Network security risk assessment system and method

Abstract

The invention discloses a network security risk assessment system and method, and particularly relates to the field of network security risk assessment, and the method comprises the steps: receiving control instruction sequences continuously executed by terminal equipment deployed in an edge scene of the Internet of Things, extracting the execution content and the response state of each control instruction sequence, and forming an initial instruction state sequence; and matching the corresponding timestamp, state context and input channel information of each control instruction in the instruction state sequence to generate a behavior node set. By constructing a time-stable window constraint model based on a behavior node graph structure, on the premise of not depending on command content analysis, the time sequence consistency of control instructions is comprehensively judged by utilizing an actual trigger interval between the control instructions, context disturbance and a path graph topological relation; the low-frequency playback control instruction with legitimate semantics and abnormal time logic is recognized, and the problem that an existing system cannot discover'behavior time sequence mismatch type attack 'under the condition that the edge node computing power is limited is effectively solved.

Description

Technical Field

[0001] The present invention relates to the technical field of network security risk assessment, and more specifically, to a network security risk assessment system and method. Background Art

[0002] In industrial control systems or Internet of Things edge deployment scenarios such as smart cities, devices usually rely on lightweight instruction protocols to execute tasks. Attackers can, without destroying the logical structure of the system, carry out low-frequency replay attacks by hijacking the communication link, that is, repeatedly sending legitimate control commands that have been executed in the past at artificially created time intervals;

[0003] Such commands are completely legal semantically and cannot be recognized as abnormal by traditional instruction verification mechanisms; at the same time, their intermittent characteristics avoid frequency-based attack detection means. Especially under the premise of limited computing power of edge computing nodes, existing detection mechanisms are difficult to identify this type of "behavioral timing mismatch" attack, resulting in devices being repeatedly miscontrolled or generating unexpected states. Summary of the Invention

[0004] In order to overcome the above-mentioned defects of the prior art, embodiments of the present invention provide a network security risk assessment system and method. By constructing a behavior node sequence based on a path graph structure and a context-driven time offset modeling mechanism, the consistency determination of the embedding of control instructions in the structural path and time logic is realized, so as to solve the problem that it is difficult to identify the "behavioral timing mismatch attack" proposed in the above background art.

[0005] To achieve the above object, the present invention provides the following technical solution: A network security risk assessment method, including:

[0006] Receiving a sequence of control instructions continuously executed by a terminal device deployed in an Internet of Things edge scenario, extracting the execution content and response status of each control instruction sequence, and constituting an initial instruction status sequence;

[0007] Matching each control instruction in the instruction status sequence with its corresponding timestamp, status context, and input channel information to generate a set of behavior nodes;

[0008] Constructing directed edges for the set of behavior nodes according to the execution order and context state transition to generate a path graph structure; extracting all adjacent behavior node pairs in the path graph structure, recording the trigger interval between each pair of adjacent behavior node pairs, and generating an instruction interval distribution table;

[0009] Performing outlier removal and stable segment aggregation on the instruction interval distribution table of each type of control instruction to generate a corresponding time stable window interval;

[0010] Bind the set of behavior nodes in the path graph structure to the time-stable window intervals corresponding to each type of control instruction one by one to construct a complete set of behavior nodes with global timing constraints;

[0011] Based on the complete set of behavior nodes, perform step-by-step risk assessment and verification on the legality of its connection edges, the rationality of the embedding position, and the degree of structural deviation to achieve the structural consistency judgment of the behavior nodes in the timing graph.

[0012] In a preferred embodiment, receive a newly input control instruction in the current cycle of the device to be detected, extract the device state, environmental context, and input channel information corresponding to the control instruction, and construct a behavior node to be determined;

[0013] Compare the semantic similarity between the behavior node to be determined and the set of historical behavior nodes already constructed in the path graph structure, and determine the target path insertion position based on the semantic matching degree of the semantic similarity comparison.

[0014] In a preferred embodiment, insert the behavior node to be determined into the path position determined by the semantic similarity match, and retrieve whether there is a legal connection edge between it and the set of upstream historical behavior nodes; if no effective connection edge is found between the behavior node to be determined and its previous historical behavior node in the path graph structure, then determine that the node is a path break node; calculate the required repair steps and semantic edit distance for the jump behavior segment between the path break node and its target insertion path, and output the structural deviation index;

[0015] Compare the structural deviation index with the predefined tolerance threshold in the behavior graph structure. If the structural deviation exceeds the tolerance threshold, mark the behavior node to be determined as a structure mismatch node.

