Intelligent network attack surface prediction method and system based on deep learning

Abstract

The invention relates to an intelligent network attack surface prediction method and system based on deep learning, and belongs to the technical field of network security and information, and the method comprises the steps: obtaining network asset information, vulnerability distribution information and external threat intelligence data in a target network environment, and carrying out the preprocessing to generate a standardized data set; inputting the standardized data set into a pre-trained deep learning model to extract a feature vector related to the network attack; reasoning and analyzing a potential attack link based on the feature vector and the knowledge graph, and combining an association relationship among a network asset node, a vulnerability node and a threat intelligence node in the knowledge graph; and finally, according to a reasoning analysis result, evaluating an intrusion path possibly utilized by an attacker, outputting an attack surface prediction result, and presenting the attack surface prediction result in the form of an attack path list. According to the scheme, a potential attack link can be subjected to deep reasoning analysis, an intrusion path possibly utilized by an attacker can be accurately predicted, and the effectiveness of network security protection is improved.

Description

Technical Field

[0001] The present application relates to the fields of network security and information technology, and in particular to an intelligent network attack surface prediction method and system based on deep learning. Background Art

[0002] In today's digital age, network security faces unprecedented challenges, and the methods and approaches of cyberattacks are becoming increasingly complex and diverse. The management and security of network assets have become key technical sub-sectors. Within this area, the collection and analysis of data such as network asset information, vulnerability distribution, and external threat intelligence are fundamental to ensuring network security. By collecting information such as the hardware type, software version, and configuration parameters of network assets, as well as understanding the vulnerability ID, impact scope, and remediation status of known vulnerabilities, and by gathering threat intelligence such as external attack patterns, attack tools, and attacker behavior records, we can gain a preliminary understanding of the network's security status.

[0003] To combat cyberattacks, a common solution currently involves performing simple correlation analysis on various types of collected data. By setting rules and thresholds, the system can determine whether the network presents potential attack risks. For example, if a known vulnerability is detected in a software version and there are records of external attacks targeting that vulnerability, the network asset is considered to be at risk.

[0004] However, this solution suffers from a significant technical issue: it lacks the ability to conduct in-depth reasoning and analysis of potential attack vectors. Simple correlation analysis can only identify surface risks, but cannot accurately predict the complex intrusion paths that attackers might exploit. This creates significant blind spots in network security, making it difficult to effectively respond to increasingly complex cyberattacks. Summary of the Invention

[0005] The main purpose of this application is to provide an intelligent network attack surface prediction method based on deep learning, which can perform in-depth reasoning and analysis of potential attack links, accurately predict the intrusion paths that attackers may exploit, and improve the effectiveness of network security protection.

[0006] To achieve the above objectives, an embodiment of the present invention provides an intelligent network attack surface prediction method based on deep learning, the method comprising: Obtain network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device types, software versions, and configuration parameters; the vulnerability distribution information includes known vulnerability numbers, impact scope, and repair status; and the external threat intelligence data includes attack patterns, attack tools, and attacker behavior records. Preprocessing the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized data set; Inputting the standardized data set into a pre-trained deep learning model to extract feature vectors related to network attacks from the data set, wherein the deep learning model is a multi-layer neural network structure; Based on the feature vector and the knowledge graph, a reasoning analysis is performed on the potential attack link to obtain a reasoning analysis result, wherein the knowledge graph includes the association relationship between the network asset node, the vulnerability node and the threat intelligence node; Based on the reasoning analysis results, the intrusion paths that the attacker may exploit are evaluated, and the attack surface prediction results are output. The attack surface prediction results are presented in the form of an attack path list, which contains specific information about each attack path, including the starting node, intermediate nodes, and target nodes.

[0007] Accordingly, an embodiment of the present application further provides an intelligent network attack surface prediction system based on deep learning, the system comprising: An acquisition module is configured to acquire network asset information, vulnerability distribution information, and external threat intelligence data from a target network environment. The network asset information includes hardware device types, software versions, and configuration parameters; the vulnerability distribution information includes known vulnerability numbers, impact scope, and repair status; and the external threat intelligence data includes attack patterns, attack tools, and attacker behavior records. A preprocessing module, configured to preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized data set; A feature extraction module, configured to input the standardized data set into a pre-trained deep learning model to extract feature vectors related to network attacks from the data set, wherein the deep learning model is a multi-layer neural network structure; An inference analysis module, configured to perform inference analysis on potential attack links based on the feature vectors and the knowledge graph to obtain inference analysis results, wherein the knowledge graph includes associations between network asset nodes, vulnerability nodes, and threat intelligence nodes; The prediction module is used to evaluate the intrusion paths that an attacker may exploit based on the reasoning analysis results and output an attack surface prediction result. The attack surface prediction result is presented in the form of an attack path list, which contains specific information about each attack path, including the starting node, intermediate nodes, and target nodes.

[0008] In summary, the technical solution of the present application is adopted to obtain network asset information, vulnerability distribution information and external threat intelligence data in the target network environment, and preprocess and generate a standardized data set, which can provide comprehensive and standardized data for subsequent analysis. The standardized data set is input into a pre-trained deep learning model to extract feature vectors related to network attacks, and the powerful feature extraction capability of deep learning is used to mine attack-related information hidden in the data. Based on the feature vectors and the knowledge graph, the potential attack links are reasoned and analyzed. Combined with the association between network asset nodes, vulnerability nodes and threat intelligence nodes in the knowledge graph, the intrusion paths that attackers may take can be more accurately discovered. Finally, based on the reasoning analysis results, the intrusion paths that attackers may exploit are evaluated and the attack surface prediction results are output, which are presented in the form of an attack path list, providing network security protection personnel with a clear and definite prevention direction, thereby effectively improving the security and anti-attack capabilities of the network. It can be seen that this solution can perform in-depth reasoning and analysis on potential attack links, accurately predict the intrusion paths that attackers may exploit, and improve the effectiveness of network security protection. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For those skilled in the art, other drawings can be obtained based on these drawings without creative work.

[0010] Figure 1a This is a scenario diagram of an intelligent network attack surface prediction method based on deep learning in an embodiment of the present application; Figure 1b This is a schematic diagram of the implementation framework of the intelligent network attack surface prediction method based on deep learning in the embodiment of the present application; Figure 2 A flowchart of an intelligent network attack surface prediction method based on deep learning is provided for the embodiment of the present application; Figure 3 A flowchart of the reasoning analysis provided in the embodiment of the present application; Figure 4 A schematic diagram of the process of generating candidate attack links provided in an embodiment of the present application; Figure 5 A schematic diagram of a process for updating a candidate attack link set provided in an embodiment of the present application; Figure 6 A schematic diagram of the attack link sorting process provided in an embodiment of the present application; Figure 7 Another schematic diagram of the attack link sorting process provided in an embodiment of the present application; Figure 8 A schematic diagram of the complexity score calculation process provided in the embodiment of the present application; Figure 9 A schematic diagram of the structure of an intelligent network attack surface prediction system based on deep learning provided in an embodiment of the present application; Figure 10 A schematic diagram of the structure of a computer device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0011] The following will be combined with the drawings in the embodiments of this application to clearly and completely describe the technical solutions in the embodiments of this application. Obviously, the embodiments described are only part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without making creative efforts are within the scope of protection of this application.

[0012] The embodiments of the present application provide an intelligent network attack surface prediction method and system based on deep learning, which will be described in detail below.

[0013] In the embodiments of this application, the network attack surface refers to the collection of all potential paths and weak links in the network system that can be exploited by attackers to launch attacks, encompassing multiple dimensions such as hardware, software, network protocols, and human operations. In terms of hardware, this may include chip design flaws or firmware vulnerabilities in devices such as servers and routers. In terms of software, this may include security vulnerabilities in operating systems and applications, such as remote execution vulnerabilities in Windows systems and SQL injection vulnerabilities in web applications. In terms of network protocols, this may include design and implementation flaws in network protocols, such as security vulnerabilities in the early WEP protocol, which can put network communications at risk. Inappropriate or improperly configured network topology, such as opening unnecessary ports and using weak passwords, can increase attack risk exposure.

[0014] In the embodiments of this application, network assets refer to various resources and entities with value within a network environment. These may include hardware, software, and related data and services. Hardware includes servers, terminal devices (such as desktop computers, laptops, and tablets), and network equipment (such as routers and switches). Software includes operating systems, applications, and database management systems, which provide various functions and services for the network. Data may include enterprise business data, user information, and confidential documents.

