Network security threat assessment and traceability system based on big data

Abstract

The invention relates to the technical field of network security, in particular to a network security threat assessment and traceability system based on big data, which comprises a node behavior monitoring module, a function offset identification module, a path variation screening module, a behavior trajectory comparison module and a threat traceability judgment module. According to the method, through behavior vector change angles and frequency differences of a plurality of time periods, nodes with violent behavior characteristics fluctuation are identified, communication frequency and interaction direction changes are analyzed, node links with abnormal communication characteristics are screened in combination with time interval differences of abnormal paths, and according to a comparison result of a static access template and a dynamic operation log, the dynamic operation log of the static access template is determined. The deviation item number mapping is calculated, and the suspicious communication starting point is traced, so that the comprehensive evaluation and attack source positioning of node function role change, communication path mutation and operation behavior abnormity are realized, the threat identification precision is effectively improved, and the credibility of attack path reconstruction and attacker judgment is improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, and in particular to a network security threat assessment and tracing system based on big data. BACKGROUND

[0002] The technical field of network security refers to the collection of security protection and risk control technologies for computer network systems, and its core goal is to protect data, communication, and system resources in the network from unauthorized access, tampering, destruction, or leakage. This field covers multiple specific technical directions, including but not limited to access control mechanisms, identity authentication protocols, data encryption and decryption algorithms, malicious code detection technologies, security audits, network intrusion detection and defense systems, security policy management, vulnerability scanning and patch management, network behavior analysis, attack modeling and simulation, etc. Network security technology not only needs to protect static resources, but also requires dynamic threat identification capabilities, as well as event response and forensics capabilities, to ensure that network systems have comprehensive proactive defense and emergency handling capabilities.

[0003] Among them, the network security threat assessment and tracing system is a system solution for identifying, assessing, and analyzing potential or existing security threats in a network environment, and locating the source of attacks. Its main purpose is to quantify the threat level faced by the network environment through multi-dimensional risk assessment, attack path reasoning, and trace data chain construction techniques, to assist security management personnel in adjusting protection strategies and deploying resources. At the same time, the system can locate the attack path and attack subject based on attack chain analysis and evidence correlation mechanisms after a security incident occurs, providing technical support for emergency response, legal evidence, and responsibility tracing.

[0004] Traditional tracing systems rely on multi-dimensional risk assessment and attack path reasoning to identify and trace network threats, lack quantitative analysis means for the evolution trend of node behavior over time, and are difficult to detect changes in functional roles and behavior anomalies during the incubation period. When there is a slight deviation in periodic behavior patterns, traditional systems are prone to ignore potential threat signals. In addition, the identification of communication links relies on static communication topology or overall traffic threshold judgment, making it difficult to accurately filter node pairs whose communication characteristics change significantly before and after an attack, limiting the high-precision restoration ability of attack paths. In actual complex network environments, if an attacker uses legitimate permissions to hide operation tracks, it will cause the tracing path to break or the attack source to be identified, affecting the integrity and efficiency of subsequent emergency response and legal evidence. SUMMARY

[0005] The purpose of the present application is to solve the shortcomings in the prior art, and to provide a network security threat assessment and tracing system based on big data.

[0006] In order to achieve the above object, the present application adopts the following technical scheme: a network security threat assessment and tracing system based on big data, the system comprises:

[0007] The node behavior monitoring module obtains the node unique identifier and the audit log within the specified monitoring period, collects the event type occurrence times and time distribution of each node through the node identifier and behavior timestamp, constructs the behavior feature data table taking the node as the key and the behavior type as the field, and generates the period behavior feature table;

[0008] The function role deviation identification module is based on the period behavior feature table, and the sum of the absolute values of the frequency difference of each behavior type is counted to obtain the behavior vector change amplitude of each node, and the function role deviation evaluation result is generated;

[0009] The path variation screening module calls the function role deviation evaluation result, screens the connection node pairs with communication deviation, counts the interaction direction consistency rate and the average time interval standard deviation between the node pairs, calculates the abnormal index of the path, identifies the suspicious node link, and generates the suspicious node link list;

[0010] The behavior trajectory comparison module is based on the suspicious node link list, extracts the dynamic behavior features in the audit log, compares the static behavior template with the dynamic behavior item, marks and counts the unmatched items, forms the mapping structure of the node and the deviation item number, and generates the node behavior deviation index table.

[0011] The present application improves that the period behavior feature table includes node identifier index, behavior category distribution and behavior time density, the function role deviation evaluation result includes vector angle value, frequency change value and standardized deviation score, the suspicious node link list includes communication frequency difference value, direction consistency ratio and time interval standard deviation, and the node behavior deviation index table includes static parameter matching result, dynamic behavior abnormality label and deviation item quantity statistical information.

[0012] The present application improves that the node behavior monitoring module comprises:

[0013] The log extraction submodule obtains the node unique identifier and the audit log within the specified monitoring period, extracts the event type field, event timestamp field and event target field from the log, screens the event type field content, retains four behavior events of authentication event, file system operation, network session establishment and remote command execution, establishes an event mapping table according to the node unique identifier, and generates the node behavior event set quantity;

[0014] The behavior statistics submodule calls the node behavior event set quantity, aggregates according to the event type and the timestamp field, and according to the node unique identifier, carries out statistics on the occurrence number of each behavior event in a monitoring period, extracts the hour value and the minute value in the event occurrence timestamp, establishes the behavior event frequency and time distribution table according to the node number, and generates the node behavior statistics distribution information;

[0015] The feature collection submodule establishes a two-dimensional data structure according to the node number and the event type number as index fields according to the information node behavior statistics distribution information, carries out summary and arrangement on each node behavior statistics data according to the behavior occurrence number and the time distribution density as data fields, constructs the node behavior feature data table, and generates the period behavior feature table.

[0016] The function deviation identification module comprises:

[0017] The vector construction submodule extracts the event frequency data of each node under multiple types of behavior events according to the period behavior feature table, constructs the behavior frequency vector group in two periods according to the node number as the index field, forms the vector structure in each period according to the frequency arranged in the behavior type order, calculates the vector combination of the node behavior frequency in the period, generates the period behavior vector pair group, and the like.

