Intelligent evidence obtaining and analysis system for network attack process

Abstract

The invention relates to the field of network security analysis, in particular to an intelligent evidence obtaining and analysis system for a network attack process. The system comprises a data acquisition module for acquiring data in a network environment in real time; the atlas entity relation model building module is used for building an atlas entity relation model based on the collected data and dynamically updating model configuration; the intelligent evidence obtaining module is used for carrying out intelligent evidence obtaining on the collected data by utilizing a graph entity relation model, extracting key information of attack behaviors and constructing a network killing chain; and the real-time analysis module is used for carrying out real-time analysis on the network attack behavior based on the constructed atlas entity relationship model and the intelligent evidence obtaining result. The invention provides an intelligent evidence collection and analysis system for a network attack process, which can reflect the change of a network environment in real time, dynamically associate and analyze attack behaviors in different stages, completely cover the whole network attack process, fully utilize various types of data for evidence collection and analysis, and improve the efficiency and accuracy of network security protection.

Description

Technical Field

[0001] The present invention relates to the field of network security analysis, and in particular to an intelligent evidence collection and analysis system for a network attack process. Background Art

[0002] With the rapid development of information technology, network security threats are becoming increasingly complex and changeable. Network attackers use a variety of covert, multi-level, and multi-source attack methods, which poses a great challenge to network security protection. Traditional network security forensics and analysis systems often rely on static data analysis and empirical judgment, which cannot reflect changes in the network environment in real time and are difficult to effectively respond to new network threats.

[0003] Most of the existing network forensics and analysis methods are based on log auditing and traffic analysis, which extract key information about attack behaviors by recording and parsing network activities. However, these methods have the following shortcomings when dealing with complex and changeable network attacks: First, they lack dynamic correlation analysis capabilities and cannot effectively correlate and infer attack behaviors at different stages, resulting in incomplete attack links; second, they cannot process and analyze ongoing attack traffic in real time, resulting in delayed analysis; third, they lack comprehensive coverage of the entire network attack process and cannot effectively prevent and detect complex attacks; fourth, the means of forensics are single and cannot fully utilize various types of data for supplementation and verification, resulting in incomplete and inaccurate analysis.

[0004] For example, in patent publication number CN118054957B, the patent name is "A computer network security analysis system based on security signal matching", which is based on real-time status monitoring on a visual operation and maintenance platform, including a security signal matching system, a network security analysis system and a central processing server. The security signal matching system uses a digital processing method to achieve collaborative management of network security events, and is composed of a feature matching module, a data exchange control unit and a register. The system of the present invention is based on security signal matching, which includes an intrusion detection system and an access detection system. Through data collection, analysis and response, it uses a security system mechanism to scan each data stream to achieve the purpose of monitoring and intrusion prevention. The disadvantage is that it cannot reflect changes in the network environment in real time, and cannot dynamically correlate and analyze attack behaviors at different stages. Summary of the invention

[0005] In view of the problem that the network forensics and analysis systems in the prior art cannot reflect the changes in the network environment in real time and cannot dynamically correlate and analyze the attack behaviors at different stages, the present invention provides an intelligent forensics and analysis system for the network attack process, which can reflect the changes in the network environment in real time, dynamically correlate and analyze the attack behaviors at different stages, completely cover the entire network attack process, and make full use of various types of data for forensics and analysis, thereby improving the efficiency and accuracy of network security protection.

[0006] In order to achieve the above technical objectives, the present invention provides a technical solution, which is a network attack process intelligent evidence collection and analysis system, comprising: Data collection module, used for real-time collection of data in the network environment; The graph entity relationship model construction module is used to build a graph entity relationship model based on the collected data and dynamically update the model configuration; Intelligent forensics module, which is used to use the graph entity relationship model to perform intelligent forensics on the collected data, extract key information of attack behaviors, and build a network kill chain; The real-time analysis module is used to perform real-time analysis of network attack behaviors based on the constructed graph entity relationship model and intelligent forensics results, and identify attack stages, attack paths, and attack targets.