[0016] In a preferred embodiment, extract the set of all historical behavior nodes with the same type as the current control instruction from the path graph structure, and count the historical trigger time interval sequences between adjacent behavior node pairs in these node sets;

[0017] Perform kernel density estimation and sliding window fitting operations on the historical trigger time interval sequence to construct a standardized time distribution model corresponding to the control instruction type; the standardized time distribution model solves the instruction interval fluctuation boundary interval according to the interval probability density function and local time response change rate corresponding to the control instruction type in the path graph structure; then combine the control instruction type label and its corresponding historical context perturbation factor combination to generate a multi-variable time offset expression structure, construct a consistency calculation path for comparing the current control instruction interval with the historical distribution tolerance boundary; derive a residual response matrix based on the consistency calculation path, and perform time anomaly deformation detection to identify complex behavior patterns with slow interval drift and drastic context state mutation in low-frequency replay attacks.

[0018] In a preferred embodiment, the actual trigger interval between the current control instruction and the same type of control instruction that appeared previously in the path graph structure is input into the standardized time distribution model to solve for the residual offset value corresponding to the current control instruction interval;

[0019] Determine whether the residual offset value exceeds the upper bound of the time stability window interval corresponding to the current control instruction type in the standardized time distribution model. If it exceeds, mark the current control instruction as an interval anomaly node;

[0020] Based on the marked interval anomaly nodes, trace back their relative change trajectories in the historical interval perturbation samples, generate an interval drift trend, and calculate the corresponding interval drift amplitude index;

[0021] Determine whether the interval drift amplitude index exceeds the historical fluctuation threshold set for the current control instruction type in the standardized time distribution model. If it exceeds, mark the current control instruction as a time recombination suspected node.

[0022] In a preferred embodiment, compare the node identifiers of the control instruction marked as a structure mismatch node and the control instruction marked as a time recombination suspected node in the path graph structure to determine whether they correspond to the same current control instruction; if the current control instruction has both a structure deviation identifier and an interval drift identifier, output the control instruction as a high-confidence node for replay attack;

[0023] If the current control instruction has only one of the structure deviation identifier or the interval drift identifier, extract the behavior nodes embedded in the path graph structure around the control instruction, calculate the path perturbation amplitude and the state transition consistency index, and generate a combined perturbation factor; input the combined perturbation factor into the abnormal perturbation interval determination function. If the numerical result corresponding to the combined perturbation factor falls within the predefined abnormal perturbation interval, output the current control instruction as a gray-box attack node;

[0024] Write the control instructions marked as high-confidence nodes for replay attack and the control instructions marked as gray-box attack nodes in the current control instruction into the risk behavior log respectively, and generate a behavior record index to support the dynamic modeling process of the path graph structure and the iterative optimization process of the risk identification rules.

[0025] In a preferred embodiment, extract the behavior fragments and context states of the risk behavior nodes corresponding to the control instructions written into the risk behavior log in the path graph structure to generate a set of risk behavior path fragments;

[0026] Construct the set of risk behavior path segments into an abnormal path subgraph, and insert it into the existing path graph structure. Set the abnormal connection edges as the connection edges with confidence label values lower than the dynamic determination threshold to form an evolving graph structure with attack buffering capabilities;

[0027] Perform a confidence weight adjustment operation on the connection edges carried by the abnormal path subgraph inserted into the path graph structure. Set the connection edges with confidence label values lower than the path connection threshold as risk edges, and define the path propagation boundary range affected by each risk edge;

[0028] Regularly count all the abnormal path subgraphs cumulatively inserted in the path graph structure, perform clustering analysis based on path structure similarity, solve the path overlap grouping results, and perform structure merging and archiving processing on the repeated path groups to control the expansion range of the graph structure;

[0029] Perform incremental learning operations relying on the path graph structure on the path embedding process triggered by the new control instructions in the current cycle, and update the structure matching function parameters of the path insertion model according to the existing path topology and risk annotation results; Synchronously update the time window interval threshold and the structure deviation tolerance limit value corresponding to each type of control instruction for the path graph structure containing the abnormal path subgraph, and generate a risk adaptation behavior graph structure that continuously self-adjusts with the recognition results.

[0030] A network security risk assessment system, including an extraction instruction module, a generation node module, a graph construction module, an aggregation window module, a binding constraint module, and a verification structure module;

[0031] The extraction instruction module is used to receive the control instruction sequences continuously executed by the terminal devices deployed in the Internet of Things edge scenarios, extract the execution content and response status of each control instruction sequence, and form an initial instruction status sequence;

[0032] The generation node module is used to match each control instruction in the instruction status sequence with its corresponding timestamp, status context, and input channel information to generate a set of behavior nodes;

[0033] The graph construction module is used to construct directed edges for the set of behavior nodes according to the execution order and context state transition to generate a path graph structure; Extract all adjacent behavior node pairs in the path graph structure, record the trigger interval between each pair of adjacent behavior node pairs, and generate an instruction interval distribution table;

[0034] The aggregation window module is used to perform outlier removal and stable segment aggregation on the instruction interval distribution table of each type of control instruction to generate the corresponding time stable window interval;

[0035] The binding constraint module is used to bind the set of behavior nodes in the path graph structure to the time-stable window intervals corresponding to each type of control instruction one by one, and construct a complete set of behavior nodes with global timing constraints;

[0036] The verification structure module performs step-by-step risk assessment and verification on the legality of its connection edges, the rationality of the embedding position, and the degree of structural deviation based on the complete set of behavior nodes, so as to realize the structural consistency judgment of behavior nodes in the timing graph.

