A network security analysis method, device, storage medium and electronic equipment

Abstract

The application provides a network security analysis method and device, a storage medium and an electronic device. The method comprises the following steps: collecting multi-source heterogeneous network data, extracting network entity interaction relationship and time sequence attribute, and constructing a dynamic heterogeneous graph structure network security knowledge graph; performing external communication monitoring on the network entity, and taking the periodic external communication feature as a target entity when the periodic external communication feature is detected; inputting the target entity and its neighborhood subgraph into a pre-trained graph neural network model, and outputting an intermediate state representing suspicious confidence by the model through graph embedding and association mining; matching the intermediate state with an attack mode library, predicting a future attack event of the target entity, and performing dynamic defense. The application can accurately identify hidden malicious communication, predict attacks in advance, and improve the pertinence and initiative of network security protection.

Description

Technical Field

[0001] This application relates to the field of network data security technology, and in particular to a network security analysis method, apparatus, storage medium and electronic device. Background Technology

[0002] As cyberattack methods continue to evolve, new attack methods such as Advanced Persistent Threats (APTs) exhibit characteristics of being slow, multi-stage, and implicitly interconnected. Attackers often employ a "feint" strategy, dispersing malicious activities across different times and devices, maintaining control over compromised hosts through seemingly harmless periodic heartbeat communications, and waiting for an opportunity to move laterally or leak data. Traditional network security analysis methods, primarily based on rule matching or single-point detection, suffer from the following technical shortcomings:

[0003] First, traditional detection methods rely on known attack signature databases (such as malicious IP blacklists and virus signatures), making it difficult to effectively identify unknown or variant attacks. In particular, attackers using encrypted tunnels or communication patterns that mimic normal heartbeat behavior exhibit traffic characteristics highly similar to legitimate business traffic, rendering traditional detection methods based on deep packet inspection (DPI) or fixed thresholds ineffective and prone to generating a large number of false negatives.

[0004] Second, existing technologies isolate security alerts from different sources, making it impossible to build a global attack view. For example, one host may exhibit periodic outbound heartbeats, another host may display abnormal login behavior, and a third host may send data outwards. These isolated events are unrelated in traditional analysis, making it difficult for security analysts to connect them into a complete attack chain. This "seeing the trees but not the forest" approach makes it difficult to detect lurking malicious activities in a timely manner.

[0005] Third, existing security analysis methods are mostly reactive, lacking the ability to predict the attacker's next move. By the time malicious behavior is detected, the attack has often already caused substantial harm, resulting in a delayed defense response and an inability to achieve proactive defense.

[0006] Therefore, how to identify suspected malicious but difficult-to-confirm communication characteristics from massive amounts of network data, uncover the hidden attack intentions behind them, and predict the attacker's next move has become a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0007] To improve network security, this application proposes a network security analysis method, apparatus, storage medium, and electronic device.

[0008] Firstly, the technical solution provided in this application includes:

[0009] A network security analysis method, the method comprising:

[0010] Collect multi-source heterogeneous network data, extract the interaction relationships and temporal attributes between network entities, and construct a network security knowledge graph with a dynamic heterogeneous graph structure.

[0011] The network entity is monitored for external communication. When the network entity is found to have periodic external communication characteristics, the network entity is analyzed as a target entity. The periodic external communication characteristics refer to a communication pattern in which the communication interval between the target entity and external entities is regular and the length of the communication data packet is less than a preset length threshold.

[0012] The target entity and its neighborhood subgraph in the network security knowledge graph are input into a pre-trained graph neural network model.

[0013] The graph neural network model performs graph embedding and association mining on the neighborhood subgraph and outputs intermediate states, which represent the confidence level of the target entity belonging to the suspicious activity cluster.

[0014] The intermediate state is matched with a preset attack pattern library, and the attack events that the target entity may execute within a future time window are predicted based on the matching results. The attack events include attack type and attack target.

[0015] Based on the predicted attack events, execute the corresponding dynamic defense response.

[0016] Furthermore, the monitoring of external communications of the network entity includes:

[0017] Obtain the communication records of the network entity in network activities, the communication records including network traffic data of the network entity as a communication initiator or receiver;

[0018] Extract the communication time sequence and data packet length sequence between the network entity and the external entity from the communication records;

[0019] The communication time series is decomposed into time series components to extract the periodic components and communication interval sequences;

[0020] Determine whether the fluctuation level of the communication interval sequence is less than a preset interval threshold and whether the data packet length is less than a preset length threshold;

[0021] If both conditions are met, the network entity is determined to have periodic external communication characteristics.

[0022] Furthermore, the graph neural network model is trained using a meta-learning framework, and the training process includes:

[0023] Based on historical attack events, multiple meta-learning training tasks are obtained according to attack families or attack tactics.

[0024] A model-independent meta-learning algorithm is used to meta-train the graph neural network model, enabling the model to quickly adapt to small samples of new attack patterns.

[0025] During the model inference phase, if the confidence level of the intermediate state representation falls within the preset fuzzy confidence interval, an online adaptive mechanism is triggered to update the model parameters using a small sample of the neighborhood subgraph of the current target entity and recalculate the intermediate state.

[0026] Furthermore, after constructing the cybersecurity knowledge graph with the aforementioned dynamic heterogeneous graph structure, the following is also included:

[0027] Train a time-series knowledge graph embedding model based on historical time-series graph data;

[0028] When a network entity is detected to have periodic external communication characteristics, local map completion is initiated with that network entity as the center.

