Network situation monitoring system and method

Abstract

The invention relates to the technical field of network monitoring, and provides a network situation monitoring system and method.The method comprises the steps that entities and relations of multi-source data are extracted through a sensing fusion module, a network situation map is constructed in combination with causal rules of an attack behavior knowledge base, and causal association of attack chains is recognized in combination with time sequence analysis and a causal discovery algorithm; the problems of attack chain identification fragmentation and risk path prediction distortion in the prior art are solved. The simulation verification module generates a dynamic mirror image based on a behavior feature library of an entity so as to construct an isolation simulation environment, and associates the causal strength of an attack chain with a defense effect to calculate an efficiency value so as to provide a precise basis for defense strategy screening; and the response feedback module takes the efficiency value as a reward function, optimizes a defense strategy through reinforcement learning, updates a network situation map, an attack behavior knowledge base and an isolation simulation environment through a feedback mechanism, and remarkably improves the coping capacity of the system to complex attacks and attack variations.

Description

Technical Field

[0001] The present application relates to the field of network monitoring technology, and in particular to a network situation monitoring system and method. Background Art

[0002] With the increasing complexity of network attack methods and the heterogeneity of network environments, network situation monitoring has become a core technology for ensuring network security. Among existing technologies, some collect isolated alarm data through intrusion detection systems, firewalls and other devices, but they can only achieve single-point threat detection and cannot correlate and analyze the overall situation. Some also integrate multi-source data to identify attack behaviors based on rule matching or simple machine learning, but data fusion remains at the surface level and lacks in-depth analysis of the causal logic of the attack chain. At the same time, some solutions introduce simulation environments to verify defense strategies, but simulation environments are mostly built based on static states, which deviate from the real environment. In addition, the optimization of defense strategies relies on manual experience and lacks a dynamic iteration mechanism.

[0003] Based on the above shortcomings, the technical problem that this application needs to solve is: how to achieve closed-loop monitoring of network attacks with accurate perception, reliable verification and dynamic optimization in a complex network environment. Summary of the Invention

[0004] In response to the deficiencies of the existing technology, the present application provides a network situation monitoring system and method.

[0005] In a first aspect, the present application provides a network situation monitoring system, the system comprising: a perception fusion module, a simulation verification module, and a response feedback module;

[0006] The perception fusion module is used to acquire multi-source data including network traffic logs, asset configuration databases, and threat intelligence, extract entities and relationships from the multi-source data, and combine it with an attack behavior knowledge base that stores attack chain patterns and causal rules to construct a network situation map. At the same time, the network situation map is processed and analyzed through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths.

[0007] The simulation verification module constructs an isolated simulation environment based on the network situation map and the dynamic mirror of the attack chain, injects the attack chain into the isolated simulation environment, simulates the defense strategy and evaluates the effectiveness of the defense strategy to generate a simulation verification result;

[0008] The response feedback module is used to receive the attack chain, risk transmission path and simulation verification results, use the effectiveness value of the defense strategy as the reward function, optimize the defense strategy through reinforcement learning, and send it to the operation and maintenance system for execution through automated and semi-automated interfaces, monitor the actual effect of the defense strategy after execution, and provide feedback to update the network situation map, attack behavior knowledge base and isolated simulation environment.

[0009] As an optional implementation, the attack chain and risk transmission path identification logic includes:

[0010] The relationship between entities in the network situation map is constructed into a time sequence subgraph through time sequence analysis, and the attack steps are identified in the time sequence subgraph as candidate attack chains;

[0011] Perform causal analysis on the relationships in candidate attack chains using a causal discovery algorithm, calculate the causal strength between attack steps, and select attack chains with causal strength greater than a threshold.

[0012] Taking the initial attack node in the attack chain as the starting point, a risk transmission directed graph is constructed by combining the node reachability and node dependency in the network situation map, and the risk transmission coefficient of each node is calculated through the page-level algorithm to identify the risk transmission path and occurrence probability.

[0013] As an optional implementation, the sub-logic of constructing the network situation map includes:

[0014] Perform layered pre-processing on multi-source data including network traffic logs, asset configuration databases, and threat intelligence;

[0015] Entities from multi-source data are extracted through graph convolutional networks, and relationships between entities are extracted based on long short-term memory networks and conditional random fields. Entities from multi-source data are also aligned based on attribute similarity and relationship consistency.

[0016] Extract the attack chain patterns and causal rules stored in the attack behavior knowledge base, perform semantic mapping between the extracted entities and the attack chain patterns, and match the extracted relationships with the causal rules to obtain the confidence and causal strength of the relationships;

[0017] With entities as nodes and relationships as edges between nodes, a network situation map is constructed, and weights are assigned to edges based on the confidence and causal strength of the relationships.

[0018] As an optional implementation, the dynamic mirroring includes:

[0019] The probe captures the entity's behavior sequence in real time. The entity's behavior sequence includes the asset entity's operation behavior, network interaction characteristics, and threat entity's attack characteristics.

[0020] Perform feature dimensionality reduction on the entity's behavior sequence and assign a behavior identifier to each entity to build an entity's behavior feature library;

[0021] Generate a dynamic image of the entity state at any time point based on the entity's behavioral feature library.

[0022] As an optional implementation manner, the generation logic of the simulation verification result includes:

[0023] Based on the behavioral feature library of entities in the dynamic image, the attack behavior sequence is injected into the isolated simulation environment according to the timestamp of the attack chain, where the attack behavior sequence is associated with the behavior identifier and behavior feature of the entity;

[0024] Simulate the deployment of multiple defense strategies in an isolated simulation environment and compare the behavioral characteristics of entities to obtain the attack blocking success rate, service interruption time, resource consumption, and false alarm rate under different defense strategies.

[0025] The attack blocking success rate, service interruption time, resource consumption, and false alarm rate are correlated with the causal strength of the attack chain to obtain the effectiveness values ​​of different defense strategies.

[0026] Defense strategies are screened based on their effectiveness, and simulation verification results are generated, including the adaptability of defense strategies to the behavioral characteristics of different entities, the coverage of association rules of attack chains, and the execution cost.

[0027] As an optional implementation, the construction sub-logic of the isolated simulation environment includes:

[0028] Based on the behavioral feature library of entities in the dynamic image, the association rules between the behavioral features of the entity to be simulated and the attack chain are extracted, and resources are allocated through the virtualized resource pool to create an isolated network domain;

[0029] The network topology and protocol parameters of the attack chain are replicated through the minimum spanning tree algorithm, and security rules are adapted in the isolated network domain to build an isolated simulation environment.

[0030] Entities that match the real environment are integrated into the isolated simulation environment, and the behavioral feature library of the entity is implanted. At the same time, the functional and performance errors between the isolated simulation environment and the real environment are calibrated to adjust the isolated simulation environment.

[0031] As an optional implementation, the feedback update logic of the network situation map includes:

[0032] Monitor the actual effects of defense strategies after execution, adjust the attributes of entities in multi-source data, and mark the timestamps and reasons for entity status changes;

[0033] Determine the change in the relationship before and after the defense strategy is executed, and adjust the weight assigned to the confidence level of the relationship in proportion to the change;

[0034] When the defense strategy intercepts new attack behaviors, it automatically adds new attack nodes and new relationships, and assigns initial confidence to the new relationships to provide feedback and update the network situation map.

[0035] As an optional implementation, the feedback update logic of the attack behavior knowledge base includes:

[0036] Compare the attack behavior sequences actually intercepted by the defense strategy with the attack chain patterns in the attack behavior knowledge base. Use a sequence comparison algorithm to identify the mutation points of the attack chain pattern, generate a new attack chain pattern, and mark the mutation probability.

