Passive vulnerability risk detection system based on traffic fingerprints

Abstract

The invention belongs to the technical field of network security vulnerability detection, and discloses a passive vulnerability risk detection system based on a traffic fingerprint, which can capture asset communication abnormity in real time through combination of a three-dimensional asset fingerprint and an LSTM model, and then is linked with MITREATTamp; unknown attacks missed by traditional static matching can be identified without depending on frequent manual updating of rules; for example, for protocol variant or version fuzzy vulnerabilities, the dynamic weight model can automatically adjust the matching priority, the vulnerabilities related to core services cannot be missed due to rule lagging, and the conversion from passive rule identification to active rule identification is realized; by collecting encrypted traffic metadata, such as TLS handshake parameters and JA3 fingerprints, and marking non-standard encryption behaviors through heuristic analysis, suspicious traffic can be positioned without decryption; and meanwhile, through the low interference characteristic of the fault bypass switch, the original service flow is normally transmitted in the acquisition process, and the service delay is not influenced by analyzing the encrypted flow.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network security vulnerability detection, and specifically relates to a passive vulnerability risk detection system based on traffic fingerprints. BACKGROUND

[0002] In the current network environment, vulnerability exploitation is still the main path of network attacks, which poses a serious threat to the core assets and business continuity of enterprises. Passive vulnerability detection technology has become an important protection choice for production environments and sensitive systems due to its characteristics of not requiring active scanning and not interfering with the operation of target assets, but the existing technical solutions still have the following technical problems.

[0003] Traditional passive detection relies on static feature libraries and fixed rule sets, which are difficult to cope with dynamically changing attack scenarios. Such systems usually match based on known vulnerability features, and have insufficient recognition ability when facing unknown vulnerabilities or variant attacks. Moreover, rule updates rely on manual maintenance, and in the case of continuous emergence of new vulnerabilities, there is often a rule lag problem, resulting in a blind area in vulnerability identification in the protection system, which cannot capture new attack behaviors in a timely manner.

[0004] Currently, mainstream network communication generally uses encryption protocols such as HTTPS, and traditional deep detection methods based on packet content analysis are completely unsuitable. Although some solutions attempt to analyze SSL / TLS handshake information, they have poor adaptability to non-standard encryption suites and private protocols, making it difficult to effectively identify vulnerability exploitation behaviors in encrypted traffic, providing attackers with a hidden penetration space.

[0005] Existing systems focus on the severity score of a single vulnerability, ignoring the transmission path of the vulnerability in the network topology and the importance difference of assets, and cannot distinguish the vulnerability risk priority of core assets and non-core assets. At the same time, the lack of intelligent classification of alarms makes it easy for security personnel to be overwhelmed by "alarm storms", key risks are submerged, and vulnerability response efficiency is affected. SUMMARY

[0006] The purpose of the present application is to provide a passive vulnerability risk detection system based on traffic fingerprints to solve the problems raised in the background.

[0007] In order to achieve the above purpose, the present application provides the following technical solution: a passive vulnerability risk detection system based on traffic fingerprints, which comprises:

[0008] Intelligent traffic collection and analysis module: collect network layer five-tuple, transmission layer flag, application layer protocol features and encrypted traffic metadata through a switch; then mark suspicious traffic and filter redundant traffic;

[0009] The three-dimensional asset fingerprint extraction module: adopts the DPI technology to extract the static fingerprint, integrates into a 128-dimensional feature matrix, generates a static device fingerprint ID, analyzes the traffic data based on the LSTM model and establishes a dynamic behavior baseline, associates the environmental characteristics with the network topology information and the asset value label, and finally forms a three-dimensional fingerprint to provide the asset image for the adaptive vulnerability identification engine module;

[0010] The adaptive vulnerability identification engine module: based on the asset image, calculates the vulnerability weight by using a ternary weight model, and the vulnerability data comes from the CVE library; after detecting the zero-day vulnerability, transmits the vulnerability information, associated asset fingerprint and attack behavior label to the attack path visualization report module;

[0011] The attack path visualization report module: receives the vulnerability information and asset data, constructs a visual risk model, calculates the shortest attack path, then quantifies the risk, draws a trend curve, and customizes a multi-role report;

[0012] The self-evolution update and intelligent alarm module: when the topology change rate is greater than 15% or the number of new fingerprints per day is greater than 20, update the fingerprint library; use the asset value score, vulnerability exploitation difficulty score and attack trend score to grade the alarm.