[0029] By using the temporal knowledge graph embedding model, the missing potential interaction relationships between the target entity and other entities within the historical time window are inferred, and the inferred interaction relationships with confidence are integrated into the network security knowledge graph with the current dynamic heterogeneous graph structure for updating the neighborhood subgraph.

[0030] Furthermore, the preset attack pattern library is built based on the MITREATT&CK framework, mapping multi-stage attack chains to graph pattern matching rules, with each attack step corresponding to a subgraph structure in the network security knowledge graph.

[0031] Furthermore, the step of executing a corresponding dynamic defense response based on the predicted attack events includes:

[0032] Obtain the confidence level of the intermediate state representation;

[0033] If the predicted attack type is lateral movement, then based on the risk level of the confidence level, the access control level of the predicted attack target is temporarily increased, and multi-factor authentication or direct blocking is enabled for access requests from the target entity.

[0034] If the predicted attack type is data leakage, then based on the risk level of the confidence level, the predicted attack target IP address will be temporarily blocked at the network exit, and deep traffic monitoring will be initiated on the target entity.

[0035] Furthermore, the graph neural network model is a dynamic graph convolutional network or a temporal graph attention network;

[0036] The intermediate output state includes: aggregating the multi-hop neighbor information of the target entity through node embedding, calculating the graph structure similarity and node reachability probability between the target entity and known malicious entities, and fusing the graph structure similarity and node reachability probability to generate the confidence that the target entity belongs to the suspicious activity cluster.

[0037] Secondly, the technical solution provided in this application includes:

[0038] A network security analysis device, the device comprising:

[0039] The graph construction module is used to collect multi-source heterogeneous network data, extract the interaction relationships and temporal attributes between network entities, and construct a network security knowledge graph with a dynamic heterogeneous graph structure.

[0040] The feature detection module is used to monitor the external communication of the network entity. When the network entity is detected to have periodic external communication characteristics, the network entity is analyzed as the target entity. The periodic external communication characteristics refer to a communication pattern in which the communication interval between the target entity and the external entity is regular and the length of the communication data packet is less than a preset length threshold.

[0041] The graph neural network processing module is used to input the target entity and its neighborhood subgraph in the network security knowledge graph into a pre-trained graph neural network model; the graph neural network model performs graph embedding and association mining on the neighborhood subgraph and outputs intermediate states, the intermediate states representing the confidence level of the target entity belonging to a suspicious activity cluster;

[0042] An attack prediction module is used to match the intermediate state with a preset attack pattern library and predict the attack events that the target entity may execute within a future time window based on the matching results. The attack events include attack type and attack target.

[0043] The dynamic defense response module is used to execute corresponding dynamic defense responses based on the predicted attack events.

[0044] Thirdly, the technical solution provided in this application includes:

[0045] A computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the steps of the network security analysis method described above.

[0046] Fourthly, the technical solution provided in this application includes:

[0047] A computer-readable storage medium having a computer program stored thereon, characterized in that the computer program, when executed by a processor, implements the steps of the above-described network security analysis method.

[0048] The technical solution provided in this application has at least the following advantages over the prior art:

[0049] 1. Effectively identifies concealed malicious communication characteristics, reducing false negative rates. This solves the problem of traditional detection methods based on known attack signature databases and fixed thresholds struggling to identify unknown attacks, variant attacks, and malicious communications mimicking normal heartbeat behavior. By collecting multi-source heterogeneous network data and extracting entity interaction relationships and temporal attributes, a dynamic heterogeneous network security knowledge graph is constructed. Simultaneously, it focuses on monitoring the periodic outbound communication characteristics of network entities and analyzing them as target entities. This allows for accurate capture of slow, seemingly harmless periodic heartbeat communications used by attackers to maintain control. Even if this communication pattern mimics legitimate business traffic and is transmitted through encrypted tunnels, effective identification can be achieved, avoiding false negatives due to feature matching failures.

[0050] 2. Construct a global, dynamic network entity relationship view to overcome the limitations of existing technologies that handle security events in isolation, and solve the current problems of being unable to uncover implicit relationships between entities and forming a complete attack chain view. Through a network security knowledge graph with a dynamic heterogeneous graph structure, it integrates entity interaction relationships and temporal attributes from multi-source heterogeneous network data. Combined with analysis of the target entity's neighborhood subgraph, it can link isolated interactions scattered across different times and devices, clearly presenting implicit relationships between entities, helping to uncover latent malicious activities and eliminating reliance on isolated alerts.

[0051] 3. Achieve proactive prediction of attack behavior, addressing the limitations of existing technologies that only provide post-event alerts, suffer from delayed defense responses, and are unable to achieve proactive defense. By using a graph neural network model to perform graph embedding and association mining on the target entity and its neighborhood subgraph, an intermediate state representing the confidence level of the target entity belonging to a suspicious activity cluster is output. This intermediate state is then matched with a pre-defined attack pattern library to accurately predict the attack types and targets that the target entity may execute within future time windows. This shifts the defense response from reactive remediation to proactive prediction, providing effective support for proactive defense.