[0037] Based on the changes in risk transmission paths after the defense strategy is executed, the intensity threshold of the causal rules in the attack behavior knowledge base is modified;

[0038] Based on the coverage in the simulation verification results, uncovered attack behaviors are extracted to generate candidate rules, which are then used as feedback to update the attack behavior knowledge base.

[0039] As an optional implementation, the optimization sub-logic of the defense strategy includes:

[0040] The causal strength of the attack chain, the probability of occurrence of the risk transmission path, and the fitness and coverage in the simulation verification results are used as state variables to form the state space of reinforcement learning;

[0041] Decompose the defense strategy into defense actions, and associate each defense action with an execution cost to form an action space for strength learning;

[0042] Taking the effectiveness of the defense strategy as the reward function, a Monte Carlo tree search is used to search for a defense action sequence in the state space. In each iteration, the reward function is modified based on the actual effect of the operation and maintenance system monitoring to optimize the defense strategy.

[0043] In a second aspect, the present application provides a network situation monitoring method, comprising: acquiring multi-source data, extracting entities and relationships from the multi-source data, and constructing a network situation map by combining an attack behavior knowledge base storing attack chain patterns and causal rules, and processing and analyzing the network situation map through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths;

[0044] Based on the dynamic mirroring of the network situation map and attack chain, an isolated simulation environment is constructed. The attack chain is injected into the isolated simulation environment to simulate the defense strategy and evaluate its effectiveness to generate simulation verification results.

[0045] Receive attack chains, risk transmission paths, and simulation verification results, use the effectiveness of the defense strategy as a reward function, optimize the defense strategy through reinforcement learning, and send it to the operation and maintenance system for execution through automated and semi-automated interfaces;

[0046] Monitor the actual effects of defense strategies after execution, and provide feedback to update network situation maps, attack behavior knowledge base, and isolated simulation environments.

[0047] Compared with the existing technology, the beneficial effects of the present application are: through the perception fusion module, entities and relationships of multi-source data are extracted and combined with the causal rules of the attack behavior knowledge base to construct a network situation map, and the causal relationship of the attack chain is identified by combining time series analysis and causal discovery algorithm, solving the problems of fragmented attack chain identification and distortion of risk path prediction in the existing technology; the simulation verification module generates a dynamic mirror based on the entity's behavioral feature library to build an isolated simulation environment to ensure the functional and performance consistency of the isolated simulation environment and the real environment. At the same time, the causal strength of the attack chain is associated with the defense effect to calculate the effectiveness value, solving the problems of simulation environment distortion and one-sided strategy evaluation, and providing an accurate basis for defense strategy screening; the response feedback module uses the effectiveness value as the reward function, optimizes the defense strategy through reinforcement learning, and updates the network situation map, attack behavior knowledge base and isolated simulation environment through the feedback mechanism, solving the problems of static defense strategy and poor adaptability in the existing technology, and significantly improving the system's response to complex attacks and attack variations. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be derived from these drawings without inventive effort. Among them:

[0049] Figure 1 A flow chart showing the principles of a network situation monitoring system provided in an embodiment of the present application;

[0050] Figure 2 A logic diagram for generating simulation verification results of a network situation monitoring system provided in an embodiment of the present application;

[0051] Figure 3 An optimized sub-logic diagram of a defense strategy for a network situation monitoring system provided in an embodiment of the present application;

[0052] Figure 4 A flowchart of the steps of a network situation monitoring method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] In order to make the objectives, technical solutions and advantages of the embodiments of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application are clearly and completely described below in conjunction with the drawings in the specification. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments.

[0054] Example 1

[0055] like Figure 1As shown, a principle flow chart of a network situation monitoring system is provided for an embodiment of the present application. The system includes a perception fusion module, a simulation verification module and a response feedback module.

[0056] The perception fusion module is used to obtain multi-source data including network traffic logs, asset configuration databases and threat intelligence, extract entities and relationships from multi-source data, and combine it with the attack behavior knowledge base that stores attack chain patterns and causal rules to construct a network situation map. At the same time, the network situation map is processed and analyzed through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths.

[0057] Furthermore, the sub-logic of constructing the network situation map includes:

[0058] Perform layered pre-processing on multi-source data including network traffic logs, asset configuration databases, and threat intelligence;

[0059] Entities from multi-source data are extracted through graph convolutional networks, and relationships between entities are extracted based on long short-term memory networks and conditional random fields. Entities from multi-source data are also aligned based on attribute similarity and relationship consistency.

[0060] Extract the attack chain patterns and causal rules stored in the attack behavior knowledge base, perform semantic mapping between the extracted entities and the attack chain patterns, and match the extracted relationships with the causal rules to obtain the confidence and causal strength of the relationships;

[0061] With entities as nodes and relationships as edges between nodes, a network situation map is constructed, and weights are assigned to edges based on the confidence and causal strength of the relationships.

[0062] There are significant differences in the sources and formats of network traffic logs, asset configuration data, and threat intelligence. Network traffic logs mostly contain unstructured alarm descriptions and message information, asset configuration data records asset attributes in structured tables, and threat intelligence often presents attack characteristics and vulnerability information in semi-structured text. These differences will lead to format conflicts when the data is directly integrated, and there will be noise or missing values ​​in the original data. If not processed, it will interfere with the accurate extraction of subsequent entities and relationships. In specific implementation, for unstructured network traffic logs, the natural language descriptions therein are semantically parsed through pre-trained language models, and key information such as attack types and involved IP addresses are extracted and converted into structured fields. For structured asset configuration data, the default field mapping rules are used to convert Asset attributes in different formats are uniformly converted into a standard format to ensure consistent representation of information such as operating system version and open ports. For semi-structured threat intelligence, vulnerability numbers and attack characteristics are extracted through information extraction technology, and compared with the internally maintained intelligence validity list to filter outdated intelligence, while adding time attribute tags to retained intelligence. In addition, anomaly detection technology is used to identify and remove noise records in the three types of data. For missing asset attribute data, it is reasonably supplemented by combining the historical interaction data of the asset and the typical configuration of similar assets. This eliminates the format barriers of multi-source data, improves data quality, and provides standardized and high-quality input for the subsequent extraction of entities and relationships, avoiding extraction bias caused by chaotic data formats or noise interference.

[0063] In the preprocessed multi-source data, the same entity is expressed differently in different data sources. For example, the same server is presented as an IP address in the traffic log and as a device name in the asset configuration data. Failure to perform unified identification will lead to duplication or omission of entities. At the same time, the relationships between entities are scattered in different data, and some relationships need to be clarified through reasoning. Failure to extract and align will affect the integrity and accuracy of the graph. In specific implementation, the preprocessed multi-source data is subjected to entity extraction through a graph convolutional network, and type labels are assigned to the entities according to their attribute characteristics and contextual information, including assets, vulnerabilities, and attacks, and a unique identifier is generated for each entity. For entities with different expressions, they are identified by comparing the attributes and association relationships of the entities. For example, assets associated with IP addresses and device names are determined to be the same entity; then, the explicit and implicit relationships between entities are extracted through a combination of long short-term memory networks and conditional random fields. Explicit relationships include the correspondence between assets and open ports, and the association between attack behaviors and involved IPs. Implicit relationships include a certain attack behavior exploiting a certain vulnerability, which is deduced by analyzing the historical association records of attack behaviors and vulnerabilities in threat intelligence. Finally, based on the attribute similarity and relationship consistency of the entities, the identified identical entities are merged into a single node to ensure the uniqueness of the entity; thereby solving the problems of inconsistent entity representation and scattered relationships in multi-source data, forming a structured set of entities and relationships, and ensuring the accuracy and consistency of entities and relationships in subsequent graph construction.