[0015] In the embodiments of this application, the intelligent network attack surface prediction method based on deep learning is a comprehensive network security analysis method. It involves collecting, processing, and analyzing various data in the target network environment. It aims to use deep learning technology and knowledge graphs to intelligently predict the intrusion paths that attackers may exploit. Specifically, network asset information (including hardware device type, software version, and configuration parameters), vulnerability distribution information (including known vulnerability numbers, impact scope, and remediation status), and external threat intelligence data (including attack patterns, attack tools, and attacker behavior records) are obtained. This data is then preprocessed, including data cleaning, format standardization, and missing value filling, to generate a standardized dataset. A pre-trained deep learning model (a multi-layer neural network structure consisting of convolutional layers, pooling layers, and fully connected layers) is used to extract feature vectors related to network attacks from the dataset. Combined with the knowledge graph (which contains the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes), the model performs inference analysis on potential attack links, assessing the intrusion paths that attackers may exploit. The attack surface prediction result is ultimately output as a list of attack paths. Each attack path includes detailed information about the starting node, intermediate nodes, and target node. The entire process is intelligent, based on deep learning, and predictive, and can effectively improve the pertinence and effectiveness of network security protection.

[0016] like Figure 1a and Figure 1b As shown, a scenario of an intelligent network attack surface prediction method based on deep learning is provided. In this scenario, it mainly includes a network security monitoring system, external threat intelligence of the target network environment, and a data analysis platform; wherein the network security monitoring system, the target network environment (taking a network system as an example), external threat intelligence, and the data analysis platform (such as a data analysis server) are connected through a network.

[0017] For example, in a large enterprise network environment, there are numerous network assets, including servers, terminals, and network devices. These devices run a variety of software and applications and interact with external networks. Network security monitoring systems are tasked with collecting network asset information, vulnerability distribution data, and external threat intelligence data.

[0018] Regarding network asset information collection, the network security monitoring system conducts a detailed scan and identification of each hardware device within the enterprise, determining its hardware type, such as whether the server is a tower server, rack server, or blade server. It also records software versions and configuration parameters. For example, for a database server, the system will record its operating system version, database management system version, and database configuration parameters, such as the maximum number of connections and memory allocation. Different hardware device types and software versions may present different security vulnerabilities.

[0019] Vulnerability distribution information can be collected by regularly performing comprehensive scans of network assets using vulnerability scanning tools. Vulnerability scanning tools detect known vulnerabilities, including their IDs, impact scope, and remediation status. For example, discovering a vulnerability with a specific ID on a server could affect file system access permissions, allowing attackers to illegally access sensitive data. Furthermore, the vulnerability is recorded to determine whether it has been fixed. If not, it warrants further attention.

[0020] External threat intelligence data can be collected through data exchange with threat intelligence platforms. These platforms collect information on global attack patterns, attack tools, and attacker behavior records. For example, if a new attack pattern has recently emerged, where attackers exploit a software vulnerability using a specific attack tool to gain remote control and cause significant damage to other enterprise networks, the network security monitoring system will transmit this collected data to a data analysis platform or store it in a standardized database.

[0021] After receiving data or extracting it from a database, the data analysis platform first performs preprocessing. Data cleaning removes noise and erroneous information from the data, for example, removing duplicate network asset records or incorrect vulnerability information. Format normalization converts data from different sources into a unified format for subsequent analysis. Missing value filling properly fills in missing data. For example, if a device's configuration parameters are missing, the average configuration parameters for similar devices can be used to fill in the missing data. After preprocessing, a standardized dataset is generated.

[0022] The standardized dataset is fed into a pre-trained deep learning model. A deep learning model is a multi-layered neural network structure consisting of convolutional layers, pooling layers, and fully connected layers. The convolutional layer slides a kernel over the data to extract local features, such as identifying specific patterns or characteristics within the data. The pooling layer performs dimensionality reduction on the output of the convolutional layer, reducing the dimensionality of the data while retaining important feature information. The fully connected layer integrates the previously extracted features and outputs a feature vector related to the cyberattack.

[0023] Inferential analysis of potential attack paths is performed based on feature vectors and the knowledge graph. The knowledge graph contains the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes. For example, a network asset node is associated with a specific vulnerability node because the software version running on that network asset has that vulnerability. Simultaneously, that vulnerability node is associated with certain threat intelligence nodes because there are records of external attacks exploiting that vulnerability. Using these relationships, potential attack paths can be inferred.

[0024] Finally, based on the inference analysis results, the attacker's potential intrusion paths are evaluated and an attack surface prediction is output. This attack surface prediction is presented as a list of attack paths, each of which includes detailed information about the starting node, intermediate nodes, and target node. For example, an attack path might involve an attacker from an external network exploiting a vulnerability to compromise a perimeter server (the starting node), then exploiting the perimeter server's permissions to access an internal database server (the intermediate node), ultimately obtaining sensitive data from the database (the target node). Based on this list of attack paths, enterprise network security managers can implement appropriate security measures, such as patching vulnerabilities and strengthening access controls, thereby effectively improving network security.

[0025] refer to Figure 2 , Figure 2 This is a flow chart of a method for predicting an intelligent network attack surface based on deep learning provided by an embodiment of the present application. The method may be executed by a computer device (which may serve as a data analysis server). The computer device may be a single computer device or a cluster of multiple computer devices. The computer device may be a terminal device or a server. The method for predicting an intelligent network attack surface based on deep learning provided by an embodiment of the present application specifically includes: S10: Obtain network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device type, software version, and configuration parameters. The vulnerability distribution information includes known vulnerability numbers, impact scope, and repair status. The external threat intelligence data includes attack patterns, attack tools, and attacker behavior records.

[0026] In the embodiments of the present application, network asset information is a collection of information that comprehensively describes the characteristics of various hardware and software assets in the target network environment. Hardware device types refer to the categories of various physical devices used in the network. For example, servers can be divided into tower servers, rack servers, and blade servers; terminal devices can include desktop computers, laptops, tablets, etc. Different hardware device types have different performance and security features. Software versions refer to the specific version numbers of software such as operating systems and applications installed on hardware devices, such as Windows Server 2019 and Office 2016. Different software versions may lead to different security vulnerabilities, and newer versions of software usually fix some known vulnerabilities. Configuration parameters refer to various setting options for hardware devices and software, such as network configuration parameters for servers and security configuration parameters for databases. The rationality of the settings of these configuration parameters directly affects the security of network assets.

[0027] Vulnerability distribution information is a collection of detailed information about known vulnerabilities in the network. The known vulnerability number is a unique identifier for each vulnerability, which can be used to query the vulnerability database for detailed information. Impact scope refers to the range of network assets that a vulnerability may affect. For example, a vulnerability may affect the entire enterprise's database server or only the terminal devices of a specific department. Remediation status indicates whether the vulnerability has been fixed. If it has not been fixed, it requires special attention, as attackers may exploit it to launch attacks.

[0028] External threat intelligence data is a collection of externally acquired information about network attacks. Attack patterns refer to the methods and strategies employed by attackers, such as brute force attacks, SQL injections, and DDoS attacks. Attack tools are the software or tools used by attackers to carry out attacks, such as hacking tools and malicious scripts. Attacker behavior records are records of attackers' actions on the network, including their IP addresses, attack times, and attack frequency.

[0029] In the embodiment of the present application, by obtaining these three types of data, a comprehensive understanding of the security status of the target network environment can be achieved. From a technical perspective, these data provide a rich information basis for subsequent network attack surface prediction and can help discover potential security risks.

[0030] In one embodiment, network asset information can be comprehensively scanned using a network scanning tool. This tool can use SNMP (Simple Network Management Protocol) to obtain basic device information, including hardware type and software version. Furthermore, it can parse device configuration files to obtain configuration parameters. For large enterprise networks, a distributed scanning approach can be used to improve scanning efficiency.

[0031] For vulnerability distribution information, you can use professional vulnerability scanning software such as Nessus and OpenVAS. These software programs regularly update their vulnerability databases and scan network assets to identify known vulnerabilities, including their IDs, impact, and patch status. The scan results generate detailed reports for subsequent analysis.

[0032] For external threat intelligence data, you can collaborate with professional threat intelligence platforms. These platforms collect information on global attack patterns, attack tools, and attacker behavior records and provide it to enterprises. Enterprises can access this data through APIs and integrate it into their own network security monitoring systems.

[0033] S20: Preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized data set. The preprocessing may include data cleaning, format unification, and missing value filling.

[0034] In the embodiments of this application, data cleaning is the process of removing noise and erroneous information from data. During the data collection process, duplicate device records and incorrect vulnerability information may appear. For example, due to inaccuracies in network scanning, information for the same device may be recorded multiple times. Data cleaning can improve data quality and accuracy, preventing erroneous data from affecting subsequent analysis.

[0035] Format standardization involves converting data from different sources into a unified format. Different data sources may use different data formats, such as date formats and data encoding methods. Format standardization makes data easier to process and analyze, improving the efficiency of data analysis.

[0036] Missing value filling is the process of rationally supplementing missing data. During the data collection process, some data may be missing due to various reasons, such as equipment failure or data transmission interruption. For example, the configuration parameters of a device may be unavailable due to network problems. Missing value filling ensures data integrity and avoids biased analysis results caused by missing data.