[0052] 4. Enhance the targeting and efficiency of network security analysis and optimize defense response effectiveness. By periodically filtering target entities based on external communication characteristics, indiscriminate full analysis of all network entities is avoided, reducing unnecessary consumption of computing resources and enabling rapid location of potential risk entities. At the same time, dynamic defense responses are executed based on predicted attack events, replacing traditional fixed-mode defense methods, so that defense measures are accurately matched with attack intentions, further improving the effectiveness and targeting of network security defense. Attached Figure Description

[0053] Figure 1 This is a flowchart of a network security analysis method according to an embodiment of this application;

[0054] Figure 2 This is a structural diagram of a network security analysis device according to an embodiment of this application. Detailed Implementation

[0055] This specific embodiment is merely an explanation of this application and is not intended to limit it. Those skilled in the art, after reading this specification, can make modifications to this embodiment without contributing any inventive step, but such modifications are protected by patent law as long as they fall within the scope of the claims of this application. To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions in the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without inventive effort are within the scope of protection of this application.

[0056] The term "comprising" and any variations thereof in the specification and claims of this application are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are explicitly listed, but may include other steps or units that are not explicitly listed or that are inherent to such process, method, product or device.

[0057] In the embodiments of this application, the terms "exemplary" or "for example" are used to indicate that something is an example, illustration, or description. Any embodiment or design that is described as "exemplary" or "for example" in the embodiments of this application should not be construed as being more preferred or advantageous than other embodiments or design. Specifically, the use of the terms "exemplary" or "for example" is intended to present the relevant concepts in a specific manner.

[0058] The embodiments of this application will now be described in further detail with reference to the accompanying drawings.

[0059] Figure 1 This application provides an exemplary embodiment of a network security analysis method, the method comprising:

[0060] S1. Collect multi-source heterogeneous network data, extract the interaction relationships and temporal attributes between network entities, and construct a network security knowledge graph with a dynamic heterogeneous graph structure.

[0061] Specifically, the scope of multi-source heterogeneous network data collection is defined, covering various types of data generated by core network devices (such as switches, routers, and firewalls), terminal devices (such as employee computers, servers, and IoT devices), and security devices (such as intrusion detection systems (IDS), intrusion prevention systems (IPS), and log auditing systems) within the enterprise intranet. Examples include: network traffic data (TCP / UDP session data, packet header information, packet length, and communication timestamps), device log data (login logs, operation logs, and abnormal alarm logs), application layer data (HTTP / HTTPS request data and database access logs), and asset information data (device IP address, device model, department, and operating services).

[0062] Distributed data acquisition tools (such as Flink and Logstash) are used to collect and preprocess the above multi-source data in real time. The preprocessing process includes data deduplication, outlier removal (such as invalid IP addresses and abnormal timestamp data), and data standardization (unifying the timestamp format to UTC time and the IP address encoding format) to avoid invalid data from interfering with subsequent analysis.

[0063] Subsequently, network entities and their interaction relationships and temporal attributes are extracted. Network entities include terminal devices, network devices, servers, external communication nodes (devices corresponding to external IPs), applications, user accounts, etc. Entity recognition algorithms (such as the BERT-based named entity recognition model) are used to extract entities from the preprocessed data, assigning a unique identifier to each entity (e.g., device entity identifier is "IP + device type"). Interaction relationships include communication relationships (e.g., TCP connection between terminal A and external IP B), access relationships (e.g., user C logging into server D), and data transmission relationships (e.g., terminal E sending data to server F). Simultaneously, temporal attributes for each type of interaction relationship are extracted, including interaction start time, interaction end time, interaction frequency, communication interval, and data packet length sequence.

[0064] Based on the extracted entities, interaction relationships, and time-series attributes, a dynamic heterogeneous network security knowledge graph is constructed: the nodes in the graph represent various network entities, and the node attributes include entity identifier, entity type, asset information, and historical interaction records; the edges in the graph represent the interaction relationships between entities, and the edge attributes include interaction type and time-series attributes (communication interval, data packet length, and interaction time); preferably, a dynamic update mechanism for the graph can be set, for example, collecting the latest network data every 5 minutes to update the node attributes, edge attributes, and interaction relationships in the graph, ensuring that the graph can reflect the dynamic changes in network entity interactions in real time, avoiding the shortcomings of static graphs in capturing real-time malicious behavior.

[0065] Compared to existing technologies that only collect single types of network data, ignore interaction time-series attributes, and construct static graphs, this step achieves comprehensive coverage of the network environment through multi-source data collection, avoiding the one-sidedness of analysis caused by single data sources. By extracting time-series attributes and constructing a dynamic graph, it can accurately capture the temporal patterns of network entity interactions (such as periodic communication), providing reliable data support for subsequent periodic outbound communication feature detection and entity implicit association mining. Existing technologies construct network security knowledge graphs that are mostly static and do not integrate time-series attributes, failing to capture the low-speed, periodic interaction characteristics in APT attacks, making it difficult for subsequent analysis to locate covert malicious behavior. The dynamic heterogeneous graph knowledge graph constructed in this step integrates multi-source data and time-series attributes, enabling real-time updates of network entity interaction states, providing a foundation for subsequent accurate identification of periodic malicious communication and attack chain mining, effectively overcoming the limitations of existing graph construction technologies.

[0066] S2. Monitor the external communication of the network entity. When the network entity is found to have periodic external communication characteristics, the network entity is analyzed as a target entity. The periodic external communication characteristics refer to a communication pattern in which the communication interval between the target entity and external entities is regular and the length of the communication data packet is less than a preset length threshold.

