Power industry network security collaborative defense system based on threat hunting technology

Abstract

The invention discloses a power industry network security collaborative defense system based on a threat hunting technology, and particularly relates to the technical field of network security defense, and constructs a threat intelligence defense model comprising a threat intelligence sharing platform, a multi-layer defense architecture building unit, a network attack behavior analysis unit and a risk visual display unit. Security log information in a power system is collected and analyzed in real time, potential network security threats are found in time, and early warning is automatically given out. Acquiring network security threat information by building a threat intelligence sharing platform and a multi-layer defense architecture building unit; therefore, rich intelligence resources are provided for the risk visualization display unit, the risk visualization display unit can identify and analyze potential threats more accurately, quick response and effective disposal of the threats are achieved by establishing a linkage response mechanism among the hierarchies, and the risk visualization display unit is more efficient. The problem that in the prior art, a power industry network security cooperative defense system cannot provide perfect network security threat information is solved.

Description

Technical Field

[0001] The present invention relates to the field of network security defense technology, and more specifically, to a power industry network security collaborative defense system based on threat hunting technology. Background Art

[0002] Threat hunting refers to the process of actively and continuously searching the network for threats that can bypass security detection or cause harm with the help of threat data, analysis technology and expert experience. It is a continuous, closed-loop active defense technology.

[0003] There are two main technologies for threat hunting, namely forensics and analysis. Forensics refers to the use of existing tools and technologies to collect traces left by attackers in preparation for the subsequent threat identification. Analysis refers to the method used to analyze and detect threat traces to identify threats. According to the different objects of forensics, analysis technologies can be divided into two categories, namely log analysis technology and network analysis technology. Log analysis technology refers to obtaining event logs such as application logs and system logs of devices or systems, and then sending them to threat detection models for identification to determine whether an intrusion has occurred. Network analysis technology refers to using traffic collection tools to obtain network traffic data packets, and then determine whether the traffic is abnormal, and then identify possible threats.

[0004] However, it still has many shortcomings in actual use. For example, the existing power industry network security collaborative defense system cannot combine forensic technology and analysis technology to provide complete network security threat information. Summary of the invention

[0005] In order to overcome the above-mentioned defects of the prior art, the present invention provides a power industry network security collaborative defense system based on threat hunting technology to solve the problems raised in the above-mentioned background technology.

[0006] To achieve the above objectives, the present invention provides the following technical solutions: A network security collaborative defense system for the power industry based on threat hunting technology, comprising:

[0007] A threat intelligence defense model is used to collect and analyze security log information in the power system in real time, timely discover potential network security threats, and automatically issue warnings; the threat intelligence defense model includes a threat intelligence sharing platform, a multi-layer defense architecture building unit, a network attack behavior analysis unit, and a risk visualization display unit;

[0008] Threat intelligence sharing platform, used to collect, organize, analyze and share cybersecurity threat intelligence within the power industry, and to achieve rapid transmission and sharing of intelligence;

[0009] A multi-layer defense architecture building unit is used to build a multi-layer defense layer including the perception layer, network layer and application layer. Each layer has corresponding security protection measures and can respond quickly when a threat is detected;

[0010] The network attack behavior analysis unit is used to obtain network security threat information, including network attack behavior, attack technology, attacker identity, attack intention and attack path; based on the threat intelligence sharing platform and multi-layer defense architecture, network attack behavior, attack technology and attacker identity are obtained; the ATT&CK framework is used to analyze network attack behavior and attack technology text information, and output attack intention and attack path;

[0011] The risk visualization display unit is used to display network security threat information to the outside world. The risk visualization display unit maintains a close collaborative working relationship with the threat intelligence sharing platform, the multi-layer defense architecture building unit, and the network attack behavior analysis unit.

[0012] Preferably, a linkage response mechanism is established between the perception layer, network layer and application layer. If a potential threat is found, a rapid response mechanism is immediately activated to isolate, trace and deal with the threat to prevent its further spread, and the network attack behavior is recorded.