[0013] Preferably, the intelligent traffic collection and analysis module is specifically as follows:

[0014] The deployment fault bypass switch collects the network five-tuple, transmission layer TCP / UDP flag, application layer protocol characteristics and encrypted traffic metadata to form a traffic feature library;

[0015] The heuristic analysis marks suspicious encrypted traffic, and then the dynamic baseline filtering mechanism filters redundant traffic, only retaining abnormal samples; the edge node completes the preliminary screening, packs the full-stack traffic features and abnormal sample label two types of data, and synchronizes them to the three-dimensional asset fingerprint extraction module through the internal API.

[0016] Preferably, the three-dimensional asset fingerprint extraction module is specifically as follows:

[0017] Based on the traffic data of the intelligent traffic collection and analysis module, the DPI technology is used to extract the static fingerprint, extract the Server and X-Powered-By fields, combine the TCP initial window size and IPTTL value, integrate into a 128-dimensional feature matrix, and generate a static device fingerprint ID through SHA-256 hashing;

[0018] TensorFlow2.8 is used to build an LSTM model to analyze dynamic behavior, model 24-hour traffic time series data input by the intelligent traffic collection and analysis module, establish a normal behavior baseline, and mark abnormality when the deviation is more than 30%; environmental features are collected through the SNMP protocol to collect network topology, combined with asset account value labels to form a three-dimensional fingerprint of static ID, dynamic baseline and environment vector; the three-dimensional fingerprint data is pushed to the adaptive vulnerability identification engine module through Redis cache to provide asset image.

[0019] Preferably, the adaptive vulnerability identification engine module is specifically as follows:

[0020] Based on the asset image of the three-dimensional asset fingerprint extraction module, a ternary weight model is used to calculate the vulnerability weight, the asset value coefficient is the value label of the three-dimensional asset fingerprint extraction module, and the vulnerability data comes from the CVE library of the Elasticsearch hierarchical index;

[0021] Zero-day vulnerability detection analyzes the terminal Sysmon log synchronized by the abnormal behavior rule library analysis collection module, and interfaces with MITREATT&CK and micro-step online intelligence. When more than two chain behaviors are detected, preliminary judgment is triggered. After identification, the vulnerability information, associated asset fingerprint and attack behavior label are packaged and transmitted to the attack path visualization report module through the Kafka message queue;

[0022] Vulnerability dynamic weight calculation formula:

[0023]

[0024] In the formula: represents the maximum weight of the vulnerability, and the value range is [0.1, 1.0];

[0025] represents the asset value coefficient, which is divided based on asset importance;

[0026] represents the vulnerability timeliness coefficient, which is divided based on the vulnerability disclosure time;

[0027] represents the attack popularity coefficient, which is divided based on the vulnerability utilization.

[0028] Preferably, the attack path visualization report module is specifically as follows:

[0029] The vulnerability information and asset data received by the adaptive vulnerability identification engine module are used to build a visual risk model. Topological modeling uses a Neo4j graph database to store asset fingerprint ID and value label nodes, access relationship and port state edges. Based on the secondary development of BloodHound, vulnerability attributes are supplemented. The shortest attack path is calculated by Dijkstra algorithm, and the simulation repair scheme deduction function is provided.

[0030] The risk transmission coefficient is used to quantify the risk, and the attack trend curve is drawn by Matplotlib based on the number of days of vulnerability and the number of attack attempts. The report template is customized according to the role, and the chart can be generated according to the vulnerability or asset type. After the report is generated, the high-risk vulnerability list and asset topology change data are automatically extracted and pushed to the self-evolution update and intelligent alarm module.

[0031] Risk transmission coefficient calculation formula:

[0032]

[0033] In the formula: The risk transmission coefficient is represented by, and the value range is [0, 1.0];

[0034] The vulnerability CVSS score is represented by, and the value range is [0, 10];

[0035] The network accessibility score is represented by, which is based on the network connection relationship between assets.

