Big data based cyber security situation awareness method and system

Abstract

The present application relates to the technical field of big data, and particularly relates to a network security situation awareness method and system based on big data, which comprises the following steps: decomposing a multi-source heterogeneous security event data stream into behavior primitives, analyzing a combination mode and a dependency relationship to reconstruct an attack mode structure, inferring an attack target and calculating a confidence degree based on a behavior primitive sequence, calculating an attack path cost benefit ratio according to resource consumption and availability of an unexecuted node, analyzing node centrality and necessity to identify a key node and quantify an exposure degree, and integrating inference results, cost benefit distribution and exposure degree to generate a network security situation awareness result, so that comprehensive awareness and accurate prediction of network attacks are realized, and the accuracy and efficiency of situation awareness are improved.

Description

Technical Field

[0001] This invention relates to the field of big data technology, and in particular to a method and system for network security situation awareness based on big data. Background Technology

[0002] The current mainstream approach in the field of cybersecurity situational awareness primarily relies on a combination of signature-based intrusion detection systems and statistical anomaly-based detection methods. These systems typically standardize network traffic, logs, and alert data before inputting them into a pre-defined rule base or machine learning model, identifying threats by comparing them to known attack characteristics or deviations from baseline behaviors. Some advanced solutions introduce attack chain or kill chain models, categorizing events according to fixed stages (such as detection, weaponization, delivery, etc.) and providing risk scores based on alert frequency or asset importance within a time window. In practice, these methods particularly emphasize real-time response to single points of anomalous events, focusing on prioritizing isolated alerts rather than reconstructing the overall attack intent.

[0003] Current practices suffer from two significant drawbacks. First, multi-source, heterogeneous security event data (such as network flow data, system logs, and threat intelligence) is typically processed independently or fused using simple field concatenation, lacking in-depth analysis of the underlying behavioral logic of the events. This results in a large number of redundant alerts obscuring crucial clues, making it difficult for the system to automatically identify the attacker's complete intent chain from fragmented events; for example, it cannot distinguish whether a scanning sequence is a reconnaissance action or preparation for a probing attack. Second, attack path assessment heavily relies on static rules or historical statistics. Existing solutions generally calculate risk by assessing the probability of attack step completion or the global asset value, but neglect the attacker's dynamic trade-off between attack costs and benefits—that is, the impact of factors such as resource consumption, changes in the network environment, and the degree of exposure of intermediate nodes on future behavioral choices. This makes situational awareness results lagging and crude, failing to provide accurate decision-making basis for proactive defense. Summary of the Invention

[0004] This invention provides a network security situation awareness method and system based on big data, which can solve the problems in the prior art.

[0005] A first aspect of this invention provides a network security situation awareness method based on big data, comprising: The multi-source heterogeneous security event data stream is decomposed into multiple behavioral primitives. The combination patterns and dependencies of the behavioral primitives in the time series are analyzed to identify the sequence of behavioral primitives that form a complete attack intent. The attack pattern structure is reconstructed based on the predecessor and successor constraints between the behavioral primitives. Based on the sequence of behavioral primitives that have appeared in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, the attacker's potential attack targets are inferred and the confidence of being attacked is calculated, thus generating the attack target inference result. Based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack mode structure and the resource availability status of the current network environment, calculate the attack cost and attack benefit that the attacker needs to pay to execute each possible path, and generate the cost-benefit ratio distribution of the attack path. The centrality measure of the behavioral primitive nodes in the attack pattern structure and the necessity measure in the attack logic are analyzed to identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of the attack, and the current exposure degree of the nodes is quantified respectively. By integrating the attack target inference results, the cost-benefit ratio distribution, and the current exposure level, a network security situation awareness result is generated.

[0006] The multi-source heterogeneous security event data stream is decomposed into multiple behavioral primitives. The combination patterns and dependencies of these behavioral primitives in the time series are analyzed to identify the sequence of behavioral primitives that form a complete attack intent. Based on the predecessor and successor constraints between the behavioral primitives, the attack pattern structure is reconstructed, including: Each security event in the multi-source heterogeneous security event data stream is semantically decomposed according to three dimensions: operation object, operation action, and operation result. Behavioral primitives describing a single atomic operation are extracted, and the resource consumption characteristics of each behavioral primitive are labeled. Calculate the sequential occurrence relationship and time interval distribution characteristics between the behavioral primitives in the time series, and establish a predecessor and successor constraint relationship graph between the behavioral primitives. The directed edges in the predecessor and successor constraint relationship graph represent that the execution result of the preceding behavioral primitive provides necessary conditions or triggering conditions for the execution of the subsequent behavioral primitive. Based on the predecessor-successor constraint relationship graph, a graph traversal method is used to extract the behavioral primitive sequence that satisfies the path connectivity condition, and the behavioral primitive sequence containing complete attack intent semantics is selected as the candidate attack behavior sequence. The behavioral primitives in the candidate attack behavior sequence are organized into a hierarchical structure according to the topological order in the predecessor-successor constraint relationship graph, generating the attack mode structure containing mandatory behavioral primitive nodes, optional behavioral primitive nodes, and branch paths.

[0007] Based on the behavioral primitive sequences already appearing in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, the attacker's potential attack targets are inferred and the confidence level of the attacked target is calculated, generating attack target inference results including: From the behavioral primitive sequence that has appeared in the attack mode structure, extract the combination pattern of the behavioral primitive in three dimensions: operation object type, operation action type and operation result type, and generate a combined feature vector that describes the overall semantics of the behavioral primitive sequence. The combined feature vector includes the type distribution features of each behavioral primitive in the behavioral primitive sequence in the three dimensions and the predecessor and successor relationship features between the behavioral primitives. The similarity between the combined feature vector and the standard feature vector of the preset attack target type is calculated. The standard feature vector of the preset attack target type describes the typical combination pattern of behavioral primitives required to achieve a specific attack target. The potential attack target type pointed to by the behavioral primitive sequence is identified by the similarity calculation result. For each identified potential attack target type, the confidence level of the attacker in achieving the corresponding potential attack target is calculated based on the similarity value between the combined feature vector and the corresponding standard feature vector, and the proportional relationship between the number of behavioral primitives that have appeared in the behavioral primitive sequence and the number of complete behavioral primitives required to achieve the corresponding attack target. The identified potential attack target types and their corresponding confidence levels are organized into the attack target inference results.

[0008] Based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack pattern structure and the resource availability status of the current network environment, the attack cost and potential gain for the attacker to execute each possible path are calculated, and the cost-benefit ratio distribution of the generated attack paths includes: Starting from the end node of the behavioral primitive sequence that has appeared in the attack mode structure, traverse all unexecuted behavioral primitive nodes along the predecessor and successor constraint relationship graph in the attack mode structure, extract the combination of behavioral primitive nodes required to reach the preset attack target type from the current state, and generate multiple possible attack paths. For each possible attack path, based on the matching degree between the resource consumption characteristics marked by each unexecuted behavior primitive node in the path and the resource availability status of the current network environment, the amount of additional resources that the attacker needs to consume to execute each behavior primitive in the path in the current network environment is calculated. The amount of additional resources that all behavior primitives in the path need to consume is added together to obtain the attack cost that the attacker needs to pay to execute the corresponding possible attack path. For each possible attack path, based on the potential attack target type and corresponding confidence level corresponding to the path endpoint, and the topological position relationship of each behavioral primitive node in the path in the attack mode structure, the attack target value and attack success probability that the attacker can achieve after successfully executing the corresponding possible attack path are evaluated and weighted to obtain the attack benefit that the attacker can obtain by executing the corresponding possible attack path. The cost-benefit ratio of the attack is calculated to obtain the cost-benefit ratio of the corresponding possible attack paths. All possible attack paths and their corresponding cost-benefit ratios are organized into the cost-benefit ratio distribution of the attack paths.

