Knowledge graph-based automatic attack and defense strategy generation method, device and equipment

Abstract

The application relates to a knowledge graph-based automatic attack and defense strategy generation method, device and equipment. The method comprises the following steps: constructing a multi-layer knowledge graph fusing network security knowledge; based on a preset reasoning rule set and the multi-layer knowledge graph, deducing an attack path through a graph reasoning engine to generate a candidate defense strategy; constructing a double-layer game model of an attacker and a defender, and applying a multi-objective optimization algorithm to search and optimize the candidate defense strategy to generate a defense strategy plan containing operation instructions; verifying the effectiveness of the defense strategy plan through a simulation verification environment, and deploying the defense strategy plan that passes the verification to a production environment; collecting execution feedback data of the defense strategy plan in the production environment, and dynamically adjusting the multi-layer knowledge graph and the reasoning rule set. By using the method, attack semantic understanding, intelligent path deduction, dynamic strategy generation and continuous evolution can be realized.

Description

Technical Field

[0001] This application relates to the field of cybersecurity technology, and in particular to a method, apparatus, computer device, computer-readable storage medium, and computer program product for generating automated attack and defense strategies based on knowledge graphs. Background Technology

[0002] With the increasing sophistication of cyberattack techniques and the frequent occurrence of Advanced Persistent Threat (APT) attacks, cybersecurity defense systems are evolving from passive defense based on static rules to proactive countermeasures based on intelligent analysis. Network attack and defense simulation and automated strategy generation technologies, as important means to enhance the practical protection capabilities of critical information infrastructure, have received widespread attention.

[0003] Traditional network attack and defense simulation platforms or Security Orchestration, Automation, and Response (SOAR) systems typically employ a linear architecture of "data acquisition - rule matching - script execution." These systems rely on predefined attack signature libraries and static response playbooks. Their core operating mode involves matching monitored security events with rules in the knowledge base to trigger pre-written response scripts. Generally, attack knowledge bases (such as the MITRE ATT&CK matrix) and attack phase models (such as the Kill Chain) are stored independently, lacking deep semantic association and integration. The generation of defense strategies heavily depends on the experience of security experts for manual orchestration and configuration, making it difficult to dynamically adapt to new and variant attack tactics.

[0004] Therefore, there is an urgent need for an automated attack and defense strategy generation method, device, computer equipment, computer-readable storage medium, and computer program product based on knowledge graphs, to achieve everything from attack semantic understanding and intelligent path deduction to dynamic strategy generation and continuous evolution. Summary of the Invention

[0005] Therefore, it is necessary to provide a knowledge graph-based automated attack and defense strategy generation method, device, computer equipment, computer-readable storage medium, and computer program product that can realize attack semantic understanding, intelligent path deduction, dynamic strategy generation, and continuous evolution, addressing the aforementioned technical problems.

[0006] Firstly, this application provides an automated attack and defense strategy generation method based on knowledge graphs, including:

[0007] Construct a multi-layered knowledge graph that integrates cybersecurity knowledge;

[0008] Based on the preset set of reasoning rules and the multi-layer knowledge graph, the attack path is deduced through the graph reasoning engine, candidate defense strategies are generated, and the concealment cost, detection hit probability and business impact factor of the attack path are calculated for multi-objective optimization.

[0009] A two-layer game model of attacker and defender is constructed, and a multi-objective optimization algorithm is applied to search and optimize the candidate defense strategies to generate a defense strategy plan containing operation instructions.

[0010] The effectiveness of the defense strategy plan is verified through a simulation verification environment, and the verified defense strategy plan is deployed to the production environment.

[0011] Collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and the inference rule set based on the execution feedback data.

[0012] In one embodiment, the construction of a multi-layered knowledge graph integrating cybersecurity knowledge includes:

[0013] Construct a heterogeneous graph model, which includes multiple node types such as attack technology nodes, attack stage nodes, device feature nodes, defense measure nodes and cost model nodes, as well as a set of edges representing the dependencies, connections and mapping relationships between nodes.

[0014] Cross-mapping is performed between the pre-defined attack technology framework and the attack phase model to calculate the semantic association strength between attack technology nodes and attack phase nodes.

