Network attack tracing and evidence fixing method and system based on full-link data

Abstract

The invention relates to the technical field of network security, and discloses a network attack tracing and evidence fixing method and system based on full-link data, and the method comprises the steps: collecting multi-source heterogeneous data; cleaning and standardizing the collected data, and extracting attack feature information; constructing a full-link data association model, and connecting scattered attack behaviors in series into a complete attack chain through time sequence analysis and node relation graph technologies; based on the attack chain, determining an attack source and a potential motivation thereof by using a multi-level threat intelligence matching algorithm; and the traceability result is in butt joint with an evidence fixing module, a network attack electronic evidence file is generated, and the evidence is stored in a non-tampering manner through a block chain technology. The system corresponds to the method. The method and the system have remarkable technical advantages in the aspects of data integration, traceability precision, evidence fixation, storage optimization, visual display and the like, and can effectively cope with security challenges in a complex network environment.

Description

Technical Field

[0001] The present application relates to the field of network security technology, and specifically to a method and system for network attack traceability and evidence fixation based on full-link data. Background Art

[0002] With the rapid development of information technology, the forms and complexity of network attacks are increasing day by day. Traditional network security defense means are difficult to effectively cope with complex attack behaviors such as advanced persistent threats (APT). Currently, network attack traceability and evidence fixation are important research directions in the field of network security, aiming to determine the attack source by analyzing attack behaviors and provide reliable evidence required for judicial forensics.

[0003] Problems existing in the prior art:

[0004] Data silo problem: The prior art usually relies on a single data source (such as traffic logs or device logs), lacking the ability to integrate multi-source heterogeneous data, resulting in the inability to fully restore the attack chain.

[0005] Insufficient traceability accuracy: Traditional threat intelligence matching algorithms are mainly based on static rule libraries, difficult to adapt to rapidly changing attack patterns, especially performing poorly when facing unknown threats.

[0006] Poor evidence reliability: Existing evidence fixation methods mostly adopt centralized storage methods, vulnerable to tampering or destruction, and difficult to meet the requirements of judicial forensics.

[0007] Insufficient visualization and interactivity: The existing display methods of traceability results are relatively single, lacking dynamic adjustment and interactive functions, restricting the analysis efficiency of users.

[0008] High storage cost: In a large-scale data environment, the cost of blockchain storage is relatively high, and the query efficiency is low, restricting its popularization in practical applications.

[0009] Therefore, there is an urgent need for a new technology to improve the accuracy of attack traceability, the reliability of evidence, and the overall performance of the system. Summary of the Invention

[0010] The purpose of the present application is to provide a method and system for network attack traceability and evidence fixation based on full-link data, aiming to overcome the defects in the prior art and improve the accuracy of attack traceability, the reliability of evidence, and the overall performance of the system.

[0011] To achieve the above purpose, the present application discloses the following technical solutions:

[0012] In the first aspect, the present application discloses a method for network attack traceability and evidence fixation based on full-link data, and the method includes the following steps:

[0013] Collect multi-source heterogeneous data;

[0014] Clean and standardize the collected data, and extract attack feature information;

[0015] Construct a full-link data association model, and through time series analysis and node relationship graph technology, connect scattered attack behaviors into a complete attack chain;

[0016] Based on the attack chain, use a multi-level threat intelligence matching algorithm to determine the attack source and its potential motivation;

[0017] Connect the traceability result with the evidence fixation module to generate a network attack electronic evidence file, and store the evidence immutably through blockchain technology.

[0018] Preferably, the collecting of multi-source heterogeneous data specifically includes:

[0019] Collect basic data, where the basic data includes traffic logs, device logs, application logs, and user behavior data;

[0020] Capture the probing behavior data of attackers through a dynamically deployed distributed honeypot system; the honeypot deployment location of the distributed honeypot system is determined by the following formula:

[0021]

[0022] where LOC is the honeypot deployment priority, T i is the traffic anomaly index of the i-th network node, W i is the node weight, and max(T) is the maximum traffic anomaly index among all nodes.