[0013] Preferably, the process of obtaining network attack behaviors, attack techniques, and attacker identities based on the threat intelligence sharing platform and multi-layer defense architecture includes the following steps:

[0014] Step S11: Join the threat intelligence sharing platform within the power industry to obtain the latest threat intelligence and attack technology information;

[0015] Step S12: Browse the latest network security threat intelligence in the intelligence library of the platform, use the keyword search function, enter keywords related to network attack behaviors and attack technologies, and obtain relevant intelligence information; conduct a detailed analysis of the acquired intelligence information to understand the characteristics of the attack behaviors, the principles of the attack technologies, and the scope of influence; record the analysis results in text form for subsequent use;

[0016] Step S13, collecting security log information at each level in the multi-layer defense architecture; analyzing the collected security log information to extract key information related to network attack behaviors and attack techniques; using correlation analysis technology to correlate security log information from different sources to build a complete attack chain; identifying network attack behaviors, attack techniques, and attacker identities based on log analysis and correlation results, and recording the identification results in text form;

[0017] Step S14: Integrate the network attack behaviors, attack techniques, and attacker identities obtained from the threat intelligence sharing platform and the multi-layer defense architecture; output text information related to the network attack behaviors and attack techniques, and share the integrated intelligence information with other members or organizations in the power industry to achieve intelligence sharing and collaborative defense.

[0018] Preferably, the attack intention includes but is not limited to data theft, system destruction, and extortion; the attack path refers to a series of steps and stages that the attacker goes through from launching the attack to achieving its goal; the attack path is divided into multiple attack stages, each attack stage corresponds to different actions and strategies of the attacker; the attack stages include but are not limited to initial access, malicious execution, persistent changes, privilege escalation, and defense bypass.

[0019] Preferably, the attack intention and attack path are obtained in the following manner:

[0020] Obtain attack technology text information and use natural language processing technology to perform semantic analysis on the attack technology text, thereby capturing the contextual information in the text, accurately understanding the meaning and contextual relationship of the attack technology, and matching it to the attack stage in the ATT&CK framework;

[0021] Combined with the description of this attack phase in the ATT&CK framework, infer the attacker's intentions, analyze the keywords and phrases in the attack technical text, and confirm the attacker's goals and motivations; connect the attack phases in chronological order to obtain the attack path.

[0022] Preferably, the power industry network security collaborative defense system based on threat hunting technology also includes

[0023] Collaborative defense performance analysis module, used to test the collaborative defense performance of the threat intelligence defense model and output the collaborative defense performance index XF;

[0024] The attacker hazard analysis module analyzes the attacker information, uses the product of threat weight and attack intensity to represent the attacker's hazard coefficient, predicts the attacker's appearance probability, inputs the appearance probability and hazard coefficient into the attacker risk analysis model, and outputs the attacker's risk coefficient Gf;

[0025] The network attack behavior real-time monitoring module is used to monitor and analyze network attack behaviors in real time and output the network attack behavior aggregation degree Yx;

[0026] The network security assessment module jointly analyzes the collaborative defense performance index, attacker risk factor and network attack behavior aggregation, and after standardization, uses the formula Calculate and obtain the network security coefficient Text;

[0027] The early warning module sends out an early warning when the network security coefficient is lower than the threshold THa, and prompts to take measures, such as blocking the attack source and strengthening security protection.

[0028] Preferably, the collaborative defense performance index is obtained in the following manner:

[0029] Design test cases: Obtain existing security vulnerabilities based on security log information, and design test cases for each identified security vulnerability. The test cases include input data, expected output, execution steps, and evaluation criteria;

[0030] Build a test environment to test the threat intelligence defense model, execute test cases, record the number of threats detected by the threat intelligence defense model, the response time, record the intelligence sharing efficiency, and evaluate the intelligence quality coefficient, which is used to reflect the accuracy of the intelligence;

[0031] The ratio of the number of threats detected by the threat intelligence defense model to the number of threats that actually exist is recorded as the threat detection rate Tdr; the response time required from detecting a threat to taking defense measures is analyzed, and the average threat response time Trs is calculated; the product of the intelligence sharing efficiency and the intelligence quality coefficient is recorded as the intelligence sharing quality coefficient Sle;

[0032] After de-dimensionalizing and linearly normalizing the threat detection rate Tdr, average threat response time Trs, and intelligence sharing quality coefficient Sle, the formula The collaborative defense performance index XF is calculated.