[0007] In this technical solution, the system continuously captures various types of data in the network environment through the data acquisition module to ensure that the latest changes in the network status can be reflected immediately. With the help of the graph entity relationship model construction module, the system not only builds a complex network relationship diagram based on real-time data, but also dynamically adjusts the model configuration as the network environment evolves to ensure the timeliness and accuracy of the analysis model. The intelligent forensics module uses graph analysis technology to extract key information about attack behaviors from massive data and construct a network kill chain, which not only covers every subtle link of the attack, but also realizes the intelligent association of attack behaviors at different stages, providing strong support for tracing the source of the attack and understanding the attack methods. The real-time analysis module conducts in-depth analysis of network attack behaviors based on the constructed graph entity relationship model and intelligent forensics results, and can quickly identify the stage of the attack, track the attack path, and lock the attack target, so as to achieve comprehensive coverage and precise control of the network attack process.

[0008] The present invention is further configured as follows: the graph entity relationship model building module includes: Perform pre-processing operations such as cleaning, deduplication, and format unification on the collected raw data; According to machine learning methods, uniquely identified entities are identified from the preprocessed data; Assign types and data fields to identified entities; Automatically generate relationship names based on risk events identified in risk data and establish associations between entities; According to the graph database method, the identified entities and defined relationships are stored as a graph structure to form an entity relationship model.

[0009] In this technical solution, the graph entity relationship model construction module first strictly cleans, removes duplicates and unifies the format of the collected raw data, effectively eliminates redundant and erroneous information, lays a data foundation for subsequent entity recognition, and ensures the accuracy of the analysis results. With the help of advanced machine learning methods, the module can intelligently identify entities with unique identifiers from the preprocessed data. Whether it is network equipment, user accounts or security events, they can be accurately captured one by one, providing core elements for building graphs. Appropriate types and data fields are assigned to each identified entity, such as IP addresses, user names, and event types, so as to build a clear-structured and information-rich entity classification system, which facilitates subsequent relationship establishment and analysis. The module can intelligently identify key events in risk data, and automatically generate relationship names based on these events to establish associations between entities. This dynamic relationship generation mechanism ensures that the graph can reflect the complex relationship network in the network environment in real time, providing strong support for the tracking and analysis of attack behaviors. Finally, using the graph database method, the module stores the identified entities and defined relationships as a graph structure, forming an intuitive and easy-to-analyze entity relationship model, which is not only convenient for visual display, but also can support complex query and analysis operations, providing strong decision-making support for network security protection.

[0010] The present invention is further configured as follows: the intelligent evidence collection module comprises: Identify abnormal behaviors and potential attack activities in the network based on the entities and relationships in the graph entity-relationship model; Analyze the associations and risk events between entities and identify the characteristics of attack behaviors; Extract key information from the identified attack behavior, including the attack source IP, attack target IP, attack time, attack type, and malicious tools used; Based on the graph entity relationship model, locate all entities and relationships related to the attack behavior; Construct a network kill chain by arranging the key information in the logical and chronological order of the attack behavior; The constructed network kill chain and extracted key information are used as intelligent forensics.

[0011] In this technical solution, the intelligent forensics module relies on the graph entity relationship model to monitor and analyze entities and relationships in the network in real time, and keenly identify any abnormal behavior or potential attack activities, laying a solid foundation for timely response and defense. Through in-depth analysis of the complex association relationships and risk events between entities, the module can extract the unique characteristics of the attack behavior. In the identified attack behavior, the module can quickly and accurately extract key information, including the attack source IP, the attack target IP, the precise attack time, the attack type, and the malicious tools used, providing detailed materials for subsequent forensics and analysis. With the powerful association ability of the graph entity relationship model, the module can locate all entities and relationships related to the attack behavior, whether direct participants or indirect associates, can be revealed one by one to ensure the integrity of the attack chain. Based on the extracted key information, the module carefully constructs a network kill chain in accordance with the logical order and time sequence of the attack behavior. This chain not only clearly shows the entire process of the attack, but also reveals the attacker's strategy and intention, providing an important reference for the formulation of defense strategies. Ultimately, the module integrates the constructed network kill chain and extracted key information into intelligent forensic materials, providing the network security team with comprehensive, accurate, and easy-to-understand attack analysis reports, greatly improving response speed and defense efficiency.

[0012] The present invention is further configured as follows: the real-time analysis module comprises: Analyze the temporal characteristics of attack behaviors by using the timestamp information and the relationship between entities in the graph entity relationship model; According to the characteristics and patterns of attack behaviors, the attack process is divided into different stages; Through machine learning algorithms, the stage to which each attack behavior belongs is automatically identified, and the status information of the entities in the graph is updated; Using the graph traversal function, we start from the attack source entity and follow the relationship chain between entities to gradually trace the attack propagation path. Analyze entities and events on each relationship node to determine how attackers exploit vulnerabilities, spread malware, and gain permissions; Analyze the attributes and relationships of entities in the graph to identify the attacker’s ultimate goal; Monitor new data and events in the network environment in real time, and dynamically update the graph entity relationship model and intelligent forensics results.