[0009] The analysis of the behavioral primitive nodes in the attack pattern structure includes the following: a measure of centrality in the topological structure and a measure of necessity in the attack logic. Based on the number of predecessor nodes and successor nodes connected to each behavioral primitive node in the topology, the topological hub status of the behavioral primitive node in the process of attack path convergence and forking is evaluated, and the topological centrality metric of the behavioral primitive node is generated. Based on the frequency of occurrence of behavioral primitive nodes in the possible attack paths and the types of network asset nodes associated with the behavioral primitive nodes, the irreplaceability of each behavioral primitive node in the process of achieving the potential attack target type is calculated. According to the proportion of the frequency of occurrence of the behavioral primitive node in the possible attack paths to the total number of all possible attack paths, and the functional uniqueness of the network asset node type operated by the behavioral primitive node in the process of achieving the attack target, an attack logic necessity metric value of the behavioral primitive node is generated.

[0010] Identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of an attack, and quantify the current exposure level of each node, including: The topology centrality metric and the attack logic necessity metric are weighted and fused. Behavioral primitive nodes whose weighted fusion results exceed the preset criticality judgment threshold are identified as essential attack primitive nodes that affect the success or failure of the attack. The network asset nodes operated by the essential attack primitive nodes are extracted and identified as essential attack network asset nodes that affect the success or failure of the attack. For each primitive node of the attack's inevitable behavior, the feasibility of the attacker executing the primitive node of the attack's inevitable behavior is quantified as the current exposure degree of the primitive node of the attack's inevitable behavior, based on the degree of matching between the resource consumption characteristics marked by the primitive node of the attack's inevitable behavior and the resource availability status of the current network environment. For each network asset node that an attack must pass through, the reachability of the attacker to access the network asset node is quantified as the current exposure level of the network asset node based on the access control configuration status of the network asset node in the current network environment and the sensitivity level of the business data carried by the network asset node.

[0011] Integrating the attack target inference results, the cost-benefit ratio distribution, and the current exposure level, the generated network security situation awareness results include: Based on the confidence level of the potential attack target type in the attack target inference results, the cost-benefit ratio of the possible attack paths in the cost-benefit ratio distribution, and the exposure level of the attack must-pass behavior primitive nodes and attack must-pass network asset nodes in the current exposure level, the probability of each potential attack target type being selected and executed by the attacker is calculated, and a threat urgency assessment value for the potential attack target type is generated. Based on the threat urgency assessment value and the topological position relationship of the attack-bound behavior primitive nodes and attack-bound network asset nodes in the possible attack paths, the contribution of implementing protection measures for different attack-bound nodes to reducing threat urgency is calculated. The contribution is combined with the sharing degree and current exposure degree of the attack-bound behavior primitive nodes and attack-bound network asset nodes in multiple possible attack paths to generate the protection priority ranking result of the attack-bound behavior primitive nodes and attack-bound network asset nodes. The attack target inference result, the threat urgency assessment value, the protection priority ranking result, the cost-benefit ratio distribution, and the current exposure level are organized into a network security situational awareness result.

[0012] A second aspect of this invention provides a network security situation awareness system based on big data, comprising: The pattern reconstruction unit is used to decompose the multi-source heterogeneous security event data stream into multiple behavioral primitives, analyze the combination patterns and dependencies of the behavioral primitives in the time series, identify the sequence of behavioral primitives that form a complete attack intent, and reconstruct the attack pattern structure based on the predecessor and successor constraint relationship between the behavioral primitives. The target inference unit is used to infer the attacker's potential attack targets and calculate the confidence level of being attacked based on the sequence of behavioral primitives that have appeared in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, and to generate the attack target inference result. The cost-benefit unit is used to calculate the attack cost and the attack benefit that the attacker needs to pay to execute each possible path based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack mode structure and the resource availability status of the current network environment, and to generate the cost-benefit ratio distribution of the attack path. The exposure quantification unit is used to analyze the centrality measure of the behavioral primitive nodes in the attack pattern structure in the topology and the necessity measure in the attack logic, identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of the attack, and quantify the current exposure degree of the nodes respectively. The situational awareness unit is used to integrate the attack target inference results, the cost-benefit ratio distribution, and the current exposure level to generate network security situational awareness results.

[0013] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0014] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0015] The beneficial effects of this application are as follows: By decomposing multi-source heterogeneous security event data streams into behavioral primitives and reconstructing attack pattern structures, it is possible to accurately extract behavioral chains that reflect the attacker's true intent from massive amounts of noisy data. This significantly reduces the reliance of traditional correlation analysis on complete attack sequences, improves the recognition rate of fragmented and variant attack behaviors, and is particularly adept at discovering long-term, multi-stage advanced persistent threats, effectively overcoming the problems of high false positive rates and fragmented attack paths.

[0016] By inferring potential attack targets and calculating confidence levels based on existing behavioral primitive sequences, it is possible to perceive the attacker's strategic intentions in advance, enabling the defender to shift from passive response to proactive early warning. It can identify threats to critical assets before the attack is completed, providing quantifiable decision-making basis for the formulation of targeted defense strategies and avoiding the waste of resources caused by blind defense.

[0017] By analyzing the resource consumption and network availability of primitive nodes that do not perform actions, the cost-benefit ratio distribution of attack paths is generated, revealing the attacker's attack tendencies and difficulty for different targets. This helps security teams predict the most likely attack paths, prioritize strengthening high-risk links, and thus achieve maximum security defense with limited resources.

[0018] By quantifying the centrality of behavioral primitive nodes and the necessity of attack logic, and assessing the degree of node exposure, it is possible to accurately locate network assets and critical vulnerabilities that play a decisive role in the success or failure of an attack, guide security personnel to concentrate resources to eliminate core weaknesses, and integrate the assessment results of attack targets, cost-benefit and exposure levels to generate a comprehensive situational awareness view, thereby improving the comprehensiveness, accuracy and timeliness of network security situation assessment. Attached Figure Description

[0019] Figure 1 This is a flowchart illustrating a big data-based network security situation awareness method. Figure 2 A schematic diagram illustrating the process of inferring attack targets and calculating confidence levels. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] The technical solution of the present invention will be described in detail below with reference to specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments.

[0022] Figure 1 This is a flowchart illustrating the network security situation awareness method based on big data, as described in an embodiment of the present invention.

[0023] Big data-based network security situation awareness methods include: The multi-source heterogeneous security event data stream is decomposed into multiple behavioral primitives. The combination patterns and dependencies of the behavioral primitives in the time series are analyzed to identify the sequence of behavioral primitives that form a complete attack intent. The attack pattern structure is reconstructed based on the predecessor and successor constraints between the behavioral primitives. Based on the sequence of behavioral primitives that have appeared in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, the attacker's potential attack targets are inferred and the confidence of being attacked is calculated, thus generating the attack target inference result. Based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack mode structure and the resource availability status of the current network environment, calculate the attack cost and attack benefit that the attacker needs to pay to execute each possible path, and generate the cost-benefit ratio distribution of the attack path. The centrality measure of the behavioral primitive nodes in the attack pattern structure and the necessity measure in the attack logic are analyzed to identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of the attack, and the current exposure degree of the nodes is quantified respectively. By integrating the attack target inference results, the cost-benefit ratio distribution, and the current exposure level, a network security situation awareness result is generated.

[0024] In one optional implementation, the multi-source heterogeneous security event data stream is decomposed into multiple behavioral primitives. The combination patterns and dependencies of the behavioral primitives in the time series are analyzed to identify the sequence of behavioral primitives that form a complete attack intent. The attack pattern structure is reconstructed based on the predecessor and successor constraints between the behavioral primitives, including: Each security event in the multi-source heterogeneous security event data stream is semantically decomposed according to three dimensions: operation object, operation action, and operation result. Behavioral primitives describing a single atomic operation are extracted, and the resource consumption characteristics of each behavioral primitive are labeled. Calculate the sequential occurrence relationship and time interval distribution characteristics between the behavioral primitives in the time series, and establish a predecessor and successor constraint relationship graph between the behavioral primitives. The directed edges in the predecessor and successor constraint relationship graph represent that the execution result of the preceding behavioral primitive provides necessary conditions or triggering conditions for the execution of the subsequent behavioral primitive. Based on the predecessor-successor constraint relationship graph, a graph traversal method is used to extract the behavioral primitive sequence that satisfies the path connectivity condition, and the behavioral primitive sequence containing complete attack intent semantics is selected as the candidate attack behavior sequence. The behavioral primitives in the candidate attack behavior sequence are organized into a hierarchical structure according to the topological order in the predecessor-successor constraint relationship graph, generating the attack mode structure containing mandatory behavioral primitive nodes, optional behavioral primitive nodes, and branch paths.