[0015] Receive security events and monitoring evidence input from external systems, and bind the security events and monitoring evidence to the corresponding nodes in the heterogeneous graph model to form an evidence chain;

[0016] The multi-layer knowledge graph is generated based on the heterogeneous graph model, the semantic association strength, and the evidence chain.

[0017] In one embodiment, the attack technique framework is the MITRE ATT&CK matrix, and the attack phase model is the Kill Chain model; the step of cross-mapping the preset attack technique framework with the attack phase model includes:

[0018] Semantically associate the attack technique nodes in the MITRE ATT&CK matrix with the attack stage nodes in the Kill Chain model, and construct an association strength function based on semantic similarity index and logical dependency index.

[0019] The output value of the correlation strength function is used to quantify the connection strength between the attack technique node and the attack phase node.

[0020] In one embodiment, based on a preset set of reasoning rules and the multi-layered knowledge graph, the attack path is deduced through a graph reasoning engine to generate candidate defense strategies, and the concealment cost, detection hit probability, and business impact factor of the attack path are calculated for multi-objective optimization, including:

[0021] The set of reasoning rules and the multi-layer knowledge graph are input into the graph reasoning engine, and the graph search algorithm is used to identify the reachable path from the initial intrusion point to the attack target, which is used as the deduction result of the attack path.

[0022] Based on the defense measure nodes and cost model nodes bound in the multi-layer knowledge graph, at least one candidate defense strategy corresponding to the attack path is generated.

[0023] The predefined cost function is invoked to calculate the concealment cost, expected detection hit probability, and business impact assessment value for each candidate defense strategy, and then a weighted sum is performed to obtain a multi-objective optimization score.

[0024] In one embodiment, the construction of a two-layer game model between the attacker and the defender, and the application of a multi-objective optimization algorithm to search for and optimize the candidate defense strategies, includes:

[0025] A two-layer game model is constructed, in which the upper layer model represents the attacking party's decision-making process with the goal of minimizing attack costs and maximizing attack benefits, and the lower layer model represents the defending party's decision-making process with the goal of minimizing defense costs and maximizing defense effectiveness.

[0026] A multi-objective evolutionary algorithm is used to search the solution space of the candidate defense strategies to identify the optimal set of strategies that approximate the Pareto front in multiple objectives such as attack success rate, defense cost, and business availability.

[0027] Select the final strategy from the set of optimal strategies and convert it into a standardized operation plan that includes detection rule configuration, isolation point instructions, response thresholds and linkage processes.

[0028] In one embodiment, the step of collecting execution feedback data of the defense strategy plan in the production environment and dynamically adjusting the multi-layer knowledge graph and the inference rule set based on the execution feedback data includes:

[0029] Continuously monitor network traffic, security event logs, and system response status after the deployment of the defense strategy plan; collect attack detection results, strategy blocking effects, and business impact indicators, and use them as execution feedback data.

[0030] Using reinforcement learning algorithms, the association weights between nodes in the multi-layer knowledge graph, the rule triggering conditions in the inference rule set, and the policy cost function parameters are iteratively optimized and updated based on the execution feedback data.

[0031] Secondly, this application also provides an automated attack and defense strategy generation device based on knowledge graphs, comprising:

[0032] The knowledge graph construction module is used to build a multi-layered knowledge graph that integrates cybersecurity knowledge.

[0033] The graph reasoning and deduction module is used to deduce attack paths based on a preset set of reasoning rules and the multi-layer knowledge graph, generate candidate defense strategies, and calculate the concealment cost, detection hit probability, and business impact factor of the attack path for multi-objective optimization.

[0034] The game optimization module is used to construct a two-layer game model between the attacker and the defender, and to apply a multi-objective optimization algorithm to search and optimize the candidate defense strategies, generating a defense strategy plan containing operation instructions.

[0035] The verification and deployment module is used to verify the effectiveness of the defense strategy plan through a simulation verification environment, and to deploy the verified defense strategy plan to the production environment.

[0036] The closed-loop optimization module is used to collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and the inference rule set based on the execution feedback data.

[0037] Thirdly, this application also provides a computer device, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0038] Construct a multi-layered knowledge graph that integrates cybersecurity knowledge;

[0039] Based on the preset set of reasoning rules and the multi-layer knowledge graph, the attack path is deduced through the graph reasoning engine, candidate defense strategies are generated, and the concealment cost, detection hit probability and business impact factor of the attack path are calculated for multi-objective optimization.