[0067] Among them, based on the dynamic heterogeneous graph knowledge graph constructed in step S1, the external communication records of all network entities (i.e., the interaction records between entities and external entities, where external entities are defined as entities that do not belong to the enterprise's internal network IP segment) are extracted, and the external communication of each network entity is monitored in real time.

[0068] In some embodiments, the monitoring of external communications of the network entity includes:

[0069] Obtain the communication records of the network entity in network activities. The communication records include network traffic data of the network entity as a communication initiator or receiver. Specifically, obtaining the communication records of the network entity includes: extracting all communication records between the entity as a communication initiator or receiver and external entities from the edge attributes of the dynamic heterogeneous graph knowledge graph, including network traffic data such as communication timestamps, data packet lengths, communication protocols, and external entity IP addresses.

[0070] Extract the communication time sequence and data packet length sequence between the network entity and the external entity from the communication records; specifically, extracting the communication time sequence and data packet length sequence includes: sorting the communication records between the entity and the same external entity by time according to the timestamp to form a communication time sequence, and simultaneously extracting the data packet length at the corresponding time point to form a data packet length sequence;

[0071] The communication time series is decomposed to extract the periodic component and the communication interval sequence. Specifically, a time series decomposition algorithm (such as the STL decomposition algorithm) is used to decompose the communication time series, separate the trend component, periodic component and noise component, remove the interference of the noise component, and extract the periodic component that can reflect the regularity of the communication interval, thereby obtaining the communication interval sequence (e.g., the time interval between two adjacent communications is 10 minutes, that is, the communication interval sequence is [10min, 10min, 10min, ...]).

[0072] The system determines whether the fluctuation of the communication interval sequence is less than a preset interval threshold and whether the data packet length is less than a preset length threshold. Specifically, two thresholds are preset: the preset length threshold is set to 100 bytes (determined based on the statistical analysis of data packet lengths for normal business external communication within the enterprise intranet; normal business communication data packets are typically longer than 100 bytes, while the periodic heartbeat communication data packets of APT attacks are mostly small data packets); and the preset interval threshold is set to 5 minutes (i.e., the variance of the fluctuation of the communication interval sequence is less than the corresponding threshold, specifically, the variance ≤ 1 min², ensuring the regularity of the communication interval). The system then determines whether the fluctuation (variance) of the communication interval sequence is less than the preset interval threshold and whether the length of all data packets in the data packet length sequence is less than the preset length threshold.

[0073] If both conditions are met simultaneously, the network entity is determined to have periodic external communication characteristics. Conversely, if neither condition is met simultaneously, it is determined to be normal external communication and will not be subject to further analysis.

[0074] Specifically, the above monitoring process clarifies how to accurately determine the characteristics of periodic outbound communication, avoiding the one-sidedness of traditional monitoring methods. The first step is to acquire communication records to ensure the comprehensiveness of the monitoring data, covering all outbound traffic initiated and received by network entities, avoiding the omission of hidden passive communication. The second step is to extract time series and packet length series to provide basic data for subsequent periodic analysis, ensuring the analysis's relevance. The third step is to extract periodic components through time-series decomposition (such as the STL decomposition algorithm), which can eliminate noise interference and accurately capture the regularity of communication intervals. This is the core of identifying the low-speed heartbeat communication in APT attacks. The fourth step adopts a dual judgment standard of "communication interval fluctuation degree + packet length" to avoid the shortcomings of single threshold detection, ensuring that only communication that simultaneously meets the two characteristics of "regular interval and small packet length" is judged as periodic outbound communication, effectively distinguishing malicious communication that imitates normal business and reducing the false positive and false negative rates.

[0075] This step establishes a targeted external communication monitoring mechanism to screen out target entities with periodic external communication characteristics, avoiding indiscriminate full analysis of all network entities, reducing unnecessary computational resource consumption, and enabling rapid location of potentially risky entities. At the same time, it clarifies the criteria for determining periodic external communication characteristics, ensuring the accuracy of monitoring results and providing a clear analysis target for subsequent precise analysis, thus solving the problem of the lack of specificity in existing anomaly detection technologies.

[0076] S3. Input the target entity and its neighborhood subgraph in the network security knowledge graph into a pre-trained graph neural network model; the graph neural network model performs graph embedding and association mining on the neighborhood subgraph and outputs an intermediate state, which represents the confidence level of the target entity belonging to a suspicious activity cluster.

[0077] First, obtain the neighborhood subgraph of the target entity in the dynamic heterogeneous graph knowledge graph: taking the target entity as the central node, select its 1-3 hop neighbor entities (1-hop neighbors are entities that have direct interaction with the target entity, 2-hop neighbors are entities that have interaction with 1-hop neighbors, and so on), as well as all interaction relationships and temporal attributes between the target entity and its neighbor entities, to form the neighborhood subgraph; the selection range of the neighborhood subgraph can be adjusted according to the scale of the enterprise intranet. In this embodiment, 2-hop neighbors are selected, which can ensure that sufficient association information is obtained, and avoid the increase in computational complexity caused by the subgraph being too large.