[0037] In the embodiments of the present application, preprocessing generates a standardized data set, providing high-quality data input for subsequent deep learning models. The standardized data set enables the deep learning model to better learn the characteristics and patterns in the data, improving the model's performance and prediction accuracy.

[0038] In one embodiment, data cleaning can utilize data mining algorithms, such as cluster analysis and anomaly detection, to identify and delete duplicate records and erroneous information in the data. Format unification can involve writing data conversion scripts to convert data in different formats into a unified format. Missing value filling can be performed using methods such as mean filling, median filling, and model-based filling, depending on the data type and characteristics.

[0039] S30: Inputting the standardized data set into a pre-trained deep learning model to extract feature vectors related to network attacks from the data set, wherein the deep learning model is a multi-layer neural network structure. The multi-layer neural network structure may include convolutional layers, pooling layers, and fully connected layers.

[0040] In the embodiments of the present application, the deep learning model is a machine learning model based on a neural network, which has powerful feature extraction and pattern recognition capabilities. Among them, the multi-layer neural network structure consists of multiple neuron layers, and each layer of neurons is connected to the next layer through weights. The convolution layer slides on the data through the convolution kernel to extract the local features of the data. The convolution kernel is a small matrix that performs a convolution operation on the data to extract the local features of the data. For example, in image recognition, the convolution layer can extract features such as edges and textures in the image. In network attack data, the convolution layer can identify specific attack pattern features in the data.

[0041] The pooling layer performs dimensionality reduction on the output of the convolutional layer, reducing the dimensionality of the data while retaining important feature information. Common pooling operations include max pooling and average pooling. Max pooling selects the maximum value in a local region of the convolutional layer output as the pooling result, while average pooling calculates the average value of the local region. Pooling layers can reduce the amount of computation required for data analysis and improve model training efficiency.

[0042] The fully connected layer integrates the previously extracted features and outputs a feature vector related to the cyberattack. Each neuron in the fully connected layer is connected to all neurons in the previous layer. Using weights and biases, the input features are linearly combined and nonlinearly transformed, ultimately outputting a feature vector.

[0043] In this embodiment, a standardized data set is fed into a deep learning model to automatically extract feature vectors related to cyberattacks from the data. These feature vectors can reflect potential attack patterns and characteristics in the data, providing strong support for subsequent attack chain reasoning and analysis.

[0044] In one embodiment, deep learning models can be trained using a large amount of historical cyberattack data. The data is first divided into a training set and a test set. The training set is used to train the model, while the test set is used to evaluate model performance. During training, a backpropagation algorithm is used to adjust the model's weights and biases, ensuring that the model's output is as close to the true labels as possible. After training is complete, the standardized dataset is input into the trained model to extract feature vectors related to cyberattacks.

[0045] S40: Based on the feature vector and the knowledge graph, perform reasoning analysis on the potential attack link to obtain a reasoning analysis result, wherein the knowledge graph includes the association relationship between the network asset node, the vulnerability node and the threat intelligence node.

[0046] In an embodiment of the present application, a knowledge graph is a graph structure used to represent the relationship between entities. Network asset nodes represent various assets in the network, such as servers, terminal devices, etc. Each node contains relevant information about the network asset, such as hardware device type, software version, etc. Vulnerability nodes represent known vulnerabilities in the network, including vulnerability numbers, impact ranges, and other information. Threat intelligence nodes represent external threat intelligence, including attack patterns, attack tools, and other information. The edges between nodes represent the association relationship between nodes. For example, the edge between a network asset node and a vulnerability node indicates that the network asset has the vulnerability; the edge between a vulnerability node and a threat intelligence node indicates that the vulnerability may be exploited by a certain attack pattern.

[0047] A potential attack link is an intrusion path from the starting node to the target node that an attacker might exploit. Inference analysis is the process of identifying all possible attack links based on feature vectors and the relationships within the knowledge graph. By analyzing feature vectors, we can identify attack-related features in the data. Combined with the relationships within the knowledge graph, we can infer potential vulnerabilities and attack patterns that an attacker might exploit, thereby identifying potential attack links.

[0048] In the embodiments of the present application, reasoning and analysis based on feature vectors and knowledge graphs can identify potential attack links, helping network security personnel understand the possible intrusion paths of attackers in advance, take corresponding preventive measures, and reduce the risk of network attacks.

[0049] In one embodiment, the reasoning analysis can use graph search algorithms, such as breadth-first search and depth-first search, to search for all possible paths in the knowledge graph. Simultaneously, the searched paths are screened and evaluated based on the information in the feature vector. For example, if a vulnerability in a path has been fixed, the path is considered not a valid attack link.

[0050] S50: Based on the reasoning analysis results, evaluate the intrusion paths that the attacker may use, and output the attack surface prediction results. The attack surface prediction results are presented in the form of an attack path list, and each attack path includes specific information of the starting node, intermediate nodes, and target node.

[0051] In the embodiment of the present application, evaluating the intrusion path that an attacker may use is a process of further analyzing and judging the potential attack links obtained by reasoning analysis. Multiple factors need to be considered, such as the success rate of the attack, the cost of the attack, the importance of the target node, etc. The success rate of the attack refers to the probability that the attacker will successfully attack using this path, which is affected by factors such as the difficulty of exploiting the vulnerability and the network's protection measures. The cost of the attack includes the time, resources, and other costs that the attacker needs to pay. The importance of the target node depends on the information and functions contained in the node. For example, the importance of the core business server is usually higher than that of ordinary terminal devices.

[0052] The attack surface prediction results are presented as a list of attack paths, predicting the scope and paths of potential network attacks. Each attack path includes detailed information about the starting node, intermediate nodes, and target node. The starting node can be the attack's starting point, a device at the network edge, or an asset with a vulnerability. Intermediate nodes are nodes that the attack passes through during the attack, potentially including multiple devices or vulnerabilities. The target node is the final target of the attack and typically contains important information or functionality.

[0053] Specific information about the originating node can include network attributes (such as IP address, MAC address, and subnet), device type and configuration (such as the operating system and software version of the server and terminal device), and security status (known vulnerability number, patch status, and protective measures). This information reflects the origin and initial conditions of the attack. Specific information about intermediate nodes can include connection relationships and data transmission (such as connection method, data volume, frequency, and protocol type), device functions and permissions (primary functions, access permissions), and security audit information (audit logs and abnormal activity).

[0054] The target node can be the final destination of the attack, and its specific information can include: multiple items, such as the hardware, including the device type (such as core server, storage array, etc.), hardware configuration (such as CPU model, memory size, storage capacity), and the physical location of the device. The software level includes the operating system version, running applications and their versions, database management system and version, etc., and also involves software security settings such as access control lists and permission management rules. Data-related information includes the type of data stored (such as sensitive customer information, business transaction data, intellectual property information), data importance classification, data update frequency, and data backup status. Security protection information covers deployed firewall rules, intrusion detection system status, encryption algorithms and key management, security vulnerability scanning records and repair status.

[0055] In this embodiment, the intrusion path is evaluated based on the inference analysis results and the attack surface prediction result is output, which can provide network security personnel with clear prevention directions. Network security personnel can take corresponding protective measures based on the attack path list, such as strengthening the protection of target nodes, fixing vulnerabilities, and restricting access, thereby improving network security.

[0056] In one embodiment, each attack path can be assigned a comprehensive score, calculated by weighting factors such as attack success rate, attack cost, and target node importance. Attack paths are ranked based on the comprehensive score, with those with higher scores prioritized. The attack path list is also output to network security personnel to facilitate decision-making and prevention efforts.

[0057] In one embodiment, reference Figure 3 Step S20 may include steps S21-S24, which will be described in detail below: Step S21: extracting network asset nodes, vulnerability nodes, and threat intelligence nodes that match the feature vector from the knowledge graph to generate a set of candidate attack links.

[0058] In this embodiment of the application, the feature vector contains characteristic information related to network attacks. By matching it with nodes in the knowledge graph, network asset nodes, vulnerability nodes, and threat intelligence nodes related to the current data characteristics can be found. Network asset nodes represent actual assets in the network, such as servers and terminal devices; vulnerability nodes represent known network vulnerabilities; and threat intelligence nodes contain information such as external attack patterns and tools. By matching these nodes, possible attack links can be preliminarily determined.

[0059] From a technical perspective, generating a set of candidate attack links can narrow the scope of subsequent analysis, improve the efficiency and accuracy of analysis, and help quickly locate potential attack paths.