[0013] In this technical solution, the real-time analysis module makes full use of the timestamp information and the intricate relationships between entities in the graph entity relationship model to deeply analyze the temporal characteristics of the attack behavior, which not only makes the occurrence, development and evolution of the attack clear at a glance, but also provides strong support for accurately locating the key nodes of the attack. Based on a deep understanding of the characteristics and patterns of attack behavior, the module can intelligently subdivide the entire attack process into several stages, which helps to more clearly understand the various components of the attack and lay a solid foundation for subsequent analysis and defense strategy formulation. With the help of advanced machine learning algorithms, the module can automatically identify the stage to which each attack behavior belongs and update the status information of the entities in the graph in real time, which not only greatly improves the analysis efficiency, but also ensures the accuracy and timeliness of the analysis results. Using the powerful traversal function of the graph, the module can start from the attack source entity and follow the relationship chain between entities to track the propagation path of the attack step by step. It can not only intuitively see how the attack spreads in the network, but also provide key clues for tracing the source of the attack and blocking the propagation link. At each relationship node, the module will deeply analyze entities and events to reveal how attackers exploit vulnerabilities, spread malware, and obtain system permissions. Through comprehensive analysis of entity attributes and relationships in the graph, the module can accurately identify the attacker's ultimate goal, which is of great significance for assessing the degree of harm caused by the attack and formulating targeted defense measures.

[0014] The present invention is further configured as follows: the data collected by the data collection module includes network flow data, security device log data and asset vulnerability data.

[0015] In this technical solution, the data collection module can comprehensively and accurately collect a variety of key data. These data include network traffic data, which is used to monitor and analyze data transmission in the network; security device log data, which records the working status of security devices and detected security events; and asset vulnerability data, which reveals the security vulnerabilities and risk points of various assets in the network.

[0016] The present invention is further configured as follows: the graph entity relationship model construction module includes a data extraction configuration and an entity relationship configuration, which are used to define entities and relationships and dynamically update the model configuration.

[0017] In this technical solution, the graph entity relationship model not only includes data extraction configuration functions, which can efficiently extract key information, but also has the ability to configure entity relationships, allowing users or systems to customize entities and complex relationships between them. Even better, this module also supports dynamic updates of model configurations, which means that as the network environment and attack methods change, users can flexibly adjust the definitions of entities and relationships to ensure that the model can always accurately reflect the current network security situation.

[0018] The present invention is further configured as follows: the data extraction configuration includes data types and data screening conditions, the data types include risk data output by the policy model, as well as security equipment logs and asset vulnerability data, the data screening conditions are to use the fields in the data for any free combination screening, and configure the historical data range at the same time.

[0019] In this technical solution, the graph entity relationship model building module of the intelligent forensics and analysis system for network attack processes has a high degree of flexibility and refinement in its data extraction configuration function. This configuration not only covers a wide range of data types, including risk data output by policy models, security equipment logs, and asset vulnerability data, ensuring the comprehensiveness and diversity of data sources; but also provides a powerful data filtering condition setting function. Users can freely combine and use various fields in the data for filtering according to actual needs, whether it is simple conditional filtering or complex logical combination, it can be easily achieved. At the same time, the system also supports the configuration of the query range of historical data, allowing users to flexibly trace back past data.

[0020] The present invention is further configured as follows: the entity relationship configuration includes entity definition and relationship definition, the entity definition includes entity type and data field to identify a unique entity, the entity type includes common, attribute, merge and extension, the relationship definition includes a dynamic method using the risk identified in the risk data as the relationship name and a static method using the relationship name pre-configured manually.

[0021] In this technical solution, the graph entity relationship model building module of the intelligent forensics and analysis system for network attack processes has demonstrated flexibility and depth in its entity relationship configuration function. In terms of entity definition, the system not only allows users to specify the data type and data field of the entity to ensure the uniqueness and identifiability of each entity in the model, but also provides a variety of entity type options, including ordinary entities, attribute entities, merged entities, and extended entities, meeting the needs of entity complexity in different scenarios. It supports a dynamic way of using risks identified in risk data as relationship names. As risk data is updated in real time, the relationships in the model will be adjusted accordingly, keeping the model in close synchronization with the actual situation.