[0036] Preferably, the self-evolution update and intelligent alarm module is as follows:

[0037] The risk data received by the attack path visualization report module is used to update the fingerprint library based on the topology change data. When the change rate is greater than 15% or the number of new fingerprints increases by more than 20 per day, the fingerprint library is updated by FTP. The rule library is updated in a gray manner, first deployed on 10% of the edge nodes, and then pushed to the entire network when the 24-hour false positive rate is less than 0.5%.

[0038] The intelligent alarm uses a three-dimensional scoring model to grade the alarm based on asset value score, vulnerability exploitation difficulty score, and attack trend score. The asset value score and the vulnerability exploitation difficulty score are obtained by using the asset value label of the three-dimensional asset fingerprint extraction module and the identification result of the adaptive vulnerability identification engine module. The attack trend score is based on the attack trend curve of the attack path visualization report module.

[0039] High-risk alerts are pushed through WeChat and email, and low-risk alerts are summarized daily; after aggregation, Jira is connected to create a work order, and after repair, the historical traffic stored by the intelligent traffic collection and analysis module is played back through tcpreplay to verify the asset feature changes of the three-dimensional asset fingerprint extraction module;

[0040] The network topology change rate calculation formula is:

[0041]

[0042] In the formula: The network topology change rate is represented, and the value range is [0, 100%];

[0043] The number of new assets represents the number of new effective assets in the network within the statistical period;

[0044] The number of deleted assets represents the number of assets that are offline or lost in the network within the statistical period;

[0045] The total number of assets represents the total number of effective assets registered in the network at the beginning of the statistical period;

[0046] The intelligent alarm scoring calculation formula is:

[0047]

[0048] In the formula: The alarm score is represented, and the value range is [0, 100];

[0049] The asset value score represents a quantitative score based on asset importance;

[0050] The vulnerability exploit difficulty score represents a value based on vulnerability exploit threshold division;

[0051] The attack trend score represents a value based on the frequency of attack attempts in the past 7 days.

[0052] The beneficial effects of the present application are as follows:

[0053] 1、The present application can capture asset communication abnormalities in real time by combining three-dimensional asset fingerprints (static ID + dynamic behavior + environment vector) with an LSTM model, and then link to MITREATT&CK and other threat intelligence, without relying on manual frequent rule updates, so as to identify unknown attacks that are missed by traditional static matching; for example, in the face of protocol variants or version fuzzy vulnerabilities, the dynamic weight model can automatically adjust the matching priority, and the core business related vulnerabilities will not be missed due to rule lag, realizing the change from passive waiting for rules to actively identifying abnormalities.

[0054] 2、The present application can locate suspicious traffic without decryption by collecting encrypted traffic metadata such as TLS handshake parameters and JA3 fingerprints and marking non-standard encryption behavior through heuristic analysis; at the same time, relying on the low interference characteristics of the fault bypass switch, the original business traffic is transmitted normally during the collection process, and the business delay will not be affected by analyzing encrypted traffic; for example, the system can associate asset identity through JA3 fingerprint and match vulnerability characteristics to solve the problem that traditional solutions cannot see and cannot find in an encrypted environment.

[0055] 3、The present application can clearly present the conduction path from the vulnerability to the core asset through attack path visualization and dynamic risk quantification, such as calculating the shortest attack chain of “external web server -> core database” after building a topology graph with Neo4j, and then combining asset value to dynamically adjust the alarm level, high-risk vulnerabilities are pushed to the responsible person within 5 minutes, and medium and low-risk vulnerabilities are summarized by day; operation and maintenance personnel do not need to filter key risks in a large number of alarms, and when repairing, they can also block the attack path, which not only reduces invalid operation and maintenance cost, but also concentrates resources to protect the security of core assets. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 The present application is based on the flowchart of the passive vulnerability risk detection system based on traffic fingerprint. DETAILED DESCRIPTION

[0057] The technical solutions in the embodiments of the present application will be described clearly and completely in combination with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0058] As shown in Figure 1 The present application provides a passive vulnerability risk detection system based on traffic fingerprint, which comprises:

[0059] Intelligent traffic collection and analysis module: Collect network layer five-tuple, transmission layer flag, application layer protocol features and encrypted traffic metadata through switches; Then mark suspicious traffic and filter redundant traffic;

[0060] Three-dimensional asset fingerprint extraction module: Extract static fingerprints using DPI technology, integrate them into a 128-dimensional feature matrix, and generate static device fingerprint ID; Analyze traffic data based on LSTM model and establish dynamic behavior baseline; Environment features associate network topology information and asset value labels to form a three-dimensional fingerprint, which provides asset image for adaptive vulnerability identification engine module;

[0061] Adaptive vulnerability identification engine module: Based on the asset image, calculate the vulnerability weight using a three-element weight model, and the vulnerability data comes from the CVE library; After detecting zero-day vulnerabilities, transmit vulnerability information, associated asset fingerprints, and attack behavior labels to the attack path visualization reporting module;

[0062] Attack path visualization reporting module: Receive vulnerability information and asset data, build a visual risk model, and calculate the shortest attack path; Then quantify the risk, draw a trend curve, and customize multi-role reports;

[0063] Self-evolution update and intelligent alarm module: When the topology change rate is > 15% or the number of new fingerprints increases by > 20 per day, update the fingerprint library; Use asset value score, vulnerability exploit difficulty score, and attack trend score to classify alarms.

[0064] The intelligent traffic collection and analysis module is as follows:

[0065] Distributed fault bypass deployment mode is adopted to deploy Ruiji RG-N18000-X series switches to collect network layer five-tuple, transmission layer TCP / UDP flag (such as SYN+ACK combination), application layer protocol features (such as HTTP GET / POST request, FTP USER command) and encrypted traffic metadata to form a traffic feature library; Form a complete traffic feature library;

[0066] The network layer five-tuple includes source IP, destination IP, source port, destination port, and protocol; Encrypted traffic metadata includes TLS handshake version, cipher suite, and JA3 fingerprint. JA3 extraction uses standard hexadecimal hashing algorithm;

[0067] The fault bypass switch collection rate is configured as 10Gbps full duplex, and the data packet capture buffer size is set to 1GB to avoid data packet loss in high traffic scenarios; Supports IEEE802.1Q VLAN tag analysis to ensure the integrity of cross-VLAN traffic collection;

[0068] SUSPICIOUS ENCRYPTED TRAFFIC IS MARKED BY HEURISTIC ANALYSIS, such as non-standard ECDHE key exchange algorithm, abnormal certificate with validity period exceeding 398 days, and more than 90% of redundant traffic is filtered by a dynamic baseline filtering mechanism, such as heartbeat packets of WeChat for enterprise 10 minutes per time, and only abnormal samples are reserved, such as 200 HTTP requests per IP per minute; after preliminary screening by an edge node (Raspberry Pi 4B + Python Scapy library), full-stack traffic features and abnormal sample labels are packaged and synchronized to a three-dimensional asset fingerprint extraction module through an internal API;

[0069] The dynamic baseline filtering mechanism adopts a 5-minute sliding window, and traffic features are counted in three dimensions of request frequency, single-IP traffic size, and protocol type proportion. The baseline is established based on the historical traffic of the past 7 days.

[0070] The three-dimensional asset fingerprint extraction module is specifically as follows:

[0071] Based on the traffic data of the intelligent traffic collection and analysis module, static fingerprints are extracted using DPI technology, and the HTTP protocol analysis depth is set to "request line + response header front 1024 bytes". The Server (such as Apache / 2.4.49) and X-Powered-By (such as PHP / 7.4.26) fields are extracted, combined with the TCP initial window size and IPTTL value (Windows 128 / Linux 64), and integrated into a 128-dimensional feature matrix to generate a static device fingerprint ID through SHA-256 hashing.

