Network attack path tracking method and system based on three-domain communication event structure

Abstract

The invention discloses a network attack path tracking method and system based on a three-domain communication event structure, and relates to the technical field of network security, and the method comprises the steps: converting the three-domain communication event structure into a heterogeneous atlas structure composed of nodes and multi-dimensional label edges, and generating an industrial network topological graph; training the graph neural network model by using an industrial network topological graph, identifying an abnormal jump path and an attack chain segment, and generating a suspicious path set; performing consistency calculation and weighted fusion on communication behaviors, protocol calling logic and physical state response in the suspicious path set to generate a credibility score vector; and carrying out fusion calculation on the credibility score vectors, selecting a path with the lowest credibility as a high-risk attack path, and backtracking and reconstructing an attack path starting point in combination with a time sequence, an industrial network topological graph and an abnormal jump path to obtain an attack propagation chain. According to the invention, the precision and efficiency of industrial network security situation awareness are improved.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network security, in particular to a network attack path tracking method and system based on a three-domain communication event structure. BACKGROUND

[0002] With the digital transformation of industrial control systems and critical infrastructures, network attack means are increasingly complex and diverse, especially in the form of multi-hop attack chains and hidden abnormal jump paths. Existing network security technologies mostly rely on single-dimensional data analysis and rule matching methods, which have certain recognition ability for known attack behaviors, but have limitations in dealing with new attacks and complex attack chains. In recent years, the field of industrial network security has begun to introduce graph structure-based modeling and deep learning technologies, by constructing network topology graphs and training graph neural network models, to realize deep understanding of network communication relationships and mining of abnormal paths. It can extract complex nonlinear features between nodes in industrial networks, assist in discovering potential attack chain segments, and improve the accuracy and efficiency of network security situation awareness.

[0003] Existing technologies generally lack in multi-source data fusion and dynamic attack path reconstruction. On the one hand, most methods fail to fully integrate multi-dimensional information such as communication traffic, industrial protocol content, and device status, resulting in network topology graphs that do not fully represent attack behaviors. On the other hand, the identification of abnormal jump paths and the reconstruction of attack chains lack consistent computing and weighted fusion mechanisms, making the credibility assessment of attack paths less accurate and affecting the timeliness and relevance of security responses. To address these shortcomings, there is an urgent need for a comprehensive method that can construct a three-domain communication event structure based on multi-source heterogeneous data, convert it into a multi-dimensional label heterogeneous graph, and use graph neural networks to identify abnormal paths and score credibility, thereby dynamically tracking attack paths and implementing real-time protection. SUMMARY

[0004] In view of the above existing problems, the present application is proposed.

[0005] Therefore, the present application provides a network attack path tracking method based on a three-domain communication event structure to solve the problems of insufficient multi-source heterogeneous data fusion and low accuracy of dynamic attack path identification.

[0006] To solve the above technical problems, the present application provides the following technical solutions: In a first aspect, the application provides a network attack path tracking method based on a three-domain communication event structure, which comprises collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure; converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph; training a graph neural network model using the industrial network topology graph to identify abnormal jump paths and attack segments and generate a suspicious path set; performing consistency calculation and weighted fusion on the communication behavior, protocol call logic and physical state response in the suspicious path set to generate a credibility score vector; performing fusion calculation on the credibility score vector to select the path with the lowest credibility as a high-risk attack path, and combining time series, industrial network topology graph and abnormal jump path backtracking to reconstruct the attack path starting point to obtain an attack propagation chain; displaying the attack propagation chain in the industrial network topology graph through a visual method and outputting to an industrial security linkage to trigger real-time blocking, protection and early warning response.

[0007] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the original multi-source data is collected for preprocessing and encoding into a three-domain communication event structure, and the specific steps are as follows, The network communication traffic, industrial control protocol content and running state form original multi-source data. The original multi-source data is subjected to format unification, time alignment and abnormality filtering to generate structured preprocessed data, which is divided into a communication domain, a protocol domain and a state domain to form three-domain communication event structure elements. The three-domain communication event structure elements are sorted and numbered according to the event occurrence time to generate a three-domain communication event structure.

[0008] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the communication parties are extracted as nodes from the three-domain communication event structure, the protocol type, communication frequency, function code abnormality mark and state change information are mapped into the multi-dimensional label of the edge, and the heterogeneous graph structure is constructed and optimized to generate an industrial network topology graph.

[0009] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the suspicious path set is generated, and the specific steps are as follows, The industrial network topology graph is converted into a node feature matrix and an edge weight matrix, and the graph neural network model is iteratively trained until the loss converges to obtain a trained graph neural network model. The trained graph neural network model is used to reason the industrial network topology graph, extract complex nonlinear features, and identify abnormal jump paths and potential attack segments in the industrial network topology graph using a path search method and an anomaly detection method to generate a suspicious path set.