[0022] The present invention is further configured as follows: the entity allocation types include common entities, attribute entities, merged entities and extended entities.

[0023] In this technical solution, the design of entity allocation types demonstrates a high degree of meticulousness and professionalism. The system not only supports common entity allocation, but also introduces multiple types such as attribute entities, merged entities, and extended entities. It not only enriches the entity's expression form, enabling the system to more accurately describe and characterize the various elements and relationships in the cyber attack process, but also improves the system's flexibility and scalability, providing a more comprehensive and accurate data foundation for subsequent intelligent forensics and in-depth analysis.

[0024] The present invention is further configured as follows: the system also includes: a visualization display module, which is used to visualize the results of intelligent forensics and real-time analysis.

[0025] In this technical solution, the visualization display module can not only present the results of intelligent forensics and real-time analysis in an intuitive and easy-to-understand graphical manner, allowing users to grasp the entire process of network attacks and their key details; but also, through the dynamically updated visualization interface, users can also track the progress of analysis in real time, and promptly discover and respond to potential security threats.

[0026] The beneficial effects of the present invention are as follows: (1) It can reflect the changes in the network environment in real time, dynamically correlate and analyze the attack behaviors at different stages, completely cover the entire network attack process, and make full use of various types of data for evidence collection and analysis, thereby improving the efficiency and accuracy of network security protection; (2) With the help of the graph entity relationship model construction module, the system can not only construct a complex network relationship diagram based on real-time data, but also dynamically adjust the model configuration as the network environment evolves, thereby ensuring the timeliness and accuracy of the analysis model. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 The figure is a flow chart of the network attack process intelligent evidence collection and analysis system of the present invention. DETAILED DESCRIPTION

[0028] In order to make the objectives, technical solutions and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific implementation method described herein is only an optimal embodiment of the present invention, which is only used to explain the present invention and does not limit the scope of protection of the present invention. All other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0029] like Figure 1 As shown, as a first embodiment of the present invention, a network attack process intelligent evidence collection and analysis system includes: Data collection module, used for real-time collection of data in the network environment; The graph entity relationship model construction module is used to build a graph entity relationship model based on the collected data and dynamically update the model configuration; Intelligent forensics module, which is used to use the graph entity relationship model to perform intelligent forensics on the collected data, extract key information of attack behaviors, and build a network kill chain; The real-time analysis module is used to perform real-time analysis of network attack behaviors based on the constructed graph entity relationship model and intelligent forensics results, and identify attack stages, attack paths, and attack targets.

[0030] The system continuously captures various types of data in the network environment through the data acquisition module to ensure that the latest changes in the network status can be reflected immediately. With the help of the graph entity relationship model construction module, the system not only builds a complex network relationship diagram based on real-time data, but also dynamically adjusts the model configuration as the network environment evolves to ensure the timeliness and accuracy of the analysis model. The intelligent forensics module uses graph analysis technology to extract key information about attack behaviors from massive data and build a network kill chain, which not only covers every subtle link of the attack, but also realizes the intelligent association of attack behaviors at different stages, providing strong support for tracing the source of the attack and understanding the attack methods. The real-time analysis module conducts in-depth analysis of network attack behaviors based on the constructed graph entity relationship model and intelligent forensics results, and can quickly identify the stage of the attack, track the attack path, and lock the attack target, achieving comprehensive coverage and precise control of the network attack process.

[0031] The graph entity relationship model building module includes: Perform pre-processing operations such as cleaning, deduplication, and format unification on the collected raw data; According to machine learning methods, uniquely identified entities are identified from the preprocessed data; Assign types and data fields to identified entities; Automatically generate relationship names based on risk events identified in risk data and establish associations between entities; According to the graph database method, the identified entities and defined relationships are stored as a graph structure to form an entity relationship model.