[0072] Based on TensorFlow2.8, an LSTM model is built to analyze dynamic behavior, model 24-hour traffic time series data input by the intelligent traffic collection and analysis module, establish a normal behavior baseline, such as 10-30 SSH connections per day for a server, and mark it as abnormal if the deviation exceeds 30%; environmental features are collected through SNMP protocol, combined with asset account value labels, such as core database labeled as high value and test machine labeled as low value, to form a three-dimensional fingerprint of static ID, dynamic baseline and environment vector; the three-dimensional fingerprint data is pushed to the adaptive vulnerability identification engine module through Redis cache to provide asset portrait;

[0073] LSTM model: 8-dimensional features are input, including access frequency, session average duration, packet average size, protocol type proportion (HTTP / HTTPS / FTP / SSH proportion), source IP regional distribution number, destination port usage number, TCP retransmission rate and UDP packet loss rate. The feature data needs to be normalized to the [0, 1] interval before inputting the model.

[0074] The adaptive vulnerability identification engine module is specifically as follows:

[0075] Based on the asset image of the three-dimensional asset fingerprint extraction module, the vulnerability weight is calculated using a ternary weight model, the asset value coefficient is the value label of the three-dimensional asset fingerprint extraction module, and the vulnerability data comes from the CVE library of the Elasticsearch hierarchical index. The core asset vulnerability weight is increased by 300%, the non-core low-risk is reduced by 50%, the fuzzy matching allows a version ±1 deviation, such as Apache / 2.4.49 matching CVE-2021-41773;

[0076] The Elasticsearch hierarchical index is constructed in two dimensions of "CVSS score layering and vulnerability type layering". The CVSS score layering includes 0-3.9, 4.0-6.9, 7.0-8.9, and 9.0-10. The vulnerability type layering includes remote code execution, buffer overflow, privilege escalation, and information disclosure.

[0077] The asset value label includes high, medium, and low, corresponding to asset value coefficients 1.0, 0.6, and 0.3.

[0078] Zero-day vulnerability detection analyzes the terminal Sysmon logs synchronized by the collection module through abnormal behavior rule library (such as execve+openat+write system call combination, process 100MB+heap memory application), and interfaces with MITREATT&CK and micro-step online intelligence. MD5 hash / IP blacklists are synchronized every 30 minutes, and confidence <0.5 is filtered. When detecting two-step or more exploit chain behaviors such as "payload delivery→privilege escalation", the preliminary judgment is triggered. After identification, the vulnerability information (CVSS score, exploit difficulty), associated asset fingerprint, and attack behavior marker are packaged and transmitted to the attack path visualization report module through the Kafka message queue.

[0079] Vulnerability dynamic weight calculation formula:

[0080]

[0081] In the formula: represents the maximum vulnerability weight, which is a comprehensive indicator to measure the priority of the vulnerability, with a value range of [0.1, 1.0]. The larger the value, the more urgent the vulnerability needs to be handled.

[0082] represents the asset value coefficient, which is based on the asset importance division: core business assets (such as core databases, transaction systems) take 1.0, ordinary business assets (such as office servers) take 0.6, and non-core assets (such as test machines) take 0.3. The data comes from the asset value label in the three-dimensional asset fingerprint extraction module.

[0083] Represents the timeliness coefficient of vulnerability, based on the disclosure time of vulnerability, the value is taken as 1.0 for vulnerability disclosed within the last 3 months, 0.5 for vulnerability disclosed within 3-12 months, and 0.2 for vulnerability disclosed more than 1 year, the data is from the time field of the CVE vulnerability library in the adaptive vulnerability identification engine module;

[0084] Represents the attack popularity coefficient, based on the vulnerability utilization, the value is taken as 1.0 for public utilization samples or attack events within the last 7 days, 0.4 for POC (proof of concept) only but no actual utilization sample, and 0.1 for vulnerability disclosure only and no utilization information, the data is from the threat intelligence platform data synchronized by the adaptive vulnerability identification engine module.