[0040] A two-layer game model of attacker and defender is constructed, and a multi-objective optimization algorithm is applied to search and optimize the candidate defense strategies to generate a defense strategy plan containing operation instructions.

[0041] The effectiveness of the defense strategy plan is verified through a simulation verification environment, and the verified defense strategy plan is deployed to the production environment.

[0042] Collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and the inference rule set based on the execution feedback data.

[0043] Fourthly, this application also provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, performs the following steps:

[0044] Construct a multi-layered knowledge graph that integrates cybersecurity knowledge;

[0045] Based on the preset set of reasoning rules and the multi-layer knowledge graph, the attack path is deduced through the graph reasoning engine, candidate defense strategies are generated, and the concealment cost, detection hit probability and business impact factor of the attack path are calculated for multi-objective optimization.

[0046] A two-layer game model of attacker and defender is constructed, and a multi-objective optimization algorithm is applied to search and optimize the candidate defense strategies to generate a defense strategy plan containing operation instructions.

[0047] The effectiveness of the defense strategy plan is verified through a simulation verification environment, and the verified defense strategy plan is deployed to the production environment.

[0048] Collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and the inference rule set based on the execution feedback data.

[0049] Fifthly, this application also provides a computer program product, including a computer program that, when executed by a processor, performs the following steps:

[0050] Construct a multi-layered knowledge graph that integrates cybersecurity knowledge;

[0051] Based on the preset set of reasoning rules and the multi-layer knowledge graph, the attack path is deduced through the graph reasoning engine, candidate defense strategies are generated, and the concealment cost, detection hit probability and business impact factor of the attack path are calculated for multi-objective optimization.

[0052] A two-layer game model of attacker and defender is constructed, and a multi-objective optimization algorithm is applied to search and optimize the candidate defense strategies to generate a defense strategy plan containing operation instructions.

[0053] The effectiveness of the defense strategy plan is verified through a simulation verification environment, and the verified defense strategy plan is deployed to the production environment.

[0054] Collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and the inference rule set based on the execution feedback data.

[0055] The aforementioned knowledge graph-based automated attack and defense strategy generation method, device, computer equipment, computer-readable storage medium, and computer program product overcome the limitations of fragmented traditional security knowledge bases by constructing a multi-layered knowledge graph that integrates attack techniques, stages, defense measures, and costs. This achieves unified cross-domain semantic modeling and provides a structured foundation for intelligent reasoning. Based on this graph and rule engine, attack paths are dynamically deduced and candidate defense strategies are generated simultaneously. Real-time optimization based on multiple objectives such as concealment, detection rate, and business impact elevates defense decision-making from static rule matching to proactive prediction and comprehensive balancing. Furthermore, a two-layer attack-defense game model and multi-objective optimization search are introduced, giving strategy generation an adversarial perspective and foresight, outputting precise defense plans that can be directly deployed. After ensuring the strategy's security and reliability through simulation verification, it is automatically orchestrated for execution in the production environment. The knowledge graph and reasoning rules are then fine-tuned in a closed loop based on real-time feedback data, ultimately forming an intelligent defense system with continuous learning and adaptive evolution capabilities. This significantly improves the response speed to new threats, the strategy's targeting, and the overall resilience of the system. Attached Figure Description

[0056] To more clearly illustrate the technical solutions in the embodiments of this application or related technologies, the drawings used in the description of the embodiments of this application or related technologies will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0057] Figure 1 This is an application environment diagram of an automated attack and defense strategy generation method based on knowledge graphs in one embodiment;

[0058] Figure 2 This is a flowchart illustrating an automated attack and defense strategy generation method based on knowledge graphs in one embodiment.

[0059] Figure 3 This is a flowchart illustrating an automated attack and defense strategy generation method based on knowledge graphs in another embodiment.