[0010] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the steps of generating the credibility score vector are as follows, The communication behavior, protocol calling logic and physical state response involved in the suspicious path set are parsed from the three-domain communication event structure, the corresponding function code sequence and parameter structure feature are extracted, and the behavior consistency score, logic consistency score and state response consistency score are calculated by matching with the historical normal mode; The behavior consistency score, logic consistency score and state response consistency score are weighted and fused and normalized to generate a multi-path credibility score vector.

[0011] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the steps of generating the credibility score vector are as follows, The multi-path credibility score vector set is sorted in ascending order, the path with the lowest multi-path credibility score is extracted, and a high-risk attack path candidate set is formed; Based on the communication node sequence and timestamp information of the high-risk attack path candidate set, the order of events in the path is rearranged to generate a time-consistent attack behavior chain; In the attack behavior chain, the industrial network topology graph and the abnormal jump path are combined to backtrack the first abnormal communication event and locate the path source node; According to the path source node, the jump nodes in the high-risk attack path candidate set are backtracked, and the path source node, abnormal jump path and candidate path endpoint are connected in order to obtain the attack propagation chain.

[0012] As a preferred scheme of the network attack path tracking method based on the three-domain communication event structure, the steps of generating the credibility score vector are as follows, The attack propagation chain is structured and coded to convert into graphical representation of network node coordinates, connection edge attributes and identification information, forming visual graphical input data; Based on the industrial network topology graph, the visual graphical input data is mapped to the network node coordinates and connection relationship in the industrial network topology graph to obtain the attack propagation chain spatial structure; The path starting node, abnormal jump path and victim node identification information are extracted from the attack propagation chain spatial structure to generate a security linkage trigger instruction set; The security linkage trigger instruction set is transmitted to the linkage execution end to trigger real-time blocking, protection and early warning response.

[0013] In a second aspect, the present application provides a network attack path tracking system based on a three-domain communication event structure, comprising: a data processing module for collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure; a graph construction module for converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges, generating an industrial network topology graph; a training and identification module for training a graph neural network model using the industrial network topology graph, identifying abnormal jump paths and attack chain segments, and generating a suspicious path set; a score calculation module for performing consistency calculation and weighted fusion on communication behaviors, protocol call logic and physical state responses in the suspicious path set, generating a credibility score vector; a path screening module for performing fusion calculation on the credibility score vector, selecting the path with the lowest credibility as a high-risk attack path, and combining time series, industrial network topology graph and abnormal jump path backtracking to reconstruct the attack path starting point, obtaining an attack propagation chain; and a visualization module for displaying the attack propagation chain in the industrial network topology graph through a visual method and outputting to an industrial security linkage to trigger real-time blocking, protection and early warning response.

[0014] In a third aspect, the present application provides a computer device comprising a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, any step of the network attack path tracking method based on the three-domain communication event structure according to the first aspect of the present application is implemented.

[0015] In a fourth aspect, the present application provides a computer readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, any step of the network attack path tracking method based on the three-domain communication event structure according to the first aspect of the present application is implemented.

[0016] The present application has the following beneficial effects: by collecting original multi-source data for preprocessing and encoding into a three-domain communication event structure, the fusion and unified expression of multi-source heterogeneous data are realized, the data silos are broken, and the completeness and consistency of the data are improved; the three-domain communication event structure is converted into a heterogeneous graph structure composed of nodes and multi-dimensional label edges, an industrial network topology graph is generated, the semantic association and topological continuity of nodes and edges in the network are strengthened, the expression ability of the model for complex interaction relationships is improved, thereby effectively enhancing the accuracy and robustness of subsequent attack path identification, and significantly improving the precision and efficiency of industrial network security situation awareness. BRIEF DESCRIPTION OF DRAWINGS

[0017] To more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the following description of the embodiments will be briefly introduced. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0018] Fig. 1 This is a flowchart of a network attack path tracing method based on a three-domain communication event structure.

[0019] Fig. 2 This is a schematic diagram of a network attack path tracing system.

[0020] Fig. 3 A flowchart for generating a three-domain communication event structure.

[0021] Fig. 4 A flowchart for generating credibility score vectors. Detailed Implementation

[0022] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings.

[0023] Many specific details are set forth in the following description in order to provide a full understanding of the invention. However, the invention may also be practiced in other ways different from those described herein, and those skilled in the art can make similar extensions without departing from the spirit of the invention. Therefore, the invention is not limited to the specific embodiments disclosed below.

[0024] Secondly, the term "one embodiment" or "embodiment" as used herein refers to a specific feature, structure, or characteristic that may be included in at least one implementation of the present invention. The phrase "in one embodiment" appearing in different places in this specification does not necessarily refer to the same embodiment, nor is it a single or selective embodiment that is mutually exclusive with other embodiments.