[0064] The collection of entities and relationships can only reflect the static associations between network elements, but cannot reflect the dynamic logical relationships in attack scenarios, that is, the sequence and causal relationship between attack steps. The network situation map needs to include these dynamic information to achieve effective perception of the network situation. In specific implementation, the preset attack chain pattern and causal rules are extracted from the attack behavior knowledge base, where the attack chain pattern includes a typical attack step sequence of scanning, vulnerability exploitation and data theft, and the causal rule includes the probability association of specific attack behaviors when a vulnerability exists. The extracted entities are semantically associated with the standard entities in the attack chain pattern, for example, the specific vulnerabilities in the data are matched with the vulnerability types involved in the attack chain pattern in the knowledge base, and the relationships between entities are associated with the causal rules. Matching is performed, and the confidence and causal strength of the relationship are determined based on the degree of matching. Finally, a network situation map is constructed with entities as nodes and the relationships between entities as edges. The nodes include the attributes of the entities, and the weights of the edges are determined according to the confidence and causal strength of the relationships. At the same time, the network situation map is hierarchically organized according to the asset layer, vulnerability layer, and threat layer to clearly present the associations between different types of entities; so that the network situation map not only includes the static associations between entities, but also incorporates the dynamic causal logic under the attack scenario, which can more comprehensively reflect the security situation of the network, realize the transformation from data association to situation understanding, and provide a rich information basis for the identification of attack chains and risk transmission paths, so that the identification process can be accurately carried out based on the semantics and logical relationships of the attack.

[0065] Specifically, the identification logic of the attack chain and risk transmission path includes:

[0066] The relationship between entities in the network situation map is constructed into a time sequence subgraph through time sequence analysis, and the attack steps are identified in the time sequence subgraph as candidate attack chains;

[0067] Perform causal analysis on the relationships in candidate attack chains using a causal discovery algorithm, calculate the causal strength between attack steps, and select attack chains with causal strength greater than a threshold.

[0068] Taking the initial attack node in the attack chain as the starting point, a risk transmission directed graph is constructed by combining the node reachability and node dependency in the network situation map, and the risk transmission coefficient of each node is calculated through the page-level algorithm to identify the risk transmission path and occurrence probability.

[0069] Network attack behaviors have obvious temporal characteristics, and the attack steps occur in chronological order. However, the relationships in the network situation map do not clearly reflect the time dimension, making it impossible to directly identify the order of the attack steps. Therefore, it is necessary to construct a time subgraph through time series analysis to extract the attack time sequence. In specific implementation, the time information associated with the relationships between entities in the network situation map is extracted, including the time when the attack behavior occurs and the time when the asset status changes. These relationships are sorted according to the time sequence to construct a time subgraph. In the time subgraph, temporal pattern mining technology is used to identify regular attack steps. These attack steps usually include multiple consecutive attack behaviors, such as port scanning, vulnerability exploitation, and finally data theft. At the same time, combined with the network's business logic, behavioral sequences that are consecutive in time but have no actual connection are filtered out. For example, if the normal operation and maintenance of an asset has no direct connection with the attack behavior occurring at the same time, it will not be included in the candidate attack chain. Attack steps with temporal correlation are extracted from the network situation map, and the order of attack behaviors is clarified, providing candidates for subsequent accurate identification of attack chains and avoiding misjudgment of attack chains due to the lack of time dimension.

[0070] For example, different attacks launched by different attackers against the same asset at similar times may be mistakenly identified as the same attack chain based solely on the temporal relationship. Therefore, causal analysis is required to verify the inherent connection between the attack steps. In specific implementation, a causal discovery algorithm is used to perform causal analysis on the attack steps in the candidate attack chain to determine whether the previous step will lead to the occurrence of the next step. The causal strength between the attack steps is determined by analyzing the dependencies between the attack steps, such as whether the vulnerability exploitation depends on the information obtained from the previous port scan, or whether data theft depends on the successful implementation of the vulnerability exploit. Based on the preset strength threshold, the attack steps with a causal strength greater than the strength threshold are selected as valid attack chains, and those false sequences that are continuous in time but have no causal relationship are eliminated. This ensures that the identified attack chain is composed of attack steps with inherent causal connections, improves the accuracy and reliability of attack chain identification, and avoids misjudging accidentally related attack behaviors as complete attack chains.

[0071] The attack chain mainly reflects the attack steps directly implemented by the attacker, while there are complex business dependencies and network connection relationships between assets in the network. After the attack is successful, other assets will be indirectly affected through these relationships. If these risk transmission paths are not identified, the impact range of the attack will be underestimated. Therefore, it is necessary to analyze the risk propagation path in combination with asset correlation. In the specific implementation, the initial attack node in the attack chain is used as the starting point, and the node dependency and node reachability related to the initial attack node in the network situation map are obtained. The node dependency includes a server providing services to multiple other terminals, and the node reachability information includes the network connection method and routing relationship between assets. Then, combined with the causal strength of the attack chain, a risk transmission directed graph is constructed. The nodes in the risk transmission directed graph are assets, and the edges represent the risk transmission between assets. The risk transmission coefficient of each node is calculated by the page-level algorithm. The risk transmission coefficient comprehensively considers factors such as the importance, vulnerability and correlation degree of the asset with the attack node. Finally, according to the size of the risk transmission coefficient, the risk transmission path with higher risk is identified, and the risk transmission coefficient is normalized to give the probability of occurrence of the risk transmission path. These risk transmission paths reflect the main direction in which the attack will spread. In this way, the scope of assets affected by the attack in direct and indirect ways is fully identified, including not only the assets involved in the attack chain, but also the assets affected by the correlation relationship, providing a basis for formulating a comprehensive defense strategy. The identified risk transmission path provides the simulation verification module with threat scenarios that need to be verified in focus, so that the simulation verification can evaluate the effectiveness of the defense strategy for high-risk paths.

[0072] The simulation verification module builds an isolated simulation environment based on the network situation map and the dynamic mirror of the attack chain, injects the attack chain into the isolated simulation environment, simulates the defense strategy and evaluates the effectiveness of the defense strategy to generate simulation verification results.

[0073] Specifically, dynamic mirroring includes:

[0074] The probe captures the entity's behavior sequence in real time. The entity's behavior sequence includes the asset entity's operation behavior, network interaction characteristics, and threat entity's attack characteristics.

[0075] Perform feature dimensionality reduction on the entity's behavior sequence and assign a behavior identifier to each entity to build an entity's behavior feature library;

[0076] Generate a dynamic image of the entity state at any time point based on the entity's behavioral feature library.

[0077] The behavior of network entities has dynamic evolution characteristics, and attack behaviors will vary over time. Static data cannot reflect the real-time status and interaction rules of entities. If we only rely on snapshots at fixed time points, the simulation environment will find it difficult to reproduce the timing characteristics of real attacks, resulting in distortion in defense strategy evaluation. Therefore, it is necessary to build a basic data layer for dynamic mirroring through real-time capture; in specific implementation, distributed probes are deployed at the core nodes of the network. The probes use bypass monitoring mode to avoid interfering with real business. For asset entities, the process life cycle of the operating system layer, metadata changes of the file system, and command sequences of user operations are captured. The process life cycle includes parent process association and memory mapping changes when the process is created, and metadata changes of the file system include permission modifications and access timestamp updates; for network interactions, the establishment or termination timing of the session, the protocol bytes of the message are recorded. Segment variation and link quality fluctuation, among which the protocol field variation of the message includes dynamic adjustment of TCP window size and abnormal combination of HTTP header fields, and link quality fluctuation includes the correlation between packet loss rate and retransmission interval; for threat entities, track the command chain of attack tools, communication fingerprints with C&C servers and jump paths between different assets, among which the command chain of attack tools includes scanning module call, vulnerability detection script loading, and then payload generation execution sequence, while the communication fingerprint with C&C server includes the key negotiation characteristics of encrypted traffic. All captured data are attached with high-precision timestamps and entity unique identifiers to form a multi-dimensional behavior sequence; thereby fully preserving the dynamic characteristics and temporal correlation of entity behavior, avoiding the behavior fragmentation caused by static snapshots, and providing continuous and complete original data support for subsequent feature extraction.