[0078] Next, prepare the graph neural network model: the graph neural network model can be the Temporal Graph Attention Network (TGAT), which can effectively handle the temporal features of dynamic graphs and focus on important neighbor nodes through the attention mechanism to improve the accuracy of association mining;

[0079] The target entity and its neighborhood subgraph are input into the pre-trained temporal graph attention network model to initiate the model's inference process. The model's processing of the neighborhood subgraph is implemented in conjunction with relevant technical features, as follows:

[0080] 1. Node Embedding: The model performs embedding processing on all nodes in the target entity and its neighborhood subgraph, mapping the node's attribute information (entity type, asset information), edge attribute information (interaction type, communication interval, data packet length), and time series information (interaction time) to a low-dimensional vector space to obtain the embedding vector of each node, thereby achieving effective representation of node features;

[0081] 2. Multi-hop neighbor information aggregation: Through the attention mechanism, the embedding vectors of the target entity's 1-2 hop neighbor nodes are aggregated, with a focus on neighbor nodes that frequently interact with the target entity and have abnormal temporal characteristics (such as external nodes that have periodic communication with the target entity or terminal nodes that exhibit abnormal login behavior). These neighbor nodes are given higher attention weights to achieve effective integration of multi-hop neighbor information.

[0082] 3. Implicit Association Mining: Based on the aggregated node embedding vectors, implicit associations between the target entity and its neighboring entities are mined. For example, the potential communication associations between the target entity and external malicious nodes, and the abnormal interaction associations between the target entity and other nodes in the internal network. These implicit associations are difficult to discover in traditional analysis, but they are the key to the multi-stage associations in APT attacks.

[0083] 4. Intermediate State Generation: Calculate the graph structure similarity (calculated by the cosine similarity of node embedding vectors) and node reachability probability (calculated by path analysis in the graph) between the target entity and known malicious entities. Then, perform a weighted fusion of the graph structure similarity and node reachability probability (the weights are determined based on training with historical attack data; in this embodiment, both weights are 0.5) to generate the confidence score that the target entity belongs to the suspicious activity cluster. The confidence score ranges from [0,1]. The higher the confidence score, the greater the possibility that the target entity is a malicious entity and participates in suspicious activities. This confidence score is the intermediate state output by the model.

[0084] This step effectively mines implicit entity associations by selecting neighborhood subgraphs of the target entity and inputting them into a graph neural network model, avoiding the one-sidedness of single-entity analysis. Using a temporal graph attention network trained with a meta-learning framework not only adapts to the temporal characteristics of dynamic graphs but also enhances the model's adaptability to novel attacks, addressing the problems of poor generalization and inability to handle unknown attacks in existing models. By generating intermediate states representing confidence levels through graph embedding and association mining, the suspiciousness of the target entity can be quantified, providing clear quantitative evidence for subsequent attack event prediction. An online adaptive mechanism further optimizes the model output, improves the accuracy of intermediate states, and ensures the reliability of subsequent analysis. Simultaneously, pre-training the model ensures analysis efficiency and meets the needs of real-time security analysis.

[0085] In some embodiments, the graph neural network model is trained using a meta-learning framework, and the training process includes:

[0086] Based on historical attack events, multiple meta-learning training tasks are obtained according to attack families or attack tactics. Specifically, historical attack event data of the enterprise intranet and publicly available APT attack datasets are collected, and multiple meta-learning training tasks are obtained according to attack families (such as Emotet, WannaCry) or attack tactics (such as initial access, lateral movement, data leakage). Each training task contains a small amount of labeled data (labeling whether the target entity is a malicious entity and the corresponding attack type).

[0087] The model-independent meta-learning algorithm is used to meta-train the graph neural network model, enabling the model to quickly adapt to small samples of new attack patterns. Specifically, the model-independent meta-learning algorithm (MAML) is used to meta-train the temporal graph attention network. Through iterative training of multiple training tasks, the model acquires the ability to quickly adapt to small samples of new attack patterns. That is, only a small amount of labeled data of new attack patterns is needed to quickly adjust the model parameters to adapt to the analysis needs of new attacks.

[0088] During the model inference phase, if the confidence level of the intermediate state representation falls within a preset fuzzy confidence interval, an online adaptive mechanism is triggered. This mechanism updates the model's parameters using a small sample of the target entity's neighborhood subgraph and recalculates the intermediate state. Specifically, a pre-trained temporal graph attention network model is deployed to the enterprise intranet security analysis platform. The model inputs are the node attributes of the target entity, the node attributes of the neighborhood subgraph, edge attributes, and temporal attributes; the output is the intermediate state.

[0089] Specifically, this training method and inference optimization mechanism address the problems of poor generalization ability, inability to cope with unknown attacks, and insufficient accuracy of inference results in existing models. During the training phase, meta-learning tasks are divided according to attack families or tactics, enabling the model to learn the characteristic patterns of different types of attacks, rather than a single attack pattern. The use of Model-Independent Meta-Learning Algorithm (MAML) for meta-training has the core advantage of enabling the model to have "small sample adaptation" capability. That is, when encountering new or variant APT attacks, it can quickly adjust parameters using only a small number of samples, without requiring a large amount of labeled data, to adapt to the analysis needs of new attack patterns. The online adaptive mechanism in the inference phase addresses situations where the confidence level of intermediate states is in an ambiguous range (e.g., 0.4-0.6) (i.e., it is impossible to clearly determine whether it is a malicious entity). It updates the confidence level using small samples from the neighborhood subgraph of the current target entity, recalculating the confidence level to avoid misjudgments caused by insufficient model adaptation and improve the accuracy of inference results.