[0018] The deviation determination submodule calls the period behavior vector pair group, calculates the corresponding cosine angle value in the space according to the two-period vector data of each node, extracts the frequency difference value of each type of behavior, takes the absolute value and sums, judges whether the angle value is greater than the set vector deviation angle threshold, screens the node behavior deviation record meeting the condition, calculates the behavior vector change amplitude value of each node in the period space, sorts according to the amplitude value, generates the behavior vector change amplitude sequence, and the like.

[0019] The change normalization submodule constructs the fluctuation sequence according to the behavior vector change amplitude sequence, takes the node number as the horizontal axis and the behavior vector change amplitude value as the vertical axis, carries out Z-score standardization, takes the standardized value of each node to average, and the like.

[0020] The path variation screening module comprises:

[0021] The frequency extraction submodule calls the function role offset evaluation result, extracts the communication record of the corresponding node in the network traffic log according to the node identification whose behavior change amplitude value exceeds the judgment threshold, sets the attack occurrence time point as the reference, extracts the window interval of the target length before and after, extracts the establishment times of TCP connection of each pair of communication nodes in the two time windows, calculates the difference value and outputs the difference value list according to the node pair number, and generates the communication frequency difference information;

[0022] The offset calculation submodule compares the frequency difference value of each node pair with the set communication frequency change threshold according to the communication frequency difference information, screens the node pairs whose frequency difference value is greater than the threshold, extracts the communication direction information and event time stamp of the node pairs in the two window intervals, statistics the proportion of the same direction communication node pairs, and calculates the standard deviation of the connection time interval for two times, obtains the abnormal index value of each pair of communication nodes in the offset background, and generates the node pair abnormal information;

[0023] The link determination submodule calls the node pair abnormal information, sorts each communication node pair abnormal index in descending order, screens the target number of high-risk node pairs according to the sorting, summarizes the communication field combination according to the node pair index field, extracts the source node and target node number, communication port and protocol type as the link characteristics, combines to form the link path determination table, establishes the many-to-many path information set between nodes, and generates the suspicious node link list.

[0024] The application improves that the behavior trajectory comparison module comprises:

[0025] The template extraction submodule extracts three static access template information of the access control permission level, operation time period and network protocol type associated with each node based on the suspicious node link list, extracts three dynamic behavior records of the operation instruction type, target resource type and event time stamp matched with the node number from the audit log, establishes the static and dynamic behavior data set corresponding to the node, and generates the node behavior information comparison table;

[0026] The behavior matching submodule calls the node behavior information comparison table, selects the static access template field and the dynamic behavior record field respectively, performs field corresponding, matches the static template data in the permission level, operation period and protocol type three items for each dynamic behavior record, judges whether there is inconsistent field value and marks the matching state, records the mark state of the inconsistent items and enters the node index table, and generates the behavior field matching offset information;

[0027] The deviating counting sub-module matches the deviating information according to the behavior field, takes the node number as an index item, counts the total number of mismatched items of each node, and aggregates the number of deviating items, and outputs the number of deviating items of the node as a mapping table structure, establishes a behavior deviating degree set of the node between the static expectation and the dynamic trajectory, and generates a node behavior deviating index table.

[0028] The system further comprises:

[0029] The threat tracing judgment module calls the node behavior deviating index table, extracts the first communication time and the number of deviating items of each node, calculates the attack source ranking value, arranges each node in descending order according to the ranking value, selects a target number of nodes as a source candidate according to the ranking value, and generates an attack source node positioning result.

[0030] The attack source node positioning result is specifically a combination of behavior starting time ranking and deviating value, and attack node priority score.

[0031] The threat tracing judgment module comprises:

[0032] The deviating screening sub-module selects a node set whose number of deviating items exceeds a deviating item judgment threshold based on the node behavior deviating index table according to the number of deviating items of the node, extracts the communication request record in the network communication log, takes the node number as an index, establishes a node behavior activity sequence structure, and generates a high deviating node set.

[0033] The behavior ranking sub-module calls the high deviating node set, performs time ranking on the communication behavior record of each node, extracts the first communication initiation time and converts it into a timestamp second value from zero point, calls the number of deviating items corresponding to the node, calculates the attack source ranking value of each node, arranges the nodes in descending order according to the ranking value, and obtains a node list after ranking.

[0034] The node positioning sub-module selects a target number of nodes according to the node list after ranking, outputs the behavior starting time, the number of deviating items and the corresponding communication link information according to the node number, constructs a node positioning path mapping table structure, and generates an attack source node positioning result.

[0035] Compared with the prior art, the application has the advantages and positive effects that:

[0036] In the present application, by extracting four types of behavior events of authentication events, file system operations, network session establishment and remote command execution in the set monitoring period, a period behavior feature table with node as the key is constructed, the nodes with dramatic fluctuation of behavior features are identified by combining the change angle and frequency difference of the behavior vectors of multiple time periods, the communication frequency and interaction direction change are analyzed, the node links with abnormal communication characteristics are screened by combining the time interval difference of the abnormal path, and the number of deviation items is mapped and the suspicious communication starting point is traced according to the comparison result of the static access template and the dynamic operation log, so that the comprehensive evaluation and attack source positioning of the node function role change, communication path mutation and operation behavior anomaly are realized, the precision of threat identification is effectively improved, the systematicness of abnormal link screening is enhanced, the credibility of attack path reconstruction and attacker determination is improved, and the tracking capability and protection deployment response efficiency in the multi-stage attack scene are strengthened. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 The system flowchart of the present application is shown in the figure;

[0038] Figure 2 The flowchart of the period behavior feature table of the present application is shown in the figure;

[0039] Figure 3 The flowchart of the function role deviation evaluation result of the present application is shown in the figure;

[0040] Figure 4 The flowchart of the suspicious node link list of the present application is shown in the figure;

[0041] Figure 5 The flowchart of the node behavior deviation index table of the present application is shown in the figure;

[0042] Figure 6 The flowchart of the attack source node positioning result of the present application is shown in the figure. DETAILED DESCRIPTION

[0043] In order to make the purpose, technical scheme and advantages of the present application more clear and explicit, the present application will be further described in detail below in combination with the drawings and examples. It should be understood that the specific examples described herein are only used to explain the present application and do not limit the present application.