[0033] Preferably, the attacker risk coefficient is obtained in the following manner:

[0034] By analyzing the homology of network attack behaviors, the number of attackers is obtained, denoted as m, and k is used to represent the sequential number of the attacker's identity;

[0035] The number of requests per second, the number of affected users, and the percentage of application performance degradation of the k-th attacker are denoted as PSqk, Uqk, and Dqk, respectively; PSq k × k ×D k Recorded as basic strength, the attack strength is calculated using the following formula:

[0036]

[0037] Among them, max_1 is the maximum value of the basic intensity;

[0038] The occurrence probability, harm coefficient, threat weight and attack intensity of the kth attacker are denoted as P k , W k 、wq k 、gqk ;

[0039] The attacker risk factor Gf is calculated by the following attacker risk analysis model:

[0040]

[0041] W k =wq k ×gq k

[0042] The threat weight ranges from 0 to 1 to reflect the potential threat level of attackers of different attack types.

[0043] Preferably, the network attack behavior concentration degree is obtained in the following manner:

[0044] Mark the timestamp of the network attack behavior in the security log information, sort the network attack behaviors according to the timestamp, set the number of network attack behaviors as n, use i, j to represent the sequence number of network attack behaviors, and i≠j, and calculate the network attack behavior aggregation degree Yx by the following formula:

[0045]

[0046] Among them, T ij is the time interval between the ith network attack behavior and the jth network attack behavior, T a is the average value of the time interval, T b is the preset value of the time interval; q i is the weight coefficient corresponding to the i-th network attack behavior, q j is the weight coefficient corresponding to the j-th network attack behavior; e -λtci is the attenuation function of the time when the ith network attack behavior occurs from the current time, λ is the attenuation coefficient, which is used to adjust the attenuation speed, and tci is the distance between the time when the ith network attack behavior occurs and the current time; e -λtcj is the attenuation function of the time when the j-th network attack behavior occurs from the current time, and tcj is the distance between the time when the j-th network attack behavior occurs and the current time.

[0047] Preferably, the weight coefficient corresponding to the network attack behavior is allocated based on the abnormal traffic size of the network attack behavior at each time point, and the formula is Calculate the weight coefficient corresponding to the i-th network attack behavior, L i is the abnormal traffic size of the i-th network attack behavior.

[0048] Technical effects and advantages of the present invention:

[0049] (1) The power industry network security collaborative defense system based on threat hunting technology provided by the present invention constructs a threat intelligence defense model including a threat intelligence sharing platform, a multi-layer defense architecture building unit, a network attack behavior analysis unit and a risk visualization display unit, collects and analyzes security log information in the power system in real time, promptly discovers potential network security threats, and automatically issues warnings; obtains network security threat information by building a threat intelligence sharing platform and a multi-layer defense architecture building unit; and further provides a rich intelligence resource for the risk visualization display unit, so that it can more accurately identify and analyze potential threats. By establishing a linkage response mechanism between various levels, a rapid response and effective disposal of threats are achieved, which solves the problem that the power industry network security collaborative defense system in the prior art cannot provide complete network security threat information. Through threat hunting technology, potential threats can be actively found and identified, which can significantly improve defense efficiency and reduce the frequency and losses of security incidents.

[0050] (2) The power industry network security collaborative defense system based on threat hunting technology provided by the present invention obtains a real-time network security coefficient through a collaborative defense performance analysis module, an attacker hazard analysis module, a network attack behavior implementation monitoring module, and a network security assessment module, and takes measures based on the network security coefficient. It provides an indicator for comprehensively evaluating the network security status for enterprises, so that enterprises can have a more comprehensive understanding of their own network security level. By regularly evaluating and improving the network security coefficient, enterprises can continuously improve their own network security protection capabilities, effectively solving the problem of being unable to quantify the evaluation of network security in the power industry.