[0037] The technical effects and advantages of the present invention:

[0038] 1. By constructing a time-stable window constraint model based on the behavior node graph structure, without relying on command content analysis, the actual trigger interval, context perturbation, and path graph topology relationship between control instructions are used to comprehensively determine their timing consistency, realizing the identification of low-frequency replay control instructions with legal semantics but abnormal time logic, effectively solving the problem that the existing system cannot detect "behavior timing mismatch attacks" under the condition of limited computing power of edge nodes;

[0039] 2. This solution uses the "control instruction - response status - environmental context" ternary combination to form high-dimensional behavior nodes, and combines semantic similarity and historical path graph to determine the insertion position of nodes, enabling the system to still judge the rationality of the structural embedding of control instructions in real time without the support of a structure template library, thus realizing the identification of instruction jump insertion path breaks and enhancing the system's adaptive detection ability for structure-damaging camouflage attacks;

[0040] 3. By constructing a multi-variable context-driven time residual response model, the context state, perturbation factor, and instruction type of the historical trigger interval are jointly used to form a dynamically weighted center estimation path. Based on this path, the time residual and trend drift index of the current control instruction are calculated to realize the capture of slowly changing time abnormal behaviors;

[0041] 4. This solution integrates three different dimensions of risk factors: structural deviation identification, time residual response, and interval drift trend, constructs a composite risk scoring function to generate a high-confidence risk identification of attack nodes, and at the same time introduces a path perturbation factor and a dynamic tolerance interval judgment mechanism to output a gray attack mark, ensuring that a hierarchical response standard can be established for control behaviors at the fuzzy boundary and improving the system's robustness to non-deterministic attack scenarios. Description of the Drawings

[0042] Figure 1 It is a flowchart of the method steps of the present invention.

[0043] Figure 2 It is a system module diagram of the present invention.

[0044] Figure 3Flowchart for constructing behavior nodes and generating path diagrams of the present invention.

[0045] Figure 4 Flowchart for evaluating behavior nodes and identifying replay risks of the present invention Figure 1 。

[0046] Figure 5 Flowchart for evaluating behavior nodes and identifying replay risks of the present invention Figure 2 。

[0047] Figure 6 Flowchart for updating risk maps and evolving structures of the present invention. Detailed implementation manners

[0048] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all the embodiments. All other embodiments obtained by those of ordinary skill in the art based on the embodiments of the present invention without creative efforts shall fall within the protection scope of the present invention.

[0049] Refer to the attached Figures 1-6 description, a network security risk assessment method according to an embodiment of the present invention includes:

[0050] Receiving a sequence of control instructions continuously executed by a terminal device deployed in an Internet of Things edge scenario, and extracting the execution content and response status of each control instruction sequence to form an initial instruction status sequence;

[0051] Matching each control instruction in the instruction status sequence with its corresponding timestamp, status context, and input channel information to generate a set of behavior nodes;

[0052] Constructing directed edges for the set of behavior nodes according to the execution order and context state transition to generate a path diagram structure; extracting all adjacent behavior node pairs in the path diagram structure and recording the triggering interval between each pair of adjacent behavior node pairs to generate an instruction interval distribution table;

[0053] Performing outlier removal and stable segment aggregation on the instruction interval distribution table of each type of control instruction to generate a corresponding time stable window interval;

[0054] Binding the set of behavior nodes in the path diagram structure with the corresponding time stable window interval of each type of control instruction one by one to construct a complete set of behavior nodes with global timing constraints;

[0055] Based on the complete set of behavior nodes, performing hierarchical risk assessment and verification on the legality of its connection edges, the rationality of the embedding position, and the degree of structural deviation to achieve the structural consistency judgment of the behavior nodes in the timing graph.

[0056] It should be noted that an asymmetric stable trigger interval of the control instruction type is constructed based on the trigger time interval between adjacent behavior nodes;

[0057]

[0058] where Ω C is the time stable window interval of instruction type C (unit: second); is the minimum / maximum stable interval of this type of instruction (unit: second); is the local perturbation energy function of instruction type C in the candidate interval t (unit: second²); m C is the number of historical behavior node pairs of instruction type C (unit: piece); represents the time interval between the i-th pair of adjacent behavior nodes of type C (unit: second); is the time stable weight of the instruction sample (unit: none); represents the context perturbation correction factor of this behavior node pair (unit: perturbation coefficient) θ L , θ U is the lower / upper limit of the perturbation energy threshold of the stable interval (unit: second²);

[0059] In the above formula, in order to characterize the stable range of the control instruction trigger time, for each type of instruction C, the trigger interval set of all adjacent behavior node pairs is counted, and the perturbation energy function is constructed in combination with its context perturbation situation This function accumulates the weighted squared residuals of the candidate central value t, reflecting the degree of interval deviation; the window interval boundary by searching to make fall into the extreme value position within the threshold range, an asymmetric stable window is formed for subsequent time consistency verification.