[0025] The multi-source heterogeneous security event data stream originates from various security awareness components, including firewall logs, intrusion detection system alerts, endpoint behavior records, traffic collection devices, and application layer logs. These data vary significantly in format, semantic granularity, and timestamp precision. For each security event record, semantic decomposition is performed along three dimensions: operation object, operation action, and operation result. The operation object refers to the network assets or system entities involved in the event, such as a specific IP address, port, process, or file path; the operation action refers to the specific type of behavior described by the event, such as port scanning, credential submission, file writing, or process creation; and the operation result refers to the state change resulting from the execution of the action, such as successful authentication, connection establishment, or privilege escalation. After this three-dimensional semantic decomposition, each security event is mapped to a behavioral primitive describing a single atomic operation. This behavioral primitive is indivisible and semantically complete. Simultaneously, each behavioral primitive is labeled with its associated resource consumption characteristics, including the computing resources, network bandwidth resources, and time window resources consumed during execution, providing foundational data for subsequent cost-benefit analysis of attack paths.

[0026] After obtaining the set of behavioral primitives, the sequential occurrence relationship and time interval distribution characteristics among the behavioral primitives in the time series are calculated. For any two behavioral primitives in the set of behavioral primitives... and ,like Prior to in time Appearance, and the time interval between the two Falling within the preset reasonable time window range Inside, it is believed and There are potential predecessor-successor relationships among them. Furthermore, statistical analysis of multiple attack samples... Prior to Frequency of occurrence ,as well as The execution result status and The degree of semantic matching between the execution preconditions A comprehensive judgment is made on whether it is in and Establish a directed edge between them. When Exceeding the preset frequency threshold and When the preset semantic matching threshold is exceeded, from the predecessor-successor constraint relationship graph Towards Add a directed edge to represent The execution result is The execution provides the necessary or triggering conditions. In this way, a complete predecessor-successor constraint graph is gradually constructed, where nodes in the graph correspond to behavioral primitives, and directed edges correspond to causal dependencies between behavioral primitives.

[0027] Based on the constructed predecessor-successor constraint graph, a graph traversal approach is used to extract behavioral primitive sequences that satisfy the path connectivity condition. The path connectivity condition requires that adjacent behavioral primitives in the sequence have direct directed edges in the constraint graph or a transmission path reachable via intermediate nodes, and that the sequence as a whole does not have logical contradictions or circular dependencies. The graph traversal process adopts a depth-first strategy, starting from a behavioral primitive node with an in-degree of zero and extending gradually along directed edges to enumerate all paths that satisfy the connectivity condition. For the enumerated set of paths, behavioral primitive sequences containing complete attack intent semantics are further filtered as candidate attack behavior sequences. The determination of complete attack intent semantics is based on a pre-established attack intent semantic library, which records the behavioral primitive combination feature patterns corresponding to typical attack scenarios (such as reconnaissance, vulnerability exploitation, lateral movement, data theft, etc.). When the coverage rate of the behavioral primitive combination covered by a path with a certain attack intent pattern in the semantic library exceeds a preset completeness threshold, the path is identified as having complete attack intent semantics and included in the candidate attack behavior sequence set.

[0028] For the selected candidate attack behavior sequences, the behavioral primitives are organized into a hierarchical structure according to the topological order of the predecessor-successor constraint graph, generating an attack pattern structure. During the topological sorting process, nodes with an in-degree of zero in the constraint graph are placed at the first level. After eliminating the outgoing edges of already arranged nodes, newly generated nodes with an in-degree of zero are placed at the next level, until all nodes are arranged. During the hierarchical organization, the role of each behavioral primitive node is labeled: if a node appears in all candidate paths, it is labeled as a mandatory behavioral primitive node, indicating that the node is indispensable for achieving the complete attack intent; if a node appears only in some paths, it is labeled as an optional behavioral primitive node, indicating that the attacker can choose whether to execute it based on the actual situation; if there are multiple optional nodes at a certain level that are mutually exclusive, these nodes are organized into a branch path structure, reflecting the attacker's multiple possible action choices at that stage. The final generated attack pattern structure is expressed in the form of a directed acyclic graph, in which nodes carry behavioral primitive semantic labels, role annotations and resource consumption features, and edges carry predecessor and successor constraint strength weights. The overall structure clearly presents the complete logical progression path from the initial state of the attack to the achievement of the attack target, providing structured input for subsequent attack target inference, attack path cost-benefit analysis and key node identification.

[0029] In practical processing, timestamp alignment of multi-source data is a crucial prerequisite for ensuring the accuracy of the temporal relationships of behavioral primitives. Security event data from different sources often exhibit clock skew during acquisition, necessitating timestamp normalization before semantic decomposition to map all event timestamps onto the same reference time axis. Furthermore, to address noisy events and false alarms in the data stream, a confidence filtering mechanism is introduced during the behavioral primitive extraction stage. This mechanism only includes security events with confidence levels exceeding a preset threshold in the behavioral primitive set, thereby reducing the impact of noise on the quality of the predecessor-successor constraint graph construction. For dynamically changing network environments, the predecessor-successor constraint graph supports incremental updates. When new security event data arrives, only the affected local graph structure is recalculated, without requiring a full reconstruction of the entire graph structure, thus ensuring processing efficiency in real-time situational awareness scenarios.

[0030] In one optional implementation, based on the sequence of behavioral primitives already appearing in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, the attacker's potential attack targets are inferred and the confidence level of being attacked is calculated, generating the attack target inference result, including: From the behavioral primitive sequence that has appeared in the attack mode structure, extract the combination pattern of the behavioral primitive in three dimensions: operation object type, operation action type and operation result type, and generate a combined feature vector that describes the overall semantics of the behavioral primitive sequence. The combined feature vector includes the type distribution features of each behavioral primitive in the behavioral primitive sequence in the three dimensions and the predecessor and successor relationship features between the behavioral primitives. The similarity between the combined feature vector and the standard feature vector of the preset attack target type is calculated. The standard feature vector of the preset attack target type describes the typical combination pattern of behavioral primitives required to achieve a specific attack target. The potential attack target type pointed to by the behavioral primitive sequence is identified by the similarity calculation result. For each identified potential attack target type, the confidence level of the attacker in achieving the corresponding potential attack target is calculated based on the similarity value between the combined feature vector and the corresponding standard feature vector, and the proportional relationship between the number of behavioral primitives that have appeared in the behavioral primitive sequence and the number of complete behavioral primitives required to achieve the corresponding attack target. The identified potential attack target types and their corresponding confidence levels are organized into the attack target inference results.

[0031] like Figure 2 As shown, the method includes: After obtaining the attack pattern structure, deep semantic analysis is needed on the behavioral primitive sequences that have appeared to infer the attacker's potential targets and quantify the confidence level. The behavioral primitive sequences carry implicit information about the attacker's intent. By extracting multidimensional features from these sequences, the original operation records can be mapped to a semantically meaningful space of attack target types.

[0032] For the behavioral primitive sequences already appearing in the attack pattern structure, attribute tags are extracted for each behavioral primitive from three dimensions: operation object type, operation action type, and operation result type. The operation object type describes the target resource category that the behavioral primitive operates on, such as file systems, network interfaces, process spaces, and identity credential storage; the operation action type describes the specific operation performed by the behavioral primitive, such as read, write, create, delete, traverse, inject, and forward; and the operation result type describes the state changes that occur after the behavioral primitive is executed, such as privilege escalation, data leakage, persistent persistence, and lateral movement preparation. For each behavioral primitive in the sequence, it is categorized into types along the above three dimensions, and the frequency and distribution ratio of each type in the entire sequence are statistically analyzed to form a type distribution feature.