[0051] (3) The power industry network security collaborative defense system based on threat hunting technology provided by the present invention tests the collaborative defense performance of the threat intelligence defense model through the collaborative defense performance analysis module, and outputs the collaborative defense performance index XF, which helps enterprises understand the effectiveness of the current defense system and thus carry out targeted optimization and upgrades; the attacker hazard analysis module analyzes the attacker information, calculates the attacker's hazard coefficient and predicts the probability of its occurrence, and then outputs the attacker's risk coefficient Gf, so that enterprises can more accurately understand the severity and possibility of potential threats; the network attack behavior implementation monitoring module monitors and analyzes network attack behaviors in real time, and outputs the network attack behavior aggregation degree Yx, which helps enterprises to promptly discover and respond to network attacks and prevent the attack behaviors from further spreading and causing greater damage. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 This is a structural block diagram of the threat intelligence defense model of the present invention.

[0053] Figure 2 This is a structural block diagram of the power industry network security collaborative defense system of the present invention. DETAILED DESCRIPTION

[0054] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. On the contrary, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0055] At the same time, it should be understood that for the convenience of description, the sizes of the various parts shown in the drawings are not drawn according to the actual proportional relationship.

[0056] The following description of at least one exemplary embodiment is merely illustrative in nature and is in no way intended to limit the present application, its application, or uses.

[0057] Technologies, methods, and equipment known to ordinary technicians in the relevant art may not be discussed in detail, but where appropriate, the technologies, methods, and equipment should be considered as part of the specification.

[0058] Example 1, see Figure 1 The threat intelligence defense model structure diagram is shown in FIG. 1 , and the embodiment of the present invention provides the following technical solutions:

[0059] The power industry network security collaborative defense system based on threat hunting technology includes:

[0060] A threat intelligence defense model is used to collect and analyze security log information in the power system in real time, timely discover potential network security threats, and automatically issue warnings; the threat intelligence defense model includes a threat intelligence sharing platform, a multi-layer defense architecture building unit, a network attack behavior analysis unit, and a risk visualization display unit;

[0061] Threat intelligence sharing platform, used to collect, organize, analyze and share cybersecurity threat intelligence within the power industry, and to achieve rapid transmission and sharing of intelligence;

[0062] Explanation: The threat intelligence sharing platform supports the import and export of multiple intelligence formats, facilitates the exchange of intelligence between different systems, and establishes a threat intelligence sharing platform to ensure that threat intelligence can be shared in real time among all participants in the industry so as to quickly respond to emerging threats;

[0063] The multi-layer defense architecture building unit is used to build a multi-layer defense hierarchy including the perception layer, network layer and application layer. Each layer has corresponding security protection measures and can respond quickly when a threat is detected. A linkage response mechanism is established between the layers. If a potential threat is found, the rapid response mechanism is immediately activated to isolate, trace and deal with the threat to prevent it from further spreading, and record network attack behaviors. Once a threat is detected at a certain layer, other layers are immediately notified for coordinated defense. For example, when the perception layer or network layer detects a potential threat, an alarm will be triggered immediately. The linkage response mechanism will record network attack behaviors for subsequent analysis and improvement of defense strategies.

[0064] The network attack behavior analysis unit is used to obtain network security threat information, including network attack behavior, attack technology, attacker identity, attack intention and attack path; based on the threat intelligence sharing platform and multi-layer defense architecture, network attack behavior, attack technology and attacker identity are obtained; the ATT&CK framework is used to analyze network attack behavior and attack technology text information, and output attack intention and attack path;

[0065] The risk visualization display unit is used to display network security threat information externally.

[0066] The risk visualization display unit maintains a close collaborative working relationship with the threat intelligence sharing platform, the multi-layer defense architecture construction unit, and the network attack behavior analysis unit.