[0078] The original behavior sequence contains a large amount of redundant information and noise data. Directly using it for image generation will lead to a surge in resource consumption and make it difficult to achieve accurate matching of entity behavior. Therefore, it is necessary to extract core features through feature dimensionality reduction and build a structured feature library to support the efficient generation of dynamic images. In specific implementation, the behavior sequence is reduced in dimensionality through the time series feature extraction algorithm. For the operation behavior of asset entities, the benchmark template of periodic operations and the key turning points of abnormal operations are extracted through sequence pattern mining. The benchmark template includes the database backup process at dawn every day, and the key turning points of abnormal operations include the escalation of permissions during non-working hours. The statistical features and abnormal patterns of the network interaction features are extracted through the sliding window technology. The statistical features of the session include The fluctuation range of message volume every 5 minutes, and abnormal patterns include sudden SYN message storms; the dependency of attack steps is decomposed into attack features through the behavior tree model, for example, vulnerability exploitation must be based on the successful port scan. At the same time, a unique behavior identifier is assigned to each entity, and the extracted features are classified and stored according to normal behavior baselines, abnormal behavior patterns and attack feature templates to form an entity's behavior feature library. The behavior feature library supports rapid retrieval based on behavior identifiers and can update feature templates through incremental learning, such as the features of newly added attack variants; thereby eliminating redundant information, extracting core features that can reflect the essence of entity behavior, and reducing data storage and processing costs. At the same time, the structured feature library provides a unified benchmark for cross-scenario matching of entity behavior.

[0079] Simulation verification needs to reproduce the triggering conditions and entity status of the attack chain at a specific time point, such as the asset configuration and the version of the attack tool when the vulnerability is exploited. The entity status changes dynamically over time. If the historical or real-time status mirror cannot be generated on demand, the simulation scenario will have a time deviation from the real attack scenario, resulting in the defense strategy evaluation result losing its reference value. In the specific implementation, based on the entity behavior feature library, the behavior characteristics of the target time point are located through the time axis index, and the hardware resource occupancy status, software configuration parameters and the relationship with other entities at that time point are extracted for the asset entity. The hardware resource occupancy status includes the inflection point of the CPU load curve, the software configuration parameters include the effective version of the firewall rules, and the relationship with other entities includes the network connection topology at that time. The characteristic parameters of the attack tool at that time point and the progress of the attack path are extracted for the threat entity. The characteristic parameters Including the encryption algorithm version of the payload, the progress of the attack path includes the number of assets that have been successfully invaded; the dynamic image stores these key features in a lightweight structure instead of copying the full data of the entity, and associates the evolution trajectory of the previous and subsequent states through timestamps, such as the transition characteristics from the normal state to the invaded state; it also supports the state backtracking function, which can restore the entity state before the attack based on the image, and is used to compare the effect difference before and after the defense strategy takes effect; thereby realizing on-demand generation and time backtracking of the entity state, ensuring that the simulation environment can accurately reproduce the triggering conditions of each link in the attack chain, and at the same time, the lightweight structure reduces the resource consumption of image storage and transmission. The dynamic image provides an entity state benchmark for the isolated simulation environment that is consistent with the real environment, so that the construction of the simulation environment can focus on the key time points and entity characteristics involved in the attack chain, ensuring the authenticity and pertinence of the simulation scenario.

[0080] Furthermore, the construction sub-logic of the isolated simulation environment includes:

[0081] Based on the behavioral feature library of entities in the dynamic image, the association rules between the behavioral features of the entity to be simulated and the attack chain are extracted, and resources are allocated through the virtualized resource pool to create an isolated network domain;

[0082] The network topology and protocol parameters of the attack chain are replicated through the minimum spanning tree algorithm, and security rules are adapted in the isolated network domain to build an isolated simulation environment.

[0083] Entities that match the real environment are integrated into the isolated simulation environment, and the behavioral feature library of the entity is implanted. At the same time, the functional and performance errors between the isolated simulation environment and the real environment are calibrated to adjust the isolated simulation environment.

[0084] The network environment contains a large number of entities that are not related to the current attack chain, such as office terminals and non-core servers. If all entities are simulated, it will lead to resource waste and confusion in the simulation logic. Therefore, it is necessary to screen the core entities related to the attack chain from the dynamic image, extract the association rules between their behavioral characteristics and attack steps, and clarify the simulation scope and logical basis; in the specific implementation, based on the behavioral feature library of the entities in the dynamic image, the entities to be simulated are screened through rule matching, and the entities directly involved in the attack chain, the entities indirectly supporting the spread of the attack, and the core business entities affected by the attack are identified. The entities directly involved in the attack chain include the attacked database server and the malicious IP that initiates the attack, and the entities indirectly supporting the spread of the attack include the database server that is attacked and the malicious IP that initiates the attack. The core business entities affected by the attack include the payment system that relies on the attacked server. At the same time, the behavioral characteristics of these entities and the association rules of the attack chain are extracted. For example, the weak password configuration characteristics of a web server are associated with the triggering of the brute force cracking steps in the attack chain, and the port forwarding rules of the router are dependent on the propagation path of the attack chain. These rules are associated with the entity list and stored to form the core basis for constructing an isolated simulation environment. This accurately defines the simulation scope, eliminates interference from irrelevant entities, and reduces simulation resource consumption. At the same time, clear association rules provide logical constraints for subsequent topology replication and entity deployment, ensuring that the isolated simulation environment focuses on the key links of the attack chain.

[0085] The network topology and protocol parameters directly affect the propagation path of the attack chain and the effectiveness of the defense strategy. The network topology includes the node connection relationship and routing strategy, the protocol parameters include the TCP timeout retransmission mechanism and the MTU value, and the effectiveness includes the blocking range of the firewall rules in a specific topology. If the topology of the isolated simulation environment is too different from the real environment, the evaluation result of the defense strategy will lose its reference value. At the same time, malicious traffic will be generated during the simulation process, and it is necessary to use an isolation domain to prevent it from affecting the real network. In the specific implementation, based on the behavioral characteristics of the entity to be simulated and the association rules of the attack chain, the minimum spanning tree algorithm is used to extract the core links from the real network topology, retaining the node connections that the attack chain must pass through, such as the path from the malicious IP to the border firewall, through the Web server and then to the database, and ignoring the branches that are not related to the attack chain, such as the connection of the employee's office terminal; the network topology is replicated in the virtualized resource pool, and the network topology is configured. Protocol parameters consistent with the real environment are set, such as the OSPF routing priority of the router and the VLAN (virtual local area network) division rules of the switch. An independent isolated network domain is created through virtualization technology. The isolated network domain uses an independent IP address space and network namespace, and a virtual firewall is deployed to prevent traffic within the domain from interacting with the real network. At the same time, the security rules of the real environment are converted into executable rules for the virtual security device in the isolated domain to ensure the consistency of rule logic. For example, the policy of prohibiting external IP access to port 3306 is also effective in the virtual firewall. The security rules include the detection signature library of the IDS (intrusion detection system) and the protection policy of the WAF (website application-level intrusion prevention system). This simplifies the topology and reduces the complexity of the simulation while ensuring the authenticity of the attack chain propagation path. The isolated network domain prevents the overflow of malicious traffic during the simulation process and prevents fluctuations in the real network from interfering with the simulation results.