[0023] Preferably, the cleaning and standardizing of the collected data specifically includes:

[0024] Step D1: Use an anomaly detection model based on deep learning to analyze multi-source heterogeneous data, and identify and mark potential abnormal data points;

[0025] Step D2: Dynamically fill in missing values based on the distribution characteristics of abnormal data points; the missing value filling formula is:

[0026]

[0027] where X fillcd is the data value after filling; u is the data mean; σ is the standard deviation; k 1 and k 2 are adjustment coefficients, and are respectively used for filling positive and negative deviations; P(X) is the probability density function value of the data point; τ 1and τ 2 are the set upper and lower threshold values, and are respectively used to determine whether the data points deviate from the normal range;

[0028] Step D3: Format the cleaned data.

[0029] Preferably, between the step D2 and the step D3, the verification of the selected target vulnerabilities further includes a step D4, and the step D4 specifically includes:

[0030] Step D41: Use multi-scale wavelet transform to decompose the original data layer by layer, and extract the signal components in different frequency ranges; the noise suppression effect is quantitatively evaluated through the following complex formula:

[0031]

[0032] where S noise is the noise intensity; W i is the wavelet decomposition coefficient of the i-th layer; N is the total number of wavelet decomposition layers; υ i is the standard deviation of the wavelet coefficient of the i-th layer; υ avg is the average value of the standard deviations of the wavelet coefficients of all layers; α and β are adjustment parameters, which are respectively used to control the influence of exponential decay and normalization terms; C j is the contribution weight of the j-th key feature; M is the total number of key features;

[0033] Step D42: Dynamically set the denoising threshold according to the calculated noise intensity, and perform soft threshold or hard threshold processing on the high-frequency noise part;

[0034] Step D43: Recombine the wavelet coefficients of each layer after threshold processing, and reconstruct the clean signal as the cleaned data in the step D3.

[0035] Preferably, the multi-level threat intelligence matching algorithm specifically includes:

[0036] Preprocess the data of the local threat intelligence library and the global sharing platform, extract the key feature vectors, and generate a preliminary matching score through similarity calculation;

[0037] For threat intelligence from different sources, based on the dynamic weight adjustment mechanism, calculate the final matching probability according to the credibility, timeliness and context relevance of the data source.

[0038] Preferably, the evidence fixation module is configured to: generate an evidence digest through the SHA-3 hash algorithm, and store the digest value in the consortium chain through a smart contract.

[0039] Preferably, the generation of the evidence digest includes the following steps:

[0040] Structurally process the key information in the traceability result to form a standardized data format. The key information includes the attack chain, threat intelligence matching result, and timestamp information;

[0041] Calculate the hash value for each key data segment of each node to generate a local digest;

[0042] Arrange all local digests in chronological order and calculate the overall digest value;

[0043] Combine the timestamp and the metadata of the traceability system to generate an evidence digest. The metadata includes system identification and / or operator ID;

[0044] When the traceability result is updated, regenerate the evidence digest and retain the content of the original version.

[0045] Preferably, when generating the network attack electronic evidence file, perform additional processing of the timestamp on the network attack electronic evidence file and verify the validity of the timestamp.

[0046] Preferably, the smart contract specifically includes:

[0047] Initiate a write request for the evidence digest at an authorized node;

[0048] Before writing to the blockchain, perform integrity verification on the digest value of the evidence digest;

[0049] Assign a unique identifier to the evidence digest that has passed integrity verification.

[0050] In a second aspect, the present application discloses a network attack traceability and evidence fixation system based on full-link data, which applies the network attack traceability and evidence fixation method based on full-link data as described above, and includes:

[0051] A data collection module configured to collect multi-source heterogeneous data

[0052] A data processing module configured to clean and standardize the collected data and extract attack feature information;

[0053] A chain acquisition module configured to build a full-link data association model, and through time series analysis and node relationship graph technology, concatenate scattered attack behaviors into a complete attack chain;

[0054] An attack traceability module configured to, based on the attack chain, use a multi-level threat intelligence matching algorithm to determine the attack source and its potential motivation;

[0055] An evidence fixation module, configured to: interface with the traceability result, generate a cyber-attack electronic evidence file, and perform tamper-proof storage of the evidence through blockchain technology.