[0033] Building upon the extracted type distribution features, it is also necessary to capture the predecessor-successor relationship features between behavioral primitives. For adjacent or dependent pairs of behavioral primitives in the sequence, their type transition patterns in three dimensions are recorded: the frequency matrix of transitions from one type of operation object to another, and from one type of operation action to another. The type distribution features are then concatenated with the predecessor-successor relationship features to form a complete combined feature vector. This vector describes the overall semantic structure of the behavioral primitive sequence in a numerical way, so that sequences with different attack intentions exhibit distinguishable distribution characteristics in the vector space.

[0034] Preset attack target type standard feature vector Describes achieving the first The typical behavioral primitive combination patterns required for various attack targets are statistically summarized from annotated historical attack sample data. Attack target types cover multiple categories such as data theft, service interruption, persistent control, lateral movement, and privilege escalation. Each category corresponds to a standard feature vector that is representative in terms of three-dimensional type distribution and predecessor-successor relationships. The combined feature vectors... With each standard feature vector Perform cosine similarity calculation to obtain a similarity score. The calculation method is as follows: ,in This represents the dot product of two vectors. and Let represent the Euclidean norms of the two vectors respectively. Similarity score. The higher the value, the more likely the observed sequence of behavioral primitives is to be compared with the first... The more similar the typical patterns of the attack targets, the better. Set a similarity threshold. , will satisfy The attack target type is identified as a potential attack target, forming a candidate attack target set. Threshold The value should be adjusted according to the security sensitivity of the actual network environment. In high security sensitivity scenarios, the threshold should be appropriately lowered to reduce false alarms, while in low false alarm requirements scenarios, the threshold should be appropriately increased to control the false alarm rate.

[0035] For each potential attack target type in the candidate attack target set Further calculate the attacker's confidence in achieving the attack objective. The confidence level considers two aspects of information: one is the numerical similarity between the combined feature vector and the standard feature vector. The first is the degree of semantic fit between the observed behavioral patterns and the target attack patterns; the second is the proportion of behavioral integrity. , defined as the number of behavioral primitives that have appeared in the current sequence. With the achievement of the first Number of complete behavioral primitives required for a type of attack target The ratio between them, that is The closer the number of behavioral primitives already appearing is to the number required for a complete attack, the higher the progress of the attack and the greater the likelihood of achieving the attack target. The confidence score is obtained by weighting and fusing the similarity component and the completeness ratio component. ,in and For the weighting coefficients, satisfying , , The weighting coefficients reflect the relative importance placed on the degree of semantic matching and the progress of the attack. In the early stages of an attack, when the number of behavioral primitives is small, semantic similarity contributes more significantly to the confidence score; therefore, it can be appropriately increased. The value of the behavior integrity ratio increases as the attack sequence extends and the number of behavioral primitives increases, and it can be dynamically adjusted. The weights are used to improve the accuracy of confidence assessment.

[0036] In actual processing, the length of the behavioral primitive sequence grows dynamically over time, therefore the combined feature vectors It needs to be updated in real time as new behavioral primitives emerge. Whenever a confirmed behavioral primitive node is added to the attack pattern structure, its three-dimensional type labels are categorized, and the corresponding type distribution statistics and predecessor / successor relationship statistics are incrementally updated. Then, the similarity score and confidence score of each candidate attack target type are recalculated to dynamically update the attack target inference results. This incremental update mechanism avoids repeated full calculations of the entire sequence, reduces computational overhead, and enables the inference results to reflect the latest changes in the attack situation in a timely manner.

[0037] Each potential attack target type in the candidate attack target set and their corresponding confidence levels The organization provides structured attack target inferences. These results are presented as a list of multiple potential attack targets, sorted by confidence level from highest to lowest, allowing security analysts to prioritize the most likely attack intentions. Attack target types with higher confidence levels will be used in subsequent steps to guide cost-benefit analysis of attack paths and quantify the exposure of critical nodes, thus forming a complete situational awareness inference chain. When the confidence level exceeds a preset high-confidence threshold, a specific defense response strategy for the corresponding attack target type can be triggered, deploying protective measures in advance to block the attack process before it fully unfolds.

[0038] In one optional implementation, based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack pattern structure and the resource availability status of the current network environment, the attack cost and potential attack benefit required for the attacker to execute each possible path are calculated, generating a cost-benefit ratio distribution for the attack paths, including: Starting from the end node of the behavioral primitive sequence that has appeared in the attack mode structure, traverse all unexecuted behavioral primitive nodes along the predecessor and successor constraint relationship graph in the attack mode structure, extract the combination of behavioral primitive nodes required to reach the preset attack target type from the current state, and generate multiple possible attack paths. For each possible attack path, based on the matching degree between the resource consumption characteristics marked by each unexecuted behavior primitive node in the path and the resource availability status of the current network environment, the amount of additional resources that the attacker needs to consume to execute each behavior primitive in the path in the current network environment is calculated. The amount of additional resources that all behavior primitives in the path need to consume is added together to obtain the attack cost that the attacker needs to pay to execute the corresponding possible attack path. For each possible attack path, based on the potential attack target type and corresponding confidence level corresponding to the path endpoint, and the topological position relationship of each behavioral primitive node in the path in the attack mode structure, the attack target value and attack success probability that the attacker can achieve after successfully executing the corresponding possible attack path are evaluated and weighted to obtain the attack benefit that the attacker can obtain by executing the corresponding possible attack path. The cost-benefit ratio of the attack is calculated to obtain the cost-benefit ratio of the corresponding possible attack paths. All possible attack paths and their corresponding cost-benefit ratios are organized into the cost-benefit ratio distribution of the attack paths.

[0039] After obtaining the attack pattern structure, a systematic cost-benefit quantification analysis is needed for the attacker's unexecuted behavioral paths. Starting from the terminal nodes of the behavioral primitive sequences already appearing in the attack pattern structure, a depth-first traversal is performed along the predecessor-successor constraint graph to traverse all unexecuted behavioral primitive nodes, enumerating the combinations of behavioral primitive nodes required to reach each preset attack target type from the current attack state. Each complete traversal path starting from a terminal node and ending at a certain attack target node is recorded as a possible attack path. During the traversal, nodes marked as executed are skipped, and only unexecuted nodes are retained to participate in path construction, thereby ensuring that the generated set of possible attack paths truly reflects the attacker's available action space in the current state.

[0040] For each potential attack path, the calculation of the attack cost depends on the matching relationship between the resource consumption characteristics marked on the primitive nodes of each unexecuted behavior in the path and the resource availability status of the current network environment. Each unexecuted behavior primitive node is pre-marked with the type of resources required to execute the behavior and the theoretical consumption, including feature descriptions of multiple dimensions such as computing resources, network bandwidth, time window, and exploit tools. The resource availability status of the current network environment reflects the remaining amount and reachability of various resources that the attacker can actually call upon at the current moment. For the first [unspecified] behavior primitive node in the path... Let there be a primitive node with an unexecuted behavior, and let the theoretical demand for a certain type of resource it labels be . The current availability of this type of resource in the network environment is The additional resources required for the node to execute in the current environment. Satisfy: When hour, This indicates that current resources are sufficient and no additional investment is needed; when hour, This represents the additional resource gap that the attacker needs to acquire. The additional resource consumption of all unexecuted primitive nodes in the path is summed across each resource dimension, and then weighted and normalized across dimensions to obtain the attack cost corresponding to the possible attack path. ,in This is used as the path number. The weights of resource dimensions are pre-configured based on the difficulty and scarcity of acquiring various resources in actual attack scenarios. Computational resources and exploit tools are usually given higher weights, while time resources have relatively lower weights.