[0086] Even if the topology is consistent with the rules, the behavior of entities in the isolated simulation environment will still deviate from the real environment. For example, the CPU performance of the virtual server is different from that of the physical machine. The behavior of the entity includes the response delay of the application and the exploitability of the vulnerability. If these errors are not calibrated, the effectiveness evaluation of the defense strategy will be distorted. In specific implementation, the entities with the same configuration as the real environment will be deployed to the corresponding nodes of the isolated network domain. The entities include virtual servers with the same operating system version and database applications with the same version. Then, the behavior feature library of the entities in the dynamic image will be implanted into each entity, so that the entity can reproduce the real behavior pattern in the isolated simulation environment, such as the response time distribution of the Web server to a specific request and the query execution efficiency of the database. By comparing the key indicators of the isolated simulation environment and the real environment, the deviation is calibrated and the configuration of the entity is adjusted to the functional error. Setting parameters, such as enabling specific services that exist in the real environment, where functional errors include a vulnerability not being triggered in the isolated simulation environment; for performance errors, the bandwidth limitations and delay characteristics of the real link are simulated through the QoS mechanism of the virtual network, where performance errors include the transmission delay of attack traffic in the isolated simulation environment being too low. The calibration process is continuously iterated until the behavioral characteristics of the entities in the isolated simulation environment are consistent with those in the real environment, where the behavioral characteristics of the entities include the triggering probability of the attack steps and the response time of the service; thereby eliminating functional and performance deviations between the isolated simulation environment and the real environment, ensuring that the behavior of the entities in the isolated simulation environment is close to reality, laying the foundation for the accurate evaluation of defense strategies. The calibrated isolated simulation environment can truly reproduce the triggering conditions and entity responses of the attack chain, making the injection of attack behavior sequences and the simulation results of defense strategies credible.

[0087] Specifically, if Figure 2 As shown, the generation logic of the simulation verification results includes:

[0088] Based on the behavioral feature library of entities in the dynamic image, the attack behavior sequence is injected into the isolated simulation environment according to the timestamp of the attack chain, where the attack behavior sequence is associated with the behavior identifier and behavior feature of the entity;

[0089] Simulate the deployment of multiple defense strategies in an isolated simulation environment and compare the behavioral characteristics of entities to obtain the attack blocking success rate, service interruption time, resource consumption, and false alarm rate under different defense strategies.

[0090] The attack blocking success rate, service interruption time, resource consumption, and false alarm rate are correlated with the causal strength of the attack chain to obtain the effectiveness values ​​of different defense strategies.

[0091] Defense strategies are screened based on their effectiveness, and simulation verification results are generated, including the adaptability of defense strategies to the behavioral characteristics of different entities, the coverage of association rules of attack chains, and the execution cost.

[0092] The timing and correlation of attack behaviors directly affect the effectiveness of defense strategies. If the injected attack chain doesn't match the timing or characteristics of a real attack, the effectiveness evaluation of the defense strategy will be meaningless. During implementation, the attack chain's attack behavior sequence is extracted from the behavioral feature library of the dynamically mirrored entity and injected into the isolated simulation environment in timestamp order. For each attack step, the corresponding entity's behavioral identifier is associated, such as linking scanning behavior to the behavioral characteristics of malicious IP addresses and linking vulnerability exploitation to the vulnerability characteristics of the attacked asset. During the injection process, the triggering conditions of the attack behavior are ensured to be consistent with the real environment. For example, the vulnerability exploitation step must be triggered after a port scan identifies the target vulnerability and use the same payload characteristics as a real attack, such as encryption algorithm and field structure. Furthermore, the interaction logic between the attack sequence and the environment is verified to be authentic by comparing the entity behavior characteristics. For example, the routing path of the attack traffic in the simulation topology is consistent with the real environment. This accurately reproduces the timing characteristics and triggering logic of a real attack in the simulation environment, ensuring that the attack scenarios faced by the defense strategy are consistent with the real environment, providing a reliable benchmark for subsequent evaluation.

[0093] A single defense strategy will not be able to cope with complex attack chains. A certain defense strategy can block scanning but cannot intercept vulnerability exploitation. In addition, different defense strategies have different impacts on the business. A one-size-fits-all blocking will lead to business interruption, while precise interception has less impact on the business. Therefore, it is necessary to simulate multiple defense strategies in parallel to fully obtain defense effect and business impact data. During specific implementation, multiple independent sub-environments are divided in an isolated simulation environment, and each sub-environment deploys a set of differentiated defense strategies, including passive defense strategies, active defense strategies and hybrid strategies. Passive defense strategies include vulnerability patching and permission tightening, active defense strategies include attack traffic blocking and honeypot luring, and hybrid strategies include blocking first and then patching. Then, the attack blocking success rate and business interruption rate are obtained by comparing the behavioral characteristics of the entity. Time, resource consumption and false alarm rate, including recording the interception ratio of each defense strategy for different steps of the attack chain, such as whether the scan is blocked and the success rate of intercepting vulnerability exploits, recording the duration of core business interruption during the execution of the defense strategy, such as the unavailability time of the payment system, resource consumption includes additional CPU and memory usage, and recording the number of times the defense strategy judges normal business behavior as an attack, such as mistakenly blocking the login request of a legitimate user. All data is associated with the behavior identifier of the entity. For example, the resource consumption of a certain defense strategy is associated with the behavioral characteristics of the protected server to ensure data traceability; thus, the comprehensive performance of multiple groups of defense strategies can be evaluated simultaneously, not only obtaining the defense effect, but also recording the interference of the strategy on the business and resource consumption, providing a multi-dimensional basis for subsequent performance evaluation.

[0094] The pros and cons of defense strategies need to be comprehensively evaluated in combination with the threat level of the attack chain and business needs. The threat level includes the importance of the core attack steps, and the business needs include the interruption tolerance of the core business. If strategies are screened only by a single defense effectiveness indicator, the selected defense strategy may have a good blocking effect but seriously affect the business, or fail to cover the key attack steps. During specific implementation, the obtained attack blocking success rate, business interruption time, resource consumption and false alarm rate will be associated with the causal strength of the attack chain to calculate the effectiveness value. For attack steps with high causal strength, their blocking success rate is given a higher weight in the effectiveness value. Attack steps with high causal strength include the core links that directly lead to data leakage. The weight of the business interruption time is adjusted in combination with the importance of the affected entity. The importance of the affected entity means that the interruption weight of the core database is higher than that of ordinary terminals. Resource consumption and false alarm rate are penalized according to the resource threshold and security requirements of the business. Coefficient, for example, in resource-constrained scenarios, strategies with high resource consumption will be deducted more points; then, based on the effectiveness value, strategies with better overall performance are screened out, and simulation verification results are generated, including the adaptability of the defense strategy to different entity behavior characteristics, the coverage of the association rules of the attack chain, and the execution cost. The adaptability of the defense strategy to different entity behavior characteristics refers to the small interference with the normal operation of a server, the coverage of the association rules of the attack chain by the defense strategy refers to how many key attack steps can be intercepted, and the execution cost refers to the manpower and time cost required for deployment; thereby achieving a multi-dimensional comprehensive evaluation of the defense strategy, avoiding the limitations of a single indicator, and ensuring that the selected defense strategy can not only effectively defend against attacks but also adapt to the actual needs of the business. The adaptability, coverage, and execution cost contained in the simulation verification results provide precise optimization directions for the reinforcement learning of the response feedback module, so that the defense strategy optimization can take into account both defense effect and business adaptability.