[0025] Reference Figs. 1-4 As one embodiment of the present invention, this embodiment provides a network attack path tracing method based on a three-domain communication event structure, comprising the following steps: S1. Collect raw multi-source data, preprocess it, and encode it into a three-domain communication event structure.

[0026] S1.1 Collect network communication traffic, industrial control protocol content, and operating status to form raw multi-source data.

[0027] Specifically, network communication traffic generated in the industrial network environment is collected by setting up mirror ports or deploying traffic acquisition probes and stored in pcap format. Communication middleware or protocol decoders are connected at key nodes of the industrial control system to extract real-time content of industrial control protocols such as Modbus, OPC UA, and Profinet, including function codes, register addresses, and call parameters. Operating status information is obtained from devices such as controllers, sensors, and actuators by calling device management interfaces or reading log records to obtain real-time status parameters of the devices, such as temperature, pressure, and motor start / stop status. During the collection process, timestamps are added, and the data is labeled and organized in a unified data format, ultimately forming a data set containing network communication traffic, industrial control protocol content, and operating status as raw multi-source data.

[0028] S1.2. Perform format unification, time alignment and anomaly filtering on the original multi-source data to generate structured preprocessed data, which is divided into communication domain, protocol domain and state domain to form a three-domain communication event structure element.

[0029] Specifically, the network communication traffic, industrial control protocol content, and operation status data in the original multi-source data are converted into different formats. The pcap format network communication traffic is extracted into data records containing source IP, destination IP, port number, protocol type, and timestamp. The industrial control protocol content is parsed into a structure composed of function code, register address, call parameters, and timestamp. The operation status data is unified into a data format containing status variable name, variable value, and acquisition time. Based on timestamps, a sliding window mechanism is used to align all data with a uniform time precision (e.g., milliseconds) to ensure that network communication traffic, industrial control protocol content, and operational status data can be analyzed synchronously within the same time interval. Remove or correct missing values, duplicate records, and obvious erroneous values ​​in the original multi-source data. Examples include: deleting network communication traffic with no source IP or destination IP, removing industrial control protocol content with empty function codes, and correcting operating status data with illegal encodings. The processed network communication traffic is divided into communication domain data, the parsed industrial control protocol content is divided into protocol domain data, and the processed operating status data is divided into status domain data. The three types of data are then merged according to the aligned time order to form a three-domain communication event structure element.

[0030] S1.3 Sort the three-domain communication event structure elements according to the event occurrence time and assign them uniform numbers to generate the three-domain communication event structure.

[0031] Specifically, the timestamp field in the three-domain communication event structure element is extracted, and all three-domain communication event structure elements are sorted by time in ascending order to ensure that the communication domain data, protocol domain data, and status domain data are arranged on the same time axis in the actual order of occurrence. Starting with the earliest timestamp, assign a unique event number to each three-domain communication event structure element in an incremental manner. Example numbering formats include "E0001", "E0002", and "E0003", etc. The numbering process must strictly maintain consistency between the event order and the time sequence; skipping or duplicate numbers is not allowed. The sorted three-domain communication event structure elements retain the original field information (including source address, destination address, protocol type, function code, parameters, and status value, etc.) and add an event number field, ultimately forming a three-domain communication event structure arranged in chronological order and with a unique number identifier.

[0032] S2. Convert the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph.

[0033] It should be noted that by integrating multi-source domain information, multi-dimensional information from the communication domain, protocol domain, and state domain is innovatively integrated to construct multi-dimensional labeled edges containing dynamic features such as function code anomaly markers and state changes, significantly improving the richness and accuracy of industrial network topology representation. The introduction of a heterogeneous graph structure enables high-dimensional attribute representation of edges, differing from traditional network construction that only uses simple edge weights or single labels, thus enhancing the expressive power of industrial network behavior. Intelligent node merging and label aggregation effectively avoid redundant nodes and multiple edge information, ensuring the compactness and information integrity of the topology graph. Simultaneously, incorporating dynamic state information into the topology construction breaks through the limitations of existing technologies that only depict static communication relationships, enhancing the topology graph's dynamic perception capability of the industrial network's operating status, demonstrating significant innovation and practical value.

[0034] The beneficial effect is that by fusing the communication domain, protocol domain, and state domain information in the three-domain communication event structure to construct a heterogeneous graph structure with multi-dimensional labeled edges, it significantly differs from existing technologies that construct industrial network topologies based solely on a single communication relationship or simple edge weights. For example, existing technologies typically only use the IP addresses or MAC addresses of the communicating parties as nodes, and edges only represent simple connection relationships or communication frequencies, failing to reflect protocol anomalies and equipment status changes. In contrast, this invention innovatively integrates function code anomaly markers and state change information into the multi-dimensional labels of the edges, greatly improving the sensitivity and performance of industrial network topologies to abnormal behavior and equipment operating status.

