fa is the attractive force, d is the Euclidean distance between nodes, and k is the ideal distance between nodes. When k = d, fr = fa, indicating that the equilibrium state is reached.

[0057] The specific steps of determining the visualization layout algorithm and visualization tool of each layer in (60) are as follows:

[0058] (61) The platform layer nodes have longitude and latitude information, so the map is used as the background board, the screen position is calculated according to the longitude and latitude of the node, and the position information is stored in the attributes of each node;

[0059] (62) The logic layer nodes use cluster layout to calculate the node position. First, the layout is initialized to give each node a position. Then, the cluster layout algorithm is iterated multiple times to calculate the screen position of each logic layer node and store the position information in the node attributes.

[0060] (63) The application layer and the threat layer use force-directed layout to calculate the node position. There are aggregated nodes in the application layer and the threat layer, so what is calculated is the screen position of each node that needs to be presented. The screen position of each node is calculated through multiple iterations of the force-directed algorithm, and the position information is stored in the attributes of each node.

[0061] (64) Through the g6 rendering node, multi-layer visualization of threat correlation data is achieved.

Claims

1. A hierarchical topological aggregation visualization display method for network threat correlation data, characterized in that: The steps include: (10) Determine the four-layer network topology, that is, divide the data into four categories according to the platform layer, logic layer, application layer and threat layer. The four-layer network topology refers to the overall associated data of units, devices, software and threats. The platform layer refers to the platform in the network topology, including network nodes, target units, important information systems, etc. The logic layer refers to the devices contained in each platform layer node, including host terminals, routers, servers, storage devices, switches and other devices. The application layer refers to the software existing on each logical layer node, including databases, office software, security protection, Android systems and windows and other applications. The threat layer refers to the threats existing on each application layer node, including network attacks, backdoors, non-compliant configurations, vulnerabilities, weak passwords, viruses, etc. By classifying the entire network threat association data according to the characteristics of each layer, a complete network hierarchical topology is constructed. (20) Determine the icons for displaying the specific node classifications of each layer and the four-layer visualization. The specific node classification display refers to setting corresponding icons according to the specific classification of each node in the layer, including the classification nodes of the logic layer, application layer and threat layer; the platform layer uses a unified icon for the analysis target. The four-layer visualization refers to selecting respective shapes and background images through the overall four-layer classification of the network topology to form a four-layer visualization background board, including the platform layer of the map background, the blue logic layer, the green application layer and the red threat layer. (30) Determine the node and edge aggregation display of the application layer and the threat layer. The node aggregation display of the application layer and the threat layer refers to aggregating the classified application layer and threat layer nodes and then displaying the classification nodes, including multi-level classification aggregation, wherein the information of the classification node includes the classification name and the number of nodes; the aggregation method classifies the nodes by the category attributes attached to the nodes and counts the number of nodes it contains. The edge aggregation display of the application layer and the threat layer refers to the aggregation display of the node relationships between the specific different classifications between the layers, including the aggregation of the subclass relationships of the multi-level classifications. The aggregation method integrates the data according to the node classification through the relationship between the nodes to form the edge aggregation of the multi-level classification. (40) Determine the expansion of nodes and edges of the application layer and the threat layer. The expansion of nodes of the application layer and the threat layer refers to expanding the aggregated nodes of step (30). After the aggregated nodes are expanded, all nodes and relationships of the classification are visualized on the corresponding layer, including the expansion of the classification categories and subcategories. The expansion of edges of the application layer and the threat layer refers to expanding the aggregated edges of step (30), including the expansion of aggregated nodes and edges. After the aggregated edges are expanded, all nodes and edges of the two classifications connected by the edge are visualized on the corresponding layer. (50) Determine a visualization method for marking and hiding important and unimportant nodes in the logic layer and the application layer. The important and unimportant nodes in the logic layer and the application layer refer to nodes that are threatening in the network topology; threatening nodes include nodes that have a direct or indirect relationship with the threat layer (threats exist on the associated software nodes of the logic layer nodes). The visualization method for marking and hiding refers to marking the nodes that are threatening in the logic layer, i.e., important nodes, in red, and hiding unimportant nodes, while important nodes in the application layer are not hidden, and vice versa. This solves the problem of large amounts of data being presented at the same time and being cluttered and unable to be quickly located. (60) Determine the visualization layout algorithm and visualization tool for each layer. The visualization layout algorithm for each layer refers to forming a customized presentation method for each layer node of the four-layer network topology, so as to balance the layout speed and visualization aesthetics, and use mainstream visualization tools for graphical display.