[0044] In the description of the present application, it should be understood that the orientations or positional relationships indicated by the terms "length", "width", "up", "down", "front", "back", "left", "right", "vertical", "horizontal", "top", "bottom", "inner", "outer" and the like are based on the orientations or positional relationships shown in the drawings, and are only for the convenience of describing the present application and simplifying the description, and therefore cannot be understood as indicating or implying that the devices or elements referred to must have a particular orientation, be constructed and operated in a particular orientation, and therefore cannot be understood as limiting the present application. In addition, in the description of the present application, the meaning of "multiple" is two or more, unless otherwise specifically limited.

[0045] Referring to Figure 1 The application provides a technical solution: a network security threat assessment and tracing system based on big data, which comprises a node behavior monitoring module, a function deviation identification module, a path variation screening module, a behavior trajectory comparison module, and a threat tracing judgment module.

[0046] The node behavior monitoring module obtains the node unique identifier and audit log within a specified monitoring period, extracts four types of behavior events, including authentication events, file system operations, network session establishment, and remote command execution, from the log, aggregates the occurrence frequency and time distribution of each node event type through the node identifier and behavior timestamp, performs frequency statistics on each behavior, constructs a behavior feature data table with the node as the key and the behavior type as the field, and generates a periodic behavior feature table.

[0047] The function deviation identification module extracts the event frequency vector of the node in each type of behavior within two adjacent periods based on the periodic behavior feature table, constructs a vector space with the behavior type as the dimension, calculates the included angle between the vectors of the previous and subsequent periods, and for the nodes with an included angle value greater than the vector deviation angle threshold, calculates the sum of the absolute values of the frequency difference of each behavior type, superimposes and averages the Z-score standardized values, obtains the behavior vector variation amplitude of each node, and generates a function role deviation assessment result.

[0048] The path variation screening module calls the function role deviation assessment result, obtains the corresponding communication session records of the node in the network traffic log according to the nodes with a behavior variation amplitude exceeding a set judgment value, extracts the target length of time window before and after the attack, extracts the TCP session frequency difference of each pair of communication nodes in the time window, compares it with the communication frequency change threshold, screens the connection node pairs with communication deviation, calculates the abnormal index of the path, identifies suspicious node links, and generates a suspicious node link list.

[0049] The behavior trajectory comparison module extracts the access control permission level, operation time period, and network protocol type in the suspicious node static access template based on the suspicious node link list, and synchronously extracts the dynamic behavior features in the audit log, including the operation instruction type, target resource type, and event timestamp, compares the static behavior template with the dynamic behavior items, marks and counts the unmatched items, forms a mapping structure of the node and the deviation item number, and generates a node behavior deviation index table.

[0050] The threat traceability determination module calls the node behavior deviation index table, sorts all communication requests initiated by the node in the network log according to the node whose deviation items exceed the deviation item determination threshold, constructs a behavior time chain based on the starting time, extracts the first communication time of each node and the number of deviation items, calculates the attack source ranking value, ranks each node in descending order of the ranking value, selects a target number of nodes as a traceability candidate according to the ranking value, and generates an attack source node positioning result;

[0051] The periodic behavior feature form includes a node identification index, a behavior category distribution and a behavior time density, the function role deviation evaluation result includes a vector angle value, a frequency change value and a standardized deviation score, the suspicious node link list includes a communication frequency difference value, a direction consistency ratio and a time interval standard deviation, the node behavior deviation index table includes a static parameter matching result, a dynamic behavior anomaly label and deviation item number statistical information, and the attack source node positioning result is specifically a behavior starting time ranking and deviation value combination and an attack node priority score.

[0052] Please refer to Figure 2 , the node behavior monitoring module includes:

[0053] The log extraction submodule obtains the node unique identifier and the audit log within the specified monitoring period, extracts the event type field, the event timestamp field and the event target field from the log, filters the event type field content, retains four behavior events of authentication events, file system operations, network session establishment and remote command execution, establishes an event mapping table according to the node unique identifier, and generates a node behavior event set quantity;

[0054] The audit log and node unique identifier in the specified monitoring period are obtained, and the acquisition operation is based on the log management module deployed in the network environment. The syslog log system in the selected monitoring range is selected, and all original log data is exported in the time interval of 2024-05-01 0:00 to 23:59. The log field structure contains five key fields: node IP, node number, event type, event timestamp and target resource path. First, extract the node number field as the primary index and remove duplicate values to determine the unique node set. Then extract the event type field, which is recorded in the log as a short code. Extract the "AUTH", "FILE", "SESS", and "CMD" code values, which correspond to authentication events, file system operations, network session establishment, and remote command execution behavior, respectively. Extract the event target resource field to identify the system entity affected by the operation behavior. Extract the event timestamp field for subsequent behavior positioning and time sequence attribution. Then, classify events by node number. Construct a five-field log mapping structure with the extracted fields. Filter all non-behavioral events such as system alerts, heartbeat detection, and resource warning logs. Construct a node event record set. Finally, form a node event mapping data structure containing the specified four types of behavior events, and generate a node behavior event set.

[0055] Table 1: Node behavior log record example table

[0056] As shown in Table 1, the event data content involves behavior type and its execution target resource, reflecting the node behavior operation trajectory, and constitutes the node event behavior sample source.

[0057] The behavior statistics submodule calls the node behavior event set, aggregates the events by node unique identifier based on the event type and timestamp field, counts the number of occurrences of each behavior event in the monitoring period, and extracts the hour and minute values from the event timestamp. Establish a behavior event frequency and time distribution table by node number to generate node behavior statistical distribution information.