[0060] In one embodiment, a similarity calculation-based method can be used for node matching. First, a similarity measurement function between feature vectors and node attributes is defined (e.g., similarity = sum of feature vector and node attribute matching / total number of feature vector attributes), such as cosine similarity. For network asset nodes, a similarity calculation is performed between the network asset features in the feature vector and the node attributes to identify nodes with high similarity. Similarity calculations are also performed for vulnerability nodes and threat intelligence nodes. The matched nodes are then combined according to preset association rules to generate a set of candidate attack links. Association rules can be constructed based on historical attack event statistics. For example, if a vulnerability frequently appears with a certain attack pattern in historical attack events, then when combining nodes, the corresponding vulnerability node and threat intelligence node are combined.

[0061] In one embodiment, reference Figure 4 Step S20 may include steps S211-S214, which will be described in detail below: Step S211: Locate the network asset node in the knowledge graph according to the network asset features in the feature vector, wherein the network asset features include a device identifier and configuration parameters.

[0062] In the embodiments of this application, network asset features are a collection of key information used to accurately describe and identify the characteristics of various network assets. These features can include multiple pieces of information, including a device identifier, which uniquely identifies a network asset, such as its serial number or MAC address. Configuration parameters reflect various device settings, such as network configuration and security configuration. Using the network asset features in the feature vector, the corresponding network asset node can be accurately located in the knowledge graph.

[0063] In the embodiment of the present application, accurately locating network asset nodes is the basis for generating candidate attack links. Only after the relevant network asset nodes are determined can their association with vulnerability nodes and threat intelligence nodes be further analyzed to construct attack links.

[0064] In one embodiment, positioning can be performed using an index search. When constructing the knowledge graph, an index is created for the device identifiers and configuration parameters of network asset nodes. When locating a node, the index is searched based on the network asset features in the feature vector to quickly find a matching network asset node.

[0065] Step S212: Locate the vulnerability node in the knowledge graph according to the vulnerability features in the feature vector, where the vulnerability features include the vulnerability number and the impact range.

[0066] In the embodiments of this application, vulnerability features are a combination of key information used to identify and define the specific conditions of known vulnerabilities in the network. The vulnerability number uniquely identifies each vulnerability, allowing accurate identification of the corresponding vulnerability node in the knowledge graph. The impact scope describes the range of network assets that the vulnerability may affect, helping to further determine the relationship between the vulnerability node and the network asset node.

[0067] In the embodiment of the present application, locating the vulnerability node can clarify the security risks existing in the network, and combining the network asset node and the threat intelligence node can better analyze the potential attack path.

[0068] In one embodiment, vulnerability location can be achieved by linking a vulnerability database with a knowledge graph. First, the vulnerability number in the feature vector is matched with the vulnerability database to obtain detailed vulnerability information. Then, based on this information, the corresponding vulnerability node is searched in the knowledge graph. Furthermore, the impact range information is combined to further filter and identify relevant vulnerability nodes.

[0069] In one embodiment, reference Figure 5 Step S212 may include steps S2121-S2124, which will be described in detail below: Step S2121: extracting key fields of network asset features from the feature vector, wherein the key fields include device type, software version, and configuration parameters.

[0070] In this embodiment, key fields are information used to describe the characteristics of network assets. The device type specifies the physical category of the network asset, such as server or terminal device; the software version reflects the specific version of the software installed on the device; and the configuration parameters reflect the various device settings. Extracting these key fields from the feature vector helps accurately locate network asset nodes in the knowledge graph.

[0071] In one embodiment, key fields may be extracted from the feature vector using preset rules. For example, the location and data type of the key fields may be determined based on the format and data structure of the feature vector, and then extracted according to the rules.

[0072] Step S2122: Query the knowledge graph for network asset nodes that match the key field. If there are multiple matching nodes, calculate the similarity between each matching node and the key field.

[0073] In this embodiment of the present application, searching for matching network asset nodes in the knowledge graph is intended to find nodes related to the current network asset characteristics. When there are multiple matching nodes, similarity calculation can further determine which node has the highest match with the key field. Similarity calculation can be performed based on the node attributes and the content of the key field.

[0074] In the embodiment of the present application, calculating the similarity helps to select the most relevant node among multiple matching nodes, improve the accuracy of node positioning, and avoid erroneous associations.

[0075] In one embodiment, the cosine similarity algorithm is used to calculate the matching degree. Assuming that the key fields constitute vector A and the node attributes constitute vector B, the similarity Sim can be expressed as: Sim = (A・B) / (|A| × |B|), where A・B is the dot product of vectors A and B, and |A| and |B| are the moduli of vectors A and B, respectively. By calculating the cosine similarity between each matching node and the key field, the degree of similarity between them can be quantified.

[0076] Step S2123: Sort the matching nodes according to the similarity, and select the network asset node with the highest similarity as the positioning result.

[0077] In the embodiment of the present application, the matching nodes are sorted and the node with the highest similarity is selected as the positioning result to ensure the accuracy of positioning. Through sorting, the matching degree between each matching node and the key field can be clearly seen, so that the optimal selection can be made.

[0078] In the embodiment of the present application, selecting the node with the highest similarity as the positioning result can improve the accuracy of subsequent attack link analysis and reduce the possibility of misjudgment.

[0079] In one embodiment, a sorting algorithm may be used to sort the matching nodes in descending order according to similarity. After the sorting is completed, the node ranked first is selected as the positioning result.

[0080] Step S2124: If no network asset node matching the key field is found, a new network asset node is created in the knowledge graph and added to the candidate attack link set.

[0081] In this embodiment, if no matching network asset node is found, it indicates that the knowledge graph may lack information about that node. Creating a new network asset node can supplement the knowledge graph and make it more complete. Adding a new node to the set of candidate attack links can also account for possible new attack paths.

[0082] In the embodiment of the present application, creating a new node and adding it to the candidate attack link set can expand the coverage of the attack path and improve the accuracy of the attack surface prediction.

[0083] In one embodiment, key fields related to unmatched network asset characteristics, such as device type, software version, and configuration parameters, are first extracted from the standardized dataset. A new network asset node is then generated based on these key fields, a unique identifier is assigned to the node, and relevant attribute information is added. Finally, the new node is added to the candidate attack link set.

[0084] In one embodiment, step S2124 can be implemented as follows: A1: Extract key fields related to unmatched network asset features from the standardized dataset, where the key fields include device type, software version, and configuration parameters.

[0085] In this embodiment, the standardized dataset is a preprocessed data set that contains information on various aspects, including network assets, vulnerabilities, and threat intelligence. When no node matching the network asset characteristics is found in the knowledge graph, the relevant key fields are extracted from the standardized dataset to obtain detailed information on the unmatched network asset.

[0086] From a technical perspective, accurately extracting key fields can ensure that newly created network asset nodes have accurate attribute information, providing a more reliable foundation for subsequent attack link analysis.

[0087] In one embodiment, key fields related to unmatched network asset features can be extracted from the standardized dataset based on predefined field mapping relationships. For example, the field names of device type, software version, and configuration parameters in the dataset can be determined using a data dictionary and then extracted.

[0088] A2: Generate a new network asset node based on the key field, where the new node contains a unique device identifier and hardware and software attribute information related to the device.

[0089] In this embodiment, the purpose of generating new network asset nodes based on the extracted key fields is to supplement the missing network asset information in the knowledge graph. The unique device identifier is used to distinguish different network asset nodes, and the hardware and software attribute information describes the characteristics of the network asset in detail.

[0090] In the embodiment of the present application, generating new network asset nodes can improve the content of the knowledge graph, so that it more comprehensively reflects the actual situation of the network and helps to discover more potential attack paths.

[0091] In one embodiment, a hash algorithm can be used to generate a unique device identifier for a new node. Based on key fields such as the device type, software version, and configuration parameters, the corresponding hardware and software attribute information is added to the new node. For example, if the device type is a server, hardware attributes such as the server model and processor information are added, as well as software attributes such as the operating system version and installed applications.

[0092] A3: The new node is associated with the existing vulnerability nodes and threat intelligence nodes in the knowledge graph to determine its potential contribution to the attack link.

[0093] In this embodiment, association analysis involves connecting and analyzing newly created network asset nodes with existing vulnerability nodes and threat intelligence nodes in the knowledge graph. The potential attack chain contribution refers to the degree of influence of the new node on the potential attack chain. By performing association analysis and determining the contribution, the importance of the new node in the attack chain can be assessed.

[0094] In the embodiment of the present application, determining the potential attack link contribution of a new node can help network security personnel better understand the impact of the new node on network security and take targeted preventive measures.

[0095] In one embodiment, the degree of association between the new node and the vulnerability node and threat intelligence node can be calculated based on their attribute information. Let Rv be the association between the new node and the vulnerability node, and Rt be the association between the new node and the threat intelligence node. The potential attack link contribution C can be expressed as: C = α × Rv + β × Rt, where α and β are pre-set weight coefficients that are adjusted based on actual conditions to reflect the importance of different associations.