[0060] Receive a new input control instruction in the current cycle of the device to be detected, extract the device status, environmental context, and input channel information corresponding to the control instruction, and construct a behavior node to be determined;

[0061] Compare the semantic similarity between the behavior node to be determined and the set of historical behavior nodes already constructed in the path graph structure, and determine the path insertion position of the target based on the semantic matching degree of the semantic similarity comparison.

[0062] Insert the behavior node to be determined into the path position determined by the semantic similarity match, and retrieve whether there is a legal connection edge between it and the set of upstream historical behavior nodes; if no effective connection edge is found between the behavior node to be determined and its previous historical behavior node in the path graph structure, then determine that the node is a path break node; calculate the required repair steps and semantic edit distance for the jump behavior segment between the path break node and its target insertion path, and output the structural deviation amount index;

[0063] Compare the structural deviation index with the predefined tolerance threshold in the behavior graph structure. If the structural deviation exceeds the tolerance threshold, mark the behavior node to be determined as a structure mismatch node;

[0064] It should be noted that by identifying the degree of structural break between the current behavior node and the historical path, constructing a structural deviation index, and generating a structure mismatch detection formula:

[0065]

[0066] where δ s is the structural deviation (unit: structural offset degree); α s , β s are the weight coefficients of the structural distance and the state offset (unit: normalization coefficient); is the semantic edit distance between behavior paths (unit: number of steps); P jump , P ref are the current behavior path segment and the reference path segment (unit: node sequence); is the path difference between state transition vector groups (unit: Euclidean distance of state units); Z jump , Z ref are the state sequence matrices corresponding to two paths (unit: state value combination);

[0067] For the above formula, the function divides the structure mismatch into two parts: one is the semantic jump distance at the path level and the other is the response offset at the state level Calculate the path jump and state drift caused by the insertion of the current node respectively by combining the weighting coefficients, and output the overall structural deviation δ s , which is used to determine whether there is a path break.

[0068] Extract all historical behavior node sets with the same type as the current control instruction from the path graph structure, and count the historical trigger time interval sequences between adjacent behavior node pairs in these node sets;

[0069] Perform kernel density estimation and sliding window fitting operations on the historical trigger time interval sequence to construct a standardized time distribution model corresponding to the control instruction type; the standardized time distribution model solves the instruction interval fluctuation boundary interval according to the interval probability density function corresponding to the control instruction type in the path graph structure and the local time response change rate; subsequently, combine the control instruction type label with its corresponding historical context perturbation factor combination to generate a multivariate time offset expression structure, and construct a consistency calculation path for comparing the current control instruction interval with the historical distribution tolerance boundary; derive a residual response matrix based on the consistency calculation path, and perform time anomaly deformation detection to identify complex behavior patterns with slow interval drift and drastic context state mutation in low-frequency replay attacks;

[0070] By comparing the actual interval of the current control instruction with the center of the historical context-sensitive interval, output the residual offset, and model the time residual response based on this:

[0071]

[0072] Variable definition and unit description: δ t is the time residual offset value (unit: second); Δt c represents the time interval between the current control instruction and the previous instruction of the same type (unit: second); represents the weighted center based on context and perturbation correction (unit: second); X c is the context state vector of the current instruction (unit: state group); ξ c is the perturbation influence factor of the current instruction (unit: perturbation weight); κ(X j ,X c ) represents the context state similarity function (unit: similarity value); ξ j is the perturbation influence factor of the historical sample (unit: perturbation weight); is the trigger interval of the j-th historical instruction of the same type (unit: second); in the above formula, the dynamic time center is solved by performing context and perturbation weighting on the trigger intervals of historical instructions of the same type Then compare the current interval Δt c with it to obtain the deviation value δ t ; this residual is used for subsequent drift trend modeling.