[0058] The event type and timestamp field in the node behavior event set are called, the behavior category and corresponding time point value are extracted from the field value respectively, aggregation processing is performed on each node number as an index, the occurrence frequency of each category behavior in the monitoring period is calculated for the event type item, the period is divided into 96 15-minute segments, and all event timestamps are converted into total minutes after "hour x 60 + minute", and then divided by 15 and rounded to obtain the belonging time segment number, for example, "08:15" is converted into 495 minutes and belongs to the 33rd segment, "13:05" is converted into 785 minutes and belongs to the 52nd segment, all behaviors are mapped to the belonging time segment in turn, the occurrence times of the same event type in each time segment are summarized, a frequency table with "node number x event type x time segment number" as an index item is constructed, and each frequency value is recorded, which is output as a frequency time distribution data structure according to the node number dimension, taking Node-02 as an example, the file operation event at 09:42, 10:05, 10:18 and 10:45 is classified into the 39th, 40th, 40th and 42nd segments respectively, and the corresponding frequency is 1, 2, 1 respectively, forming the frequency distribution record of the behavior type in the time segment, thereby constructing the node behavior event time distribution index set, and finally obtaining the node behavior statistical distribution information.

[0059] The feature collection submodule establishes a two-dimensional data structure according to the node behavior statistical distribution information, taking the node number and event type number as index fields, summarizes and arranges the behavior statistical data of each node according to the behavior occurrence times and time distribution density, constructs a node behavior feature data table, and generates a period behavior feature table.

[0060] According to the node behavior statistical distribution information, the behavior frequency sequence data of all nodes and the corresponding time distribution segment width are extracted, a two-dimensional structure table is constructed, the frequency total value and the standard deviation of the frequency in the distribution segment width are counted for each event type according to the "node number x behavior type number" as an index item, the frequency total value is taken as the behavior occurrence strength, and the standard deviation is taken as the behavior execution time density, the data fields are normalized and written into the behavior statistical table, each row represents the frequency statistics of a node under a behavior type, including the fields "frequency value" and "time segment standard deviation", taking the network session event of Node-03 as an example, the behavior frequency is 9 times, distributed in time segment numbers 30-36, the standard deviation value is 1.6, the frequency normalized value is 0.47, and the time density value is 0.32, which are filled into the corresponding positions according to the nodes and event types respectively, and output as a statistical matrix, and finally a data table with a unified structure is constructed, and a period behavior feature table is generated.

[0061] Please refer to Figure 3 , the function offset recognition module comprises:

[0062] The vector construction submodule extracts the event frequency data of each node under multiple types of behavior events based on the periodic behavior feature table, constructs two behavior frequency vector groups within a period with the node number as the index field, arranges the frequency in the order of behavior type to form the vector structure within each period, calculates the vector combination of the node behavior frequency within the period, and generates a pair of periodic behavior vectors;

[0063] The event frequency data of each node under each type of behavior event in the periodic behavior feature table is obtained. Specifically, the node number is used as the index to extract the event frequency values of the four types of behaviors "authentication", "file operation", "network session" and "remote command" within two monitoring periods. The corresponding field formats are "period one_authentication", "period two_network session", etc. In actual application, the behavior type field is automatically aligned according to the log event coding rule to ensure that the same behavior is consistent in different time periods. For example, the authentication frequency of Node-01 in period one is 12 times, and the file operation frequency is 20 times. The corresponding frequencies in period two are 10 times and 18 times. The behavior frequency vectors of period one and period two are , Then, the vector pair combination of each node is constructed with the node number as the index, and the vectorization alignment is performed for each behavior type field to form a one-to-one vector pair list in the data structure. All vector data should be the normalized numerical results of the frequency. The normalization process uses the maximum value of each behavior in all nodes as the denominator for ratio processing. This maximum value is determined by the maximum number of occurrences of a behavior type in all nodes within a period to ensure the consistency of the normalization scale. For example, the maximum frequency of the file operation event in period one is 20, and the normalized value is processed according to the frequency / 20. The maximum value is set based on the statistics of the entire sample set within the period, and does not depend on external data or empirical judgment. Therefore, it is a dynamically adjusted reference value that facilitates subsequent angle judgment operations. Finally, the behavior frequency vector set of all nodes is generated, and the pair of periodic behavior vectors is obtained.

[0064] Table 2: Node behavior frequency vector example table

[0065] As shown in Table 2, the frequency data of each behavior event of three nodes within two periods is shown to construct the behavior frequency vector.

[0066] The offset determination submodule calls the pair of periodic behavior vectors, calculates the corresponding cosine angle value in the behavior space based on the two-period vector data of each node, extracts the absolute value sum of the frequency difference of each type of behavior, and determines whether the angle value is greater than the set vector offset angle threshold. The node behavior offset record that meets the condition is selected. The formula is:

[0067] ;

[0068] The behavior vector change amplitude value of each node under the periodic line space is obtained, and the amplitude values are sorted according to the size to generate a behavior vector change amplitude sequence;

[0069] wherein, represents the behavior vector change amplitude value of the first node, represents the total value of the normalized frequency of all behavior events of the first node in the first monitoring period, represents the total value of the normalized frequency of all behavior events of the first node in the second monitoring period, represents the normalized frequency of the first node on the first behavior type, represents the normalized frequency of the first node on the first behavior type, represents the average value of the normalized frequency of the first node on all behavior types, represents the total number of behavior types, represents the included angle of the two periodic behavior vectors of the first node, represents the number of non-zero behavior types participated by the first

[0070] The vectors of each node in the pair of periodic behavior vectors are called respectively to construct the first periodic vector and the second periodic vector , and the cosine included angle value in the four-dimensional line space is calculated , the formula is used to calculate the included angle value by inverse cosine calculation on , then the corresponding items of and are subtracted one by one and the absolute value is taken, and the sum of the difference value sequence is calculated. Taking the node Node-01 as an example, the difference value vector is , and the sum is 7. The average value of the frequency of all behavior items in the first period and the standard deviation after the variance of each item are calculated, and then the formula is embedded with the difference sum, the standard deviation and the included angle value. The following formula is used:

[0071] ;

[0072] The calculation logic of the formula is as follows: the first part reflects the change of the total strength of the periodic behavior, the second part is the dispersion degree of the frequency vector, which measures the volatility of the behavior distribution, and the denominator is used to suppress the change value of the vector when it is similar, and the logarithmic term The variation intensity expansion factor in multi-behavior participation scenarios is extracted, and the overall deviation degree of a single node in the functional role behavior is measured by combining the extracted variation intensity expansion factor. The angle is in radians, and the angle deviation is determined based on the set vector deviation angle threshold, which is set to 45 degrees by default. The setting reason is that when the included angle exceeds 45 degrees, the behavior structure no longer has significant homodirectionality, and this threshold comes from the standard vector direction consistency limit (cos value less than 0.707) calculation benchmark, so it is a general mathematical benchmark value. Take Node-01 as an example for calculation as follows:

[0073] The behavior difference sum is 7, the behavior mean is 10.5, and the squared difference sum is 210.5, radians, , and the formula gives:

[0074] ;

[0075] The result value 16.98 represents the overall behavior change intensity of Node-01 during the structural reconstruction under the four types of functional behavior. The larger the value, the more intense the functional evolution, which can be directly used as a quantitative indicator of behavior role deviation. Finally, the behavior vector change amplitude sequence is output based on the node number, and the functional role deviation evaluation result is generated;

[0076] The change normalization submodule constructs the fluctuation sequence based on the behavior vector change amplitude sequence, with the node number as the horizontal axis and the behavior vector change amplitude value as the vertical axis. The Z-score standardization operation is performed, and the standardized values of each node are averaged to measure the overall deviation degree of node behavior change, establish the performance measurement of the node in the periodic behavior level, and generate the functional role deviation evaluation result;

[0077] Based on the behavior vector change amplitude sequence, the change sequence map is constructed with the node number as the horizontal axis and the amplitude value as the vertical axis. The overall sequence mean and standard deviation are calculated, and then the Z-score standardization formula is used to standardize all amplitude values, where is the original amplitude value, , are the overall sequence mean and standard deviation, respectively. Assuming that the calculation results of the three nodes are Node-01: 16.98, Node-02: 10.12, and Node-03: 9.54, , the standardized values of which are calculated as follows: Node-01 is 1.17, Node-02 is -0.51, and Node-03 is -0.65. The Z-score normalization rule is based on the assumption of normal distribution, and uses the dispersion of behavior deviation values in the full set distribution and the center difference as reference indicators. It is a general benchmark processing form in standard behavior analysis. The node average value of the Z-score standard value is calculated again as the node comprehensive deviation level. The output is a deviation degree score table. The score is used as the dynamic behavior indicator of the functional role evolution of the node in the period. After sorting all node score results, the measurement sequence of functional behavior evolution is generated, and the functional role deviation evaluation result is obtained.

[0078] Please refer to Figure 4 , the path variation screening module includes:

[0079] The frequency extraction submodule calls the functional role deviation evaluation result, extracts the communication records of the corresponding nodes in the network traffic log according to the node identifiers whose behavior change amplitude values exceed the judgment threshold, sets the attack occurrence time point as the reference, extracts the window interval of the target length before and after, extracts the number of TCP connections established by each pair of communication nodes within the two time windows, calculates the difference and outputs the difference value list according to the node pair number, and generates communication frequency difference information;

[0080] The node set whose behavior change amplitude value exceeds the set judgment threshold in the functional role deviation evaluation result is called. The threshold is the upper limit of the standard deviation of the behavior vector change amplitude in all nodes. Specifically, the mean value plus one times the standard deviation is set as the dynamic threshold to avoid introducing static imbalance due to node size changes. In the example, if the mean value of the change amplitude of all nodes is 14.2 and the standard deviation is 3.8, the threshold is set to 14.2+3.8=18.0. Any node whose change amplitude value exceeds 18.0 will enter the subsequent step. After selecting the node number, the communication record field of the node in the network traffic log is extracted, including the source address, target address, protocol, port and timestamp. At the same time, the TCP connection events within a 300-second interval before and after the attack event trigger time are extracted to form two comparison windows. The number of TCP connections of each pair of communication nodes in the front and rear windows is obtained. The frequency difference value is calculated according to the "node pair" as the index item. The difference value is defined as the number of TCP connections in the rear window minus the number of TCP connections in the front window. A positive value indicates an increase in activity, and a negative value indicates a decrease. All difference values are recorded to form a difference data structure and output according to the node pair number to obtain the communication frequency difference information.

[0081] The offset calculation submodule compares the frequency difference of each node pair with the set communication frequency change threshold based on the communication frequency difference information, selects the node pairs with frequency difference greater than the threshold, extracts the communication direction information and event timestamps of the node pairs within the two window intervals, counts the proportion of node pairs communicating in the same direction, and calculates the standard deviation of the time interval between two consecutive connections using the formula:

[0082] ;

[0083] The calculation obtains the abnormal index value of each pair of communication nodes under the offset background and generates the abnormal information of the node pair;

[0084] in, Indicates the The abnormal index of the communication node, Indicates the The difference in the number of TCP sessions before and after the communication node in the time window, Indicates the The standard deviation of the communication time interval of the communication node in the time window, Indicates the The normalized value of the proportion of communication nodes with consistent interaction directions, Indicates the Normalized value of the average time interval of communication events of communication nodes;

[0085] According to the node pairs and difference items in the communication frequency difference information, the absolute value of the difference of all node pairs is extracted and compared with the set communication frequency change threshold. The threshold is set to the median value of the communication frequency distribution of the node pairs within the period plus 5 as an adjustment reference. According to the median value of the periodic communication frequency in the sample of 18, the threshold is set to 23. The communication pairs with a frequency difference greater than 23 are screened for the next step of processing, and the communication direction information of these node pairs within the two window intervals is extracted. The direction consistency rate is calculated by the ratio of the number of consistent directions to the total number of communications. , synchronously read the timestamps of adjacent events in each communication node pair, calculate the interval between two consecutive communications and obtain the standard deviation and mean , the mean and standard deviation are normalized and used for formula construction, using the following formula:

[0086] ;

[0087] The formula logic is as follows: the numerator is a combined expression of the frequency change value and the communication interval fluctuation, which is used to comprehensively evaluate the connection rate and regularity changes. The denominator is the directional consistency increment. The closer it is to 1, the higher the directional stability is, which is used to suppress the influence of random disturbances. The square root of the multiplication term expresses the reinforcement factor of the cumulative influence of time on abnormal behavior, forming a full factor index indicator. The greater the value represents the stronger the behavior evolution deviation, suitable for path abnormal node pair identification, such as Node01-Node02 in Table 2, the communication record is 25 times in the front window, 42 times in the rear window, the difference is 17, the direction consistency rate is 0.75, the time interval standard deviation is 3.2 seconds, the mean is 6.0 seconds, and the formula is calculated as follows:

[0088] ;

[0089] Finally, the abnormal index of the node pair is 30.52, and the higher the value represents the stronger the behavior deviation, after obtaining the abnormal index of all node pairs, the node pair abnormal information structure is formed, and the node pair abnormal information is obtained;

[0090] Table 3 communication node pair behavior example table

[0091] As shown in Table 3, some node pairs in the front and rear windows have communication behavior field data examples, including frequency, direction consistency rate and time interval data.