2. An aggregated visual representation of a hierarchical topology according to claim 1, characterized in that: The step (10) determines the four-layer network topology, that is, the data is divided into four categories according to the platform layer, logic layer, application layer and threat layer. The specific steps are: Construct a query table for the classification layer, store the nodes of threat-related data into the array of the corresponding layer through the classification of nodes, and then process the node relationship data. Determine whether the edge belongs to the inter-layer or intra-layer through the endpoints of the node relationship, store the relationship data into the corresponding array, and organize the entire network topology data according to the platform layer, logic layer, application layer and threat layer.

3. An aggregated visual representation of a hierarchical topology according to claim 1, characterized in that: (10) determines the classification display icons of specific nodes in each layer and the four-layer visualization. The specific steps are: According to (10), the data of all nodes required for display have been classified, where these classifications are the lowest level classifications. By building a classification image index table, the image management of each category is realized. When drawing a node, you only need to get the node classification to obtain the icon displayed by the node; Next, select the shape of the four layers. To achieve reasonable screen occupancy and visual beauty, choose a trapezoid with different background images, and divide the screen horizontally into four areas as the placement area for each layer. Finally, the display icon of each node is placed on the corresponding layer, and the relationship lines between layers are hidden, so that the nodes can be displayed in layers by category.

4. An aggregated visual representation of a hierarchical topology according to claim 1, characterized in that: The corresponding step (30) determines the node and edge aggregation display of the application layer and the threat layer. The specific steps are: After applying step (10) to build the graph, there are too many nodes for the application layer and the threat layer, so the node aggregation method is used to solve it. Each category is taken as a node and all the nodes of the application layer are placed in an array. The array is traversed to build a tree structure including the child nodes and relationship arrays. The father node can be used as the display node, that is, the aggregation node, and the relationship between the father nodes is used as the aggregation edge; By counting the number of bottom-level nodes on each parent node, the total number of included nodes can be displayed.

5. An aggregated visual representation of a hierarchical topology according to claim 1, characterized in that: The corresponding step (40) determines the node and edge expansion of the application layer and the threat layer. The specific steps are: First, the display status of the application layer and threat layer is stored through the first-in-last-out feature of the stack structure; When expanding an aggregate node, first push the ID of the parent node of the layer into the stack. By creating an object of the node ID when traversing the array in step (30), the corresponding descendant nodes and relationships can be quickly located to expand the node. When expanding the aggregate edge, the parent node ID of the layer is also pushed into the stack first. By obtaining the endpoint ID of the edge, the child data of the two endpoints are obtained from the object of the node ID, and all the leaf nodes and relationships of the two endpoints are mined to expand the edge. After expansion, returning to the upper layer, the id data in the stack can be popped out one by one, and the corresponding graph can be found from the object of the node id, thereby realizing the complete node and relationship expansion function.

6. An aggregated visual representation of a hierarchical topology according to claim 1, characterized in that: The corresponding step (50) determines the visualization method of marking and hiding important and unimportant nodes in the logic layer and the application layer. The specific steps are: Traverse the threat layer node data, obtain all nodes with threats through the upper layer node id and node id objects, and add important attributes to the retrieved logic layer and application layer nodes; Logical layer nodes with important attributes are highlighted in red, while non-important nodes are hidden by default; Application layer nodes with important attributes are displayed by default, while non-important nodes are hidden by default.

7. An aggregated visualization of a hierarchical topology according to claim 1, characterized in that: The step (60) determines the visualization layout algorithm of each layer. The specific steps are: A personalized visual layout is realized according to the characteristics of nodes at each layer, including: Platform layer nodes belong to the unit class and usually have longitude and latitude information. The node layout of the platform layer is realized by taking a screenshot of the map and the longitude and latitude information of the node itself. The nodes in the logic layer are not visualized in an aggregated manner. In order to make the layout of the nodes in this layer neat and understandable, a cluster layout is adopted; The application layer and threat layer use an aggregated display of nodes and edges and have a large number of nodes, so force-directed layout is used to speed up the layout.

Images