[0067] What needs to be further explained in the embodiments of the present invention is that the perception layer is responsible for monitoring network traffic and network attack behaviors, and through sensors and monitoring devices deployed in the network, it captures the data flow in the network in real time, including network traffic, user behavior and system logs, and analyzes and filters the collected data, using preset rules, pattern matching or machine learning algorithms to analyze and filter, and then find abnormal traffic or behavior; once abnormal traffic or behavior is found, the perception layer will immediately issue an alarm, record the network traffic and network attack behavior in the security log and pass it to the network attack behavior analysis unit;

[0068] The network layer is responsible for the security protection of the network boundary. It prevents external attackers from entering the internal network by setting up security devices such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS). It also prevents the leakage of internal sensitive information, and records network abnormal information (such as unauthorized access attempts, malicious traffic, etc.) in the security log and transmits it to the network attack behavior analysis unit;

[0069] The application layer is responsible for protecting the power industry's applications from attacks and damage. Through the security protection of the application layer, it prevents business interruptions and data leakage caused by security vulnerabilities, and records application abnormal information (such as unauthorized access, data tampering, etc.) in the security log and transmits it to the network attack behavior analysis unit;

[0070] A linkage response mechanism is established between the perception layer, network layer and application layer. If a potential threat is discovered, the rapid response mechanism is immediately activated to isolate, trace and deal with the threat to prevent its further spread, and the network attack behavior is recorded.

[0071] It is necessary to further explain in the embodiment of the present invention that the process of obtaining network attack behaviors, attack techniques and attacker identities based on the threat intelligence sharing platform and the multi-layer defense architecture includes the following steps:

[0072] Step S11: Join the threat intelligence sharing platform within the power industry, such as an existing professional cybersecurity intelligence sharing community or organization, and register as a formal member of the platform to obtain the latest threat intelligence and attack technology information;

[0073] Step S12: Browse the latest network security threat intelligence in the intelligence library of the platform, use the keyword search function, enter keywords related to network attack behaviors and attack techniques, such as "DDoS attack" and "SQL injection", to obtain relevant intelligence information; conduct a detailed analysis of the obtained intelligence information to understand the characteristics of the attack behavior, the principles of the attack technology, and the scope of influence; record the analysis results in text form for subsequent use;

[0074] Step S13, collecting security log information at each layer (such as perception layer, network layer and application layer) in the multi-layer defense architecture; analyzing the collected security log information to extract key information related to network attack behavior and attack technology; using correlation analysis technology to associate security log information from different sources to build a complete attack chain; identifying network attack behavior, attack technology and attacker identity based on log analysis and correlation results, and recording the identification results in text form;

[0075] Step S14: Integrate the network attack behaviors, attack techniques, and attacker identities obtained from the threat intelligence sharing platform and the multi-layer defense architecture; remove duplicate information to ensure the accuracy and completeness of the intelligence; output text information related to network attack behaviors and attack techniques, and share the integrated intelligence information with other members or organizations in the power industry to achieve intelligence sharing and collaborative defense.

[0076] It needs to be further explained in the embodiments of the present invention that the attack intention includes but is not limited to data theft, system destruction, and extortion; the attack path refers to a series of steps and stages that the attacker goes through from launching the attack to achieving his goal; the attack path is divided into multiple attack stages, each attack stage corresponds to different actions and strategies of the attacker; the attack stages include but are not limited to initial access, malicious execution, persistent changes, privilege escalation, and defense bypass.

[0077] It needs to be further explained in the embodiment of the present invention that the attack intention and the attack path are obtained in the following manner:

[0078] Obtain attack technology text information and use natural language processing technology (such as the ALBERT-BiLSTM model) to perform semantic analysis on the attack technology text, thereby capturing the contextual information in the text, accurately understanding the meaning and contextual relationship of the attack technology, and matching it to the attack stage in the ATT&CK framework;

[0079] Combined with the description of this attack phase in the ATT&CK framework, the attacker's intentions are inferred, and the keywords and phrases in the attack technical text are analyzed to further confirm the attacker's goals and motivations; the attack phases are connected in chronological order to obtain the attack path.