[0041] The calculation of attack payoff comprehensively considers two core factors: the value of the potential attack target corresponding to the path endpoint and the probability of the attacker successfully executing the path. The types of potential attack targets corresponding to the path endpoint and their confidence levels are also considered. This information was obtained during the target inference phase. This directly reflects the credibility of the attack target being achieved in the current attack context and can be used as a priori estimate of the attack success probability. Based on this, the success probability needs to be corrected by considering the topological positional relationship of each behavioral primitive node in the attack pattern structure: if a node located on the critical path of the topology has a high risk of execution failure, it will reduce the overall success probability of the path; the more behavioral primitive nodes in the path and the longer the path, the higher the cumulative failure probability. Let the path... Includes The first unexecuted primitive node, the... The single-step execution success rate of each node is Then the path Chain success probability for: ;in This value is obtained based on the execution success rate statistics of the primitive node in historical attack samples. If no historical data is available, a default value is used. Attack target value Based on a pre-defined threat level assessment table for attack target types, different attack target types (such as data theft, service interruption, privilege escalation, etc.) correspond to different value scores. Path attack benefits The result is obtained by calculating the weighted product of the attack target's value and the chain success probability: When a path leads to multiple potential attack targets, the weighted sum of the corresponding benefits of each target is taken as the comprehensive attack benefit of the path. The weights are obtained by normalizing the confidence of each target.

[0042] Obtain the path attack cost With attack benefits Then, the cost-benefit ratio of this path is obtained through ratio calculation. : , The smaller the value, the higher the potential gain for the attacker at a lower cost, the more attractive the path is to the attacker, and the higher the corresponding security threat level. The larger the value, the higher the difficulty of execution and the lower the expected return, making it less likely for an attacker to choose this path. When Approaching zero When it is large, it is necessary to They are given special treatment and marked as extremely low-cost, high-return paths, and given priority in warnings in subsequent situational awareness results.

[0043] All possible attack paths obtained through traversal and their corresponding... The values ​​are arranged in ascending order to construct a cost-benefit ratio distribution for attack paths. This distribution uses path identifiers as the horizontal axis index and... The vertical axis represents the values, providing a complete ranking of the relative attractiveness of all possible action paths for the attacker in the current attack situation. The cost-benefit ratio distribution is shown in the figure. The lowest-priority paths are marked as high-priority threat paths, providing a quantitative basis for the priority allocation of subsequent defense resources. Furthermore, the cost-benefit ratio distribution can reveal the clustering intervals of attackers' path preferences: if multiple paths... If the cost-benefit ratio is concentrated in a relatively low range, it indicates that the current network environment provides attackers with multiple low-cost, high-return alternative paths, and the overall security situation is quite severe. If the cost-benefit ratio of the paths is generally high, it indicates that the current defense configuration has effectively increased the cost of attacks, and the situation is relatively controllable.

[0044] In practical processing, if the attack pattern structure contains parallel branches or conditional jump nodes, path traversal must be strictly enumerated according to the directed edges in the constraint graph to avoid generating invalid paths that violate predecessor-successor constraints. For cases with an excessive number of paths, an upper limit on path length can be set. Prune the traversal depth, retaining only those with a length not exceeding [a certain value]. The path is used to participate in the cost-benefit ratio calculation, thereby achieving a balance between computational efficiency and analysis coverage.

[0045] In one optional implementation, analyzing the centrality measure of the behavioral primitive nodes in the attack pattern structure in terms of topological structure and the necessity measure in terms of attack logic includes: Based on the number of predecessor nodes and successor nodes connected to each behavioral primitive node in the topology, the topological hub status of the behavioral primitive node in the process of attack path convergence and forking is evaluated, and the topological centrality metric of the behavioral primitive node is generated. Based on the frequency of occurrence of behavioral primitive nodes in the possible attack paths and the types of network asset nodes associated with the behavioral primitive nodes, the irreplaceability of each behavioral primitive node in the process of achieving the potential attack target type is calculated. According to the proportion of the frequency of occurrence of the behavioral primitive node in the possible attack paths to the total number of all possible attack paths, and the functional uniqueness of the network asset node type operated by the behavioral primitive node in the process of achieving the attack target, an attack logic necessity metric value of the behavioral primitive node is generated.

[0046] After generating the cost-benefit ratio distribution of attack paths, it is necessary to further analyze the structural position and logical role of each behavioral primitive node in the attack pattern structure in order to identify the key nodes that play a decisive role in the success or failure of the attack. This analysis unfolds from two dimensions: one is the centrality measure of the topological structure, and the other is the necessity measure of the attack logic. The two dimensions complement each other and jointly characterize the importance of nodes in the entire attack system.

[0047] For topological centrality metrics, the attack pattern structure is essentially a directed graph, where each node represents a behavioral primitive, and edges represent predecessor-successor constraints between these primitives. In this directed graph, some nodes are located at the intersection of multiple attack paths, serving as hubs that converge attack steps from different predecessor nodes and propagate them to subsequent steps; other nodes are located at path forks, expanding from a single predecessor state to multiple possible successor directions. Whether a node is a convergent or forking node, the number of connections it has in the topology directly reflects its influence on the overall attack path network.

[0048] Specifically, for each behavioral primitive node in the attack pattern structure Statistical analysis of its in-degree (i.e., the number of predecessor nodes connected to this node) and out-degree (That is, the number of successor nodes connected from this node). A node with a high in-degree means that multiple attack sub-paths from different sources converge here. Regardless of the initial path combination adopted by the attacker, it must pass through this node to continue advancing. A node with a high out-degree means that the attacker has multiple subsequent options after passing through this node, and this node is an important fork point for attack decision-making. Combining the in-degree and out-degree, a topological centrality metric for the behavioral primitive node is generated. The calculation method is as follows: ,in The higher the value, the more prominent the node's topological hub status during the convergence and forking of attack paths, and the stronger its support for the overall attack graph structure. When a node is removed or the defender intervenes, the largest number of paths will be affected. Nodes with higher degrees have priority in defense. In practice, different weights can be assigned to in-degree and out-degree to differentiate the different focuses of defense strategies for convergent and forked critical nodes, but the basic logic remains the same. It is the core metric.

[0049] After completing the topology centrality measurement, the necessity measurement of each behavioral primitive node is further calculated from the attack logic dimension. Attack logic necessity focuses on: what proportion of the total number of possible attack paths a certain behavioral primitive node appears in, and whether the type of network asset node operated by that node has functional uniqueness in achieving the attack objective.

[0050] Assume that the attack mode structure contains Possible attack paths, behavioral primitive nodes The number of paths appearing in these paths is Then the path coverage of that node Defined as: , The closer a value is to 1, the more likely the primitive node appears in almost all possible attack paths. No matter which path an attacker chooses, it is difficult to bypass this node, thus making it highly irreplaceable in attack logic. Conversely, Lower-level nodes only appear in a few paths, and attackers can choose other paths to bypass them, so their irreplaceability is relatively low.

[0051] Besides path coverage, the functional uniqueness of the network asset node types operated by behavioral primitive nodes is also an important factor in measuring the necessity of attack logic. Network asset node types include different categories such as identity authentication servers, core databases, domain controllers, and critical business interfaces. If the function provided by a certain network asset node type operated by a behavioral primitive node during the entire attack target achievement process cannot be replaced by other asset types (for example, lateral movement and obtaining full domain privileges can only be achieved by operating a domain controller), then the functional uniqueness score of that node is high. Take the higher value; if an attacker can achieve the same effect by manipulating multiple asset nodes with similar functions, then... Take the lower value. Functional uniqueness score. The range of values ​​is It is supported by a pre-built knowledge base of network asset function substitution relationships, which records the degree of functional substitutability of various asset nodes under different attack target scenarios.

[0052] Based on the combination of path coverage and functional uniqueness, behavioral primitive nodes are generated. Necessity metric for attack logic The calculation method is as follows: ,in The weighting coefficient for the path coverage component, with a value range of [value range missing]. , This is the weighting coefficient for the functional uniqueness component. When the attack pattern structure has a large number of paths and high path diversity, it can be appropriately increased. The value of makes path coverage the dominant factor in necessity measurement; when the network asset type is relatively simple and the functional substitution relationship is relatively sparse, it can be appropriately reduced. This allows the uniqueness of the function to play a greater role. The higher the value, the more difficult it is for the behavior primitive node to be bypassed or replaced in the process of achieving the potential attack target type, and the higher the priority for the defender to implement protective measures against it.