[0056] The cyber-attack traceability, evidence fixation method and system based on full-link data of the present application have the following beneficial effects compared with the prior art:

[0057] 1. Full-link data analysis: By collecting multi-source heterogeneous data and constructing a full-link data association model, the accurate restoration of attack behaviors is realized. Compared with traditional methods, the present invention can more comprehensively reflect the attack process and improve the integrity of traceability.

[0058] 2. Multi-level threat intelligence matching: Combining the local threat intelligence library with the data of the global sharing platform and adopting a hierarchical weight adjustment mechanism to dynamically calculate the matching probability, significantly improving the accuracy of attack traceability. Especially when facing unknown threats, the algorithm of the present invention performs better than the traditional static rule matching method.

[0059] 3. Evidence fixation and tamper-proofness: Using blockchain technology to ensure the tamper-proofness of evidence, and realizing the secure storage and efficient retrieval of evidence summaries through smart contracts. In addition, introducing a timestamp verification mechanism further enhances the time consistency of evidence, meeting the judicial forensics standards.

[0060] 4. Data cleaning and quality improvement: Introducing an anomaly detection model based on deep learning and an improved wavelet transform noise suppression module to ensure the quality and reliability of the input data, laying a solid foundation for subsequent analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0061] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings required for use in the description of the embodiments or the prior art. Obviously, the following drawings are only some embodiments of the present application. For those skilled in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0062] Figure 1 It is a schematic flowchart of the cyber-attack traceability and evidence fixation method based on full-link data provided in this embodiment. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0063] The following will clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, rather than all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present application.

[0064] In this text, the term "including" is intended to cover non-exclusive inclusion, such that a process, method, article, or device that includes a series of elements includes not only those elements but also other elements not expressly listed, or elements that are inherent to such process, method, article, or device. Without further limitation, an element limited by the statement "including..." does not preclude the presence of additional identical elements in the process, method, article, or device that includes the element.

[0065] To address problems such as low traceability accuracy and poor evidence reliability in the prior art, in a first aspect, this embodiment provides a method for network attack traceability and evidence fixation based on full-link data as Figure 1 shown, the method comprising the following steps:

[0066] Collect multi-source heterogeneous data;

[0067] Clean and standardize the collected data, and extract attack feature information;

[0068] Construct a full-link data association model, and through time series analysis and node relationship graph technology, concatenate scattered attack behaviors into a complete attack chain;

[0069] Based on the attack chain, use a multi-level threat intelligence matching algorithm to determine the attack source and its potential motivation;

[0070] Dock the traceability result with the evidence fixation module, generate a network attack electronic evidence file, and store the evidence in an immutable manner through blockchain technology.

[0071] This method realizes full-process coverage from data collection to judicial forensics by integrating multi-source data, constructing a complete attack chain, and combining threat intelligence analysis and evidence fixation technology.

[0072] Next, the technical solution of this method will be introduced in detail.

[0073] To make up for the deficiencies of traditional log data, this method introduces a distributed honeypot system to capture the probing behavior data of attackers. Specifically, the collection of multi-source heterogeneous data includes:

[0074] Collect basic data, where the basic data includes traffic logs, device logs, application logs, and user behavior data;

[0075] Capture the probing behavior data of attackers through a dynamically deployed distributed honeypot system, and preferentially select nodes with higher traffic anomaly index and node weight for honeypot deployment, that is, deploy honeypots on nodes with high honeypot deployment priority. The honeypot deployment location of the distributed honeypot system is determined by the following formula:

[0076]

[0077] Among them, LOC is the honeypot deployment priority, which is used to evaluate the suitability of a network node as a honeypot candidate; T i is the traffic anomaly index of the i-th network node, which reflects the possibility of the node being attacked. The traffic anomaly index can be calculated by statistical analysis of historical traffic data, such as the standard deviation or mutation rate; W i is the node weight, which represents the importance of the node in the network topology and can be determined by indicators such as the number of node connections and access frequency; max(T) is the maximum traffic anomaly index among all nodes and is used for normalizing the calculation results.