[0035] S2.1 Extract the two communicating parties as nodes from the three-domain communication event structure, map the protocol type, communication frequency, function code anomaly marker and state change information as multi-dimensional labels of the edges, construct and optimize the heterogeneous graph structure, and generate an industrial network topology graph.

[0036] Specifically, for each communication event in the three-domain communication event structure, the source address and destination address information in the communication domain are extracted and used as the start node and end node, respectively. The name of the start node is the source address node, and the name of the end node is the destination address node. The node pairs are then formed as source address node-destination address node. Traverse all events and analyze the interactions between node pairs. For each node pair's communication behavior between the source and destination nodes, extract the protocol type from the protocol field and count the number of times the protocol type appears within the observation period as the communication frequency. Simultaneously, generate function code anomaly marking information based on whether the function code field is marked as abnormal. Further extract the magnitude or type of state value change in the state domain to generate state change information. Summarize the state change information as a multi-dimensional label for the edge between the source address node and the destination address node. An example format is {protocol type: Modbus, communication frequency: 120, function code anomaly flag: yes, state change information: offset increase}. The edges between all nodes and their source and destination addresses are aggregated to form a heterogeneous graph structure consisting of destination nodes and edges with multi-dimensional labels. Duplicate destination address nodes in the graph structure are merged, and edge information is aggregated to generate the industrial network topology graph.

[0037] S3. Use the industrial network topology to train the graph neural network model, identify abnormal jump paths and attack chains, and generate a set of suspicious paths.

[0038] It should be noted that this method innovatively utilizes industrial network topology as the input structure and combines it with graph neural network models for deep training to achieve accurate modeling of complex industrial communication relationships and dynamic behaviors, breaking through the limitations of traditional methods based on static rules or single features. By iteratively optimizing node embedding and edge weight parameters, the accuracy of identifying abnormal jump paths and attack chains is improved. The introduction of a joint detection mechanism for abnormal jump paths and attack chains can capture hidden potential attack behaviors and generate a more comprehensive and accurate set of suspicious paths. This significantly enhances the depth and breadth of industrial network security situational awareness, and differs from existing methods that rely solely on feature matching or threshold judgment, improving the intelligence and robustness of anomaly detection.

[0039] The beneficial effects are as follows: By training a graph neural network model based on the industrial network topology, unlike existing technologies that use static rule matching or single feature threshold judgment, it can dynamically capture the complex nonlinear correlation features in the industrial network, and achieve accurate identification of abnormal jump paths and attack chains. Existing technologies mostly rely on fixed feature extraction and lack comprehensive utilization of multi-dimensional node and edge weight information, while the fusion of node embedding and edge weight optimization significantly improves the accuracy and generalization ability of anomaly detection. In addition, existing technologies for anomaly path identification are mostly limited to single-path analysis. By combining path search and anomaly detection, it is possible to identify potential attack chains on multiple paths, enhancing the ability to analyze the spatiotemporal correlation of attack behaviors.

[0040] S3.1. Transform the industrial network topology into a node feature matrix and an edge weight matrix, and iteratively train the graph neural network model until the loss converges to obtain the trained graph neural network model.

[0041] Specifically, all address nodes and their corresponding attribute information are extracted from the industrial network topology diagram. Based on the historical communication behavior, device identification, function type and protocol participation of each address node in the three-domain communication event structure, a node feature vector is constructed. All node feature vectors are arranged in order in the industrial network topology diagram and combined to form a node feature matrix. Extract all source-destination address nodes and their corresponding multi-dimensional label information from the industrial network topology diagram, including communication frequency, protocol type, function code anomaly markers, and state change quantities. Calculate the weight value for each source-destination address node edge, ultimately forming an edge weight matrix. Based on communication frequency normalization, the expression is: ; in, Indicates starting from the node To the terminal node edge weight values, Indicates the starting node To the terminal node Communication frequency between them This represents the sum of communication frequencies between all node pairs. Indicates the index number of the starting node. Indicates the index number of the terminating node. This represents the index number of all starting nodes. Indicates the index number of all terminating nodes. Indicates the starting node number is The termination node number is The communication frequency corresponding to the edge; The node feature matrix and edge weight matrix are fed into the graph neural network model as input, and iterative training is performed using the backpropagation algorithm. In each training round, the loss function value is calculated based on the error between the predicted output of the graph neural network model and the true label. The expression is as follows: ; in, This represents the loss function value for the entire training batch. This represents the total number of training samples. Indicates the first The true label of each sample Indicates the first The predicted probability value of each sample. Indicates the index number of the training sample; Continue optimizing the parameters of the graph neural network model until the loss function converges, completing the optimization and update of node embedding vectors and edge weight parameters.