[0080] Example 2, see Figure 2 The structural block diagram of the power industry network security collaborative defense system, the embodiment of the present invention provides the following technical solution, which is different from embodiment 1 in that it also includes

[0081] Collaborative defense performance analysis module, used to test the collaborative defense performance of the threat intelligence defense model and output the collaborative defense performance index XF;

[0082] The attacker hazard analysis module analyzes the attacker information, uses the product of threat weight and attack intensity to represent the attacker's hazard coefficient, predicts the attacker's appearance probability, inputs the appearance probability and hazard coefficient into the attacker risk analysis model, and outputs the attacker's risk coefficient Gf;

[0083] The network attack behavior real-time monitoring module is used to monitor and analyze network attack behaviors in real time and output the network attack behavior aggregation degree Yx;

[0084] The network security assessment module jointly analyzes the collaborative defense performance index, attacker risk factor and network attack behavior aggregation, and after standardization, uses the formula Calculate and obtain the network security coefficient Text;

[0085] Explanation: The input parameters XF, Gf, and Yx are standardized to ensure that they are at the same order of magnitude, thereby preventing certain parameters from having an excessive impact on the final result. The standardization is one of Z-score standardization and Min-Max standardization.

[0086] The early warning module sends out an early warning when the network security coefficient is lower than the threshold THa, and prompts to take measures, such as blocking the attack source and strengthening security protection.

[0087] It needs to be further explained in the embodiment of the present invention that the collaborative defense performance index is obtained in the following manner:

[0088] Design test cases: Obtain existing security vulnerabilities based on security log information, and design test cases for each identified security vulnerability. The test cases include input data, expected output, execution steps, and evaluation criteria;

[0089] Build a test environment to test the threat intelligence defense model, execute test cases, record the number of threats detected by the threat intelligence defense model, the response time, record the intelligence sharing efficiency, and evaluate the intelligence quality coefficient, which is used to reflect the accuracy of the intelligence;

[0090] The ratio of the number of threats detected by the threat intelligence defense model to the number of threats that actually exist is recorded as the threat detection rate Tdr; the response time required from detecting a threat to taking defense measures is analyzed, and the average threat response time Trs is calculated; the product of the intelligence sharing efficiency and the intelligence quality coefficient is recorded as the intelligence sharing quality coefficient Sle;

[0091] After de-dimensionalizing and linearly normalizing the threat detection rate Tdr, average threat response time Trs, and intelligence sharing quality coefficient Sle, the formula The collaborative defense performance index XF is calculated.

[0092] It needs to be further explained in the embodiment of the present invention that the attacker risk coefficient is obtained in the following manner:

[0093] By analyzing the homology of network attack behaviors, the number of attackers is obtained, denoted as m, and k is used to represent the sequential number of the attacker's identity;

[0094] The number of requests per second, the number of affected users, and the percentage of application performance degradation of the k-th attacker are denoted as PSqk, Uqk, and Dqk, respectively; PSq k × k ×D k Recorded as basic strength, the attack strength is calculated using the following formula:

[0095]

[0096] Among them, max_1 is the maximum value of the basic intensity;

[0097] The occurrence probability, harm coefficient, threat weight and attack intensity of the kth attacker are denoted as P k , W k 、wq k , gq k ;

[0098] The attacker risk factor Gf is calculated by the following attacker risk analysis model:

[0099]

[0100] W k =wq k ×gq k

[0101] The threat weight ranges from 0 to 1 to reflect the potential threat level of attackers of different attack types.

[0102] It needs to be further explained in the embodiment of the present invention that the method for obtaining the concentration degree of the network attack behavior is:

[0103] Mark the timestamp of the network attack behavior in the security log information, sort the network attack behaviors according to the timestamp, set the number of network attack behaviors as n, use i, j to represent the sequence number of network attack behaviors, and i≠j, and calculate the network attack behavior aggregation degree Yx by the following formula:

[0104]

[0105] Among them, T ij is the time interval between the ith network attack behavior and the jth network attack behavior, T a is the average value of the time interval, T b is the preset value of the time interval; q i is the weight coefficient corresponding to the i-th network attack behavior, q j is the weight coefficient corresponding to the j-th network attack behavior; e -λtci is the attenuation function of the time when the ith network attack behavior occurs from the current time, λ is the attenuation coefficient, which is used to adjust the attenuation speed, and tci is the distance between the time when the ith network attack behavior occurs and the current time; e -λtcj is the attenuation function of the time when the j-th network attack behavior occurs from the current time, and tcj is the distance between the time when the j-th network attack behavior occurs and the current time;

[0106] Explanation: It is used to measure the degree of deviation of the time interval relative to the average time interval and the preset time interval; the weight coefficients qi and qj can be set according to factors such as the type and severity of the attack behavior, the vulnerability of the target system, etc. The double summation traverses all possible attack behaviors to calculate the common contribution to the aggregation degree.