[0095] The response feedback module is used to receive attack chains, risk transmission paths and simulation verification results. It uses the effectiveness of the defense strategy as the reward function, optimizes the defense strategy through reinforcement learning, and sends it to the operation and maintenance system for execution through automated and semi-automated interfaces. It monitors the actual effect of the defense strategy after execution and provides feedback to update the network situation map, attack behavior knowledge base and isolated simulation environment.

[0096] Furthermore, if Figure 3 As shown, the optimization sub-logic of the defense strategy includes:

[0097] The causal strength of the attack chain, the probability of occurrence of the risk transmission path, and the fitness and coverage in the simulation verification results are used as state variables to form the state space of reinforcement learning;

[0098] Decompose the defense strategy into defense actions, and associate each defense action with an execution cost to form an action space for strength learning;

[0099] Taking the effectiveness of the defense strategy as the reward function, a Monte Carlo tree search is used to search for a defense action sequence in the state space. In each iteration, the reward function is modified based on the actual effect of the operation and maintenance system monitoring to optimize the defense strategy.

[0100] Optimizing defense strategies requires associating the multidimensional features of attack scenarios. The threat levels of different steps in the attack chain vary. For example, the threat level of core data theft is higher than that of exploratory scanning. The spread potential of risk transmission paths varies. For example, paths through core switches are more dangerous than paths through edge terminals. In addition, the adaptability and coverage of defense strategies in simulation verification directly affect the actual effectiveness. If the state is constructed based on a single feature, the optimized defense strategy will not be able to adapt to complex scenarios. The causal strength of the attack chain is used as the core state variable. Links with high causal strength reflect the inevitable promotion relationship of the attack and are the focus of strategic defense. The probability of occurrence of the risk transmission path is also included. This probability reflects the actual threat spread trend of the path. For example, paths through business systems with close dependencies are more vulnerable to exploitation. At the same time, the adaptability and coverage of the simulation verification results are integrated and mapped into the state space of reinforcement learning through feature association algorithms. This allows reinforcement learning to fully perceive the complexity of the attack scenario, avoid defense strategy optimization deviations caused by one-sided state information, and ensure that the optimization direction takes into account both threat priority and defense strategy applicability.

[0101] A defense strategy is a collection of multiple coordinated operations. Adjusting a single defense strategy is difficult to cope with the multi-step characteristics of the attack chain. For example, blocking scans alone cannot defend against subsequent vulnerability exploitation, and the execution costs and business impacts of different operations vary significantly. For example, offline patching of vulnerabilities is thorough but will interrupt business, and temporary traffic filtering has a smaller impact but the defense is not sustainable. If the defense actions are not decomposed and the costs are not associated, the optimized defense strategy will fail due to out-of-control costs or poor action coordination. During specific implementation, the defense strategy is decomposed into defense actions, including network layer actions, host layer actions, and application layer actions. Network layer actions include dynamically adjusting firewall rules and modifying routing paths, host layer actions include process whitelist updates and vulnerability patch deployment, and application layer actions include API interface access rights are tightened and input validation logic is strengthened. An execution cost is associated with each defense action, including time cost, resource cost, and business impact cost. The time cost includes the length of time the business needs to be suspended for vulnerability patching, the resource cost includes the CPU resources occupied by traffic filtering, and the business impact cost includes the degree to which the tightening of permissions restricts normal operations. These actions and execution costs are integrated into an action space. The combination of actions must meet synergy constraints. For example, patch deployment must be combined with temporary blocking to avoid attacks during deployment. This allows for refined optimization of defense strategies, enabling reinforcement learning to flexibly select combination solutions in the action space, balancing defense effectiveness and execution costs, and avoiding resource waste or business interruption due to overall strategy adjustments.

[0102] Defense strategy optimization in reinforcement learning needs to strike a balance between exploring new action combinations and utilizing known effective actions. Over-reliance on known actions will lead to local optimality, while blind exploration will lead to waste of resources. At the same time, there is a deviation between the simulation verification results and the actual environment, and the optimization direction needs to be dynamically corrected through actual feedback. In specific implementation, the reward function is designed based on the effectiveness of the defense strategy. Strategies with high effectiveness values ​​receive positive rewards, and cost penalty items are introduced. If the execution cost of the defense action exceeds the business tolerance threshold, for example, the core business is interrupted for more than 10 minutes, the reward value is deducted proportionally. Then, the defense action sequence is simulated in the state space through Monte Carlo tree search. Starting from the current state, the possible results of different action combinations are explored, and the effectiveness of each action combination is evaluated based on the reward function. Based on the expected benefits, the action sequence with the highest benefits is selected as the candidate defense strategy. After the candidate defense strategy is sent to the operation and maintenance system, the actual execution effect is monitored in real time, such as whether the attack is blocked as expected and whether the business is running normally. If the deviation between the actual effect and the simulation expectation exceeds the set range, the weight of the corresponding state in the reward function is corrected, and iterative optimization is carried out until the defense strategy effect is stable; so that the optimized defense strategy can not only perform well in the simulation scenario, but also adapt to the dynamic changes of the actual environment. At the same time, it avoids local optimality through action combination exploration, taking into account the defense effect, execution cost and business adaptability. The optimized strategy provides accurate input for the delivery of automated and semi-automated interfaces to ensure that the executed defense strategy is highly matched with the actual attack scenario.

[0103] Specifically, the feedback update logic of the network situation map includes:

[0104] Monitor the actual effects of defense strategies after execution, adjust the attributes of entities in multi-source data, and mark the timestamps and reasons for entity status changes;

[0105] Determine the change in the relationship before and after the defense strategy is executed, and adjust the weight assigned to the confidence level of the relationship in proportion to the change;

[0106] When the defense strategy intercepts new attack behaviors, it automatically adds new attack nodes and new relationships, and assigns initial confidence to the new relationships to provide feedback and update the network situation map.

[0107] The execution of defense strategies directly changes the state characteristics of entities. For example, asset vulnerabilities decrease after vulnerability patching, account operation scope decreases after permission adjustments, and the active state of attack sources changes after traffic blocking. If the attributes of entities in the network situation map are not synchronously updated, subsequent attack chain identification will be based on outdated information. For example, assets with patched vulnerabilities may still be marked as high-risk, affecting the accuracy of situational awareness. In specific implementation, the operation and maintenance system monitors the entity status after defense strategy execution in real time. Assets are checked for vulnerability attributes, configuration attributes, and operational status. Vulnerability attributes include whether the CVE vulnerability status has changed from unpatched to patched; configuration attributes include whether open ports are closed; and operational status includes whether CPU and memory usage have returned to normal. Threat entities are tracked for their attack capability attributes and interaction attributes. Attack capability attributes include whether a malicious IP address is blacklisted and cannot launch new attacks; interaction attributes include whether communication with the C&C server is interrupted. Entity attributes are adjusted based on monitoring results, and each attribute change is labeled with a timestamp and reason for the change. This ensures that the attributes of entities in the network situation map are consistent with their actual state, avoids misjudgments of threats due to outdated attributes, and provides an accurate entity feature foundation for subsequent attack chain identification.