[0085] The attack path visualization report module is specifically as follows:

[0086] Receives the vulnerability information and asset data of the adaptive vulnerability identification engine module, constructs a visualization risk model, and adopts Neo4j graph database to store "asset fingerprint ID + value label" nodes and "access relationship + port state" edges in topological modeling, supplements vulnerability attributes based on secondary development of BloodHound, calculates the shortest attack path through Dijkstra algorithm, such as Web server CVE-2024-21413→intranet switch→core database, and has a simulation repair scheme deduction function;

[0087] The simulation repair scheme deduction logic is: marking the target vulnerability as "repaired", setting the CVSS score of the vulnerability to 0, recalculating the weight of all attack paths through Dijkstra algorithm; if there is no attack path with weight ≥1.0 after repair, it is determined as "repair effective"; the deduction result is verified by comparing the number of attack paths and the maximum weight value before and after repair, and the verification data automatically generates a deduction report attachment;

[0088] Dijkstra algorithm: weight=CVSS score×reachability score; the number of intranet jump layers is determined according to the number of routers, and the number of router hops from the source asset to the target asset is counted through the traceroute command;

[0089] Risk is quantified by risk transmission coefficient, and attack trend curve is drawn by Matplotlib based on the number of days of vulnerability existence and the number of attack attempts; report templates are customized according to roles, including POC verification steps for administrators, vulnerability correlation analysis for analysts, and loss estimation for decision makers, supporting generation of charts according to vulnerability or asset types; after report generation, high-risk vulnerability list (CVSS≥9.0) and asset topology change data are automatically extracted and pushed to the self-evolution update and intelligent alarm module;

[0090] Risk transmission coefficient calculation formula:

[0091]

[0092] In the formula: represents the risk transmission coefficient, which is an index quantifying the ability of vulnerability risk to spread in the network, with a value range of [0, 1.0], and the larger the value, the wider the risk spread range and the more serious the impact;

[0093] represents the vulnerability CVSS score, which is scored according to the CVSS3.1 standard for vulnerability severity, with a value range of [0, 10], wherein 0-3.9 points are low-risk vulnerabilities, 4.0-6.9 points are medium-risk vulnerabilities, 7.0-8.9 points are high-risk vulnerabilities, and 9.0-10 points are critical (fatal) vulnerabilities, and the data is derived from the CVSS field of the CVE vulnerability library in the adaptive vulnerability identification engine module;

[0094] represents the network accessibility score, which is based on the network connection relationship between assets and is divided as follows: 1.0 for assets that can be directly accessed externally (such as public network exposed web servers), 0.7 for assets that need 1-layer intranet jump to access, 0.4 for assets that need 2-layer or more intranet jump to access, and 0 for completely inaccessible assets, and the data is derived from the network topology modeling data of the attack path visualization report module.

[0095] The self-evolution update and intelligent alarm module is specifically as follows:

[0096] Upon receiving the risk data of the attack path visualization report module, based on the topology change data, when the change rate > 15% or the number of new fingerprints increases by > 20 per day, the fingerprint library is updated by FTP synchronization; the rule library is updated in gray scale first on 10% edge nodes, and if the false positive rate < 0.5% for 24 hours, it is pushed to the entire network; 10% edge nodes are selected according to traffic load, and nodes with medium traffic load (30%-70%) in the past 24 hours are selected to avoid affecting business on high-load nodes and insufficient sample size on low-load nodes;

[0097] The intelligent alarm adopts a three-dimensional scoring model, which uses asset value score, vulnerability exploit difficulty score, and attack trend score to classify alarms, the asset value score and the vulnerability exploit difficulty score use the asset value label of the three-dimensional asset fingerprint extraction module and the identification result of the adaptive vulnerability identification engine module, and the attack trend score is based on the attack trend curve of the attack path visualization report module.

[0098] High-risk alarms are pushed through WeChat and email within 5 minutes, and medium and low-risk alarms are summarized daily. After alarm aggregation, Jira is connected to create a work order, and after repair, the historical traffic stored by the intelligent traffic collection and analysis module is played back through tcpreplay to verify the asset feature changes of the three-dimensional asset fingerprint extraction module and confirm the vulnerability repair to close the loop.