[0107] In a possible embodiment, the weight coefficient corresponding to the network attack behavior is allocated based on the abnormal traffic size of the network attack behavior at each time point, and the formula is used. Calculate the weight coefficient corresponding to the i-th network attack behavior, L i is the abnormal traffic size of the i-th network attack behavior.

[0108] Finally: The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present invention should be included in the protection scope of the present invention.

Claims

1. The power industry network security collaborative defense system based on threat hunting technology is characterized by: include: Threat intelligence defense model, which is used to collect and analyze security log information in the power system in real time, identify network security threats, and automatically issue warnings; The threat intelligence defense model includes a threat intelligence sharing platform, a multi-layer defense architecture building unit, a network attack behavior analysis unit and a risk visualization display unit; the threat intelligence sharing platform is used to collect, organize, analyze and share network security threat intelligence within the power industry; the multi-layer defense architecture building unit is used to build a multi-layer defense layer including a perception layer, a network layer and an application layer, and each layer has corresponding security protection measures; the network attack behavior analysis unit is used to obtain network security threat information; obtain network attack behavior, attack technology and attacker identity; use the ATT&CK framework to analyze network attack behavior and attack technology text information, and output attack intentions and attack paths; the risk visualization display unit is used to display network security threat information externally; The collaborative defense performance analysis module is used to test the collaborative defense performance of the threat intelligence defense model and output the collaborative defense performance index XF; after jointly analyzing the threat detection rate Tdr, the average threat response time Trs and the intelligence sharing quality coefficient Sle and performing dimensionless and linear normalization processing, the collaborative defense performance index XF is calculated by the formula The collaborative defense performance index XF is calculated; The attacker hazard analysis module analyzes the attacker information, uses the product of threat weight and attack intensity to represent the attacker's hazard coefficient, predicts the attacker's appearance probability, inputs the appearance probability and hazard coefficient into the attacker risk analysis model, and outputs the attacker's risk coefficient Gf; The network attack behavior real-time monitoring module is used to monitor and analyze network attack behaviors in real time and output the network attack behavior aggregation degree Yx; The network security assessment module jointly analyzes the collaborative defense performance index, attacker risk factor and network attack behavior aggregation, and after standardization, uses the formula Calculate and obtain the network security coefficient Text; The early warning module issues an early warning when the network security coefficient is lower than the threshold THa, and prompts to take measures; the measures include blocking the attack source and strengthening security protection.

2. The power industry network security collaborative defense system based on threat hunting technology according to claim 1 is characterized in that: A linkage response mechanism is established between the perception layer, network layer and application layer. If a threat is discovered, the threat will be isolated, traced and dealt with to prevent its further spread, and network attack behaviors will be recorded.

3. The power industry network security collaborative defense system based on threat hunting technology according to claim 1 is characterized in that: Based on the threat intelligence sharing platform and multi-layer defense architecture, the process of obtaining network attack behaviors, attack techniques, and attacker identities includes the following steps: Step S11: Join the threat intelligence sharing platform within the power industry to obtain the latest threat intelligence and attack technology information; Step S12: Browse the latest network security threat intelligence in the intelligence library of the platform, use the keyword search function, enter keywords related to network attack behaviors and attack techniques to obtain relevant intelligence information; analyze the obtained intelligence information, and record the analysis results in text form for subsequent use; Step S13: Collect security log information at each level in the multi-layer defense architecture, analyze the collected security log information, and extract key information related to network attack behaviors and attack techniques; Use correlation analysis technology to correlate security log information from different sources to build a complete attack chain; identify network attack behaviors, attack techniques, and attacker identities based on log analysis and correlation results, and record the identification results in text form; Step S14: Integrate the network attack behaviors, attack techniques, and attacker identities obtained from the threat intelligence sharing platform and the multi-layer defense architecture; output text information related to the network attack behaviors and attack techniques, and share the integrated intelligence information with other members or organizations in the power industry to achieve intelligence sharing and collaborative defense.