[0073] Input the actual trigger interval between the current control instruction and the previous control instruction of the same type in the path graph structure into the standardized time distribution model to solve the residual offset value corresponding to the current control instruction interval;

[0074] Determine whether the residual offset value exceeds the upper bound of the time stability window interval corresponding to the current control instruction type in the standardized time distribution model. If it exceeds, mark the current control instruction as an interval anomaly node;

[0075] Based on the marked interval anomaly nodes, trace back their relative change trajectories in the historical interval perturbation samples, generate an interval drift trend, and calculate the corresponding interval drift amplitude index;

[0076] Determine whether the interval drift amplitude index exceeds the historical fluctuation threshold set for the current control instruction type in the standardized time distribution model. If it exceeds, mark the current control instruction as a time recombination suspected node;

[0077] It should be noted that by tracking the change of the residual time series, evaluating the possibility of time recombination of the current node, and constructing an interval drift trend function:

[0078]

[0079] where Θ t is the current time drift trend intensity (unit: second²); is the time residual of the k-th historical anomaly node (unit: second); is the time change rate of the k-th residual (unit: second / second); is the perturbation distribution covariance coefficient (unit: perturbation similarity); λ k is the context response change rate (unit: state jump rate);

[0080] In the interval drift trend function, extract the time residual change rate in the historical anomaly node sequence, and combine the perturbation structure and the state jump amplitude for weighting to quantify the time trend function Θ t , the larger its value, the more unstable the time structure is, indicating that there may be a hidden recombination attack.

[0081] Compare the control instructions marked as structure mismatch nodes with the control instructions marked as time recombination suspected nodes in the path graph structure to determine whether they correspond to the same current control instruction. If the current control instruction has both a structure deviation flag and an interval drift flag, output the control instruction as a high-confidence node for replay attack;

[0082] If the current control instruction only has one of the structure deviation flag or the interval drift flag, extract the behavior nodes embedded in the path graph structure around the control instruction, calculate the path perturbation amplitude and the state transition consistency index, and generate a combined perturbation factor. Input the combined perturbation factor into the abnormal perturbation interval determination function. If the numerical result corresponding to the combined perturbation factor falls within the predefined abnormal perturbation interval, output the current control instruction as a gray attack node;

[0083] Write the control instructions marked as high-confidence nodes for replay attacks and the control instructions marked as gray-box attack nodes in the current control instructions into the risk behavior log respectively, and generate a behavior record index to support the dynamic modeling process of the path graph structure and the iterative optimization process of risk identification rules;

[0084] By fusing the structural offset, time residual, and trend function, comprehensively output the risk score of the current instruction, and form the joint risk function output and attack node identification:

[0085] Γ c = α·δ s + β·δ t + χ·Θ t ;

[0086] where Γ c is the attack risk score of the current control instruction (unit: risk degree); δ s is the structural deviation (unit: structural deviation degree); δ t is the time residual offset value (unit: second); Θ t is the time drift trend function value (unit: second²); α, β, χ are the weighting coefficients of each factor (unit: normalization coefficient);

[0087] In the formula, by superimposing the structural matching degree, time anomaly degree, and trend into a unified function Γ c , output the risk level of the current behavior node; Γ c function is the basis for the final attack node determination.

[0088] Extract the behavior fragments and context states of the risk behavior nodes corresponding to the control instructions written into the risk behavior log in the path graph structure, and generate a set of risk behavior path fragments;

[0089] Construct the set of risk behavior path fragments into an abnormal path subgraph, and insert it into the existing path graph structure. Set the abnormal connection edges as the connection edges with confidence label values lower than the dynamic determination threshold to form an evolutionary graph structure with attack buffering ability;

[0090] Perform a confidence weight adjustment operation on the connection edges carried by the abnormal path subgraph inserted into the path graph structure. Set the connection edges with confidence label values lower than the path connection threshold as risk edges, and define the path propagation boundary range affected by each risk edge;

[0091] Regularly count all the abnormal path subgraphs cumulatively inserted in the path graph structure, perform clustering analysis based on the path structure similarity, solve the path coincidence grouping result, and perform structure merging and archiving processing on the repeated path groups to control the expansion range of the graph structure;

[0092] Perform incremental learning operations relying on the path graph structure for the path embedding process triggered by new control instructions in the current cycle, and update the structure matching function parameters of the path insertion model according to the existing path topology and risk annotation results; synchronously update the time window interval threshold and the structure deviation tolerance limit value corresponding to each type of control instruction for the path graph structure containing abnormal path subgraphs, and generate a risk adaptation behavior graph structure that continuously self-adjusts with the recognition results.

[0093] A network security risk assessment system, including an instruction extraction module, a node generation module, a graph construction module, an aggregation window module, a binding constraint module, and a structure verification module;

[0094] The instruction extraction module is used to receive the control instruction sequences continuously executed by the terminal devices deployed in the Internet of Things edge scenario, extract the execution content and its response status of each control instruction sequence, and form an initial instruction status sequence;

[0095] The node generation module is used to match each control instruction in the instruction status sequence with its corresponding timestamp, status context, and input channel information, and generate a set of behavior nodes;

[0096] The graph construction module is used to construct directed edges for the set of behavior nodes according to the execution order and context state transition, and generate a path graph structure; extract all adjacent behavior node pairs in the path graph structure, record the trigger interval between each pair of adjacent behavior node pairs, and generate an instruction interval distribution table;

[0097] The aggregation window module is used to perform outlier removal and stable segment aggregation on the instruction interval distribution table of each type of control instruction, and generate the corresponding time stable window interval;

[0098] The binding constraint module is used to bind the set of behavior nodes in the path graph structure with the time stable window interval corresponding to each type of control instruction one by one, and construct a complete set of behavior nodes with global timing constraints;

[0099] The structure verification module performs step-by-step risk assessment and verification on the legality of its connection edges, the rationality of the embedding position, and the degree of structure deviation based on the complete set of behavior nodes, so as to realize the structural consistency judgment of the behavior nodes in the timing graph.