[0032] The graph entity relationship model construction module first strictly cleans, removes duplicates and unifies the format of the collected raw data, effectively eliminating redundant and erroneous information, laying a data foundation for subsequent entity recognition and ensuring the accuracy of the analysis results. With the help of advanced machine learning methods, the module can intelligently identify entities with unique identifiers from the preprocessed data. Whether it is network equipment, user accounts or security events, they can be accurately captured one by one, providing core elements for building graphs. Appropriate types and data fields are assigned to each identified entity, such as IP addresses, user names, and event types, so as to build a clear-structured and information-rich entity classification system, which facilitates subsequent relationship establishment and analysis. The module can intelligently identify key events in risk data, and automatically generate relationship names based on these events to establish associations between entities. This dynamic relationship generation mechanism ensures that the graph can reflect the complex relationship network in the network environment in real time, providing strong support for the tracking and analysis of attack behaviors. Finally, using the graph database method, the module stores the identified entities and defined relationships as a graph structure, forming an intuitive and easy-to-analyze entity relationship model, which is not only convenient for visual display, but also can support complex query and analysis operations, providing strong decision-making support for network security protection.

[0033] As can be understood, through machine learning algorithms, the system automatically identifies entities with unique identifiers from preprocessed data, trains models to identify abnormal behaviors in the network, and once abnormal behaviors are detected, uses machine learning algorithms to further analyze behavioral characteristics. Machine learning algorithms automatically divide the attack process into different stages based on the characteristics and patterns of the attack behaviors.

[0034] It can be understood that in a graph database, entities and relationships are stored in the form of a graph structure. The graph database can also store attribute information related to entities and relationships. The graph database provides a rich query language and tools to support efficient graph query operations. In addition to basic query operations, the graph database also supports complex query requirements. The graph database supports real-time update operations and can update the graph entity relationship model in time when the network environment changes. The graph database also provides version management functions to record and track historical changes of the graph entity relationship model.

[0035] The intelligent evidence collection module includes: Identify abnormal behaviors and potential attack activities in the network based on the entities and relationships in the graph entity-relationship model; Analyze the associations and risk events between entities and identify the characteristics of attack behaviors; Extract key information from the identified attack behavior, including the attack source IP, attack target IP, attack time, attack type, and malicious tools used; Based on the graph entity relationship model, locate all entities and relationships related to the attack behavior; Construct a network kill chain by arranging the key information in the logical and chronological order of the attack behavior; The constructed network kill chain and extracted key information are used as intelligent forensics.

[0036] Relying on the graph entity relationship model, the intelligent forensics module can monitor and analyze entities and relationships in the network in real time, keenly identify any abnormal behavior or potential attack activities, and lay a solid foundation for timely response and defense. Through in-depth analysis of the complex associations and risk events between entities, the module can extract the unique characteristics of attack behaviors. In the identified attack behaviors, the module can quickly and accurately extract key information, including the attack source IP, attack target IP, precise attack time, attack type, and malicious tools used, providing detailed materials for subsequent forensics and analysis. With the powerful association ability of the graph entity relationship model, the module can locate all entities and relationships related to the attack behavior, whether direct participants or indirect associates, and can be revealed one by one to ensure the integrity of the attack chain. Based on the extracted key information, the module carefully constructs a network kill chain in the logical order and time sequence of the attack behavior. This chain not only clearly shows the entire process of the attack, but also reveals the attacker's strategy and intention, providing an important reference for the formulation of defense strategies. Ultimately, the module integrates the constructed network kill chain and extracted key information into intelligent forensic materials, providing the network security team with comprehensive, accurate, and easy-to-understand attack analysis reports, greatly improving response speed and defense efficiency.

[0037] The real-time analysis module comprises: Analyze the temporal characteristics of attack behaviors by using the timestamp information and the relationship between entities in the graph entity relationship model; According to the characteristics and patterns of attack behaviors, the attack process is divided into different stages; Through machine learning algorithms, the stage to which each attack behavior belongs is automatically identified, and the status information of the entities in the graph is updated; Using the graph traversal function, we start from the attack source entity and follow the relationship chain between entities to gradually trace the attack propagation path. Analyze entities and events on each relationship node to determine how attackers exploit vulnerabilities, spread malware, and gain permissions; Analyze the attributes and relationships of entities in the graph to identify the attacker’s ultimate goal; Monitor new data and events in the network environment in real time, and dynamically update the graph entity relationship model and intelligent forensics results.