[0099] Network topology change rate calculation formula:

[0100]

[0101] In the formula: represents the network topology change rate, which is an index for measuring the degree of change in network asset structure, with a value range of [0, 100%], mainly used to trigger dynamic updating of the fingerprint library;

[0102] represents the number of new assets, which refers to the number of new effective assets in the network within the statistical period (the default statistical period is 1 day), where effective assets are verified by three-dimensional fingerprints and exclude temporarily connected devices, and the data is derived from the fingerprint library addition record of the three-dimensional asset fingerprint extraction module;

[0103] represents the number of deleted assets, which refers to the number of assets that are offline or lost in the network within the statistical period, with a determination standard of devices with no traffic fingerprint record for 24 consecutive hours, and the data is derived from the invalid record of the fingerprint library of the three-dimensional asset fingerprint extraction module;

[0104] represents the total number of assets, which refers to the total number of effective assets registered in the network at the beginning of the statistical period, including core assets, ordinary assets, and non-core assets, and the data is derived from the total record number of the fingerprint library of the three-dimensional asset fingerprint extraction module;

[0105] Intelligent alarm score calculation formula:

[0106]

[0107] In the formula: represents the alarm score, which is a comprehensive index for dividing the emergency level of the alarm, with a value range of [0, 100], where ≥80 is a high-risk alarm, 30-79 is a medium-risk alarm, and <30 is a low-risk alarm;

[0108] represents the asset value score, which is based on the asset importance mapping to a quantitative score: core assets take 100 points, ordinary assets take 60 points, and non-core assets take 30 points, and the data is derived from the asset value label mapping result of the three-dimensional asset fingerprint extraction module;

[0109] represents the exploit difficulty score, based on the exploit threshold division, taking 100 points for no complex conditions to exploit (such as public EXP can be directly used), taking 50 points for specific environment or permission (such as requires internal network permission) to exploit, taking 10 points for extremely high difficulty to exploit (such as only theoretical vulnerability and no POC), and the data is derived from the vulnerability exploit difficulty evaluation result of the adaptive vulnerability identification engine module;

[0110] represents the attack trend score, based on the attack attempt frequency in the past 7 days, taking 100 points for continuously rising attack attempt times, taking 50 points for frequency stable, and taking 10 points for frequency decreasing or no new attempt, and the data is derived from the attack trend curve of the attack path visualization report module.

[0111] It should be noted that, in this article, relationship terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between the entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the process, method, article or equipment including a series of elements not only includes those elements, but also includes other elements not explicitly listed or inherent to such process, method, article or equipment.

[0112] Although the embodiments of the present application have been shown and described, it can be understood by those skilled in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the present application, and the scope of the present application is defined by the appended claims and their equivalents.

Claims

1. A passive vulnerability risk detection system based on traffic fingerprints, characterized in that: The system comprises: Intelligent traffic collection and analysis module: collect network layer five-tuple, transmission layer flag, application layer protocol features and encrypted traffic metadata through the switch; then mark suspicious traffic and filter redundant traffic; Three-dimensional asset fingerprint extraction module: extract static fingerprints using DPI technology, integrate into a 128-dimensional feature matrix, and generate static device fingerprint ID; analyze traffic data based on the LSTM model and establish a dynamic behavior baseline; correlate network topology information and asset value labels to form a three-dimensional fingerprint, which provides asset portraits for the adaptive vulnerability identification engine module; Adaptive vulnerability identification engine module: based on the asset portrait, calculate the vulnerability weight using a three-element weight model, and the vulnerability data comes from the CVE library; after detecting zero-day vulnerabilities, transmit vulnerability information, associated asset fingerprints and attack behavior labels to the attack path visualization report module; Attack path visualization report module: receives vulnerability information and asset data, builds a visual risk model, calculates the shortest attack path, then quantifies risks, draws trend curves and customizes multi-role reports; Self-evolution update and intelligent alarm module: update the fingerprint library when the topology change rate is greater than 15% or the number of new fingerprints increases by more than 20 per day; use asset value scores, vulnerability exploit difficulty scores and attack trend scores to classify alarms.

2. The flow-fingerprint based passive vulnerability risk detection system of claim 1, wherein: The intelligent traffic collection and analysis module is as follows: Deploy a fault bypass switch to collect network layer five-tuple, transmission layer TCP / UDP flag, application layer protocol features and encrypted traffic metadata to form a traffic feature library; Mark suspicious encrypted traffic through heuristic analysis, and filter redundant traffic through a dynamic baseline filtering mechanism, retaining only abnormal samples; After the edge node completes the preliminary screening, it packages full-stack traffic features and abnormal sample labels, and synchronizes them to the three-dimensional asset fingerprint extraction module through an internal API.