[0060] Figure 4 This is a structural block diagram of a knowledge graph-based automated attack and defense strategy generation device in one embodiment;

[0061] Figure 5 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0063] It should be noted that the terms "first," "second," etc., used in this application can be used to describe various elements, but these elements are not limited by these terms. These terms are only used to distinguish the first element from the second element. The terms "comprising" and "having," and any variations thereof, used in this application, are intended to cover non-exclusive inclusion. The term "multiple" used in this application refers to two or more. The term "and / or" used in this application refers to one of the embodiments, or any combination of multiple embodiments.

[0064] In one exemplary embodiment, such as Figure 1 As shown, an automated attack and defense strategy generation method based on knowledge graphs is provided, which is then applied to... Figure 1 Taking the server in the example, the explanation includes the following steps S102 to S110. Wherein:

[0065] Step S102: Construct a multi-layered knowledge graph that integrates cybersecurity knowledge.

[0066] Specifically, knowledge in the field of cybersecurity mainly includes: standardized models describing attack behavior chains (such as MITREATT&CK tactics and Kill Chain phases), the detection rules and response measures of the defender, the characteristics of assets and protocols in the network environment, and indicators for quantitatively assessing the cost and business impact of attack and defense actions.

[0067] Constructing a multi-layered knowledge graph enables unified semantic modeling of attack and defense tactics, Kill Chain stages, device protocol features, and detection cost models. Its basic implementation process can be divided into three parts: data structure design, semantic fusion modeling, and evidence reverse binding.

[0068] Step S104: Based on the preset set of reasoning rules and multi-layer knowledge graph, the attack path is deduced through the graph reasoning engine, candidate defense strategies are generated, and the concealment cost, detection hit probability and business impact factor of the attack path are calculated for multi-objective optimization.

[0069] Specifically, the system first invokes a predefined set of inference rules, which describe the dependencies, timing, and other constraints between attack steps. Then, it drives a graph inference engine to perform path searches within a multi-layered knowledge graph network structure, automatically deriving possible attack chains from the initial intrusion point to the final target. Based on this, the system matches and generates corresponding defense measures as candidate defense strategies for each derived attack path. Simultaneously, it invokes a built-in evaluation model to quantitatively calculate the stealth level of the attack path, the probability of it being detected by existing detection methods, and the potential impact on business systems. Finally, it integrates these multi-dimensional quantitative indicators to optimize and rank the candidate strategies, selecting the defense scheme that achieves the best balance between security effectiveness, cost, and business continuity.

[0070] Step S106: Construct a two-layer game model between the attacker and the defender, and apply a multi-objective optimization algorithm to search and optimize candidate defense strategies to generate a defense strategy plan containing operation instructions.

[0071] Specifically, the offensive and defensive confrontation is first formalized into a two-layer game model. The upper layer simulates the attacker choosing the optimal attack path that maximizes its own gains (such as attack success rate and stealth) given a defense strategy. The lower layer simulates the defender choosing the optimal defense measure that minimizes its own losses (such as defense cost and business impact) against the attacker. Within this game framework, the system then applies a multi-objective optimization algorithm (such as an evolutionary algorithm) to intelligently search the solution space composed of numerous candidate defense strategies. This algorithm simultaneously weighs multiple conflicting optimization objectives such as stealth cost, detection probability, business impact, and implementation cost, ultimately selecting the defense strategy that is comprehensively optimal in the game equilibrium sense, and converting it into an actionable plan that includes specific detection rules, isolation instructions, and threshold settings.

[0072] Step S108: Verify the effectiveness of the defense strategy plan through a simulation verification environment, and deploy the verified defense strategy plan to the production environment.

[0073] Specifically, the generated defense strategy plan is imported into a simulation verification platform that mimics a real network environment. Within this platform, known attack chains or simulated attack behaviors are injected to actively execute the plan, testing its effectiveness in detecting, blocking, or mitigating attacks. Simultaneously, the potential impact of strategy execution on the availability, performance, and stability of business systems in the simulation environment is evaluated. The simulation process can be divided into the following key steps:

[0074] Attack simulation: Using attacker models and known attack chains, this process simulates attack paths that may occur in a real-world environment. By simulating different attack tactics, it verifies the effectiveness of defense strategies.

[0075] Defense strategy execution: Implement defense measures based on the Playbook generated by the strategy, and monitor the response effect of the defense system;

[0076] Regression testing: Compare the system state before and after the strategy is implemented to evaluate the impact of the defense strategy on system performance, business operations, and resource consumption.