[0038] The real-time analysis module makes full use of the timestamp information and the intricate relationships between entities in the graph entity-relationship model to deeply analyze the temporal characteristics of the attack behavior, which not only makes the occurrence, development and evolution of the attack clear at a glance, but also provides strong support for accurately locating the key nodes of the attack. Based on a deep understanding of the characteristics and patterns of attack behavior, the module can intelligently subdivide the entire attack process into several stages, which helps to more clearly understand the various components of the attack and lay a solid foundation for subsequent analysis and defense strategy formulation. With the help of advanced machine learning algorithms, the module can automatically identify the stage to which each attack behavior belongs and update the status information of the entities in the graph in real time, which not only greatly improves the analysis efficiency, but also ensures the accuracy and timeliness of the analysis results. Using the powerful traversal function of the graph, the module can start from the attack source entity and follow the relationship chain between entities to track the propagation path of the attack step by step. It can not only intuitively see how the attack spreads in the network, but also provide key clues for tracing the source of the attack and blocking the propagation link. At each relationship node, the module will deeply analyze entities and events to reveal how attackers exploit vulnerabilities, spread malware, and obtain system permissions. Through comprehensive analysis of entity attributes and relationships in the graph, the module can accurately identify the attacker's ultimate goal, which is of great significance for assessing the degree of harm caused by the attack and formulating targeted defense measures.

[0039] The data collected by the data collection module includes network traffic data, security device log data and asset vulnerability data. The data collection module can comprehensively and accurately collect a variety of key data. These data cover network traffic data, which is used to monitor and analyze data transmission in the network; security device log data, which records the working status of security devices and detected security events; and asset vulnerability data, which reveals the security vulnerabilities and risk points of various assets in the network.

[0040] The graph entity relationship model building module includes data extraction configuration and entity relationship configuration, which are used to define entities and relationships and dynamically update the model configuration. The graph entity relationship model not only includes the data extraction configuration function, which can efficiently extract key information, but also has the ability to configure entity relationships, allowing users or systems to customize entities and the complex relationships between them. Even more outstanding is that this module also supports dynamic updating of model configuration, which means that as the network environment and attack methods change, users can flexibly adjust the definition of entities and relationships to ensure that the model can always accurately reflect the current network security situation.

[0041] The data extraction configuration includes data types and data screening conditions. The data types include risk data output by the policy model, security equipment logs, and asset vulnerability data. The data screening conditions are to use the fields in the data for any free combination screening, and configure the historical data range at the same time. The graph entity relationship model construction module of the network attack process intelligent forensics and analysis system has a high degree of flexibility and refinement in its data extraction configuration function. This configuration not only covers a wide range of data types, including risk data output by the policy model, security equipment logs, and asset vulnerability data, ensuring the comprehensiveness and diversity of data sources; but also provides a powerful data screening condition setting function. Users can freely combine and use various fields in the data for screening according to actual needs, whether it is simple conditional filtering or complex logical combination, it can be easily achieved. At the same time, the system also supports the configuration of the query range of historical data, allowing users to flexibly trace back past data.

[0042] The entity relationship configuration includes entity definition and relationship definition. The entity definition includes entity type and data field to identify a unique entity. The entity type includes common, attribute, merge and extension. The relationship definition includes a dynamic method using the risk identified in the risk data as the relationship name and a static method using the relationship name pre-configured manually. The graph entity relationship model construction module of the intelligent forensics and analysis system for network attack processes has shown flexibility and depth in its entity relationship configuration function. In terms of entity definition, the system not only allows users to specify the data type and data field of the entity to ensure the uniqueness and identifiability of each entity in the model, but also provides a variety of entity type options, including common entities, attribute entities, merged entities and extended entities, meeting the requirements for entity complexity in different scenarios. It supports a dynamic method using the risk identified in the risk data as the relationship name. As the risk data is updated in real time, the relationship in the model will be adjusted accordingly, keeping the model in close synchronization with the actual situation.

[0043] The entity allocation types include common entities, attribute entities, merged entities, and extended entities. The design of entity allocation types demonstrates a high degree of meticulousness and professionalism. The system not only supports common entity allocation, but also introduces multiple types such as attribute entities, merged entities, and extended entities. It not only enriches the entity's expression form, enabling the system to more accurately describe and characterize the various elements and relationships in the cyber attack process, but also improves the system's flexibility and scalability, providing a more comprehensive and accurate data foundation for subsequent intelligent forensics and in-depth analysis.

[0044] The system also includes a visualization module for visualizing the results of intelligent forensics and real-time analysis. The visualization module can not only present the results of intelligent forensics and real-time analysis in an intuitive and easy-to-understand graphical manner, allowing users to grasp the entire process of network attacks and their key details; but also, through a dynamically updated visualization interface, users can track the progress of analysis in real time, and promptly discover and respond to potential security threats.