[0108] The strength of the relationship between entities changes dynamically with the execution of the defense strategy. After the defense strategy blocks a communication link, the interactive relationship between the attack source and the target asset will be weakened. After the vulnerability is patched, the relationship between the threat entity and the asset vulnerability will become invalid. If the weight assigned to the relationship remains unchanged, the network situation map will not be able to reflect the actual threat propagation path. For example, the blocked path may be misjudged as still high risk, affecting the accuracy of risk assessment. When implementing the defense strategy, the activity level of the relationship between entities before and after the execution of the defense strategy is compared. For the core relationship in the attack chain, such as the vulnerability exploitation of the Web server caused by malicious IP, the frequency of occurrence, duration and change in the scope of impact of the relationship are counted. For the business dependency relationship, such as the application server to The query interaction of the database evaluates the degree of interference of the execution of the defense strategy on its normal interaction, and adjusts the confidence weight of the relationship according to the proportion of the change. If the activity of the relationship decreases, for example, the number of utilizations decreases, the weight is reduced proportionally; if a new association is triggered by the defense strategy, such as the alarm interaction of the log audit system caused by the execution of the defense strategy, a new relationship is added and assigned an initial weight. The adjusted weight needs to be associated with the attribute change of the entity. For example, the decrease in the relationship weight due to vulnerability repair requires the vulnerability attribute label of the associated asset; thus, the network situation map can dynamically reflect the actual association strength between entities, ensure that the identification of risk transmission paths is based on the current latest relationship status, and improve the real-time and accuracy of threat assessment.

[0109] Network attacks have dynamic evolution characteristics, and defense strategies will intercept unknown attack behaviors, such as new variant viruses and 0day vulnerability exploits. These attacks correspond to entities and relationships that are not included in the network situation map. If they are not added in time, the network situation map will have coverage blind spots, resulting in the subsequent attack chain identification being unable to capture new threat paths; in specific implementation, when the defense strategy intercepts new attack behaviors, it will locate the new entities involved through behavioral feature analysis, including new attack sources, new attack tools or new affected assets. New attack sources include unknown malicious IPs, new attack tools include unlisted malware families, and new affected assets include edge devices that have not been attacked before; new attack nodes are created for these entities and their labels are marked. Core attributes, such as the propagation method of attack tools and the business role of new assets, are used to extract the association relationships between entities in new attack behaviors. The weight distribution of similar known relationships and the threat level of the new attack are combined to assign initial confidence to the new relationships, and the new attack nodes and relationships are integrated into the corresponding layers of the network situation map. For example, the attack source node is added to the threat layer, and the threat layer and vulnerability layer are associated with the relationship, and the interception label of the defense strategy is associated. This expands the coverage of the network situation map for new threats, ensures that the map can fully reflect the entity and relationship status in the current network, provides complete input for the perception fusion module, and improves the system's perception of unknown threats. The newly added attack nodes and relationships provide original materials for updating the attack behavior knowledge base.

[0110] Specifically, the feedback update logic of the attack behavior knowledge base includes:

[0111] Compare the attack behavior sequences actually intercepted by the defense strategy with the attack chain patterns in the attack behavior knowledge base. Use a sequence comparison algorithm to identify the mutation points of the attack chain pattern, generate a new attack chain pattern, and mark the mutation probability.

[0112] Based on the changes in risk transmission paths after the defense strategy is executed, the intensity threshold of the causal rules in the attack behavior knowledge base is modified;

[0113] Based on the coverage in the simulation verification results, uncovered attack behaviors are extracted to generate candidate rules, which are then used as feedback to update the attack behavior knowledge base.

[0114] To evade defense strategies, attackers constantly mutate attack chain patterns. The attack chain patterns in the original attack behavior knowledge base will no longer match the mutated sequences. If mutations are not identified and the attack chain patterns are not updated, defense strategy optimization will be based on outdated attack signatures, resulting in ineffective interception. During implementation, attack behavior sequences actually intercepted by defense strategies are collected and compared with standard attack chain patterns in the attack behavior knowledge base. Sequences of varying lengths are aligned using a dynamic time warping algorithm. For example, if a mutated sequence has one more encryption step than the standard sequence, inserted, deleted, or replaced steps (i.e., mutation points) are identified. The motivation for the mutation point is analyzed, e.g., if encrypted communication is used to evade traffic detection, a new attack chain pattern is generated based on the complete mutated sequence. The mutation type and triggering conditions are annotated. Mutation types include step insertion and tool replacement, and triggering conditions include specific target asset types and specific network environments. The new pattern is associated with the original pattern and stored, such as a variant of a traditional pattern, to facilitate identification of the evolutionary relationship between patterns during subsequent defense strategy optimization. This enables the attack behavior knowledge base to dynamically track the evolution of attack chains, ensuring that the stored patterns are synchronized with current attack methods and providing the latest attack signature references for defense strategy optimization.

[0115] The execution of the defense strategy will change the strength of the causal relationship between the attack steps. If the strength threshold of the causal rule in the attack behavior knowledge base remains unchanged, it will lead to misjudgment of the dependency between the steps during attack chain identification. For example, the patched vulnerability is still considered to have a high possibility of exploitation. During specific implementation, the changes in the risk transmission path after the execution of the defense strategy are analyzed. If the probability of occurrence of a risk transmission path decreases significantly, the corresponding causal rule is traced back. The mapping relationship between the strength threshold of the causal rule and the probability of occurrence of the risk transmission path is determined through association analysis. For example, the decrease in the probability of occurrence of the risk transmission path is positively correlated with the decrease in the strength threshold of the causal rule. The strength threshold of the causal rule is corrected according to the change ratio of the risk transmission path probability. The corrected strength threshold needs to be associated with the defense strategy execution label. For example, if the strength threshold of the causal rule is adjusted due to vulnerability patching, it is convenient to trace the cause of the adjustment. This allows the causal rule to dynamically adapt to the network environment after the defense strategy is executed, ensuring that the causal judgment between the steps during attack chain identification is based on the current actual situation, reducing misjudgments and missed judgments.

[0116] Insufficient coverage is recorded in the simulation verification results. For example, a certain attack step is not effectively intercepted by any defense strategy, which often corresponds to the missing defense rules in the attack behavior knowledge base. These blind spots in defense rules will lead to a lack of pertinence in the optimization of defense strategies and the inability to effectively respond to threats in all links of the attack chain. In specific implementation, the attack links with coverage less than the set standard are extracted from the simulation verification results. For example, the interception rate of the permission maintenance step of a certain defense strategy is 0. The attack characteristics and preconditions of this link are analyzed, including uncollected vulnerability exploitation conditions, unidentified attack tool characteristics or unrelated business scenarios. Among them, the uncollected vulnerability exploitation conditions include configuration defects of specific versions of software, and the unidentified attack tool characteristics include unique functions of malicious scripts. The unrelated business scenarios include attack triggering patterns in a specific time period. Candidate rules are generated based on these features. The candidate rules must clearly include the attack triggering conditions, involved entities, and the logical chain of consequences. After comparing and removing duplicates with the existing rules in the attack behavior knowledge base, the candidate rules are marked with their applicable scenarios and confidence levels, and included in the pending verification area of ​​the attack behavior knowledge base. They will be upgraded to formal rules after subsequent actual interception data confirmation, thereby filling the blind spots of the rules in the attack behavior knowledge base, enabling the defense strategy optimization to cover the entire link of the attack chain, and improving the depth and breadth of the system's defense against complex attacks. The updated knowledge base provides the perception fusion module with more comprehensive attack modes and rules, so that the construction of the network situation map can incorporate the latest attack semantic logic.

[0117] Example 2

[0118] like Figure 4 FIG. 1 is a flowchart of a method for monitoring network status according to an embodiment of the present invention, the method comprising:

[0119] Acquire multi-source data, extract entities and relationships from the data, and build a network situation map by combining it with an attack behavior knowledge base that stores attack chain patterns and causal rules. Simultaneously, process and analyze the network situation map through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths.

[0120] Based on the dynamic mirroring of the network situation map and attack chain, an isolated simulation environment is constructed. The attack chain is injected into the isolated simulation environment to simulate the defense strategy and evaluate its effectiveness to generate simulation verification results.

[0121] Receive attack chains, risk transmission paths, and simulation verification results, use the effectiveness of the defense strategy as a reward function, optimize the defense strategy through reinforcement learning, and send it to the operation and maintenance system for execution through automated and semi-automated interfaces;

[0122] Monitor the actual effects of defense strategies after execution, and provide feedback to update network situation maps, attack behavior knowledge base, and isolated simulation environments.