[0078] By deploying a distributed honeypot system, vulnerable targets are simulated to attract attackers, thereby capturing their probing behavior data. The above formula calculates the honeypot deployment priority based on the traffic anomaly index and node weight, ensuring that the honeypot system can cover high-risk areas and improve the pertinence and effectiveness of data collection.

[0079] In order to improve the reliability of the data, in this method, the cleaning and standardization processing of the collected data specifically includes:

[0080] Step D1: Use an anomaly detection model based on deep learning (such as an autoencoder or a generative adversarial network) to analyze multi-source heterogeneous data, identify and mark potential abnormal data points. This model detects data that deviates from the normal range by learning normal behavior patterns, thereby improving the accuracy of attack feature extraction;

[0081] Step D2: Dynamically fill in missing values based on the distribution characteristics of the abnormal data points. Compared with the single mean or median filling method in the prior art, the missing value filling formula combines the probability density function and the double-threshold mechanism, and can fill in missing values more accurately; the missing value filling formula is:

[0082]

[0083] Among them, X fillcd is the data value after filling; u is the data mean, σ is the standard deviation, which is used to measure the data distribution characteristics; k 1 and k 2 are adjustment coefficients, which are respectively used for filling positive and negative deviations, that is, respectively controlling the filling intensity of positive and negative deviations; P(X) is the probability density function value of the data point, which is used to judge whether the data point deviates from the normal range and can be calculated using the normal distribution formula in the prior art; τ 1 and τ 2 are set upper and lower threshold values, which are respectively used to judge whether the data point deviates from the normal range, that is, to distinguish abnormal values from normal values;

[0084] Step D3: Format the cleaned data.

[0085] Suppose the mean of a set of traffic data is μ = 100, the standard deviation is σ = 10, the adjustment coefficients k 1 = 1.5, k 2 = 1.2, the threshold τ 1 = 0.05, τ 2 = 0.95. For a missing value, the probability density function value P(X) = 0.03, which is less than τ 1 , so the filling value is: X filled = μ + k 1 *σ = 100 + 1.5 * 10 = 115.

[0086] As a preferred implementation, during the data cleaning process, the enhanced noise suppression technology based on multi-scale wavelet transform is used to decompose the signal spectrum and remove high-frequency noise, while retaining the low-frequency effective information to the greatest extent. That is, between the step D2 and the step D3, the verification of the selected target vulnerabilities further includes a step D4, and the step D4 specifically includes:

[0087] Step D41: Use multi-scale wavelet transform to decompose the original data layer by layer and extract the signal components in different frequency ranges; the noise suppression effect is quantitatively evaluated by the following complex formula:

[0088]

[0089] where S noise is the noise intensity; W i is the wavelet decomposition coefficient of the i-th layer; N is the total number of wavelet decomposition layers; υ i is the standard deviation of the wavelet coefficient of the i-th layer; υ avg is the average value of the standard deviations of the wavelet coefficients of all layers; α and β are adjustment parameters used to control the influence of exponential decay and normalization terms respectively; C j is the contribution weight of the j-th key feature; M is the total number of key features;

[0090] Step D42: Dynamically set the denoising threshold according to the calculated noise intensity and perform soft threshold or hard threshold processing on the high-frequency noise part;

[0091] Step D43: Recombine the wavelet coefficients of each layer after threshold processing to reconstruct a clean signal as the cleaned data in the step D3.

[0092] During the noise suppression process, the formula introduces The exponential decay term is used to dynamically adjust the contribution of wavelet coefficients at each layer to the noise intensity. Compared with the simple linear weighting in the prior art, this mechanism can more accurately reflect the importance of noise at different layers. Secondly, the introduces a normalization factor to ensure the comparability of the calculated results of the noise intensity, especially partially considers the comprehensive influence of key features, further improving the applicability and robustness of the formula. Moreover, by combining the wavelet decomposition coefficients with the key feature weights, the fusion of multi-dimensional information is achieved, thus better balancing the relationship between noise removal and signal retention. In the formula, α and β can be adjusted according to specific application scenarios, enhancing the flexibility and universality of the method. In this way, the noise suppression technology of this method not only significantly improves the data quality but also has higher discrimination, and can effectively meet the data cleaning requirements in complex network environments.