[0092] The link determination submodule calls the node pair abnormal information, sorts each communication node pair abnormal index in descending order according to the size, filters the target number of high-risk node pairs according to the sorting, and combines the communication field according to the node pair index field. Extract the source node and target node number, communication port and protocol type as link features, combine to form a link path determination table, establish a many-to-many path information set between nodes, and generate a suspicious node link list;

[0093] Call the abnormal index of all node pairs in the node pair abnormal information, sort the abnormal index values in descending order from large to small, and set the filtering ratio to the top 10% of the node pairs in the abnormal index to enter the trace path analysis link, the filtering ratio is fixedly set to 10%, which is the system default setting parameter, and has been stable in the actual scene. Identify the trace link node, if the total number of sample node pairs is 90, the first 9 are extracted for path mapping construction, after filtering, the source address, target address, protocol type (such as TCP, UDP) and communication port number of each node pair are extracted, combined as a link field group, and the node pair number is summarized to form a many-to-many path structure set. Record the communication trajectory boundary and communication protocol state between nodes, finally generate the output field format as "source node-target node-protocol-port" path matrix record, and obtain the suspicious node link list.

[0094] Please refer to Figure 5 , the behavior trajectory comparison module includes:

[0095] The template extraction submodule extracts three static access template information of each node associated with access control permission level, operation time period and network protocol type based on the suspicious node link list, extracts three dynamic behavior records of operation instruction type, target resource type and event timestamp from the audit log matching the node number, establishes the static and dynamic behavior data set corresponding to the node, and generates the node behavior information table;

[0096] Based on the node numbers screened out in the suspicious node link list, the system calls the access control strategy configuration file and the network configuration table for each node, respectively extracts the corresponding access control permission level, operation time period range and binding protocol type field, and the three static information is usually set in the initial deployment stage of the system, for example, the permission level is represented by the value 0-3, where 0 is the minimum permission and 3 is the highest permission, the operation time period is recorded in 24-hour format hour range (such as 08-18 represents the normal working period), and the protocol type is TCP, UDP or HTTP standard protocol; synchronously read the audit log file, perform node number matching screening on all entries in the log, only keep the log lines with the same number, parse the log structure to extract the operation instruction type, target resource type and event timestamp field, the operation instruction is such as "chmod", "scp", "ssh", etc., the resource type is such as "directory", "kernel driver", "system configuration file", etc., the timestamp field is further parsed into the time format composed of year, month, day and hour, minute and second, and the static access field and the dynamic behavior field are bound side by side to the node as an index, and the structured output is the node behavior information table, and the node behavior information table is obtained.

[0097] The behavior matching submodule calls the node behavior information table, respectively selects the static access template field and the dynamic behavior record field for field correspondence, matches each dynamic behavior record with the static template data in three items of permission level, operation period and protocol type, judges whether there is a field value inconsistency and marks the matching state, records the mark state of the inconsistent items and enters the node index table, and generates the behavior field matching offset information;

[0098] The node behavior information table is called, each dynamic behavior record is called according to the node number, the permission level, the operation time period and the protocol type of the node in the static access template are called respectively, the operation instruction type, the event timestamp and the communication protocol field of the dynamic behavior are correspondingly compared, the consistency judgment standard between the fields is that the values are completely same (such as the permission levels are equal, the timestamp hour value is in the template time period, and the protocols are completely matched), if the values of any one of the three items are not consistent, then the inconsistent item is recorded, the marked record is recorded on the dynamic behavior record and the type information of the inconsistent field is attached, such as the record permission is 2 but the instruction operation corresponds to the permission demand of 3, or the time is 21 but the template allows the time to be only 18, which are all inconsistent behaviors and are recorded in the record list, all the marked record entries are summarized according to the node number, and the behavior field matching offset information is output.

[0099] The deviation counting submodule counts the total number of inconsistent items of each node according to the behavior field matching offset information, takes the node number as an index item, and summarizes the number of deviation items, and outputs the number of node deviation items as a mapping table structure, establishes the behavior deviation degree set of the node between the static expectation and the dynamic trajectory, and generates the node behavior deviation index table;

[0100] Each marked record in the behavior field matching offset information is called, the number of inconsistent marks in the permission, time and protocol fields is counted according to the node number, and the counting result is mapped to the corresponding node index item, forming the deviation number result between the template preset condition and the actual dynamic behavior of the node, for example, node A corresponds to 6 inconsistent behaviors, of which 3 are permission conflicts, 2 are overtime operations, and 1 is protocol inconsistency, then the number of deviation items of the node is 6, the result is merged into the node number mapping structure, and the node behavior deviation index table is output.

[0101] Table 4 deviation item data table

[0102] As shown in Table 4, the permission, time period and protocol field matching abnormal record situation and deviation item number statistical result of part of the nodes are listed, which can be used for data input of the subsequent behavior trajectory matching comparison module.

[0103] Please refer to Figure 6 , the threat trace determination module comprises:

[0104] The deviation screening submodule selects a node set whose deviation item number exceeds a deviation item determination threshold based on the node behavior deviation index table according to the deviation item number of the node, extracts the communication request record in the network communication log, takes the node number as an index, establishes a node behavior activity sequence structure, and generates a high deviation node set.