[0100] Regarding this solution, it should be noted that in modern network control systems, especially in application scenarios such as industrial field edge devices and smart city edge nodes, devices often rely on simplified control protocols to complete daily operations. Although these protocols are lightweight, they also provide attackers with low-cost intrusion paths. Replay attack is one of the most concealed attack methods and is difficult to identify through traditional logical verification means. Especially in the case of "low-frequency replay", the attacker does not tamper with the command content, but sends legitimate control instructions that have been previously executed at forged time points. Since these control instructions are semantically correct and the execution intervals are irregular, traditional detection mechanisms based on content verification, instruction signature, or frequency threshold cannot detect any anomalies.

[0101] Therefore, building a model system that can jointly identify from multiple dimensions such as behavioral time trajectories, context state changes, path structure rationality, and control logic consistency has become a key requirement for achieving fine-grained assessment of network security risks and defense against replay attacks.

[0102] The formation of this solution follows a logical closed-loop process of "starting from the basic behavior granularity, establishing a structure map, extracting temporal patterns, judging the rationality of insertions, quantifying the structure and time offset, and dynamically feeding back to the map". The whole process can be divided into the following five core construction segments:

[0103] 1. Construction of behavior nodes and formation of path graphs:

[0104] The system first receives a continuous sequence of control instructions executed by terminal devices deployed in the Internet of Things edge scenario, and extracts the execution content and response status of each control instruction to form the smallest granularity "instruction-status pair".

[0105] Subsequently, the system combines each control instruction with its corresponding timestamp, status context information (such as execution environment, voltage, current, load status, etc.) and input channel identifier to jointly form a set of behavior nodes. All behavior nodes generate a path graph structure by establishing directed connection edges according to their triggering order and state transition direction. This graph is not a static storage record, but a behavioral evolution trajectory graph built on the basis of the "instruction-status-time" triple logical structure.

[0106] 2. Extraction of time-stable windows and binding modeling:

[0107] Extract all pairs of adjacent behavior nodes in the path graph structure, and count the triggering time intervals between them. Aggregate them separately according to the control instruction types to form an "instruction interval distribution table"; these interval tables are not simple statistical data, but are used to characterize the rhythm of instruction behavior and the sensitivity to environmental perturbations; the system further performs perturbation energy modeling on the interval distribution table of each type of instruction to construct an asymmetric stable triggering interval; this modeling method does not rely on fixed boundaries or empirical thresholds, but automatically solves the upper and lower boundaries of the time stable window through an energy function composed of "context perturbation factor + weighted time residual square".

[0108] Finally, each behavior node binds its stable time interval of the corresponding type to form a "set of behavior graph nodes with time tolerance characteristics".

[0109] 3. Structural consistency verification and risk behavior embedding determination:

[0110] The control instructions newly received in the current cycle will be converted into behavior nodes to be determined, and semantic similarity comparison will be performed with the historical behavior node set to determine the position in the path graph where it should be inserted; if no connection edge can be established between this node and the previous node on the expected insertion path, the system records this phenomenon as a "path break"; further, a structural deviation index is constructed based on the behavioral semantic edit distance and the context response jump degree to determine whether this instruction is a structurally mismatched node.

[0111] In addition to path structure verification, the system will also input the actual interval between the current instruction and the previous instruction of the same type into the time residual model, compare it with the context weighted predicted interval central value, and extract its time deviation degree.

[0112] If the residual value exceeds the established stable time window, the system marks this node as an interval abnormal behavior node; further, the system traces back the residual change trajectory of this node in the historical time perturbation space to construct a time drift trend function to identify whether there is a continuous slow deviation or an asymmetric mutation time recombination behavior.

[0113] 4. Joint identification constitutes a composite risk node identification mechanism:

[0114] By jointly superimposing the triple results output by the structural deviation amount, the time residual offset value, and the time drift trend function, a composite risk function is constructed to generate a single-value risk score for the current control instruction.

[0115] If a behavior node has both a structurally mismatched label and an abnormal time drift trend label at the same time, it is identified as a high-confidence risk node for replay attack; if it has only one of them, the system further evaluates the path perturbation factor around this node and classifies it in combination with the predefined abnormal perturbation interval to determine whether it is a "gray attack node".