[0053] In practical applications, topological centrality metric Necessity metric for attack logic Together, these constitute a two-dimensional characterization of the importance of behavioral primitive nodes. However, they are not entirely equivalent: a node with high topological centrality does not necessarily have high attack logic necessity; for example, a forked node may connect to a large number of successor paths, but an attacker can bypass it and choose other equivalent paths. Similarly, a node with high attack logic necessity may not connect to a large number of nodes in the topology; it may simply be a linear node with an in-degree and out-degree of 1, but the type of asset it operates on is functionally irreplaceable. Therefore, when identifying key behavioral primitive nodes, it is necessary to consider... and When used in combination, nodes with both high metrics are given the highest priority.

[0054] For the critical identification of network asset nodes, the same logic applies: the number of times each network asset node is operated on by different behavioral primitive nodes, and the frequency of its use as an intermediate stepping stone or final target in the attack path, thereby quantifying the current exposure level of each network asset node. The exposure level comprehensively considers the path coverage reached by the attack behavior of the asset node, the functional uniqueness of the asset node, and the frequency of abnormal access behaviors currently observed on the asset node, forming an exposure risk assessment for each network asset node under the current attack situation, providing node-level risk input for subsequent integration of situational awareness results.

[0055] In one alternative implementation, identifying behavioral primitive nodes and network asset nodes that influence the success or failure of an attack, and quantifying the current exposure level of each node, includes: The topology centrality metric and the attack logic necessity metric are weighted and fused. Behavioral primitive nodes whose weighted fusion results exceed the preset criticality judgment threshold are identified as essential attack primitive nodes that affect the success or failure of the attack. The network asset nodes operated by the essential attack primitive nodes are extracted and identified as essential attack network asset nodes that affect the success or failure of the attack. For each primitive node of the attack's inevitable behavior, the feasibility of the attacker executing the primitive node of the attack's inevitable behavior is quantified as the current exposure degree of the primitive node of the attack's inevitable behavior, based on the degree of matching between the resource consumption characteristics marked by the primitive node of the attack's inevitable behavior and the resource availability status of the current network environment. For each network asset node that an attack must pass through, the reachability of the attacker to access the network asset node is quantified as the current exposure level of the network asset node based on the access control configuration status of the network asset node in the current network environment and the sensitivity level of the business data carried by the network asset node.

[0056] After measuring the topological centrality and attack logic necessity of the behavioral primitive nodes, the two need to be weighted and fused to comprehensively evaluate the actual impact of each behavioral primitive node on the success or failure of the attack. Let the behavioral primitive nodes be... The overall criticality score is The topological centrality metric is The necessity metric for attack logic is... The fusion weight coefficients are respectively and The calculation method for the comprehensive critical score is as follows: ,in Both weighting coefficients are positive real numbers. and The value can be adjusted according to the specific network security scenario. When the attack pattern structure is more complex and there are more topology branches, it can be appropriately increased. To emphasize the impact of topological location; when the attack path is relatively linear and the functional dependencies are strong, the intensity can be appropriately increased. Weights that emphasize logical necessity.

[0057] Let the preset criticality judgment threshold be... For satisfying Behavioral primitive nodes This is identified as a primitive node that is essential for an attack. The setting relies on the statistical analysis results of historical attack samples. Typically, the upper quartile of the overall criticality score distribution of all nodes is taken as the initial reference value, and dynamically calibrated based on the false positive and false negative rates during actual deployment. The set of primitive nodes identified as essential attack behavior pathways is denoted as... The nodes in this set represent key operational steps that an attacker cannot bypass in carrying out a complete attack. Once the attack behavior corresponding to these nodes is successfully executed, the attack process will be decisively advanced.

[0058] Each essential action primitive node in an attack pattern is labeled with information about the network asset nodes it operates on. These network asset nodes are the targets of the action primitive nodes, including servers, databases, network devices, and application service interfaces. Extraction All network asset nodes operated by the behavioral primitive nodes are identified as essential network asset nodes that play a crucial role in the success or failure of an attack. Their set is denoted as […]. If multiple attack primitive nodes operate on the same network asset node, then that network asset node will only be counted. Once, to avoid double counting.

[0059] against Each attack must pass through a primitive node, quantifying the feasibility of an attacker executing the attack behavior represented by that node, as the current exposure level of that node. The quantification of feasibility is based on the degree of matching between the resource consumption characteristics labeled on the node and the resource availability status of the current network environment. Specifically, the resource consumption characteristics of the primitive node describe the various resources required to execute the attack step, including network bandwidth, computing power, vulnerability exploitation conditions, credential access permissions, and other dimensions. The resource availability status of the current network environment reflects the resources that the attacker can actually obtain or utilize at the current moment. Let the attack must pass through a primitive node... The total number of resource dimensions involved is , No. The resource requirements marked on the nodes in each resource dimension are: The available quantity of the corresponding resource dimension in the current network environment is Then the first Resource satisfaction in each dimension When available resources exceed demand, the satisfaction level cap is 1. The average satisfaction level across all dimensions is used to obtain the node. Feasibility score ,Right now . The range of values ​​is The closer the value is to 1, the more sufficient the conditions are for the attacker to execute the attack behavior corresponding to that node, and the higher the current exposure level; the closer the value is to 0, the less sufficient the current environment's resource supply is for the attacker, and the lower the exposure level of that node.

[0060] against Each attack must pass through a network asset node. The reachability of this node to the attacker is quantified, representing the node's current exposure level. Reachability quantification considers two aspects: first, the access control configuration status of the network asset node in the current network environment; and second, the sensitivity level of the business data carried by this node. The access control configuration status reflects the protection strength of the asset node's external exposure, including firewall rule coverage, the completeness of the authentication mechanism, and the effectiveness of network isolation policies. A comprehensive evaluation of these protection factors yields an access control strength score. The range of values ​​is A higher value indicates stricter access control. An attacker's reachability to this node is inversely related to the strength of access control; the weaker the access control, the higher the reachability. (Business data sensitivity level) This reflects the potential data breaches or business disruptions that could result if an attacker successfully gains access to the asset node. The data is categorized into several levels according to data classification and grading standards, and mapped to... The normalized value for an interval increases with the sensitivity level.

[0061] Set up network asset nodes The current level of exposure is Access control strength score is The business data sensitivity level is The fusion weight coefficients are respectively and ,but ,in . The item translates access control strength into reachability contribution. This item reflects the amplifying effect of the asset's own sensitive value on the degree of exposure. and The proportion can be adjusted according to the actual security strategy focus; when the focus is on protecting against vulnerabilities, it can be increased. When the focus is on data asset protection, it can improve . The range of values ​​is The higher the value, the greater the risk of attack exposure the network asset node currently faces, and the more likely it is to be included in the protection and hardening scope.

[0062] Through the above process, the set of primitive nodes for the essential attack behaviors was completed respectively. Quantification of the feasibility of each node in the network, and the set of network asset nodes that must be passed through in an attack. The quantification of the reachability of each node, along with the two types of exposure indicators, forms the input basis for the subsequent integration of situational awareness results, providing quantitative support for the precise allocation and prioritization of defense resources.

[0063] In one optional implementation, integrating the attack target inference result, the cost-benefit ratio distribution, and the current exposure level to generate a network security situation awareness result includes: Based on the confidence level of the potential attack target type in the attack target inference results, the cost-benefit ratio of the possible attack paths in the cost-benefit ratio distribution, and the exposure level of the attack must-pass behavior primitive nodes and attack must-pass network asset nodes in the current exposure level, the probability of each potential attack target type being selected and executed by the attacker is calculated, and a threat urgency assessment value for the potential attack target type is generated. Based on the threat urgency assessment value and the topological position relationship of the attack-bound behavior primitive nodes and attack-bound network asset nodes in the possible attack paths, the contribution of implementing protection measures for different attack-bound nodes to reducing threat urgency is calculated. The contribution is combined with the sharing degree and current exposure degree of the attack-bound behavior primitive nodes and attack-bound network asset nodes in multiple possible attack paths to generate the protection priority ranking result of the attack-bound behavior primitive nodes and attack-bound network asset nodes. The attack target inference result, the threat urgency assessment value, the protection priority ranking result, the cost-benefit ratio distribution, and the current exposure level are organized into a network security situational awareness result.