[0042] S3.2. Using the trained graph neural network model, reason about the industrial network topology, extract complex nonlinear features, and use path search and anomaly detection methods to identify abnormal jump paths and potential attack chains in the industrial network topology, generating a set of suspicious paths.

[0043] Specifically, the trained graph neural network model is used to reason about the industrial network topology. The node feature matrix and edge weight matrix of the industrial network topology are used as input, and complex nonlinear embedding features are extracted through multi-layer graph convolution operation. Based on node embedding features, a path search method is used to traverse the industrial network topology and mine connection paths. At the same time, anomaly detection methods are used to extract multi-dimensional features of communication nodes and edges in the paths, including communication frequency, protocol type, and function code anomaly markers. These features are then compared with a behavior model established from historical normal patterns to calculate feature deviation or anomaly scores. The degree of anomaly of nodes and edges is judged based on the anomaly scores, and abnormal behaviors in abnormal jump paths are identified. Abnormal jump paths and potential attack chains are identified. The identified abnormal jump paths and attack chains are summarized to generate a set of suspicious paths.

[0044] S4. Perform consistency calculation and weighted fusion on the communication behavior, protocol call logic and physical state response of the suspicious path set to generate a credibility score vector.

[0045] S4.1. Analyze the communication behavior, protocol call logic and physical state response involved in the suspicious path set from the three-domain communication event structure, extract the corresponding function code sequence and parameter structure features respectively, and match them with the historical normal pattern to calculate the behavior consistency score, logic consistency score and state response consistency score.

[0046] Specifically, from the three-domain communication event structure, the communication behaviors, protocol call logic and physical state responses involved in the suspicious path set are extracted, and the function code sequence and parameter structure features are analyzed respectively. By comparing the corresponding function code sequence and parameter structure in the historical normal mode item by item, the behavior consistency score is calculated, and the expression is: ; in, Indicates the behavioral consistency score. Indicates the length of the function code sequence. Indicates the index position of the current function code sequence. Indicates the first suspicious path Function codes, Indicating the normal historical path and Reference function code corresponding to the location, This represents a conditional function; Based on the protocol call logic, the call order and logical relationship of the function code sequence are verified, and a logical consistency score is calculated. The expression is as follows: ; in, Indicates the logical consistency score. Indicates the first suspicious path Function codes, Indicating the normal historical path and Reference function code corresponding to the location, This represents a logical comparison function; Simultaneously, the state change values ​​in the physical state response are extracted and compared with the historical normal state change range to calculate the state response consistency score, expressed as: ; in, This indicates the consistency score of the state response. This represents the total number of state parameters. Indicates the index of the currently processed state parameter. Indicates the first suspicious path Each state parameter value, Indicating the normal historical path and The corresponding reference state parameter value, Represents small positive numbers; Calculate and output the behavioral consistency score, logical consistency score, and state response consistency score respectively.

[0047] S4.2. Perform weighted fusion and normalization on the behavioral consistency score, logical consistency score and state response consistency score to generate a multi-path credibility score vector.

[0048] Specifically, for each suspicious path, the corresponding behavioral consistency score, logical consistency score, and state response consistency score are extracted and assigned fixed weighting coefficients, such as 0.4, 0.3, and 0.3 respectively. The three types of scores are then weighted and summed according to the weighting coefficients to obtain the original credibility score of each suspicious path. The maximum value among the original credibility scores of all suspicious paths is counted. This maximum value is then used as a normalization factor to normalize the original credibility scores of all suspicious paths, resulting in a multi-path credibility score vector corresponding to all suspicious paths.

[0049] S5. The credibility score vector is fused and calculated, and the path with the lowest credibility is selected as the high-risk attack path. The attack path starting point is reconstructed by combining time series, industrial network topology map and abnormal jump path backtracking to obtain the attack propagation chain.

[0050] S5.1 Sort the multi-path credibility score vector set in ascending order, extract the path with the lowest multi-path credibility score, and form a candidate set of high-risk attack paths.

[0051] Specifically, for each suspicious path in the multi-path credibility score vector set, the paths are sorted in ascending order of their multi-path credibility scores to form a sorted path sequence. The sorted results are then iterated through to extract paths whose multi-path credibility scores fall within the smallest interval, which are then used as candidate paths. The specific extraction method includes scoring features and distinguishing between normal and abnormal by setting percentile thresholds. For example, selecting paths with multi-path credibility scores in the top 10% or selecting paths with multi-path credibility scores below a fixed value, such as paths below 0.3. Finally, the set of paths that meet the conditions constitutes a candidate set of high-risk attack paths.