[0077] After completing a series of rigorous regression tests and A / B comparison verifications, the system only pushes those policy plans that have been proven effective and have controllable negative impacts in the simulation environment to the security devices and systems of the actual production network for activation and application through automated orchestration tools and security protocols. This ensures the reliability of defense actions in the production environment and avoids business risks caused by inappropriate policies.

[0078] Validated policies will be automatically orchestrated and deployed to the SOAR platform in the production environment. The specific process is as follows: Automated orchestration tools interface the generated defense policies with the existing SOAR platform, ensuring smooth execution in the real-world environment. During orchestration, defense measures such as detection rules, isolation locations, and threshold settings are translated into executable steps. The policies are pushed to various security devices and monitoring systems in the production environment, automatically configuring and enabling the defense measures. The deployment process uses automated tools to monitor policy execution and ensure accuracy. Automated orchestration and deployment significantly improve the response speed of the defense system, ensuring policies take effect in the shortest possible time while reducing the need for manual intervention.

[0079] Step S110: Collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and inference rule set based on the execution feedback data.

[0080] Specifically, after the defense strategy plan is deployed to the production environment, multi-dimensional feedback data generated during the actual execution of the strategy is continuously collected by real-time monitoring of network traffic, security device logs, terminal behavior, and business indicators. This includes whether the attack was successfully blocked, whether there were false positives or false negatives in the detection rules, and the specific impact of strategy execution on business response time or resource consumption. Subsequently, using this feedback data from the real environment, the association weights between nodes in the multi-layer knowledge graph are dynamically adjusted, the trigger conditions and confidence thresholds in the inference rule set are updated, and the parameters in the cost model are optimized through reinforcement learning, weighted regression, or statistical analysis algorithms. This enables the entire knowledge inference and strategy generation system to continuously self-correct and evolve based on actual protection effects and operational experience, forming an intelligent security operation closed loop with adaptive capabilities.

[0081] The aforementioned knowledge graph-based automated attack and defense strategy generation method breaks through the limitations of traditional fragmented security knowledge bases by constructing a multi-layered knowledge graph that integrates attack techniques, stages, defense measures, and costs. This achieves cross-domain semantic unified modeling and provides a structured foundation for intelligent reasoning. Based on this graph and rule engine, attack paths are dynamically deduced and candidate defense strategies are generated simultaneously. Real-time optimization considering multiple objectives such as concealment, detection rate, and business impact elevates defense decision-making from static rule matching to proactive prediction and comprehensive balancing. Furthermore, a two-layer attack-defense game model and multi-objective optimization search are introduced, giving strategy generation an adversarial perspective and foresight, outputting precise defense plans that can be directly deployed. After ensuring the strategy's security and reliability through simulation verification, it is automatically orchestrated for execution in the production environment. The knowledge graph and reasoning rules are then fine-tuned in a closed loop based on real-time feedback data, ultimately forming an intelligent defense system with continuous learning and adaptive evolution capabilities. This significantly improves the response speed to new threats, the strategy's targeting, and the overall resilience of the system.

[0082] In one exemplary embodiment, such as Figure 2 As shown, a multi-layered knowledge graph integrating cybersecurity knowledge is constructed, including:

[0083] Step S202: Construct a heterogeneous graph model. The heterogeneous graph model includes multiple node types, including attack technology nodes, attack stage nodes, device feature nodes, defense measure nodes, and cost model nodes, as well as a set of edges representing the dependencies, connections, and mapping relationships between nodes.

[0084] Step S204: Cross-map the preset attack technology framework with the attack stage model, and calculate the semantic association strength between the attack technology nodes and the attack stage nodes.

[0085] Step S206: Receive security events and monitoring evidence input from external systems, and bind the security events and monitoring evidence to the corresponding nodes in the heterogeneous graph model to form an evidence chain;

[0086] Step S208: Generate a multi-layer knowledge graph based on the heterogeneous graph model, semantic association strength, and evidence chain.