[0093] In this embodiment, the multi-level threat intelligence matching algorithm specifically includes:

[0094] Preprocess the data in the local threat intelligence library and the global sharing platform, extract the key feature vectors, and generate the preliminary matching scores through similarity calculation;

[0095] For threat intelligence from different sources, based on the dynamic weight adjustment mechanism, calculate the final matching probability according to the credibility, timeliness, and context relevance of the data source.

[0096] For the multi-level threat intelligence matching algorithm, the calculation of the matching probability is based on the following logic: First, assign the initial weights according to the local and global matching scores respectively, then dynamically adjust the weights in combination with the context relevance factors (such as attack type, time window, etc.), and finally obtain the final matching probability through normalization. Feasibly, the final matching probability is calculated by the following formula:

[0097]

[0098] where θ is the local matching weight, 1 - θ is the global matching weight, used to balance the contributions of local and global intelligence; LMC and GMS respectively represent the local and global matching scores; f context(L) and f contex(tG) are the context relevance factors, used to dynamically adjust the matching scores; η i is the weight of the i-th feature, and H is the total number of features, used for normalization calculation results.

[0099] In the calculation of the above matching probability, compared with the fixed weight assignment in the prior art, a context relevance factor is introduced, which can dynamically adjust the weight according to the specific scenario, improving the flexibility of the matching algorithm. By normalizing the results, it ensures that the matching probability values are within a reasonable range, avoiding the distortion of results caused by excessive feature weights. At the same time, incorporating the context relevance factor and the normalization term significantly differentiates from the traditional linear weighting method and enhances the reliability of the results. Based on this, by dynamically adjusting the weight ratio and comprehensively considering the credibility, timeliness, and context relevance of the data source, the accuracy of the matching results is significantly improved. The normalization operation further ensures the reliability and consistency of the evidence.

[0100] In this embodiment, the full-link data association model adopts an improved graph neural network (GNN) algorithm to calculate the similarity between nodes through the following formula:

[0101]

[0102] where D is the set of feature dimensions, representing the attribute features of each node; ζ d is the feature weight, used to reflect the importance of different features; f a (d) and f b (d) are the feature values of node a and node b in dimension d respectively; ||D|| is the size of the set of feature dimensions, used for normalizing the calculation results.

[0103] Through the configuration of the full-link data association model, through time series analysis and node relationship graph technology, the scattered attack behaviors are concatenated into a complete attack chain. In the similarity calculation formula, by calculating the similarity between nodes, the reconstruction process of the attack path is dynamically adjusted to ensure the accuracy and integrity of the attack chain.

[0104] In this embodiment, the evidence fixation module is configured to: generate an evidence digest through the SHA-3 hashing algorithm and store the digest value in the consortium chain through a smart contract.

[0105] Specifically, the generation of the evidence digest includes the following steps:

[0106] Structurally process the key information in the traceability result to form a standardized data format, where the key information includes the attack chain, threat intelligence matching result, and timestamp information;

[0107] Calculate the hash value for each key data segment of each node respectively to generate a local digest;

[0108] Arrange all local digests in chronological order and calculate the overall digest value;

[0109] Generate an evidence summary by combining the timestamp and the metadata of the traceability system, where the metadata includes system identification and / or operator ID;

[0110] When the traceability result is updated, regenerate the evidence summary and retain the content of the original version.

[0111] Specifically, when generating the cyber attack electronic evidence file, perform additional processing of the timestamp on the cyber attack electronic evidence file and verify the validity of the timestamp.

[0112] Exemplarily, the mathematical expression of the hierarchical hashing calculation is as follows:

[0113] The first-layer hash value: Hi = Hash(Di)

[0114] Where Hi represents the hash value of the i-th data segment, and Di is the corresponding data segment.