[0052] It should also be explained that the specific steps for setting the percentile threshold are as follows: extract the values ​​of all confidence scores in the multi-path confidence score vector set and sort them in ascending order according to their numerical values; calculate the corresponding percentile threshold position index value according to the set percentile value, such as 10%, which in this example is the total number of paths multiplied by 10%; obtain the multi-path confidence score at the index position as the percentile threshold; traverse all paths and filter out paths whose multi-path confidence scores are less than or equal to the percentile threshold, and summarize them to form a high-risk attack path candidate set.

[0053] S5.2 Based on the communication node sequence and timestamp information of the high-risk attack path candidate set, rearrange the sequence of events within the path to generate a time-consistent attack behavior chain.

[0054] Specifically, based on the communication node sequence and timestamp information of the high-risk attack path candidate set, all communication node pairs contained in each high-risk attack path candidate set are extracted, and all three-domain communication event structure elements corresponding to the communication node pairs are selected from the three-domain communication event structure. All three-domain communication event structure elements are sorted in ascending order by the event occurrence time field, uniformly renumbered, and the order of events in the path is determined by the sorting result. An attack behavior chain is constructed using the sorted sequence of three-domain communication event structure elements. The communication node sequence is then mapped to the protocol type, function code, parameter value, and state change information recorded in the three-domain communication event structure to generate an attack behavior chain with consistent time.

[0055] S5.3 In the attack behavior chain, combine the industrial network topology map with the abnormal jump path, trace back the first abnormal communication event, and locate the source node of the path.

[0056] Specifically, in the attack behavior chain, all three-domain communication event structure elements are extracted, and for each three-domain communication event structure element associated with a communication node pair, the corresponding edges are matched in the industrial network topology graph, and the edges that belong to abnormal jump paths are identified. By combining the timestamp information corresponding to each edge, all abnormal jump path edges are sorted in ascending order of time to locate the abnormal jump path edge with the earliest time. The starting communication node associated with the abnormal jump path edge is taken as the path source node. By combining the timestamp information of the first appearance of the starting communication node in the three-domain communication event structure, the first abnormal communication event of the path is determined, and the backtracking location of the path source node is completed.

[0057] S5.4. Based on the path source node, backtrack the jump nodes in the high-risk attack path candidate set, and connect the path source node, abnormal jump path and candidate path endpoint in sequence to obtain the attack propagation chain.

[0058] Specifically, based on the path source node, all abnormal jump paths containing the path source node are selected from the high-risk attack path candidate set. According to the timestamp information in the three-domain communication event structure, the communication order of the jump nodes in each abnormal jump path is sorted in ascending order, and the communication node pairs between the jump nodes are extracted and connected in sequence to form a jump path sequence. By combining the communication nodes at the end of the jump path sequence, the termination node connected to it in the high-risk attack path candidate set is located as the candidate path endpoint; the path source node, the communication node pair composed of jump nodes in all abnormal jump paths, and the candidate path endpoint are connected in chronological order to form the final attack propagation chain.

[0059] S6. Visualize the attack propagation chain in the industrial network topology diagram and output it to the industrial security linkage to trigger real-time blocking, protection and early warning response.

[0060] S6.1. The attack propagation chain is structured and encoded into network node coordinates, connection edge attributes and identification information in a graphical representation, forming visual graphical input data.

[0061] Specifically, each communication node in the attack propagation chain is extracted as a node element. Based on the time sequence and logical position of the communication nodes in the attack propagation chain, they are numbered and sorted using a two-dimensional coordinate method. The horizontal and vertical coordinate values ​​of the nodes are assigned. For example, the horizontal coordinates are numbered sequentially according to the communication time, and the vertical coordinates are classified and layered according to the functional type to generate network node coordinates. Based on the connection relationship between communication nodes in the attack propagation chain, the communication direction is extracted to construct the connection edge attribute, and the communication protocol type, communication frequency, function code anomaly marker and state change information are attached as connection edge attribute labels; Extract the unique identifier, device identifier, and function type of the communication node to generate node identification information. Output the node coordinate set, connection edge attribute set, and node identifier set in a structured format to form graphical visualization input data.

[0062] S6.2 Based on the industrial network topology diagram, the visualized graphical input data is mapped to the network node coordinates and connection relationships in the industrial network topology diagram to obtain the spatial structure of the attack propagation chain.

[0063] Specifically, the node identification information in the visual graphic input data is compared one by one with the network node identification in the industrial network topology diagram. Based on the identification matching results, the network node coordinates in the visual graphic input data are mapped to the actual physical coordinates of the corresponding nodes in the industrial network topology diagram. Based on the connection edge attributes extracted from the visual graphic input data, find the corresponding edge connection relationship in the industrial network topology diagram. If the edge connection exists, keep the connection attribute unchanged. If the edge connection does not exist, add a connection edge in the industrial network topology diagram and attach the protocol type, communication frequency, function code anomaly marker and status change information from the visual graphic input data. After mapping all node coordinates and connections, the path structure of the attack propagation chain in the industrial network topology is reconstructed according to the mapping results, and the spatial structure of the attack propagation chain is output.