[0105] Based on the node behavior deviation index table, the system reads the node number and its corresponding deviation item number value from it, and sets the deviation item judgment threshold to 5 items. This threshold is derived from the historical behavior monitoring results. The number of deviation items of most legitimate nodes in a cycle is less than or equal to 4, and the behavior of nodes with more than 5 items shows significant differences. Therefore, 5 is used as the threshold for deviation screening to exclude non-abnormal nodes; when screening the number of deviation items, it is judged whether the number of deviation items of each node is greater than the threshold. If true, the node is included in the screening results, and its network communication log within the cycle is extracted. The communication request behavior initiated by the node in the log is parsed. The fields include the target node address, communication port, protocol type and event timestamp, etc. All behavior event sequences are collected by node number and integrated to generate a high-deviation node set.

[0106] The behavior sorting submodule calls the high deviation node set, sorts the communication behavior records of each node by time, extracts the first communication initiation time and converts it into a timestamp value in seconds from zero, and calls the number of deviation items corresponding to the node using the formula:

[0107] ;

[0108] Obtain the attack source ranking value of each node through calculation, sort the nodes in descending order according to the ranking value, and obtain the sorted node list;

[0109] in, For the The attack source ranking value of each node, For the The normalized value of the first communication time ranking of a node among all high deviation nodes, For the The number of deviation items of nodes, For the The total number of communication sessions of each node in the period;

[0110] Call the high deviation node set, sort the network communication records of each node in ascending order according to the timestamp field, extract the timestamp of the first communication of each node, convert it into the second value from 00:00:00 on the day, and record it as the start time of the behavior. For example, if the first communication of the node occurs at 03:15:00, the timestamp is 11700 seconds; rank all the node start times and normalize them to interval, and obtain the corresponding normalized time ranking value, recorded as ; At the same time, the number of node deviation items is counted and recorded as , for example, the number of matching deviations of a node is 8; then the total number of communication sessions generated by the node in the entire period is extracted and recorded as If the value is 56, use the following formula to calculate the node attack source ranking value:

[0111] ;

[0112] The example parameters are calculated as follows:

[0113] Let the normalized starting time ranking value of node f be: ;

[0114] The number of deviation terms is: ;

[0115] The total number of communications is: ;

[0116] Step one: square and root:

[0117] ;

[0118] Step two: denominator calculation:

[0119] ;

[0120] Step three: overall calculation:

[0121] ;

[0122] Therefore, the attack source ranking value of this node is 1.595, which can be used for comparison with other node ranking values to determine the ranking position.

[0123] Formula calculation logic explanation:

[0124] Molecule part : The early onset of the first communication time of the node ( ) and the degree of behavior abnormality ( ) are integrated, and the sum after squaring reflects the combined abnormal strength of the two factors; the denominator part : The communication activity suppression mechanism is introduced, and relatively low weight is given to nodes with high frequency of communication but less deviation or late time; the result : Measures the possibility of the node as the starting source in the attack path, the larger the ranking value, the more likely the node is the starting point of the attack source.

[0125] Parameter source and setting explanation:

[0126] Obtained by sorting the first communication time of the node in ascending order among all high deviation nodes and then normalizing by percentage; The total number of inconsistent items in the behavior field matched by the preceding deviation count submodule; The total number of sessions obtained by statistical communication logs; all participating parameters have been normalized or dimensionless data, avoiding dimensional conflict problems.

[0127] Table 5 attack source ranking value calculation example table:

[0128] As shown in Table 5, Node01 is the priority determination object of the attack source node due to the higher number of deviation items and the advanced first communication behavior. The results in the table will be used in the subsequent node positioning submodule to screen target nodes.

[0129] The node positioning submodule selects a target number of nodes according to the ranked node list, outputs the behavior starting time, the number of deviation items and the corresponding communication link information according to the node number, constructs a node positioning path mapping table structure, and generates an attack source node positioning result;

[0130] According to the ranked node list output by the behavior ranking submodule, the top 5 node numbers are selected as the target set, the first communication time, the number of deviation items and the communication link field information of the corresponding node are extracted, the link field includes three items of the target node connected by the node in the period, the port number and the protocol type, all fields are summarized according to the node number as the primary key, the path information structure is constructed, the structure is indexed by the node, and the multiple pairs of communication link combinations of the node and other nodes are listed, the constructed structure is formatted and output, and the attack source node positioning result is generated.

[0131] The above is only a preferred embodiment of the present application, and does not limit the form of the present application, any skilled person in the art can use the disclosed technical content to make changes or modifications as equivalent embodiments applied to other fields, but any simple modification, equivalent change and modification made according to the technical essence of the present application to the above embodiments without departing from the technical solution content of the present application still belongs to the protection scope of the technical solution of the present application.

Claims

1. A network security threat assessment and tracing system based on big data, characterized by: The system comprises: The node behavior monitoring module obtains the node unique identifier and audit log within the specified monitoring period, collects the number of occurrences and time distribution of event types for each node through the node identifier and behavior timestamp, constructs a behavior feature data table with the node as the key and the behavior type as the field, and generates a periodic behavior feature form; The function shift identification module calculates the sum of the absolute values ​​of the frequency differences of each behavior type based on the periodic behavior feature table, obtains the magnitude of the behavior vector change of each node, and generates a function role shift assessment result; The path variation screening module calls the functional role offset assessment result, screens the connection node pairs with communication offset, counts the interaction direction consistency rate and average time interval standard deviation between the node pairs, calculates the path anomaly index, identifies suspicious node links, and generates a suspicious node link list; The behavior trajectory comparison module extracts dynamic behavior features in the audit log based on the suspicious node link list, compares the static behavior template with the dynamic behavior items, marks and counts the mismatched items, forms a mapping structure between the node and the number of deviation items, and generates a node behavior deviation index table.

2. The network security threat assessment and tracing system based on big data according to claim 1 is characterized in that: The periodic behavior feature form includes node identification index, behavior category distribution and behavior time density; the functional role deviation assessment result includes vector angle value, frequency change value and standardized deviation score; the suspicious node link list includes communication frequency difference, direction consistency ratio and time interval standard deviation; the node behavior deviation index table includes static parameter matching results, dynamic behavior anomaly labels and deviation item quantity statistics.