[0064] When integrating attack target inference results, cost-benefit ratio distribution, and current exposure level to generate cybersecurity situational awareness results, the first step is to calculate a threat urgency assessment value for each potential attack target type. The threat urgency assessment value comprehensively reflects the likelihood that an attacker will select and actually execute a particular attack target, and its calculation depends on three types of inputs: the attack target inference results... Confidence level of potential attack target types The cost-benefit ratio values ​​of possible attack paths related to this attack target type in the cost-benefit ratio distribution. The exposure values ​​of the primitive nodes and network asset nodes that are essential for the attack.

[0065] Specifically, for the first This involves identifying potential attack target types and filtering out the set of all possible attack paths that terminate at that specific target type. The cost-benefit ratio of each path within this set. Take the weighted average to obtain the path attractiveness index corresponding to this attack target type. A higher path attractiveness index indicates that attackers are more likely to choose that target when weighing resource investment against expected returns. Simultaneously, for a set of paths... Extract the feasibility scores of all essential attack primitive nodes and essential network asset nodes. and exposure level The average value is calculated along the node dimension to obtain the overall node exposure index for this attack target type. . The higher the value, the weaker the current defenses of key nodes along the attack path, and the less real resistance the attacker faces in carrying out the attack. , and The three indicators are linearly weighted and fused to obtain the first... Threat urgency assessment value for different types of potential attack targets ,Right now ,in , , The fusion weight coefficients for the confidence component, path attractiveness component, and node exposure component are respectively, satisfying the following conditions. The three weights can be adjusted based on the emphasis placed on the certainty of attack intent, attack economy, and vulnerability of defenses in the actual deployment scenario.

[0066] After obtaining the threat urgency assessment values ​​for each potential attack target type, the protection priority ranking results for the attack-bound behavior primitive nodes and attack-bound network asset nodes are further calculated. The core idea of ​​protection priority ranking is: implementing protection measures on a certain attack-bound node can block all possible attack paths to that node, thereby reducing the threat urgency of potential attack target types that rely on these paths. Therefore, the degree of protection contribution is closely related to the node's position in the attack path topology. For attack-bound behavior primitive nodes... Or attack the network asset nodes that must pass through. The set of paths that appear in all possible attack paths is counted and denoted as . or If effective protection is implemented for this node, then or All paths are blocked, thus reducing the threat urgency of each potential attack target type. The protection contribution of a node is obtained by summing the weighted reduction in threat urgency for each attack target type after the node is blocked. or .

[0067] The final calculation of protection priority also needs to incorporate the degree of sharing of a node across multiple potential attack paths and its current exposure level. The degree of sharing reflects the breadth to which the node is used by multiple paths; a node with a higher degree of sharing can block more attack paths simultaneously after being protected, resulting in a stronger leverage effect of protection. For behavioral primitive nodes... Its path sharing degree can be directly determined by path coverage. Representation; for network asset nodes Similarly, the proportion of its occurrence in possible attack paths is used as its path sharing degree. The current exposure level reflects how easily the node can be attacked and exploited; nodes with higher exposure levels require priority protection. Considering the above three factors, the behavioral primitive nodes... Protection priority score according to Calculations for network asset nodes Protection priority score according to Calculation, where , , These are the priority fusion weight coefficients corresponding to the protection contribution component, the path sharing component, and the current exposure component, respectively, satisfying... All primitive nodes and network asset nodes that are essential for attack behavior are sorted from highest to lowest according to their respective protection priority scores, resulting in a protection priority ranking. Nodes ranked higher indicate that protecting them will achieve the greatest threat reduction effect with minimal protection resource investment, providing a direct basis for security operations personnel's resource allocation decisions.

[0068] After calculating the threat urgency assessment and protection priority ranking, the five types of information—attack target inference, threat urgency assessment, protection priority ranking, cost-benefit ratio distribution, and current exposure level—are unified into a unified network security situation awareness result. The attack target inference result provides a qualitative description and confidence quantification of the current attack intent; the threat urgency assessment provides a quantitative ranking of time sensitivity at the attack target level, helping security personnel identify high-priority threats requiring immediate response; the protection priority ranking result provides a suggested order for allocating protection resources at the node level; the cost-benefit ratio distribution reveals the attacker's economic preferences in path selection, assisting in predicting the most likely attack paths; and the current exposure level provides a quantitative baseline of the current protection status of each key node, facilitating continuous tracking of the effectiveness of protection measures. These five types of information corroborate each other and progress hierarchically, collectively forming a comprehensive depiction of the network security situation, enabling security operations personnel to grasp both the overall threat landscape and obtain specific and actionable protection action recommendations.

[0069] A second aspect of this invention provides a network security situation awareness system based on big data, comprising: The pattern reconstruction unit is used to decompose the multi-source heterogeneous security event data stream into multiple behavioral primitives, analyze the combination patterns and dependencies of the behavioral primitives in the time series, identify the sequence of behavioral primitives that form a complete attack intent, and reconstruct the attack pattern structure based on the predecessor and successor constraint relationship between the behavioral primitives. The target inference unit is used to infer the attacker's potential attack targets and calculate the confidence level of being attacked based on the sequence of behavioral primitives that have appeared in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, and to generate the attack target inference result. The cost-benefit unit is used to calculate the attack cost and the attack benefit that the attacker needs to pay to execute each possible path based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack mode structure and the resource availability status of the current network environment, and to generate the cost-benefit ratio distribution of the attack path. The exposure quantification unit is used to analyze the centrality measure of the behavioral primitive nodes in the attack pattern structure in the topology and the necessity measure in the attack logic, identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of the attack, and quantify the current exposure degree of the nodes respectively. The situational awareness unit is used to integrate the attack target inference results, the cost-benefit ratio distribution, and the current exposure level to generate network security situational awareness results.

[0070] A third aspect of the present invention provides an electronic device, comprising: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the aforementioned method.

[0071] A fourth aspect of the present invention provides a computer-readable storage medium having stored thereon computer program instructions that, when executed by a processor, implement the aforementioned method.

[0072] This invention can be a method, apparatus, system, and / or computer program product. The computer program product may include a computer-readable storage medium having computer-readable program instructions loaded thereon for performing various aspects of the invention.

[0073] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention.

Claims

1. A network security situation awareness method based on big data, characterized in that, include: The multi-source heterogeneous security event data stream is decomposed into multiple behavioral primitives. The combination patterns and dependencies of the behavioral primitives in the time series are analyzed to identify the sequence of behavioral primitives that form a complete attack intent. The attack pattern structure is reconstructed based on the predecessor and successor constraints between the behavioral primitives. Based on the sequence of behavioral primitives that have appeared in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, the attacker's potential attack targets are inferred and the confidence of being attacked is calculated, thus generating the attack target inference result. Based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack mode structure and the resource availability status of the current network environment, calculate the attack cost and attack benefit that the attacker needs to pay to execute each possible path, and generate the cost-benefit ratio distribution of the attack path. The centrality measure of the behavioral primitive nodes in the attack pattern structure and the necessity measure in the attack logic are analyzed to identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of the attack, and the current exposure degree of the nodes is quantified respectively. By integrating the attack target inference results, the cost-benefit ratio distribution, and the current exposure level, a network security situation awareness result is generated.

2. The method according to claim 1, characterized in that, The multi-source heterogeneous security event data stream is decomposed into multiple behavioral primitives. The combination patterns and dependencies of these behavioral primitives in the time series are analyzed to identify the sequence of behavioral primitives that form a complete attack intent. Based on the predecessor and successor constraints between the behavioral primitives, the attack pattern structure is reconstructed, including: Each security event in the multi-source heterogeneous security event data stream is semantically decomposed according to three dimensions: operation object, operation action, and operation result. Behavioral primitives describing a single atomic operation are extracted, and the resource consumption characteristics of each behavioral primitive are labeled. Calculate the sequential occurrence relationship and time interval distribution characteristics between the behavioral primitives in the time series, and establish a predecessor and successor constraint relationship graph between the behavioral primitives. The directed edges in the predecessor and successor constraint relationship graph represent that the execution result of the preceding behavioral primitive provides necessary conditions or triggering conditions for the execution of the subsequent behavioral primitive. Based on the predecessor-successor constraint relationship graph, a graph traversal method is used to extract the behavioral primitive sequence that satisfies the path connectivity condition, and the behavioral primitive sequence containing complete attack intent semantics is selected as the candidate attack behavior sequence. The behavioral primitives in the candidate attack behavior sequence are organized into a hierarchical structure according to the topological order in the predecessor-successor constraint relationship graph, generating the attack mode structure containing mandatory behavioral primitive nodes, optional behavioral primitive nodes, and branch paths.