[0115] The second-layer hash value: Htotal = Hash(Concat(H1, H2,..., Hn))

[0116] Where Htotal is the overall summary value, and Concat represents concatenating all local summaries in order.

[0117] The third-layer hash value (final evidence summary): E = Hash(Htotal ∥ T ∥ M)

[0118] Where E is the final evidence summary, T is the timestamp, M is the system metadata, and ∥ represents the data concatenation operation.

[0119] Based on the above, in the method, the generation and storage process of the evidence summary not only ensures the immutability of the evidence, but also improves the security and efficiency of the system through the hierarchical hashing algorithm and smart contract technology.

[0120] Specifically, the smart contract specifically includes:

[0121] Initiate a write request for the evidence summary at an authorized node to prevent illegal operations;

[0122] Before writing to the blockchain, perform integrity verification on the summary value of the evidence summary to ensure that the data has not been tampered with;

[0123] Assign a unique identifier to the evidence summary that has passed the integrity verification to support efficient query and verification.

[0124] In summary, the method has significant technical advantages in aspects such as data integration, traceability accuracy, evidence fixation, storage optimization, and visualization display, can effectively address security challenges in complex network environments, and has important application value and broad promotion prospects.

[0125] In the second aspect, this embodiment provides a network attack traceability and evidence fixation system based on full-link data, which applies the network attack traceability and evidence fixation method based on full-link data as described above. Specifically, this system includes:

[0126] A data collection module, configured to: collect multi-source heterogeneous data

[0127] A data processing module, configured to: clean and standardize the collected data, and extract attack feature information;

[0128] A chain acquisition module, configured to: construct a full-link data association model, and through time series analysis and node relationship graph technology, concatenate scattered attack behaviors into a complete attack chain;

[0129] An attack traceability module, configured to: based on the attack chain, use a multi-level threat intelligence matching algorithm to determine the attack source and its potential motivation;

[0130] An evidence fixation module, configured to: interface with the traceability result, generate a network attack electronic evidence file, and store the evidence in an immutable manner through blockchain technology.

[0131] It should be noted that in this embodiment, this system corresponds to the aforementioned network attack traceability and evidence fixation method based on full-link data. Therefore, for the parts not described in detail in this system (not limited to specific technical means and technical effects), reference can be made to the specific descriptions in the aforementioned network attack traceability and evidence fixation method based on full-link data, and this text will not elaborate here.

[0132] Finally, it should be noted that the above are only the preferred embodiments of this application and are not used to limit this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing embodiments, or perform equivalent replacements for some of the technical features. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of this application shall be included in the protection scope of this application.

Claims

1. A network attack tracing and evidence fixation method based on full-link data, characterized in that: The method comprises the following steps: Collect heterogeneous data from multiple sources; Clean and standardize the collected data to extract attack feature information; Build a full-link data association model, and connect scattered attack behaviors into a complete attack chain through time series analysis and node relationship graph technology; Based on the attack chain, a multi-level threat intelligence matching algorithm is used to determine the source of the attack and its potential motivations; The traceability results are connected to the evidence fixation module to generate electronic evidence files of cyber attacks, and the evidence is stored in an unalterable manner through blockchain technology.

2. According to claim 1, the network attack tracing and evidence fixing method based on full-link data is characterized in that: The collection of multi-source heterogeneous data specifically includes: Collect basic data, including traffic logs, device logs, application logs, and user behavior data; The attacker's tentative behavior data is captured through a dynamically deployed distributed honeypot system; the honeypot deployment position of the distributed honeypot system is determined by the following formula: Among them, LOC is the honeypot deployment priority, T i is the traffic anomaly index of the ith network node, W i is the node weight, and max(T) is the maximum traffic anomaly index among all nodes.