[0045] The specific description of the present invention in the above embodiments is only used to further illustrate the present invention and cannot be understood as limiting the scope of protection of the present invention. Technical engineers in this field may make some non-essential improvements and adjustments to the present invention based on the contents of the above invention, which fall within the scope of protection of the present invention.

Claims

1. A network attack process intelligent evidence collection and analysis system, characterized in that: include: Data collection module, used for real-time collection of data in the network environment; The graph entity relationship model construction module is used to build a graph entity relationship model based on the collected data and dynamically update the model configuration; Intelligent forensics module, which is used to use the graph entity relationship model to perform intelligent forensics on the collected data, extract key information of the attack behavior, and build a network kill chain; The real-time analysis module is used to perform real-time analysis of network attack behaviors based on the constructed graph entity relationship model and intelligent forensics results, and identify attack stages, attack paths, and attack targets.

2. According to claim 1, a network attack process intelligent evidence collection and analysis system is characterized in that: The graph entity relationship model building module includes: Perform pre-processing operations such as cleaning, deduplication, and format unification on the collected raw data; According to machine learning methods, uniquely identified entities are identified from the preprocessed data; Assign types and data fields to identified entities; Automatically generate relationship names based on risk events identified in risk data and establish associations between entities; According to the graph database method, the identified entities and defined relationships are stored as a graph structure to form an entity relationship model.

3. According to claim 1, the intelligent evidence collection and analysis system for network attack process is characterized in that: The intelligent evidence collection module includes: Identify abnormal behaviors and potential attack activities in the network based on the entities and relationships in the graph entity-relationship model; Analyze the associations and risk events between entities and identify the characteristics of attack behaviors; Extract key information from the identified attack behavior, including the attack source IP, attack target IP, attack time, attack type, and malicious tools used; Based on the graph entity relationship model, locate all entities and relationships related to the attack behavior; Construct a network kill chain by arranging the key information in the logical and chronological order of the attack behavior; The constructed network kill chain and extracted key information are used as intelligent forensics.

4. According to claim 1, the intelligent evidence collection and analysis system for network attack process is characterized in that: The real-time analysis module comprises: Analyze the temporal characteristics of attack behaviors by using the timestamp information and the relationship between entities in the graph entity relationship model; According to the characteristics and patterns of attack behaviors, the attack process is divided into different stages; Through machine learning algorithms, the stage to which each attack behavior belongs is automatically identified, and the status information of the entities in the graph is updated; Using the graph traversal function, we start from the attack source entity and follow the relationship chain between entities to gradually trace the attack propagation path. Analyze entities and events on each relationship node to determine how attackers exploit vulnerabilities, spread malware, and gain permissions; Analyze the attributes and relationships of entities in the graph to identify the attacker’s ultimate goal; Monitor new data and events in the network environment in real time, and dynamically update the graph entity relationship model and intelligent forensics results.

5. A network attack process intelligent evidence collection and analysis system according to claim 1, 2, 3 or 4, characterized in that: The data collected by the data collection module includes network flow data, security device log data and asset vulnerability data.

6. According to claim 5, a network attack process intelligent evidence collection and analysis system is characterized in that: The graph entity relationship model building module includes data extraction configuration and entity relationship configuration, which are used to define entities and relationships and dynamically update the model configuration.

7. The network attack process intelligent evidence collection and analysis system according to claim 6 is characterized in that: The data extraction configuration includes data types and data screening conditions. The data types include risk data output by the policy model, as well as security device logs and asset vulnerability data. The data screening conditions use the fields in the data to perform any free combination screening and configure the historical data range.

8. The network attack process intelligent evidence collection and analysis system according to claim 7 is characterized in that: The entity relationship configuration includes entity definition and relationship definition. The entity definition includes entity type and data field to identify a unique entity. The entity types include common, attribute, merge and extension. The relationship definition includes a dynamic method using the risks identified in the risk data as the relationship name and a static method using the relationship name pre-configured manually.

9. The network attack process intelligent evidence collection and analysis system according to claim 2 is characterized in that: The entity allocation types include common entity, attribute entity, merged entity and extended entity.

10. The network attack process intelligent evidence collection and analysis system according to claim 1 is characterized in that: The system also includes: a visualization display module, which is used to visualize the results of intelligent forensics and real-time analysis.

Images