3. The network security threat assessment and tracing system based on big data according to claim 2 is characterized in that: The node behavior monitoring module includes: The log extraction submodule obtains the node unique identifier and audit log within the specified monitoring period, extracts the event type field, event timestamp field, and event target field from the log, filters the content of the event type field, retains four behavioral events: authentication events, file system operations, network session establishment, and remote command execution, establishes an event mapping table based on the node unique identifier, and generates a node behavior event collection; The behavior statistics submodule calls the node behavior event collection, aggregates according to the event type and timestamp fields, and the node unique identifier, counts the number of occurrences of each behavior event within the monitoring period, extracts the hour and minute values ​​in the event occurrence timestamp, establishes a behavior event frequency and time distribution table according to the node number, and generates node behavior statistical distribution information; The feature aggregation submodule establishes a two-dimensional data structure based on the statistical distribution information of information node behavior, with the node number and event type number as the index field, and uses the number of behavior occurrences and time distribution density as the data field to summarize and organize the statistical data of each node behavior, construct a node behavior feature data table, and generate a periodic behavior feature form.

4. The network security threat assessment and tracing system based on big data according to claim 3 is characterized in that: The function deviation identification module includes: The vector construction submodule extracts event frequency data of each node under multiple types of behavioral events based on the periodic behavior feature table, constructs a behavior frequency vector group within two periods using the node number as the index field, constructs a vector structure within each period based on the frequencies arranged in the order of behavior type, calculates the vector combination of node behavior frequencies within the period, and generates a periodic behavior vector pair group; The offset determination submodule calls the periodic behavior vector pair group, calculates the corresponding cosine angle value in the behavior space based on the two periodic vector data of each node, extracts the frequency difference of each type of behavior, takes the absolute value and sums it, determines whether the angle value is greater than the set vector offset angle threshold, filters the node behavior offset records that meet the conditions, calculates and obtains the behavior vector change amplitude value of each node in the periodic behavior space, sorts them according to the amplitude value, and generates a behavior vector change amplitude sequence; The change normalization submodule constructs a fluctuation sequence based on the behavior vector change amplitude sequence, with the node number as the horizontal axis and the behavior vector change amplitude value as the vertical axis, and performs Z-score normalization. The standardized value of each node is averaged, and the overall deviation degree of the node behavior change is counted. The performance measurement of the node at the periodic behavior level is established to generate the functional role offset evaluation result.

5. The network security threat assessment and tracing system based on big data according to claim 4 is characterized in that: The path variation screening module includes: The frequency extraction submodule calls the functional role offset assessment result, extracts the communication records of the corresponding nodes in the network traffic log based on the node identification whose behavior change amplitude value exceeds the judgment threshold, sets the attack time point as the benchmark, extracts the window interval of the target length before and after, extracts the number of TCP connections established for each pair of communication nodes in the two time windows, calculates the difference, and outputs a difference value list by node pair number to generate communication frequency difference information; The offset calculation submodule compares the frequency difference of each node pair with the set communication frequency change threshold based on the communication frequency difference information, screens the node pairs with frequency difference greater than the threshold, extracts the communication direction information and event timestamps of the node pairs within the two window intervals, counts the proportion of node pairs communicating in the same direction, and calculates the standard deviation of the time intervals between two consecutive connections. It calculates the anomaly index value of each pair of communication nodes under the offset background and generates node pair anomaly information; The link determination submodule calls the node pair anomaly information, sorts each communication node pair in descending order according to the size of the anomaly index, filters the target number of high-risk node pairs based on the sorting, summarizes the communication field combination according to the node pair index field, extracts the source node and target node numbers, communication ports and protocol types as link features, combines them to form a link path determination table, establishes a multi-to-multi-path information set between nodes, and generates a suspicious node link list.

6. The network security threat assessment and tracing system based on big data according to claim 5 is characterized in that: The behavior trajectory comparison module includes: Based on the suspicious node link list, the template extraction submodule extracts three static access template information items, namely, the access control authority level, operation time period, and network protocol type, associated with each node. It also extracts three dynamic behavior records, namely, the operation instruction type, target resource type, and event timestamp, that match the node number from the audit log. This submodule establishes static and dynamic behavior datasets corresponding to the node and generates a node behavior information comparison table. The behavior matching submodule calls the node behavior information comparison table, selects static access template fields and dynamic behavior record fields for field correspondence, matches each dynamic behavior record with the static template data item by item in terms of permission level, operation period, and protocol type, determines whether there are any field value inconsistencies and marks the matching status, records the marking status of the inconsistent items and adds them to the node index table, and generates behavior field matching offset information; The deviation counting submodule matches the offset information according to the behavior field, uses the node number as the index item, counts the total number of mismatched items for each node, and summarizes them as the number of deviation items. The number of node deviation items is output as a mapping table structure, establishes a set of the degree of behavior deviation of the node between the static expectation and the dynamic trajectory, and generates a node behavior deviation index table.

7. The network security threat assessment and tracing system based on big data according to claim 6 is characterized in that: The system further comprises: The threat tracing and determination module calls the node behavior deviation index table, extracts the first communication time and the number of deviation items of each node, calculates the attack source ranking value, sorts each node in descending order according to the ranking value, selects the target number of nodes as tracing candidates according to the ranking value, and generates the attack source node positioning result; The attack source node positioning result specifically includes the behavior start time sorting and deviation value combination, and the attack node priority score.

8. The network security threat assessment and tracing system based on big data according to claim 7 is characterized in that: The threat source tracing and determination module includes: The deviation screening submodule selects a node set whose number of deviation items exceeds a deviation item determination threshold based on the node behavior deviation index table and the number of deviation items of the node, extracts communication request records from the network communication log, establishes a node behavior activity sequence structure with the node number as the index, and generates a high deviation node set; The behavior sorting submodule calls the high-deviation node set, sorts the communication behavior records of each node by time, extracts the time of the first communication initiation and converts it into a timestamp value in seconds from zero, calls the number of deviation items corresponding to the node, calculates the attack source ranking value of each node, and arranges the nodes in descending order according to the ranking value to obtain a sorted node list; The node positioning submodule selects a target number of nodes according to the sorted node list, outputs the behavior starting time, the number of deviation items and the corresponding communication link information according to the node number, constructs a node positioning path mapping table structure, and generates the attack source node positioning result.

Images