[0064] S6.3 Extract the path starting node, abnormal jump path and victim node identification information from the attack propagation chain spatial structure, and generate a security linkage trigger instruction set.

[0065] Specifically, the path origin node identification information, the multi-dimensional label information of the node pairs and edges involved in the abnormal jump path, and the victim node identification information are extracted from the attack propagation chain spatial structure; the path origin node, abnormal jump path and victim node are respectively encoded with node identification, protocol type, communication frequency, function code abnormal mark and state change information to form a structured security linkage trigger command. The structured security linkage trigger instruction set is combined according to the format, including instruction type, target node identifier, timestamp and associated edge attributes; after completing the encoding and organization of all relevant node and path information, the security linkage trigger instruction set is output.

[0066] S6.4 Transmit the security linkage trigger instruction set to the linkage execution end to trigger real-time blocking, protection and early warning response.

[0067] Specifically, the security linkage trigger instruction set is sent to the linkage execution end through the communication link. After receiving the instruction, the linkage execution end parses the instruction content and identifies the target node identifier and associated operation type respectively. According to the real-time blocking, protection and early warning response operations specified in the instruction, the corresponding network connection blocking operation, protection policy activation and early warning alarm generation are executed in sequence. During the execution, the operation status and response results are recorded, the execution feedback of all instructions is completed, and the execution feedback information is returned to the security monitoring end.

[0068] This embodiment also provides a network attack path tracing system, including: a data processing module for collecting raw multi-source data, preprocessing it, and encoding it into a three-domain communication event structure; a graph construction module for converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology map; a training and identification module for training a graph neural network model using the industrial network topology map, identifying abnormal jump paths and attack chain segments, and generating a set of suspicious paths; a score calculation module for performing consistency calculation and weighted fusion of communication behavior, protocol call logic, and physical state response in the set of suspicious paths to generate a credibility score vector; a path filtering module for performing fusion calculation on the credibility score vector, selecting the path with the lowest credibility as a high-risk attack path, and reconstructing the attack path starting point by combining time series, industrial network topology map, and abnormal jump paths to obtain the attack propagation chain; and a visualization module for displaying the attack propagation chain in a visual way on the industrial network topology map and outputting it to industrial security linkage to trigger real-time blocking, protection, and early warning responses.

[0069] This embodiment also provides a computer device applicable to the network attack path tracing method based on a three-domain communication event structure, comprising: a memory and a processor; the memory is used to store computer-executable instructions, and the processor is used to execute the computer-executable instructions to implement the network attack path tracing method based on a three-domain communication event structure as proposed in the above embodiment.

[0070] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, carrier networks, NFC (Near Field Communication), or other technologies. The display screen can be an LCD screen or an e-ink screen. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0071] This embodiment also provides a storage medium storing a computer program that, when executed by a processor, implements the network attack path tracing method based on a three-domain communication event structure as proposed in the above embodiments. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Red-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk.

[0072] In summary, this invention achieves the fusion and unified expression of multi-source heterogeneous data by: collecting and preprocessing raw multi-source data and encoding it into a three-domain communication event structure, breaking down data silos and improving data integrity and consistency; and converting the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional labeled edges to generate an industrial network topology graph, which strengthens the semantic association and topological continuity of nodes and edges in the network, improves the model's ability to express complex interaction relationships, and thus effectively enhances the accuracy and robustness of subsequent attack path identification, significantly improving the accuracy and efficiency of industrial network security situational awareness.

[0073] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the scope of the claims of the present invention.

Claims

1. A network attack path tracing method based on a three-domain communication event structure, characterized in that: include, Raw multi-source data is collected, preprocessed, and encoded into a three-domain communication event structure; The three-domain communication event structure is converted into a heterogeneous graph structure composed of nodes and multi-dimensional label edges to generate an industrial network topology graph. The graph neural network model is trained using an industrial network topology map to identify abnormal jump paths and attack chains, and to generate a set of suspicious paths. Consistency calculation and weighted fusion are performed on the communication behavior, protocol call logic and physical state response in the suspicious path set to generate a credibility score vector; The credibility score vectors are fused and calculated, and the path with the lowest credibility is selected as the high-risk attack path. The attack path origin is reconstructed by combining time series, industrial network topology map and abnormal jump path backtracking, and the attack propagation chain is obtained. The attack propagation chain is visualized in the industrial network topology and output to the industrial security linkage to trigger real-time blocking, protection and early warning responses.