[0090] In some embodiments, the graph neural network model is a dynamic graph convolutional network or a temporal graph attention network;

[0091] The intermediate output state includes: aggregating the multi-hop neighbor information of the target entity through node embedding, calculating the graph structure similarity and node reachability probability between the target entity and known malicious entities, and fusing the graph structure similarity and node reachability probability to generate the confidence that the target entity belongs to the suspicious activity cluster.

[0092] Specifically, the above steps clarify the specific type of graph neural network model and the generation method of intermediate states, ensuring that the model can adapt to the temporal characteristics of dynamic graphs and that intermediate states can accurately quantify the suspiciousness of target entities. The model uses either a dynamic graph convolutional network or a temporal graph attention network (TGAT in this embodiment). Both can effectively handle the temporal attributes of dynamic graphs. The difference lies in the fact that the temporal graph attention network has an attention mechanism, which can focus on neighboring nodes closely related to the target entity, improving the efficiency and accuracy of association mining. In the intermediate state generation process, complex graph structure data is transformed into analyzable low-dimensional vectors through node embedding, and then multi-hop neighbor information is aggregated to ensure the discovery of implicit associations between entities. By calculating graph structure similarity (judging the structural similarity between the target entity and known malicious entities) and node reachability probability (judging whether the target entity can reach the malicious entity), and performing weighted fusion, the generated confidence score can accurately quantify the suspiciousness of the target entity, providing a reliable quantitative basis for subsequent attack prediction.

[0093] S4. Match the intermediate state with a preset attack pattern library, and predict the attack events that the target entity may execute within a future time window based on the matching results. The attack events include attack type and attack target.

[0094] In some embodiments, the preset attack pattern library is built based on the MITRE ATT&CK framework, mapping multi-stage attack chains to graph pattern matching rules, with each attack step corresponding to a subgraph structure in the network security knowledge graph.

[0095] Specifically, this attack pattern library is built on the MITRE ATT&CK framework: it sorts out the multi-stage attack chain in the MITRE ATT&CK framework (such as initial access → execution → persistence → lateral movement → data leakage), maps the attack tactics and techniques of each attack stage to graph pattern matching rules, and each attack step corresponds to a subgraph structure in a dynamic heterogeneous graph knowledge graph (such as lateral movement corresponding to the interaction subgraph of "target entity → other terminal nodes in the internal network", and data leakage corresponding to the large-scale data transmission subgraph of "target entity → external node"). At the same time, it associates a corresponding doubt confidence threshold for each attack pattern (such as the confidence threshold of 0.5 for lateral movement attack and 0.6 for data leakage attack), and marks the attack type (lateral movement, data leakage, etc.) and attack target (such as internal network server, core database, etc.).

[0096] Subsequently, the intermediate states are matched with the attack pattern library: the confidence level of the suspected activity cluster of the target entity output in step S3 is compared with the confidence threshold corresponding to each attack pattern in the attack pattern library. At the same time, the structure of the target entity's neighborhood subgraph is matched with the subgraph structure in the attack pattern library (using a graph pattern matching algorithm, such as the SubgraphIsomorphism algorithm). If the confidence level is greater than or equal to the threshold of a certain type of attack pattern, and the matching degree between the neighborhood subgraph structure and the subgraph structure corresponding to the attack pattern is greater than the preset matching threshold (the matching threshold is 80% in this embodiment), then it is determined that the target entity may execute this type of attack event.

[0097] Finally, predict future attack events: Combining the target entity's periodic external communication frequency and historical interaction records, set a future time window (in this embodiment, the future time window is 1 hour, which can be adjusted according to the attack type; for example, the time window for a data leakage attack can be set to 30 minutes), and predict the type of attack and target that the target entity may execute within this time window; for example, if the confidence level of the target entity is 0.7 and the matching degree between the neighborhood subgraph structure and the subgraph structure of the lateral movement attack is 85%, then it is predicted that the target entity may execute a lateral movement attack on the internal network server in the neighborhood subgraph within the next 1 hour; if the confidence level is 0.8 and the subgraph structure matches the data leakage attack, then it is predicted that it may transmit core data to external entities.

[0098] This step combines intermediate states with an attack pattern library based on the MITRE ATT&CK framework, achieving an effective connection from "suspiciousness quantification" to "attack prediction," solving the problem that existing technologies cannot predict attack behavior; temporal knowledge graph completion can compensate for the sparsity of graph data, ensure the integrity of neighborhood subgraphs, and improve the accuracy of attack prediction; setting future time windows can enable forward-looking prediction of attack behavior, providing time support for proactive defense.

[0099] In some embodiments, after constructing the dynamic heterogeneous graph knowledge graph in step S1, temporal knowledge graph completion is also performed: based on historical temporal graph data, a temporal knowledge graph embedding model (such as the TTransE model) is trained; when step S2 detects that a network entity has periodic external communication characteristics, local graph completion is initiated with the entity as the center, and the TTransE model is used to infer the missing potential interaction relationships (such as uncollected hidden communication records) between the target entity and other entities within the historical time window (such as the past 24 hours), and the inferred interaction relationships with confidence (such as confidence ≥ 0.7) are integrated into the current dynamic heterogeneous graph knowledge graph to update the neighborhood subgraph of the target entity, ensuring the integrity of the neighborhood subgraph and improving the accuracy of attack prediction.

[0100] S5. Execute the corresponding dynamic defense response based on the predicted attack events.