[0116] All identified high-risk behavior nodes will be recorded in the risk behavior log, and behavior index information will be output for reference in graph evolution;

[0117] 5. Risk behavior feedback drives the self-evolution of the behavior graph:

[0118] Extract the recorded risk behavior nodes and their preceding and following behavior segments to form a "set of risk behavior path segments", and embed them into the main path graph structure to construct an "abnormal path subgraph";

[0119] During the insertion process, the system marks some connection edges as edges with a "confidence label value lower than the dynamic determination threshold", that is, risk edges are formed, and these risk edges will participate in the adjustment of the path insertion weight of subsequent behavior nodes;

[0120] Perform clustering analysis and structural archiving on the abnormally inserted path subgraphs that have been accumulated, and update strategic parameters such as the interval window threshold and structural tolerance boundary in the path graph structure in real time, so as to realize the continuous adaptation and evolution of the graph to risk behaviors;

[0121] The reason why the present invention uses the path graph structure as the basic support is not only to record the behavior sequence, but more importantly, it provides the three-dimensional mapping ability required for the identification of attack behaviors such as "structural jumps, state mutations, and interval perturbations"; traditional detection mechanisms that use data sequences or instruction streams as the analysis unit cannot effectively model the subtle context changes or time structure dissimilation between instructions;

[0122] This solution adopts a four-level nested judgment process of "behavior node - path structure - context perturbation - time drift", transforming attack identification into a "problem of the change of the state space of the behavior graph with dynamic evolution ability"; this method not only takes into account performance consumption and identification accuracy, but also can adapt to the gradual emergence of new attack patterns (such as replay-pitch combination attacks, low-frequency nested jump attacks, etc.).

[0123] The above are only the preferred embodiments of the present invention and are not used to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present invention shall be included in the protection scope of the present invention.

Claims

1. A network security risk assessment method, comprising: Receiving a sequence of control instructions continuously executed by a terminal device deployed in an Internet of Things edge scenario, extracting the execution content and response status of each control instruction sequence, and forming an initial instruction status sequence; Matching each control instruction in the instruction status sequence with its corresponding timestamp, status context, and input channel information to generate a set of behavior nodes; Characterized in that: Constructing directed edges based on the execution order and context state transition of the set of behavior nodes to generate a path graph structure; extracting all adjacent behavior node pairs in the path graph structure, and recording the trigger intervals between each pair of adjacent behavior node pairs to generate an instruction interval distribution table; Performing outlier removal and stable segment aggregation on the instruction interval distribution table of each type of control instruction to generate a corresponding time stable window interval; Binding the set of behavior nodes in the path graph structure with the time stable window interval corresponding to each type of control instruction one by one to construct a complete set of behavior nodes with global timing constraints; Based on the complete set of behavior nodes, performing step-by-step risk assessment and verification on the legality of its connection edges, the rationality of the embedding position, and the degree of structural deviation to achieve the structural consistency judgment of behavior nodes in the timing graph.

2. The network security risk assessment method according to claim 1, characterized in that: Receiving a new input control instruction in the current cycle of the device to be detected, extracting the device state, environmental context, and input channel information corresponding to the control instruction, and constructing a behavior node to be determined; Performing a semantic similarity comparison between the behavior node to be determined and the set of historical behavior nodes already constructed in the path graph structure, and determining the target path insertion position based on the semantic matching degree of the semantic similarity comparison.

3. The network security risk assessment method according to claim 2, characterized in that: Inserting the behavior node to be determined into the path position determined by the semantic similarity match, and retrieving whether there is a legal connection edge between it and the set of upstream historical behavior nodes; if no effective connection edge between the behavior node to be determined and its previous historical behavior node is found in the path graph structure, then determining that this node is a path break node; Calculating the required repair steps and semantic edit distance for the jump behavior segment between the path break node and its target insertion path, and outputting a structural deviation amount index; Comparing the structural deviation amount index with a predefined tolerance threshold in the behavior graph structure, and if the structural deviation amount exceeds the tolerance threshold, then marking the behavior node to be determined as a structurally mismatched node.

4. The network security risk assessment method according to claim 3, characterized in that: Extracting all sets of historical behavior nodes with the same type as the current control instruction from the path graph structure, and statistically analyzing the historical trigger time interval sequence between adjacent behavior node pairs in these node sets; Perform kernel density estimation and sliding window fitting operations on the historical trigger time interval sequence to construct a standardized time distribution model corresponding to the control instruction type; the standardized time distribution model solves the instruction interval fluctuation boundary interval according to the interval probability density function corresponding to the control instruction type in the path graph structure and the local time response change rate; subsequently, combine the control instruction type label with its corresponding historical context perturbation factor combination to generate a multivariate time offset expression structure, and construct a consistency calculation path for comparing the current control instruction interval with the historical distribution tolerance boundary. Derive a residual response matrix based on the consistency calculation path and perform time anomaly deformation detection to identify complex behavior patterns with slow interval drift and drastic context state mutation in low-frequency replay attacks.