4. The power industry network security collaborative defense system based on threat hunting technology according to claim 3 is characterized in that: The attack path refers to a series of steps and stages that an attacker goes through from launching an attack to achieving his goal; the attack path is divided into multiple attack stages, each of which corresponds to different actions and strategies of the attacker.

5. The power industry network security collaborative defense system based on threat hunting technology according to claim 3 is characterized in that: The attack intention and attack path are obtained as follows: Obtain attack technology text information and use natural language processing technology to perform semantic analysis on the attack technology text to capture contextual information in the text, understand the meaning and contextual relationship of the attack technology, and match it to the attack stage in the ATT&CK framework; Combined with the description of this attack phase in the ATT&CK framework, infer the attacker's intentions, analyze the keywords and phrases in the attack technical text, and confirm the attacker's goals and motivations; connect the attack phases in chronological order to obtain the attack path.

6. The power industry network security collaborative defense system based on threat hunting technology according to claim 1 is characterized in that: The collaborative defense performance index is obtained by: Design test cases: Obtain existing security vulnerabilities based on security log information, and design test cases for each identified security vulnerability. The test cases include input data, expected output, execution steps, and evaluation criteria; Build a test environment to test the threat intelligence defense model, execute test cases, record the number of threats detected by the threat intelligence defense model, the response time, record the intelligence sharing efficiency, and evaluate the intelligence quality coefficient, which is used to reflect the accuracy of the intelligence; The ratio of the number of threats detected by the threat intelligence defense model to the number of actual threats is recorded as the threat detection rate Tdr; the response time required from detecting the threat to taking defense measures is analyzed, and the average threat response time Trs is calculated; the product of the intelligence sharing efficiency and the intelligence quality coefficient is recorded as the intelligence sharing quality coefficient Sle.

7. The power industry network security collaborative defense system based on threat hunting technology according to claim 1 is characterized in that: The attacker risk coefficient is obtained as follows: By analyzing the homology of network attack behaviors, the number of attackers is obtained, denoted as m, and k is used to represent the sequential number of the attacker's identity; The number of requests per second, the number of affected users, and the percentage of application performance degradation of the k-th attacker are denoted as PSqk, Uqk, and Dqk, respectively; PSq k × k ×D k Recorded as basic strength, the attack strength is calculated using the following formula: Among them, max_1 is the maximum value of the basic intensity; The occurrence probability, harm coefficient, threat weight and attack intensity of the kth attacker are denoted as P k , W k 、wq k , gq k ; The attacker risk factor Gf is calculated by the following attacker risk analysis model: W k =wq k ×gq k The threat weight ranges from 0 to 1 to reflect the potential threat level of attackers of different attack types.

8. The power industry network security collaborative defense system based on threat hunting technology according to claim 1 is characterized in that: The method for obtaining the concentration degree of the network attack behavior is as follows: Mark the timestamp of the network attack behavior in the security log information, sort the network attack behaviors according to the timestamp, set the number of network attack behaviors as n, use i, j to represent the sequence number of network attack behaviors, and i≠j, and calculate the network attack behavior aggregation degree Yx by the following formula: Among them, T ij is the time interval between the ith network attack behavior and the jth network attack behavior, T a is the average value of the time interval, T b is the preset value of the time interval; q i is the weight coefficient corresponding to the i-th network attack behavior, q j is the weight coefficient corresponding to the j-th network attack behavior; e -λtci is the attenuation function of the time when the ith network attack behavior occurs from the current time, λ is the attenuation coefficient, which is used to adjust the attenuation speed, and tci is the distance between the time when the ith network attack behavior occurs and the current time; e -λtcj is the attenuation function of the time when the j-th network attack behavior occurs from the current time, and tcj is the distance between the time when the j-th network attack behavior occurs and the current time.

9. The power industry network security collaborative defense system based on threat hunting technology according to claim 8 is characterized in that: Based on the abnormal traffic size of network attack behavior at each time point, the weight coefficient corresponding to the network attack behavior is allocated through the formula Calculate the weight coefficient corresponding to the i-th network attack behavior, L i is the abnormal traffic size of the i-th network attack behavior.

Images