[0101] In some embodiments, executing a corresponding dynamic defense response based on the predicted attack event includes:

[0102] Obtain the confidence level of the intermediate state representation;

[0103] If the predicted attack type is lateral movement, then based on the risk level of the confidence level, the access control level of the predicted attack target is temporarily increased, and multi-factor authentication or direct blocking is enabled for access requests from the target entity.

[0104] If the predicted attack type is data leakage, then based on the risk level of the confidence level, the predicted attack target IP address will be temporarily blocked at the network exit, and deep traffic monitoring will be initiated on the target entity.

[0105] Specifically, this defense response method addresses the problems of fixed and poorly targeted existing defense responses, achieving precise adaptation between defense measures and attack prediction results. The core is "dynamically adjusting defense strength based on confidence level and risk level." First, it obtains the confidence level of intermediate states to classify risk levels (e.g., low, medium, high), avoiding the inability of a single defense measure to adapt to target entities with varying degrees of suspicion. For two typical attack types—lateral movement and data breaches—differentiated defense measures are formulated. For example, lateral movement attacks focus on restricting the target entity's access to the internal network, while data breach attacks focus on blocking external communication, ensuring that defense measures align with the attack intent. Simultaneously, by setting "temporary" defenses, it avoids over-defense impacting normal business operations. Subsequently, defense measures can be dynamically adjusted (removed or upgraded) based on the real-time status of the target entity, balancing defense effectiveness and business availability.

[0106] Based on the confidence level of the intermediate state, three risk levels can be divided: low risk (0.5 ≤ confidence level < 0.7), medium risk (0.7 ≤ confidence level < 0.9), and high risk (confidence level ≥ 0.9). Different risk levels correspond to different strengths of defense response measures to ensure the targeted nature of the defense response.

[0107] If the predicted attack type is lateral movement and the target is an internal network server, then corresponding measures will be taken according to the risk level: Low risk level, temporarily upgrade the access control level of the target server (such as restricting remote login permissions) and enable multi-factor authentication for access requests from the target entity; Medium risk level, upgrade the access control level and block the target entity from accessing unnecessary ports of the target server; High risk level, directly block all communication between the target entity and the target server, and isolate the target entity to prevent the attack from spreading.

[0108] If the predicted attack type is data breach and the target is an external IP address, then corresponding measures will be taken according to the risk level: Low risk level, temporarily restrict the upload bandwidth of the target entity at the network egress point and monitor the traffic of the target entity; Medium risk level, temporarily block the predicted attack target IP address, prohibit the target entity from communicating with that IP, and at the same time start deep traffic monitoring of the target entity (such as monitoring the content of data transmission); High risk level, block all external communication of the target entity, isolate the target entity, and at the same time investigate the stored data of the target entity to prevent the leakage of core data.

[0109] This step executes dynamically adapted defense response measures based on predicted attack events and confidence risk levels, avoiding the limitations of traditional fixed-mode defense and ensuring that defense measures are precisely matched with attack intent and risk levels. The dynamic adjustment mechanism of the defense response can adjust the defense strength according to the real-time status of the target entity, which can avoid excessive defense affecting normal business and effectively prevent the spread of attacks, thereby improving the defense effect.

[0110] like Figure 2 As shown, one embodiment of this application also provides a network security analysis device, the device comprising:

[0111] The graph construction module is used to collect multi-source heterogeneous network data, extract the interaction relationships and temporal attributes between network entities, and construct a network security knowledge graph with a dynamic heterogeneous graph structure.

[0112] The feature detection module is used to monitor the external communication of the network entity. When the network entity is detected to have periodic external communication characteristics, the network entity is analyzed as the target entity. The periodic external communication characteristics refer to a communication pattern in which the communication interval between the target entity and the external entity is regular and the length of the communication data packet is less than a preset length threshold.

[0113] The graph neural network processing module is used to input the target entity and its neighborhood subgraph in the network security knowledge graph into a pre-trained graph neural network model; the graph neural network model performs graph embedding and association mining on the neighborhood subgraph and outputs intermediate states, the intermediate states representing the confidence level of the target entity belonging to a suspicious activity cluster;

[0114] An attack prediction module is used to match the intermediate state with a preset attack pattern library and predict the attack events that the target entity may execute within a future time window based on the matching results. The attack events include attack type and attack target.

[0115] The dynamic defense response module is used to execute corresponding dynamic defense responses based on the predicted attack events.

[0116] Each module in the above-mentioned device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in the processor of a computer device in hardware form or independent of it, or stored in the memory of a computer device in software form, so that the processor can call and execute the operations corresponding to each module.

[0117] An embodiment of this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the above-described network security analysis method.

[0118] The computer device can be a terminal, comprising a processor, memory, communication interface, display screen, and input devices connected via a system bus. The processor provides computing and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system and computer programs. The internal memory provides an environment for the operation of the operating system and computer programs stored in the non-volatile storage media. The communication interface is used for wired or wireless communication with external terminals; wireless communication can be achieved through Wi-Fi, mobile cellular networks, NFC (Near Field Communication), or other technologies. The computer program, when executed by the processor, implements the aforementioned methods. The display screen can be an LCD screen or an e-ink display. The input devices can be a touch layer covering the display screen, buttons, a trackball, or a touchpad mounted on the computer device's casing, or an external keyboard, touchpad, or mouse.

[0119] An embodiment of this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described network security analysis method.

[0120] An embodiment of this application also provides a computer program product, including a computer program that, when executed by a processor, implements the steps of the network security analysis method described above.