3. According to claim 1, the network attack tracing and evidence fixing method based on full-link data is characterized in that: The cleaning and standardization of the collected data specifically includes: Step D1: Use a deep learning-based anomaly detection model to analyze multi-source heterogeneous data to identify and mark potential abnormal data points; Step D2: Dynamically fill in missing values ​​based on the distribution characteristics of abnormal data points; the missing value filling formula is: Among them, X fillcd represents the data value after filling; u is the data mean; σ is the standard deviation; k1 and k2 are adjustment coefficients, and are used to fill positive and negative deviations respectively; P(X) is the probability density function value of the data point; τ1 and τ2 are the set upper and lower limit thresholds, and are used to judge whether the data point deviates from the normal range respectively; Step D3: Format the cleaned data.

4. The network attack tracing and evidence fixing method based on full-link data according to claim 3 is characterized in that: Between step D2 and step D3, the verification of the screened target vulnerabilities further includes step D4, which specifically includes: Step D41: Decompose the original data layer by layer using multi-scale wavelet transform to extract signal components in different frequency ranges; the noise suppression effect is quantitatively evaluated by the following complex formula: Among them, S noise is the noise intensity; W i is the i-th wavelet decomposition coefficient; N is the total number of wavelet decomposition layers; υ i is the standard deviation of the wavelet coefficients at the i-th layer; avg is the average value of the standard deviation of wavelet coefficients of all layers; α and β are adjustment parameters, which are used to control the influence of exponential decay and normalization terms respectively; C j is the contribution weight of the jth key feature; M is the total number of key features; Step D42: dynamically setting a denoising threshold according to the calculated noise intensity, and performing soft threshold or hard threshold processing on the high-frequency noise part; Step D43: Recombining the wavelet coefficients of each layer after threshold processing to reconstruct a clean signal as the cleaned data in step D3.

5. The network attack tracing and evidence fixing method based on full-link data according to claim 3 is characterized in that: The multi-level threat intelligence matching algorithm specifically includes: Preprocess the data of the local threat intelligence library and the global sharing platform, extract key feature vectors, and generate preliminary matching scores through similarity calculation; For threat intelligence from different sources, the final matching probability is calculated based on a dynamic weight adjustment mechanism according to the credibility, timeliness and contextual relevance of the data source.

6. The network attack tracing and evidence fixing method based on full-link data according to claim 1 is characterized in that: The evidence fixing module is configured to generate an evidence summary through the SHA-3 hash algorithm, and store the summary value of the evidence summary in the alliance chain through a smart contract.

7. The network attack tracing and evidence fixing method based on full-link data according to claim 6 is characterized in that: The generation of the evidence summary comprises the following steps: Structuring the key information in the traceability results to form a standardized data format. The key information includes the attack chain, threat intelligence matching results, and timestamp information. Calculate the hash value for each node's key data fragment and generate a local summary; Arrange all local summaries in chronological order and calculate the overall summary value; Generate an evidence summary by combining the timestamp with metadata of the provenance system, the metadata including the system identifier and / or operator ID; When the traceability results are updated, the evidence summary is regenerated and the original version content is retained.

8. The network attack tracing and evidence fixing method based on full-link data according to claim 7 is characterized in that: When the network attack electronic evidence file is generated, a timestamp is added to the network attack electronic evidence file, and the validity of the timestamp is verified.

9. The network attack tracing and evidence fixing method based on full-link data according to claim 7 is characterized in that: The smart contract specifically includes: Initiate a write request for the evidence summary on the authorized node; Before writing it into the blockchain, the summary value of the evidence summary is checked for integrity; Assign a unique identifier to the integrity-checked evidence digest.

10. A network attack tracing and evidence fixation system based on full-link data, applying the network attack tracing and evidence fixation method based on full-link data as described in any one of claims 1-9, characterized in that: include: Data collection module, configured to collect multi-source heterogeneous data The data processing module is configured to: clean and standardize the collected data and extract attack feature information; The chain acquisition module is configured to: build a full-link data association model, and connect the scattered attack behaviors into a complete attack chain through time series analysis and node relationship graph technology; An attack tracing module is configured to: determine the attack source and its potential motivation based on the attack chain using a multi-level threat intelligence matching algorithm; The evidence fixation module is configured to: connect to the traceability results, generate electronic evidence files of network attacks, and store the evidence in an unalterable manner through blockchain technology.

Images