3. The flow fingerprint-based passive vulnerability risk detection system of claim 2, wherein: The three-dimensional asset fingerprint extraction module is as follows: Based on the traffic data of the intelligent traffic collection and analysis module, extract static fingerprints using DPI technology, extract Server and X-Powered-By fields, combine TCP initial window size and IPTTL value, integrate into a 128-dimensional feature matrix, and generate static device fingerprint ID through SHA-256 hashing; Build an LSTM model based on TensorFlow2.8 to analyze dynamic behavior, model 24-hour traffic time series data input by the intelligent traffic collection and analysis module, establish a normal behavior baseline, and mark abnormality when the deviation is more than 30%; Environment features collect network topology through SNMP protocol, combine asset account value labels to form a three-dimensional fingerprint of static ID, dynamic baseline and environment vector; the three-dimensional fingerprint data is pushed to the adaptive vulnerability identification engine module through Redis cache to provide asset portraits.

4. The flow-fingerprint based passive vulnerability risk detection system of claim 3, wherein: The adaptive vulnerability identification engine module is as follows: Based on the asset image of the three-dimensional asset fingerprint extraction module, the vulnerability weight is calculated using a ternary weight model, the asset value coefficient is the value label of the three-dimensional asset fingerprint extraction module, and the vulnerability data comes from the CVE library of the Elasticsearch hierarchical index; Zero-day vulnerability detection analyzes the terminal Sysmon logs synchronized by the abnormal behavior rule library analysis collection module, and interfaces with MITREATT&CK and micro-step online intelligence. When a two-step or more exploit chain behavior is detected, an initial judgment is triggered. After identification, the vulnerability information, associated asset fingerprints, and attack behavior markers are packaged and transmitted to the attack path visualization reporting module through the Kafka message queue.

5. The flow fingerprint based passive vulnerability risk detection system of claim 4, wherein: The attack path visualization reporting module is as follows: After receiving the vulnerability information and asset data from the adaptive vulnerability identification engine module, a visual risk model is constructed. Topological modeling uses a Neo4j graph database to store asset fingerprint ID and value label nodes, access relationship and port state edges, and based on BloodHound secondary development to supplement vulnerability attributes. The shortest attack path is calculated using the Dijkstra algorithm, and has a simulation repair scheme deduction function; Risk transmission is used to quantify risk, and an attack trend curve is drawn by Matplotlib based on the number of days a vulnerability exists and the number of attack attempts. Report templates are customized by role, and charts can be generated by vulnerability or asset type. After report generation, high-risk vulnerability lists and asset topology change data are automatically extracted and pushed to the self-evolution update and intelligent alarm module.

6. The flow fingerprint-based passive vulnerability risk detection system of claim 5, wherein: The self-evolution update and intelligent alarm module is as follows: After receiving the risk data from the attack path visualization reporting module, based on the topology change data, when the change rate is > 15% or the number of new fingerprints increases by > 20 per day, the fingerprint library is updated incrementally through FTP synchronization; The rule library is updated in gray scale first on 10% of the edge nodes, and then pushed to the entire network when the 24-hour false positive rate is < 0.5%. Intelligent alarm uses a three-dimensional scoring model to grade alarms based on asset value scores, vulnerability exploit difficulty scores, and attack trend scores. The asset value score and the vulnerability exploit difficulty score use the asset value label from the three-dimensional asset fingerprint extraction module and the identification results from the adaptive vulnerability identification engine module. The attack trend score is based on the attack trend curve from the attack path visualization reporting module. High-risk alarms are pushed through WeChat and email, and medium and low-risk alarms are summarized daily. After alarm aggregation, Jira is interfaced to create a work order, and after repair is complete, historical traffic stored by the intelligent traffic collection and analysis module is played back through tcpreplay to verify changes in asset characteristics from the three-dimensional asset fingerprint extraction module.

Images