5. A network security risk assessment method according to claim 4, wherein: Input the actual trigger interval between the current control instruction and the previous occurrence of the same type of control instruction in the path graph structure into the standardized time distribution model to solve the residual offset value corresponding to the current control instruction interval. Judge whether the residual offset value exceeds the upper bound of the time stability window interval corresponding to the current control instruction type in the standardized time distribution model. If it exceeds, mark the current control instruction as an interval anomaly node. Based on the marked interval anomaly nodes, trace back their relative change trajectories in the historical interval perturbation samples, generate an interval drift trend and calculate the corresponding interval drift amplitude index. Judge whether the interval drift amplitude index exceeds the historical fluctuation threshold set for the current control instruction type in the standardized time distribution model. If it exceeds, mark the current control instruction as a time recombination suspected node.

6. A network security risk assessment method according to claim 5, wherein: Compare the node identifiers of the control instructions marked as structure mismatch nodes and the control instructions marked as time recombination suspected nodes in the path graph structure to determine whether they correspond to the same current control instruction; if the current control instruction has both a structure deviation identifier and an interval drift identifier, output the control instruction as a high-confidence node for replay attack. If the current control instruction has only one of the structure deviation identifier or the interval drift identifier, extract the behavior nodes embedded in the path graph structure around the control instruction, calculate the path perturbation amplitude and the state transition consistency index, and generate a combined perturbation factor; input the combined perturbation factor into the abnormal perturbation interval determination function. If the numerical result corresponding to the combined perturbation factor falls within the predefined abnormal perturbation interval, output the current control instruction as a gray attack node. Write the control instructions marked as high-confidence nodes for replay attack and the control instructions marked as gray attack nodes in the current control instruction into the risk behavior log respectively, and generate a behavior record index to support the dynamic modeling process of the path graph structure and the iterative optimization process of the risk identification rules.

7. A network security risk assessment method according to claim 6, wherein: Extract the behavior segments and context states of the risk behavior nodes corresponding to the control instructions to be written into the risk behavior log in the path graph structure, and generate a set of risk behavior path segments; Construct the set of risk behavior path segments into an abnormal path subgraph, and insert it into the existing path graph structure. Set the abnormal connection edges as the connection edges with confidence label values lower than the dynamic determination threshold to form an evolving graph structure with attack buffering capabilities; Perform a confidence weight adjustment operation on the connection edges carried by the abnormal path subgraph inserted into the path graph structure. Set the connection edges with confidence label values lower than the path connection threshold as risk edges, and define the path propagation boundary range affected by each risk edge; Regularly count all the abnormal path subgraphs accumulated in the path graph structure, perform clustering analysis based on path structure similarity, solve the path overlap grouping results, and perform structure merging and archiving processing on the repeated path groups to control the expansion range of the graph structure; Perform an incremental learning operation relying on the path graph structure on the path embedding process triggered by the new control instructions in the current period, and update the structure matching function parameters of the path insertion model according to the existing path topology and risk annotation results; Synchronously update the time window interval threshold and the structure deviation tolerance limit value corresponding to each type of control instruction for the path graph structure containing the abnormal path subgraph, and generate a risk adaptation behavior graph structure that continuously self-adjusts with the recognition results; 8. A network security risk assessment system, including an extraction instruction module, a generation node module, a construction graph module, an aggregation window module, a binding constraint module, and a verification structure module, characterized in that: The extraction instruction module is used to receive the control instruction sequence continuously executed by the terminal device deployed in the Internet of Things edge scenario, extract the execution content and its response status of each control instruction sequence, and form an initial instruction status sequence; The generation node module is used to match each control instruction in the instruction status sequence with its corresponding timestamp, status context, and input channel information to generate a set of behavior nodes; The construction graph module is used to construct directed edges according to the execution order and context state transition of the set of behavior nodes to generate a path graph structure; extract all adjacent behavior node pairs in the path graph structure, and record the trigger interval between each pair of adjacent behavior node pairs to generate an instruction interval distribution table; The aggregation window module is used to perform outlier removal and stable segment aggregation on the instruction interval distribution table of each type of control instruction to generate a corresponding time stable window interval; The binding constraint module is used to bind the set of behavior nodes in the path graph structure with the time stable window interval corresponding to each type of control instruction one by one to construct a complete set of behavior nodes with global timing constraints; The verification structure module performs a step-by-step risk assessment and verification on the legality of its connection edges, the rationality of the embedding position, and the degree of structural deviation based on the complete set of behavior nodes to achieve the structural consistency judgment of the behavior nodes in the timing graph.

Images