3. The method according to claim 1, characterized in that, Based on the behavioral primitive sequences already appearing in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, the attacker's potential attack targets are inferred and the confidence level of the attacked target is calculated, generating attack target inference results including: From the behavioral primitive sequence that has appeared in the attack mode structure, extract the combination pattern of the behavioral primitive in three dimensions: operation object type, operation action type and operation result type, and generate a combined feature vector that describes the overall semantics of the behavioral primitive sequence. The combined feature vector includes the type distribution features of each behavioral primitive in the behavioral primitive sequence in the three dimensions and the predecessor and successor relationship features between the behavioral primitives. The similarity between the combined feature vector and the standard feature vector of the preset attack target type is calculated. The standard feature vector of the preset attack target type describes the typical combination pattern of behavioral primitives required to achieve a specific attack target. The potential attack target type pointed to by the behavioral primitive sequence is identified by the similarity calculation result. For each identified potential attack target type, the confidence level of the attacker in achieving the corresponding potential attack target is calculated based on the similarity value between the combined feature vector and the corresponding standard feature vector, and the proportional relationship between the number of behavioral primitives that have appeared in the behavioral primitive sequence and the number of complete behavioral primitives required to achieve the corresponding attack target. The identified potential attack target types and their corresponding confidence levels are organized into the attack target inference results.

4. The method according to claim 2, characterized in that, Based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack pattern structure and the resource availability status of the current network environment, the attack cost and potential gain for the attacker to execute each possible path are calculated, and the cost-benefit ratio distribution of the generated attack paths includes: Starting from the end node of the behavioral primitive sequence that has appeared in the attack mode structure, traverse all unexecuted behavioral primitive nodes along the predecessor and successor constraint relationship graph in the attack mode structure, extract the combination of behavioral primitive nodes required to reach the preset attack target type from the current state, and generate multiple possible attack paths. For each possible attack path, based on the matching degree between the resource consumption characteristics marked by each unexecuted behavior primitive node in the path and the resource availability status of the current network environment, the amount of additional resources that the attacker needs to consume to execute each behavior primitive in the path in the current network environment is calculated. The amount of additional resources that all behavior primitives in the path need to consume is added together to obtain the attack cost that the attacker needs to pay to execute the corresponding possible attack path. For each possible attack path, based on the potential attack target type and corresponding confidence level corresponding to the path endpoint, and the topological position relationship of each behavioral primitive node in the path in the attack mode structure, the attack target value and attack success probability that the attacker can achieve after successfully executing the corresponding possible attack path are evaluated and weighted to obtain the attack benefit that the attacker can obtain by executing the corresponding possible attack path. The cost-benefit ratio of the attack is calculated to obtain the cost-benefit ratio of the corresponding possible attack paths. All possible attack paths and their corresponding cost-benefit ratios are organized into the cost-benefit ratio distribution of the attack paths.

5. The method according to claim 1, characterized in that, The analysis of the behavioral primitive nodes in the attack pattern structure includes the following: a measure of centrality in the topological structure and a measure of necessity in the attack logic. Based on the number of predecessor nodes and successor nodes connected to each behavioral primitive node in the topology, the topological hub status of the behavioral primitive node in the process of attack path convergence and forking is evaluated, and the topological centrality metric of the behavioral primitive node is generated. Based on the frequency of occurrence of behavioral primitive nodes in the possible attack paths and the types of network asset nodes associated with the behavioral primitive nodes, the irreplaceability of each behavioral primitive node in the process of achieving the potential attack target type is calculated. According to the proportion of the frequency of occurrence of the behavioral primitive node in the possible attack paths to the total number of all possible attack paths, and the functional uniqueness of the network asset node type operated by the behavioral primitive node in the process of achieving the attack target, an attack logic necessity metric value of the behavioral primitive node is generated.

6. The method according to claim 1, characterized in that, Identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of an attack, and quantify the current exposure level of each node, including: The topology centrality metric and the attack logic necessity metric are weighted and fused. Behavioral primitive nodes whose weighted fusion results exceed the preset criticality judgment threshold are identified as essential attack primitive nodes that affect the success or failure of the attack. The network asset nodes operated by the essential attack primitive nodes are extracted and identified as essential attack network asset nodes that affect the success or failure of the attack. For each primitive node of the attack's inevitable behavior, the feasibility of the attacker executing the primitive node of the attack's inevitable behavior is quantified as the current exposure degree of the primitive node of the attack's inevitable behavior, based on the degree of matching between the resource consumption characteristics marked by the primitive node of the attack's inevitable behavior and the resource availability status of the current network environment. For each network asset node that an attack must pass through, the reachability of the attacker to access the network asset node is quantified as the current exposure level of the network asset node based on the access control configuration status of the network asset node in the current network environment and the sensitivity level of the business data carried by the network asset node.

7. The method according to claim 1, characterized in that, Integrating the attack target inference results, the cost-benefit ratio distribution, and the current exposure level, the generated network security situation awareness results include: Based on the confidence level of the potential attack target type in the attack target inference results, the cost-benefit ratio of the possible attack paths in the cost-benefit ratio distribution, and the exposure level of the attack must-pass behavior primitive nodes and attack must-pass network asset nodes in the current exposure level, the probability of each potential attack target type being selected and executed by the attacker is calculated, and a threat urgency assessment value for the potential attack target type is generated. Based on the threat urgency assessment value and the topological position relationship of the attack-bound behavior primitive nodes and attack-bound network asset nodes in the possible attack paths, the contribution of implementing protection measures for different attack-bound nodes to reducing threat urgency is calculated. The contribution is combined with the sharing degree and current exposure degree of the attack-bound behavior primitive nodes and attack-bound network asset nodes in multiple possible attack paths to generate the protection priority ranking result of the attack-bound behavior primitive nodes and attack-bound network asset nodes. The attack target inference result, the threat urgency assessment value, the protection priority ranking result, the cost-benefit ratio distribution, and the current exposure level are organized into a network security situational awareness result.

8. A network security situation awareness system based on big data, used to implement the method as described in any one of claims 1-7, characterized in that, include: The pattern reconstruction unit is used to decompose the multi-source heterogeneous security event data stream into multiple behavioral primitives, analyze the combination patterns and dependencies of the behavioral primitives in the time series, identify the sequence of behavioral primitives that form a complete attack intent, and reconstruct the attack pattern structure based on the predecessor and successor constraint relationship between the behavioral primitives. The target inference unit is used to infer the attacker's potential attack targets and calculate the confidence level of being attacked based on the sequence of behavioral primitives that have appeared in the attack pattern structure, by matching the mapping relationship between the combined features of the behavioral primitives and the preset attack target type, and to generate the attack target inference result. The cost-benefit unit is used to calculate the attack cost and the attack benefit that the attacker needs to pay to execute each possible path based on the resource consumption characteristics of the unexecuted behavior primitive nodes in the attack mode structure and the resource availability status of the current network environment, and to generate the cost-benefit ratio distribution of the attack path. The exposure quantification unit is used to analyze the centrality measure of the behavioral primitive nodes in the attack pattern structure in the topology and the necessity measure in the attack logic, identify the behavioral primitive nodes and network asset nodes that play a role in the success or failure of the attack, and quantify the current exposure degree of the nodes respectively. The situational awareness unit is used to integrate the attack target inference results, the cost-benefit ratio distribution, and the current exposure level to generate network security situational awareness results.

9. An electronic device, characterized in that, include: processor; Memory used to store processor-executable instructions; The processor is configured to invoke instructions stored in the memory to execute the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having computer program instructions stored thereon, characterized in that, When the computer program instructions are executed by the processor, they implement the method described in any one of claims 1 to 7.

Images