[0096] A4: Based on the potential attack link contribution, calculate the influence weight value of the new node on the candidate attack link set.

[0097] In the embodiment of the present application, the influence weight value is an indicator that measures the influence of the new node on the candidate attack link set. The influence weight value is calculated based on the potential attack link contribution, which can quantify the importance of the new node in the attack link analysis.

[0098] In the embodiment of the present application, calculating the impact weight value can provide a basis for subsequent attack link screening and sorting, making the analysis results more accurate and targeted.

[0099] In one embodiment, a linear weighting method is used to calculate the influence weight. Assuming the potential attack link contribution is C, the influence weight W can be expressed as: W = k × C, where k is the weight coefficient, which can be adjusted based on the network's security policy and actual conditions. For example, for networks with higher security requirements, the value of k can be appropriately increased to increase the influence weight of the new node.

[0100] A5: Add the new node and its influence weight value to the candidate attack link set to expand the coverage of the attack path and improve the accuracy of the prediction result.

[0101] In this embodiment of the present application, adding new nodes and their impact weights to the set of candidate attack links can take into account new attack paths that may be introduced by new nodes. Expanding the coverage of attack paths can more comprehensively identify potential attack risks, and improving the accuracy of prediction results can provide a more reliable decision-making basis for network security protection.

[0102] In the embodiment of the present application, by adding new nodes and their influence weight values, the set of candidate attack links can be made more complete, providing network security personnel with more comprehensive information, which helps them better prevent network attacks.

[0103] In one embodiment, the new node and its impact weight value are added as a new element to the candidate attack link set. In the subsequent analysis process, the new node is processed accordingly according to the impact weight value, such as considering its weight in sorting and screening.

[0104] Step S213: Locate the threat intelligence node in the knowledge graph according to the threat intelligence features in the feature vector, where the threat intelligence features include attack patterns and attack tools.

[0105] In this embodiment, threat intelligence features are key information for locating threat intelligence nodes. Attack patterns describe the attack methods and strategies employed by attackers, while attack tools are the software or tools used by attackers to carry out attacks. Using these features, threat intelligence nodes related to the current attack features can be found in the knowledge graph.

[0106] In the embodiment of the present application, positioning the threat intelligence node can understand external attack trends and means, and combined with the network asset node and vulnerability node, it can more comprehensively analyze potential attack links.

[0107] In one embodiment, text matching can be used for location. The attack pattern and attack tool information in the feature vector is matched against the attributes of the threat intelligence nodes in the knowledge graph to identify nodes with a high degree of match. Semantic analysis techniques can also be incorporated to improve matching accuracy.

[0108] Step S214: The network asset nodes, vulnerability nodes, and threat intelligence nodes are combined according to preset association rules to generate a candidate attack link set, where the association rules are constructed based on historical attack event statistical data.

[0109] In the embodiment of the present application, the preset association rules are the association relationships between nodes summarized based on historical attack event statistics. By combining the located network asset nodes, vulnerability nodes, and threat intelligence nodes according to these rules, possible attack links can be generated.

[0110] In the embodiment of the present application, generating a set of candidate attack links can provide a basis for subsequent analysis, help discover potential attack paths, and take preventive measures in advance.

[0111] In one embodiment, association rules can be expressed as connection conditions between nodes. For example, if historical data shows that a vulnerability is frequently used in conjunction with a certain attack pattern to attack a specific type of network asset, then when combining nodes, the corresponding vulnerability node, threat intelligence node, and network asset node are connected to form an attack chain. All node combinations that meet the association rule are added to the candidate attack chain set.

[0112] Step S22: For each attack link in the candidate attack link set, calculate its attack success rate and attack cost, wherein the attack success rate is determined according to the vulnerability exploitation difficulty and the threat intelligence matching degree, and the attack cost is determined according to resource consumption and time cost.

[0113] In the embodiments of the present application, the attack success rate reflects the possibility of an attacker successfully carrying out an attack using the attack link. The difficulty of exploiting a vulnerability refers to the ease or difficulty of exploiting the vulnerability. For example, some vulnerabilities require specific technical means or conditions to be exploited, and their exploitation difficulty is relatively high. The threat intelligence matching degree refers to the degree of matching between the attack mode and tools in the attack link and the external threat intelligence data. The higher the matching degree, the higher the attack success rate may be. The attack cost is the cost that the attacker needs to pay to carry out the attack. Resource consumption includes computing resources, network bandwidth, etc. that the attacker needs to use, and time cost is the time required to complete the attack.

[0114] In the embodiment of the present application, calculating the attack success rate and attack cost can quantify the feasibility and cost of each attack link. By analyzing these two indicators, the priority of the attack link can be evaluated, providing a basis for subsequent sorting and screening.

[0115] In one embodiment, to calculate the attack success rate, weights can be assigned to the vulnerability exploitation difficulty and threat intelligence matching degree, respectively, and then a weighted sum is performed. For example, the vulnerability exploitation difficulty is weighted as 0.6, and the threat intelligence matching degree is weighted as 0.4. The weighted sum of the two scores is used to obtain the attack success rate. To calculate the attack cost, an estimate can be made based on historical data on resource consumption and time costs. For example, based on the computing resources and time required for similar attacks in the past, combined with the characteristics of the current attack chain, the resource consumption and time cost of the current attack are estimated, and the two are added together to obtain the attack cost.

[0116] Step S23: Sort the attack links in the candidate attack link set according to the attack success rate and the attack cost, and generate a priority attack link list.

[0117] In the embodiments of the present application, the purpose of sorting is to prioritize candidate attack links based on attack success rate and attack cost. Attack links with high attack success rate and low attack cost are given higher priority because these links are more likely to be adopted by attackers and the attackers incur lower costs. By sorting and generating a prioritized attack link list, network security personnel can quickly understand which attack links require the most attention.

[0118] In the embodiment of the present application, generating a priority attack link list helps network security personnel to reasonably allocate resources, give priority to attack links with higher priorities, and improve the efficiency of network security protection.

[0119] In one embodiment, weights can be assigned to the attack success rate and attack cost, respectively, to calculate a comprehensive score for each attack link. For example, if the attack success rate is weighted 0.7 and the attack cost is weighted 0.3, the attack success rate score multiplied by 0.7 is added to the attack cost score multiplied by 0.3 to obtain the comprehensive score. The attack links are then sorted in descending order based on the comprehensive score, with the highest score at the top, to generate a preliminary ranked list. Next, the attack links in the preliminary ranked list are screened, removing those that do not meet security constraints, such as attack path length exceeding the limit or node access rights not meeting requirements. Finally, the screened attack links are re-ranked to generate a final prioritized attack link list.

[0120] In one embodiment, reference Figure 6 Step S23 may include S231-S234, which will be described in detail below: Step S231: assigning a weight value to each attack link in the candidate attack link set, where the weight value is calculated by the weighted sum of the attack success rate and the attack cost.

[0121] In the embodiments of this application, the attack success rate and attack cost are indicators for evaluating the feasibility and cost of an attack link. By assigning a weight to each attack link through a weighted summation method, the impact of these two factors on the attack link can be comprehensively considered. The attack success rate reflects the probability of the attack link being successfully executed, while the attack cost reflects the cost required for the attacker to carry out the attack.

[0122] In the embodiment of the present application, assigning weight values ​​to attack links can quantitatively evaluate the attack links, facilitate subsequent sorting and screening operations, and make the analysis results more objective and accurate.

[0123] In one embodiment, let P be the attack success rate and C be the attack cost. The weight W can be expressed as: W = λ × P + μ × C, where λ and μ are pre-set weight coefficients that can be adjusted based on the network's security policy and actual conditions. For example, for networks with high security requirements, λ can be increased to prioritize the attack success rate; for networks with limited resources, μ can be increased to prioritize the attack cost. For example, the weight coefficient for the attack success rate is 0.7, and the weight coefficient for the attack cost is 0.3. For each attack link, multiply the attack success rate by 0.7 and the attack cost by 0.3, and then add the two together to obtain the weight value for that attack link.

[0124] Step S232: sorting the attack links in the candidate attack link set in descending order according to the weight values ​​to generate a preliminary sorting list.

[0125] In this embodiment, descending sorting arranges the attack links in descending order based on their weights. Attack links with larger weights have a higher priority in the comprehensive evaluation results and are more likely to be adopted by attackers. Generating a preliminary sorted list allows network security personnel to quickly understand the priority order of attack links.

[0126] In the embodiment of the present application, generating a preliminary sorting list can provide a basis for subsequent screening and adjustment, allowing network security personnel to focus on the most threatening attack links.

[0127] In one embodiment, a quick sorting algorithm may be used to sort the attack links in the candidate attack link set in descending order according to their weight values. After the sorting is completed, a preliminary sorting list is obtained.

[0128] Step S233: Screen the attack links in the preliminary sorting list and remove attack links that do not meet security constraints. The security constraints include attack path length limit and node access permission limit.