[0123] Since the principle of solving the problem by the method in the embodiment of the present application is similar to that of the system described above in the embodiment of the present application, the implementation of the method refers to the implementation of the system, and the repeated parts will not be repeated.

Claims

1. A network situation monitoring system, characterized in that: include: Perception fusion module, simulation verification module and response feedback module; The perception fusion module is used to acquire multi-source data including network traffic logs, asset configuration databases, and threat intelligence, extract entities and relationships from the multi-source data, and combine it with an attack behavior knowledge base that stores attack chain patterns and causal rules to construct a network situation map. At the same time, the network situation map is processed and analyzed through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths. The simulation verification module constructs an isolated simulation environment based on the network situation map and the dynamic mirror of the attack chain, injects the attack chain into the isolated simulation environment, simulates the defense strategy and evaluates the effectiveness of the defense strategy to generate a simulation verification result; The response feedback module is used to receive the attack chain, risk transmission path and simulation verification results, use the effectiveness value of the defense strategy as the reward function, optimize the defense strategy through reinforcement learning, and send it to the operation and maintenance system for execution through automated and semi-automated interfaces, monitor the actual effect of the defense strategy after execution, and provide feedback to update the network situation map, attack behavior knowledge base and isolated simulation environment.

2. A network situation monitoring system according to claim 1, characterized in that: The identification logic of the attack chain and risk transmission path includes: The relationship between entities in the network situation map is constructed into a time sequence subgraph through time sequence analysis, and the attack steps are identified in the time sequence subgraph as candidate attack chains; Perform causal analysis on the relationships in candidate attack chains using a causal discovery algorithm, calculate the causal strength between attack steps, and select attack chains with causal strength greater than a threshold. Taking the initial attack node in the attack chain as the starting point, a risk transmission directed graph is constructed by combining the node reachability and node dependency in the network situation map, and the risk transmission coefficient of each node is calculated through the page-level algorithm to identify the risk transmission path and occurrence probability.

3. A network situation monitoring system according to claim 2, characterized in that: The construction sub-logic of the network situation map includes: Perform layered pre-processing on multi-source data including network traffic logs, asset configuration databases, and threat intelligence; Entities from multi-source data are extracted through graph convolutional networks, and relationships between entities are extracted based on long short-term memory networks and conditional random fields. Entities from multi-source data are also aligned based on attribute similarity and relationship consistency. Extract the attack chain patterns and causal rules stored in the attack behavior knowledge base, perform semantic mapping between the extracted entities and the attack chain patterns, and match the extracted relationships with the causal rules to obtain the confidence and causal strength of the relationships; With entities as nodes and relationships as edges between nodes, a network situation map is constructed, and weights are assigned to edges based on the confidence and causal strength of the relationships.

4. A network situation monitoring system according to claim 3, characterized in that: The dynamic mirroring includes: The probe captures the entity's behavior sequence in real time. The entity's behavior sequence includes the asset entity's operation behavior, network interaction characteristics, and threat entity's attack characteristics. Perform feature dimensionality reduction on the entity's behavior sequence and assign a behavior identifier to each entity to build an entity's behavior feature library; Generate a dynamic image of the entity state at any time point based on the entity's behavioral feature library.

5. A network situation monitoring system according to claim 4, characterized in that: The generation logic of the simulation verification result includes: Based on the behavioral feature library of entities in the dynamic image, the attack behavior sequence is injected into the isolated simulation environment according to the timestamp of the attack chain, where the attack behavior sequence is associated with the behavior identifier and behavior feature of the entity; Simulate the deployment of multiple defense strategies in an isolated simulation environment and compare the behavioral characteristics of entities to obtain the attack blocking success rate, service interruption time, resource consumption, and false alarm rate under different defense strategies. The attack blocking success rate, service interruption time, resource consumption, and false alarm rate are correlated with the causal strength of the attack chain to obtain the effectiveness values ​​of different defense strategies. Defense strategies are screened based on their effectiveness, and simulation verification results are generated, including the adaptability of defense strategies to the behavioral characteristics of different entities, the coverage of association rules of attack chains, and the execution cost.

6. A network situation monitoring system according to claim 5, characterized in that: The construction sub-logic of the isolated simulation environment includes: Based on the behavioral feature library of entities in the dynamic image, the association rules between the behavioral features of the entity to be simulated and the attack chain are extracted, and resources are allocated through the virtualized resource pool to create an isolated network domain; The network topology and protocol parameters of the attack chain are replicated through the minimum spanning tree algorithm, and security rules are adapted in the isolated network domain to build an isolated simulation environment. Entities that match the real environment are integrated into the isolated simulation environment, and the behavioral feature library of the entity is implanted. At the same time, the functional and performance errors between the isolated simulation environment and the real environment are calibrated to adjust the isolated simulation environment.

7. A network situation monitoring system according to claim 6, characterized in that: The feedback update logic of the network situation map includes: Monitor the actual effects of defense strategies after execution, adjust the attributes of entities in multi-source data, and mark the timestamps and reasons for entity status changes; Determine the change in the relationship before and after the defense strategy is executed, and adjust the weight assigned to the confidence level of the relationship in proportion to the change; When the defense strategy intercepts new attack behaviors, it automatically adds new attack nodes and new relationships, and assigns initial confidence to the new relationships to provide feedback and update the network situation map.

8. A network situation monitoring system according to claim 7, characterized in that: The feedback update logic of the attack behavior knowledge base includes: Compare the attack behavior sequences actually intercepted by the defense strategy with the attack chain patterns in the attack behavior knowledge base. Use a sequence comparison algorithm to identify the mutation points of the attack chain pattern, generate a new attack chain pattern, and mark the mutation probability. Based on the changes in risk transmission paths after the defense strategy is executed, the intensity threshold of the causal rules in the attack behavior knowledge base is modified; Based on the coverage in the simulation verification results, uncovered attack behaviors are extracted to generate candidate rules, which are then used as feedback to update the attack behavior knowledge base.

9. A network situation monitoring system according to claim 8, characterized in that: The optimization sub-logic of the defense strategy includes: The causal strength of the attack chain, the probability of occurrence of the risk transmission path, and the fitness and coverage in the simulation verification results are used as state variables to form the state space of reinforcement learning; Decompose the defense strategy into defense actions, and associate each defense action with an execution cost to form an action space for strength learning; Taking the effectiveness of the defense strategy as the reward function, a Monte Carlo tree search is used to search for a defense action sequence in the state space. In each iteration, the reward function is modified based on the actual effect of the operation and maintenance system monitoring to optimize the defense strategy.

10. A network situation monitoring method, implemented based on a network situation monitoring system according to any one of claims 1 to 9, characterized in that: include: Acquire multi-source data, extract entities and relationships from the data, and build a network situation map by combining it with an attack behavior knowledge base that stores attack chain patterns and causal rules. Simultaneously, process and analyze the network situation map through time series analysis and causal discovery algorithms to identify attack chains and risk transmission paths. Based on the dynamic mirroring of the network situation map and attack chain, an isolated simulation environment is constructed. The attack chain is injected into the isolated simulation environment to simulate the defense strategy and evaluate its effectiveness to generate simulation verification results. Receive attack chains, risk transmission paths, and simulation verification results, use the effectiveness of the defense strategy as a reward function, optimize the defense strategy through reinforcement learning, and send it to the operation and maintenance system for execution through automated and semi-automated interfaces; Monitor the actual effects of defense strategies after execution, and provide feedback to update network situation maps, attack behavior knowledge base, and isolated simulation environments.

Images