[0121] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments described above. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, etc., and are not limited to these.

[0122] The above description is only a preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and substitutions can be made without departing from the technical principles of this application, and these improvements and substitutions should also be considered within the scope of protection of this application.

Claims

1. A network security analysis method, characterized in that, The method includes: Collect multi-source heterogeneous network data, extract the interaction relationships and temporal attributes between network entities, and construct a network security knowledge graph with a dynamic heterogeneous graph structure. The network entity is monitored for external communication. When the network entity is found to have periodic external communication characteristics, the network entity is analyzed as a target entity. The periodic external communication characteristics refer to a communication pattern in which the communication interval between the target entity and external entities is regular and the length of the communication data packet is less than a preset length threshold. The target entity and its neighborhood subgraph in the network security knowledge graph are input into a pre-trained graph neural network model; the graph neural network model performs graph embedding and association mining on the neighborhood subgraph and outputs intermediate states, which represent the confidence level of the target entity belonging to a suspicious activity cluster; The intermediate state is matched with a preset attack pattern library, and the attack events that the target entity may execute within a future time window are predicted based on the matching results. The attack events include attack type and attack target. Based on the predicted attack events, execute the corresponding dynamic defense response.

2. The network security analysis method according to claim 1, characterized in that, The monitoring of external communication of the network entity includes: Obtain the communication records of the network entity in network activities, the communication records including network traffic data of the network entity as a communication initiator or receiver; Extract the communication time sequence and data packet length sequence between the network entity and the external entity from the communication records; The communication time series is decomposed into time series components to extract the periodic components and communication interval sequences; Determine whether the fluctuation level of the communication interval sequence is less than a preset interval threshold and whether the data packet length is less than a preset length threshold; If both conditions are met, the network entity is determined to have periodic external communication characteristics.

3. The network security analysis method according to claim 1, characterized in that, The graph neural network model is trained using a meta-learning framework, and the training process includes: Based on historical attack events, multiple meta-learning training tasks are obtained according to attack families or attack tactics. A model-independent meta-learning algorithm is used to meta-train the graph neural network model, enabling the model to quickly adapt to small samples of new attack patterns. During the model inference phase, if the confidence level of the intermediate state representation falls within the preset fuzzy confidence interval, an online adaptive mechanism is triggered to update the model parameters using a small sample of the neighborhood subgraph of the current target entity and recalculate the intermediate state.

4. The network security analysis method according to claim 1, characterized in that, After constructing the cybersecurity knowledge graph with the aforementioned dynamic heterogeneous graph structure, the following is also included: Train a time-series knowledge graph embedding model based on historical time-series graph data; When a network entity is detected to have periodic external communication characteristics, local map completion is initiated with that network entity as the center. By using the temporal knowledge graph embedding model, the missing potential interaction relationships between the target entity and other entities within the historical time window are inferred, and the inferred interaction relationships with confidence are integrated into the network security knowledge graph with the current dynamic heterogeneous graph structure for updating the neighborhood subgraph.

5. The network security analysis method according to claim 1, characterized in that, The preset attack pattern library is built on the MITREATT&CK framework, which maps multi-stage attack chains to graph pattern matching rules. Each attack step corresponds to a subgraph structure in the network security knowledge graph.

6. The network security analysis method according to claim 1, characterized in that, The step of executing a corresponding dynamic defense response based on the predicted attack events includes: Obtain the confidence level of the intermediate state representation; If the predicted attack type is lateral movement, then based on the risk level of the confidence level, the access control level of the predicted attack target is temporarily increased, and multi-factor authentication or direct blocking is enabled for access requests from the target entity. If the predicted attack type is data leakage, then based on the risk level of the confidence level, the predicted attack target IP address will be temporarily blocked at the network exit, and deep traffic monitoring will be initiated on the target entity.

7. The network security analysis method according to claim 1, characterized in that, The graph neural network model is a dynamic graph convolutional network or a temporal graph attention network; The intermediate output state includes: aggregating the multi-hop neighbor information of the target entity through node embedding, calculating the graph structure similarity and node reachability probability between the target entity and known malicious entities, and fusing the graph structure similarity and node reachability probability to generate the confidence that the target entity belongs to the suspicious activity cluster.

8. A network security analysis device, characterized in that, The device includes: The graph construction module is used to collect multi-source heterogeneous network data, extract the interaction relationships and temporal attributes between network entities, and construct a network security knowledge graph with a dynamic heterogeneous graph structure. The feature detection module is used to monitor the external communication of the network entity. When the network entity is detected to have periodic external communication characteristics, the network entity is analyzed as the target entity. The periodic external communication characteristics refer to a communication pattern in which the communication interval between the target entity and the external entity is regular and the length of the communication data packet is less than a preset length threshold. The graph neural network processing module is used to input the target entity and its neighborhood subgraph in the network security knowledge graph into a pre-trained graph neural network model; the graph neural network model performs graph embedding and association mining on the neighborhood subgraph and outputs intermediate states, the intermediate states representing the confidence level of the target entity belonging to a suspicious activity cluster; An attack prediction module is used to match the intermediate state with a preset attack pattern library and predict the attack events that the target entity may execute within a future time window based on the matching results. The attack events include attack type and attack target. The dynamic defense response module is used to execute corresponding dynamic defense responses based on the predicted attack events.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the network security analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the network security analysis method according to any one of claims 1 to 7.

Images