[0129] In the embodiments of this application, security constraints are designed to ensure that the selected attack paths comply with the network's security policy and actual conditions. The attack path length limit means the number of nodes in the attack path cannot exceed a certain threshold. Attack paths that are too long may be impractical or difficult to implement. Node access permission restrictions mean that nodes in the attack path must have the appropriate access permissions; otherwise, the attack cannot proceed.

[0130] In the embodiment of the present application, screening out attack links that do not meet security constraints can improve the effectiveness of attack link analysis, avoid analyzing unrealistic attack paths, and save analysis resources.

[0131] In one embodiment, each attack link in the preliminary sorted list is traversed to check whether it satisfies the security constraints. Let the attack path length be L and the node access permission satisfaction be A (1 for satisfaction and 0 for non-satisfaction). If L exceeds a preset length threshold or A = 0, the attack link is removed from the list.

[0132] Step S234: reorder the filtered attack links to generate a final priority attack link list.

[0133] In the embodiment of the present application, reordering is to sort the remaining attack links again after filtering out the attack links that do not meet the security constraints. Generating a final prioritized attack link list can provide network security personnel with the most accurate and valuable attack link information, enabling them to formulate network security prevention strategies more accurately.

[0134] In an embodiment of the present application, the final priority attack link list focuses on attack paths that meet security constraints and have a higher priority in comprehensive evaluation, which helps network security personnel concentrate on preventing and handling these high-risk attack links, thereby improving the efficiency and pertinence of network security protection.

[0135] In one embodiment, a sorting algorithm (such as merge sort) is used again to sort the filtered attack links in descending order of weight. After sorting, a final prioritized attack link list is formed. The attack links in this list are arranged from high to low priority, making it easier for network security personnel to handle them according to priority.

[0136] Step S24: selecting an attack link that meets preset conditions from the priority attack link list and outputting it as a reasoning analysis result. The preset conditions include that the attack success rate is greater than a first threshold and the attack cost is less than a second threshold.

[0137] In this embodiment, the preset conditions are designed to further filter out the most threatening attack paths. The first and second thresholds are set based on the network's security policy and actual conditions. An attack success rate greater than the first threshold indicates a high probability of being adopted by an attacker, while an attack cost less than the second threshold indicates a low cost for the attacker to carry out the attack. By filtering attack paths that meet the preset conditions, we can focus on the most dangerous attack paths.

[0138] In the embodiment of the present application, the attack links that meet the preset conditions are output as the reasoning analysis results, which can provide network security personnel with clear prevention targets. Network security personnel can take corresponding protective measures against these attack links to reduce the risk of network attacks.

[0139] In one embodiment, a prioritized list of attack links is traversed. For each attack link, the attack success rate is checked to see if it exceeds a first threshold and the attack cost is less than a second threshold. If these conditions are met, the attack link is added to the reasoning analysis results. Finally, the reasoning analysis results are output in a clear format, such as a list, to facilitate review and processing by network security personnel.

[0140] In one embodiment, reference Figure 7 After generating a priority attack link list according to the attack success rate and attack cost in step S24, the method of the present application may further include: Step S26: For each attack link, calculate the complexity score of its attack path, where the complexity score is determined by the number of nodes in the attack path, the node type, and the complexity of the relationship between the nodes.

[0141] In this embodiment, the attack path complexity score is a quantitative assessment of the complexity of the attack chain. The number of nodes reflects the length of the attack path; the more nodes there are, the more complex the attack path may be. Node types include network asset nodes, vulnerability nodes, and threat intelligence nodes. The combination of different types of nodes increases the complexity of the attack path. The complexity of the relationships between nodes reflects the dependencies and interactions between nodes. Complex relationships make the attack path more difficult to predict and prevent.

[0142] In the embodiment of the present application, calculating the complexity score of the attack path can help network security personnel further understand the characteristics of the attack link and pay more attention to and take precautions against attack links with higher complexity.

[0143] In one embodiment, different weighting coefficients can be set for the number of nodes, node type, and complexity of inter-node relationships. In one embodiment, assuming the number of nodes is N, the node type complexity score is T, and the inter-node relationship complexity score is R, the complexity score S can be expressed as: S = γ × N + δ × T + ε × R, where γ, δ, and ε are pre-set weighting coefficients that can be adjusted based on actual conditions to reflect the impact of different factors on the complexity score.

[0144] For example, the weight coefficient for the number of nodes is 0.3, the weight coefficient for the node type is 0.3, and the weight coefficient for the complexity of the relationships between nodes is 0.4. The number of nodes, the diversity of node types, and the complexity of the relationships between nodes are quantitatively scored separately. The scores for each component are then multiplied by the corresponding weight coefficients and added together to obtain the complexity score of the attack path.

[0145] In one embodiment, reference Figure 8 Step S26 may include steps S261-S265, which will be described in detail below: Step S261: Determine the number of nodes in the attack path, where the number of nodes includes the total number of network asset nodes, vulnerability nodes, and threat intelligence nodes.

[0146] In the embodiments of this application, the number of nodes in the attack path is a fundamental indicator of attack path complexity. Network asset nodes represent the actual devices and resources in the network, vulnerability nodes reflect security risks within the network, and threat intelligence nodes contain external attack information. The number of nodes directly reflects the length and scope of the attack path.

[0147] In the embodiment of the present application, determining the number of nodes can provide basic data for the subsequent calculation of the complexity score of the attack path. The more nodes there are, the more complex the attack path may be, requiring more resources and effort to prevent.

[0148] In one embodiment, all nodes in the attack path may be traversed to count the number of network asset nodes, vulnerability nodes, and threat intelligence nodes respectively, and then add them up to obtain the total number of nodes.

[0149] Step S262: assigning a complexity weight value to each node according to the node type, wherein the complexity weight value is determined based on the risk level of the node type and the closeness of the association relationship.

[0150] In the embodiments of this application, different types of nodes have different risk levels and associations. For example, important network asset nodes such as core servers have higher risk levels, are likely to have more associated vulnerability nodes and threat intelligence nodes, and have a greater impact on the attack path; whereas some common terminal device nodes have relatively lower risk levels. Assigning a complexity weight value to each node based on its type can more accurately reflect the node's importance in the attack path.

[0151] In the embodiment of the present application, a reasonable allocation of complexity weight values ​​can make the attack path complexity score more accurate, which helps network security personnel better assess the risk of the attack path.

[0152] In one embodiment, risk level assessments and relationship analysis are first performed on different types of nodes. Nodes with high risk levels and strong relationships are assigned higher complexity weights; nodes with low risk levels and weaker relationships are assigned lower complexity weights. For example, a node's risk level score can be Rr, and its relationship strength score can be Rc. The node's complexity weight Wn can be expressed as: Wn = κ × Rr + λ × Rc, where κ and λ are pre-set weight coefficients that can be adjusted based on actual conditions to highlight the importance of different factors.

[0153] For example, the complexity weight value of the core server node can be set to 0.8, and the complexity weight value of the common terminal device node can be set to 0.2.

[0154] Step S263: Calculate the weighted sum of the complexity weight values ​​of all nodes in the attack path to obtain a preliminary complexity score.

[0155] In this embodiment of the present application, by calculating the weighted sum of the complexity weights of all nodes, the contribution of each node in the attack path can be comprehensively considered to obtain a preliminary complexity score. This score reflects the overall complexity of the nodes in the attack path.

[0156] In the embodiment of the present application, the preliminary complexity score can be used as a preliminary measurement indicator of the complexity of the attack path, providing a basis for subsequent adjustments.

[0157] In one embodiment, the complexity weight of each node in the attack path is multiplied by the number of nodes (if there are multiple nodes of the same type), and all the results are summed to obtain a preliminary complexity score. For example, if there are n nodes in the attack path and the complexity weight of the i-th node is Wn_i, the preliminary complexity score Sp can be expressed as: Sp = Σ(Wn_i) (where i ranges from 1 to n).

[0158] Step S264: adjusting the preliminary complexity score according to the complexity of the relationship between nodes, where the complexity of the relationship between nodes is determined by the dependency and interaction frequency between nodes.

[0159] In the examples of this application, the complexity of inter-node relationships is a key factor influencing the complexity of the attack path. Inter-node dependencies indicate the degree to which one node's status affects other nodes, while interaction frequency reflects the frequency of information transfer and interaction between nodes. By adjusting the preliminary complexity score based on the complexity of inter-node relationships, the actual complexity of the attack path can be more accurately assessed.

[0160] In the embodiment of the present application, adjusting the preliminary complexity score can make the complexity score of the attack path more consistent with the actual situation, providing network security personnel with a more accurate decision-making basis.