2. The network attack path tracing method based on a three-domain communication event structure as described in claim 1, characterized in that: The process involves collecting raw multi-source data, preprocessing it, and encoding it into a three-domain communication event structure. The specific steps are as follows: Collect network communication traffic, industrial control protocol content, and operational status to form raw multi-source data; The original multi-source data is formatted, time-aligned, and anomaly-filtered to generate structured preprocessed data, which is then divided into communication domain, protocol domain, and state domain to form a three-domain communication event structure element. The three-domain communication event structure is generated by sorting the event occurrence time and assigning them a unified number.

3. The network attack path tracing method based on a three-domain communication event structure as described in claim 2, characterized in that: Extracting the two communicating parties as nodes from the three-domain communication event structure, mapping protocol type, communication frequency, function code anomaly markers, and state change information as multi-dimensional labels for edges, constructing and optimizing the heterogeneous graph structure, and generating an industrial network topology graph.

4. The network attack path tracing method based on a three-domain communication event structure as described in claim 1, characterized in that: The specific steps for generating the suspicious path set are as follows: The industrial network topology is transformed into a node feature matrix and an edge weight matrix. The graph neural network model is then iteratively trained until the loss converges, resulting in the trained graph neural network model. The trained graph neural network model is used to reason about the industrial network topology, extract complex nonlinear features, and adopt path search and anomaly detection methods to identify abnormal jump paths and potential attack chains in the industrial network topology, generating a set of suspicious paths.

5. The network attack path tracing method based on a three-domain communication event structure as described in claim 1, characterized in that: The specific steps for generating the credibility score vector are as follows: The communication behaviors, protocol call logic, and physical state responses involved in the suspicious path set are analyzed from the three-domain communication event structure. The corresponding function code sequences and parameter structure features are extracted and matched with historical normal patterns to calculate behavior consistency score, logic consistency score, and state response consistency score. The behavioral consistency score, logical consistency score, and state response consistency score are weighted, fused, and normalized to generate a multi-path credibility score vector.

6. The network attack path tracing method based on a three-domain communication event structure as described in claim 1, characterized in that: The specific steps to obtain the attack propagation chain are as follows. Sort the multi-path credibility score vector set in ascending order and extract the path with the lowest multi-path credibility score to form a candidate set of high-risk attack paths. Based on the communication node sequence and timestamp information of the high-risk attack path candidate set, the sequence of events within the path is rearranged to generate a time-consistent attack behavior chain. In the attack behavior chain, the industrial network topology map is combined with the abnormal jump path to trace back the first abnormal communication event and locate the source node of the path. Based on the source node of the path, the jump nodes in the high-risk attack path candidate set are backtracked, and the source node, abnormal jump path and candidate path endpoint are connected in sequence to obtain the attack propagation chain.

7. The network attack path tracing method based on a three-domain communication event structure as described in claim 1, characterized in that: The specific steps for triggering real-time blocking, protection, and early warning responses are as follows. The attack propagation chain is structured and encoded, and converted into a graphical representation of network node coordinates, connection edge attributes, and identification information to form visual graphical input data; Based on the industrial network topology map, the visual graphical input data is mapped to the network node coordinates and connection relationships in the industrial network topology map to obtain the spatial structure of the attack propagation chain; Extract the path starting node, abnormal jump path and victim node identification information from the attack propagation chain spatial structure to generate a security linkage trigger instruction set. The security linkage trigger instruction set is transmitted to the linkage execution end to trigger real-time blocking, protection and early warning response.

8. A network attack path tracing system based on a three-domain communication event structure, based on the network attack path tracing method based on a three-domain communication event structure as described in any one of claims 1 to 7, characterized in that: include, The data processing module is used to collect raw multi-source data, preprocess it, and encode it into a three-domain communication event structure. The graph construction module is used to convert the three-domain communication event structure into a heterogeneous graph structure composed of nodes and multi-dimensional label edges, and generate an industrial network topology graph. The training and identification module is used to train the graph neural network model using the industrial network topology map, identify abnormal jump paths and attack chains, and generate a set of suspicious paths. The scoring calculation module is used to perform consistency calculation and weighted fusion of communication behavior, protocol call logic and physical state response in the suspicious path set to generate a credibility score vector; The path filtering module is used to perform fusion calculation on the credibility score vector, select the path with the lowest credibility as the high-risk attack path, and combine time series, industrial network topology map and abnormal jump path back to reconstruct the starting point of the attack path to obtain the attack propagation chain. The visualization module is used to display the attack propagation chain in an industrial network topology diagram in a visual way, and output it to the industrial security linkage to trigger real-time blocking, protection and early warning response.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that: When the processor executes the computer program, it implements the steps of the network attack path tracing method based on the three-domain communication event structure as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by the processor, it implements the steps of the network attack path tracing method based on the three-domain communication event structure as described in any one of claims 1 to 7.

Images