[0161] In one embodiment, the dependency relationships and interaction frequency data for all nodes in the attack path are first extracted from the knowledge graph. Based on this data, the complexity coefficient of the internode relationships is calculated and multiplied by the initial complexity score to obtain an adjusted complexity score. For example, in one embodiment, assuming the complexity coefficient of the internode relationships is Cr, the adjusted complexity score Sa can be expressed as: Sa = Sp × Cr, where Cr is determined by the depth of the internode dependencies and the frequency distribution of the interaction frequencies.

[0162] In one embodiment, step S264: adjusting the preliminary complexity score according to the complexity of the relationship between nodes may specifically include: B1: Extract the dependency and interaction frequency data between all nodes in the attack path from the knowledge graph.

[0163] In this embodiment of the present application, the knowledge graph stores the relationships between network asset nodes, vulnerability nodes, and threat intelligence nodes, including information such as dependencies and interaction frequencies. Extracting this data from the knowledge graph provides a comprehensive understanding of the interactions between nodes in the attack path. Dependencies reflect the impact of one node's status on other nodes, while interaction frequencies reflect the frequency of information transfer and interaction between nodes.

[0164] In the embodiment of the present application, the extracted dependency and interaction frequency data provide basic data for calculating the complexity coefficient of the relationship between nodes, which helps to more accurately evaluate the complexity of the attack path.

[0165] In one embodiment, a graph query language (such as Cypher) can be used to query the knowledge graph for dependency relationships and interaction frequency data between all nodes in the attack path. Based on the identifiers of the nodes in the attack path, the relevant nodes are located in the knowledge graph, and the dependency relationships and interaction frequency information represented by the edges between them are extracted.

[0166] B2: Calculate the complexity coefficient of the relationship between nodes based on the dependency relationship and interaction frequency data. The complexity coefficient is determined by the depth of the dependency relationship and the frequency distribution of the interaction frequency.

[0167] In the embodiments of this application, the dependency depth describes the hierarchy and complexity of the dependencies between nodes, while the frequency distribution of interaction frequency reflects the regularity and frequency of interactions between nodes. By comprehensively considering these two factors, the complexity coefficient of the inter-node relationship can be calculated, which can more accurately measure the complexity of the inter-node relationship.

[0168] In the embodiment of the present application, calculating the complexity coefficient can provide an accurate basis for adjusting the preliminary complexity score, so that the complexity score of the attack path is more in line with the actual situation.

[0169] In one embodiment, different weighting coefficients can be set for the depth of the dependency relationship and the frequency distribution of the interaction frequency. Assuming, in one embodiment, the dependency depth score is Dd and the interaction frequency distribution score is If, the complexity coefficient Cr of the inter-node relationship can be expressed as: Cr = η × Dd + θ × If, where η and θ are pre-set weighting coefficients, which are adjusted according to actual conditions to reflect the importance of different factors. For example, the weighting coefficient for the depth of the dependency relationship is 0.6, and the weighting coefficient for the frequency distribution of the interaction frequency is 0.4. The depth of the dependency relationship and the frequency distribution of the interaction frequency are quantitatively scored, and then the scores of each component are multiplied by the corresponding weighting coefficients and added together to obtain the complexity coefficient of the inter-node relationship.

[0170] B3: Multiplying the complexity coefficient by the preliminary complexity score to obtain an adjusted complexity score.

[0171] In this embodiment, the complexity coefficient is multiplied by the preliminary complexity score to incorporate the complexity of inter-node relationships into the attack path complexity assessment. The adjusted complexity score comprehensively considers the number of nodes in the attack path, the node type, and the complexity of the inter-node relationships, more accurately reflecting the actual complexity of the attack path.

[0172] In the embodiment of the present application, the adjusted complexity score can provide network security personnel with more accurate attack path complexity information, which helps them formulate network security prevention strategies more reasonably.

[0173] In one embodiment, the calculated complexity coefficient is directly multiplied by the preliminary complexity score to obtain an adjusted complexity score, which is used as the new complexity score of the attack path for subsequent analysis.

[0174] Step S265: The adjusted complexity score is used as the final complexity score of the attack path.

[0175] In the examples of this application, the adjusted complexity score comprehensively considers the number of nodes in the attack path, the node types, and the complexity of the relationships between nodes, more accurately reflecting the actual complexity of the attack path. Using this as the final complexity score can provide a reliable evaluation indicator for network security personnel.

[0176] In the embodiment of the present application, the final complexity score can help network security personnel to accurately assess the risk of attack paths, take targeted preventive measures, and improve the effectiveness of network security protection.

[0177] In one embodiment, the adjusted complexity score is directly used as the final complexity score of the attack path and recorded for subsequent sorting and analysis.

[0178] Step S27: performing secondary sorting on the attack links in the priority attack link list according to the complexity score to generate an adjusted attack link list.

[0179] In the embodiment of the present application, the secondary sorting is based on the priority attack link list, and the attack links are reordered according to the complexity score of the attack path. The generated adjusted attack link list can put the more complex attack links at the front, allowing network security personnel to prioritize these complex attack paths.

[0180] In the embodiment of the present application, the adjusted attack link list can help network security personnel to reasonably allocate resources, first prevent complex and high-priority attack links, and improve the effectiveness of network security protection.

[0181] In one embodiment, a sorting algorithm (such as heap sort) is used to sort the attack links in the priority attack link list in descending order according to the complexity score. After the sorting is completed, an adjusted attack link list is obtained.

[0182] Step S28: Filter out attack links that meet preset security constraints from the adjusted attack link list, where the security constraints include the shortest path restriction of the attack path and the minimum permission requirement for node access rights.

[0183] In this embodiment, the preset security constraints are designed to ensure that the selected attack paths comply with the network's security policy and actual conditions. The shortest attack path constraint requires that the attack path be too short, as such a short attack path may not conform to the actual attack logic. The minimum node access permission requirement requires that nodes in the attack path must have certain access permissions, otherwise the attack cannot proceed normally.

[0184] In the embodiment of the present application, screening attack links that meet security constraints can further improve the effectiveness of attack link analysis, exclude attack paths that do not meet the requirements, and enable network security personnel to focus on truly threatening attack links.

[0185] In one embodiment, each attack link in the adjusted attack link list is traversed to check whether it meets the preset security constraints. If the attack path length is less than the shortest path limit or the node access permission is lower than the minimum permission requirement, the attack link is removed from the list.

[0186] Step S29: Reorder the filtered attack links to generate a final attack link list.

[0187] In the embodiment of the present application, reordering is to sort the remaining attack links again after filtering out the attack links that do not meet the security constraints. Generating a final attack link list can provide network security personnel with the most accurate and valuable attack link information, enabling them to formulate network security prevention strategies more accurately.

[0188] In an embodiment of the present application, the final attack link list focuses on attack paths that meet security constraints and have high complexity and priority, which helps network security personnel concentrate on preventing and handling these high-risk attack links, thereby improving the efficiency and pertinence of network security protection.

[0189] In one embodiment, a sorting algorithm (such as insertion sort) is used again to comprehensively sort the filtered attack links based on complexity score and priority. After sorting, a final attack link list is formed. The attack links in this list are arranged from high to low based on the comprehensive evaluation priority, making it easier for network security personnel to handle them according to priority.

[0190] In summary, the deep learning-based intelligent network attack surface prediction method provided in this application ensures the comprehensiveness, accuracy, and consistency of data at the data processing level by acquiring network asset information, vulnerability distribution information, and external threat intelligence data from the target network environment and preprocessing it to generate a standardized data set. This provides high-quality data for subsequent deep learning models, enabling the models to more effectively learn and mine the potential information in the data, thereby improving their ability to extract network attack characteristics.

[0191] In attack chain analysis and prediction, deep learning models are used to extract feature vectors, and combined with knowledge graphs, they perform reasoning analysis of potential attack chains, accurately identifying potential intrusion paths that attackers may exploit. By comprehensively evaluating and analyzing multiple factors, including attack success rate, attack cost, and attack path complexity, accurate attack surface predictions are generated. This helps network security personnel proactively understand network security risks, formulate targeted prevention strategies, rationally allocate security resources, improve network security and attack resistance, and effectively respond to increasingly complex and volatile network attack threats.

[0192] Accordingly, in order to better implement the above method, the embodiment of the present application also provides an intelligent network attack surface prediction system based on deep learning. Figure 9 As shown, the deep learning-based intelligent network attack surface prediction system 80 includes: Acquisition module 801 is used to obtain network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device type, software version, and configuration parameters; the vulnerability distribution information includes known vulnerability numbers, impact scope, and repair status; and the external threat intelligence data includes attack patterns, attack tools, and attacker behavior records. A preprocessing module 802 is configured to preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized data set; A feature extraction module 803 is configured to input the standardized data set into a pre-trained deep learning model to extract feature vectors related to network attacks from the data set, wherein the deep learning model is a multi-layer neural network structure; A reasoning analysis module 804 is configured to perform reasoning analysis on potential attack links based on the feature vectors and the knowledge graph to obtain reasoning analysis results, wherein the knowledge graph includes associations between network asset nodes, vulnerability nodes, and threat intelligence nodes; The prediction module 805 is used to evaluate the intrusion paths that the attacker may exploit based on the reasoning analysis results, and output the attack surface prediction results. The attack surface prediction results are presented in the form of an attack path list, which contains specific information about each attack path, including the starting node, intermediate nodes and target nodes.

[0193] The implementation of each of the above modules can be specifically referred to the above method embodiments, which will not be described in detail here. The technical effects achieved by each module and device can be referred to the description of the above method embodiments.

[0194] like Figure 10 As shown, an embodiment of the present application further provides a computer device 90, which includes a processor 901 and a memory 902, wherein the memory 902 stores a computer program, and when the computer program is executed by the processor 901, the processor 901 performs the steps of any of the methods described above.

[0195] In the several embodiments provided in this application, it should be understood that the disclosed systems and methods can be implemented in other ways. For example, the device embodiments described above are merely schematic. For example, the division of the units is merely a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be an indirect coupling or communication connection of some interfaces, devices or units, which can be electrical, mechanical or other forms.

[0196] The above disclosure is only a preferred embodiment of the present application, and certainly cannot be used to limit the scope of rights of the present application. Therefore, equivalent changes made according to the claims of the present application are still within the scope of the present application.

Claims

1. An intelligent network attack surface prediction method based on deep learning, characterized in that: The following steps are involved: Obtain network asset information, vulnerability distribution information, and external threat intelligence data in the target network environment. The network asset information includes hardware device types, software versions, and configuration parameters; the vulnerability distribution information includes known vulnerability numbers, impact scope, and repair status; and the external threat intelligence data includes attack patterns, attack tools, and attacker behavior records. Preprocessing the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized data set; Inputting the standardized data set into a pre-trained deep learning model to extract feature vectors related to network attacks from the data set, wherein the deep learning model is a multi-layer neural network structure; Based on the feature vector and the knowledge graph, a reasoning analysis is performed on the potential attack link to obtain a reasoning analysis result, wherein the knowledge graph includes the association relationship between the network asset node, the vulnerability node and the threat intelligence node; Based on the reasoning analysis results, the intrusion paths that the attacker may exploit are evaluated, and the attack surface prediction results are output. The attack surface prediction results are presented in the form of an attack path list, which contains specific information about each attack path, including the starting node, intermediate nodes, and target nodes.

2. The method according to claim 1, characterized in that Based on the feature vector and knowledge graph, reasoning analysis is performed on potential attack links, including: Extracting network asset nodes, vulnerability nodes, and threat intelligence nodes that match the feature vector from the knowledge graph to generate a set of candidate attack links; For each attack link in the candidate attack link set, calculate its attack success rate and attack cost, where the attack success rate is determined based on the vulnerability exploitation difficulty and the threat intelligence matching degree, and the attack cost is determined based on resource consumption and time cost; sorting the attack links in the candidate attack link set according to the attack success rate and the attack cost, and generating a priority attack link list; An attack link that meets preset conditions is selected from the priority attack link list and output as a reasoning analysis result. The preset conditions include that the attack success rate is greater than a first threshold and the attack cost is less than a second threshold.

3. The method according to claim 2, characterized in that The step of extracting network asset nodes, vulnerability nodes, and threat intelligence nodes that match the feature vector from the knowledge graph to generate a set of candidate attack links includes: Locating a network asset node in a knowledge graph based on network asset features in the feature vector, wherein the network asset features include a device identifier and configuration parameters; Locating vulnerability nodes in the knowledge graph based on vulnerability features in the feature vector, wherein the vulnerability features include vulnerability numbers and impact ranges; Locating a threat intelligence node in a knowledge graph based on threat intelligence features in the feature vector, wherein the threat intelligence features include attack patterns and attack tools; The network asset nodes, vulnerability nodes and threat intelligence nodes are combined according to preset association rules to generate a candidate attack link set, where the association rules are constructed based on historical attack event statistical data.

4. The method according to claim 3, characterized in that The locating of network asset nodes in the knowledge graph according to the network asset features in the feature vector includes: Extracting key fields of network asset features from the feature vector, the key fields including device type, software version, and configuration parameters; Searching the knowledge graph for network asset nodes that match the key field. If there are multiple matching nodes, calculating the similarity between each matching node and the key field. Sort the matching nodes according to the similarity, and select the network asset node with the highest similarity as the positioning result; If no network asset node matching the key field is found, a new network asset node is created in the knowledge graph and added to the candidate attack link set.

5. The method according to claim 4, characterized in that The step of creating a new network asset node in the knowledge graph and adding it to the candidate attack link set includes: extracting key fields related to unmatched network asset characteristics from the standardized dataset, the key fields including device type, software version, and configuration parameters; generating a new network asset node based on the key fields, the new node including a unique device identifier and hardware and software attribute information related to the device; Correlate the new node with the existing vulnerability nodes and threat intelligence nodes in the knowledge graph to determine its potential contribution to the attack link; Calculating the influence weight of the new node on the candidate attack link set based on the potential attack link contribution; The new node and its influence weight value are added to the candidate attack link set.

6. The method according to claim 2, characterized in that The step of sorting the attack links in the candidate attack link set according to the attack success rate and the attack cost to generate a priority attack link list includes: Assigning a weight value to each attack link in the candidate attack link set, wherein the weight value is calculated by the weighted sum of the attack success rate and the attack cost; Sort the attack links in the candidate attack link set in descending order according to the weight values ​​to generate a preliminary sorted list; Screening the attack links in the preliminary sorted list and removing attack links that do not meet security constraints, wherein the security constraints include attack path length limit and node access permission limit; Reorder the filtered attack links to generate the final priority attack link list.

7. The method according to any one of claims 2 to 6, characterized in that After generating a priority attack link list according to the attack success rate and the attack cost, the method further includes: For each attack link, calculate the complexity score of its attack path, which is determined by the number of nodes in the attack path, the node type, and the complexity of the relationship between nodes; performing secondary sorting of the attack links in the priority attack link list according to the complexity score to generate an adjusted attack link list; Filtering attack links that meet preset security constraints from the adjusted attack link list, wherein the security constraints include a shortest path restriction for the attack path and a minimum permission requirement for node access rights; Reorder the filtered attack links to generate the final attack link list.

8. The method according to claim 7, characterized in that Calculating the complexity score of an attack path involves the following steps: Determining the number of nodes in the attack path, the number of nodes including the total number of network asset nodes, vulnerability nodes, and threat intelligence nodes; Assigning a complexity weight value to each node according to the node type, wherein the complexity weight value is determined based on the risk level of the node type and the closeness of the association relationship; Calculate the weighted sum of the complexity weight values ​​of all nodes in the attack path to obtain a preliminary complexity score; Adjusting the preliminary complexity score according to the complexity of the relationships between nodes, where the complexity of the relationships between nodes is determined by the dependencies and interaction frequencies between nodes; The adjusted complexity score is used as the final complexity score of the attack path.

9. The method according to claim 8, characterized in that The adjusting the preliminary complexity score according to the complexity of the relationship between nodes includes: Extract the dependency relationships and interaction frequency data between all nodes in the attack path from the knowledge graph; Calculating the complexity coefficient of the relationship between nodes based on the dependency relationship and interaction frequency data, wherein the complexity coefficient is determined by the depth of the dependency relationship and the frequency distribution of the interaction frequency; The complexity coefficient is multiplied by the preliminary complexity score to obtain an adjusted complexity score.

10. An intelligent network attack surface prediction system based on deep learning, characterized in that: The system comprises: An acquisition module is configured to acquire network asset information, vulnerability distribution information, and external threat intelligence data from a target network environment. The network asset information includes hardware device types, software versions, and configuration parameters; the vulnerability distribution information includes known vulnerability numbers, impact scope, and repair status; and the external threat intelligence data includes attack patterns, attack tools, and attacker behavior records. A preprocessing module, configured to preprocess the network asset information, vulnerability distribution information, and external threat intelligence data to generate a standardized data set; A feature extraction module, configured to input the standardized data set into a pre-trained deep learning model to extract feature vectors related to network attacks from the data set, wherein the deep learning model is a multi-layer neural network structure; An inference analysis module, configured to perform inference analysis on potential attack links based on the feature vectors and the knowledge graph to obtain inference analysis results, wherein the knowledge graph includes associations between network asset nodes, vulnerability nodes, and threat intelligence nodes; The prediction module is used to evaluate the intrusion paths that an attacker may exploit based on the reasoning analysis results and output an attack surface prediction result. The attack surface prediction result is presented in the form of an attack path list, which contains specific information about each attack path, including the starting node, intermediate nodes, and target nodes.

Images