[0087] Specifically, firstly, at the data structure level, the system adopts a heterogeneous graph modeling method to define the node types of the heterogeneous graph model. , representing Technique (attack technique node), KillChain stage (attack stage node), Device characteristics (device feature node), Mitigation protection measures (defense measure node), and Cost model (cost model node), respectively. Edge relationship set This is used to represent the dependencies, connections, and mapping relationships between nodes. Each node Having attribute vectors:

[0088] ;

[0089] Where ai is the attribute vector of each node vi, which includes preconditions, required permissions, observable features, and potential effects, and is used to characterize the logical and physical features of tactics and techniques. Indicates a precondition. For the required permissions. As observable features, As a potential effect, it is used to characterize the logical and physical features of tactics and techniques.

[0090] Secondly, in the semantic fusion stage, semantic expansion is achieved through cross-mapping between the pre-defined attack technology framework and the attack stage model, and a relational graph encoding function is introduced:

[0091] ;

[0092] in, It refers to the graph encoding function that represents the relationship between the attack technique framework and the attack phase model, used to quantify the strength of their semantic association. For semantic similarity; The dependency coefficient; This is a weighting parameter used to quantify the strength of the connection between different tactical phases.

[0093] Finally, at the evidence binding layer, security events from the simulation platform and threat detection system are received, and monitoring evidence is extracted, such as matching confidence levels. Traffic indicators System Response This forms a chain of evidence:

[0094] ;

[0095] Here, Evid refers to the evidence chain, which includes knowledge graph nodes, matching confidence, traffic metrics, and system responses, and is used to bind to knowledge graph nodes; vi refers to nodes in the knowledge graph (such as attack technique nodes), which are the core objects of evidence binding, and are bound to knowledge graph nodes through a reverse mapping function to achieve bidirectional traceability and updating of evidence and tactics.

[0096] Through the above process, a multi-layered knowledge graph with dynamic updatableness, cross-domain semantic association, and verifiable evidence is constructed.

[0097] In this embodiment, a heterogeneous graph model is constructed to uniformly represent heterogeneous elements such as attack techniques, attack stages, and device characteristics as semantically related nodes and edges, thereby achieving the structured integration of multi-source security knowledge. Then, the semantic correlation strength between attack techniques and attack stages is calculated through cross-mapping, so that the originally discrete attack and defense knowledge forms a tactical chain with a logical evolutionary relationship. Furthermore, real-time security events and monitoring evidence are dynamically bound to graph nodes to form a traceable and verifiable evidence chain. The resulting multi-layered knowledge graph integrates a standardized attack and defense semantic system and is associated with specific environmental evidence.

[0098] In an exemplary embodiment, the attack technique framework is the MITRE ATT&CK matrix, and the attack phase model is the Kill Chain model; the pre-defined attack technique framework and the attack phase model are cross-mapped, including:

[0099] Semantically associate the attack technique nodes in the MITRE ATT&CK matrix with the attack stage nodes in the Kill Chain model, and construct an association strength function based on semantic similarity index and logical dependency index.

[0100] The output value of the correlation strength function is used to quantify the connection strength between the attack technique node and the attack phase node.

[0101] Specifically, the industry-standard MITRE ATT&CK matrix is ​​adopted as the attack technique framework, and the Kill Chain model is used as the basis for dividing attack stages. A correlation strength function is designed to semantically associate and quantitatively fuse specific attack technique nodes in MITRE ATT&CK with attack stage nodes in the Kill Chain. The core advantage of this specific framework combination lies in its standardization and authority, ensuring the semantic foundation of the knowledge graph has broad acceptance. Simultaneously, it combines the fine-grained technical coverage of MITRE ATT&CK with the macro-stage logic of the Kill Chain, thus comprehensively describing the evolution of attack behavior.

[0102] In this embodiment, a correlation strength function constructed based on semantic similarity and logical dependency can dynamically quantify the degree of correlation between specific techniques and attack stages. This provides precise weighting criteria for subsequent graph reasoning, enabling path deduction to not only determine connectivity but also assess typicality, significantly improving the accuracy and practicality of the reasoning. Furthermore, due to the adoption of a public and structured standard framework, any attack path or defense strategy generated based on it can be traced back to the specific MITRE ATT&CK technique and Kill Chain stage for explanation, thereby greatly enhancing the understandability, auditability, and transparency of the system output and the entire decision-making process.

[0103] In one exemplary embodiment, such as Figure 3 As shown, based on a pre-defined set of reasoning rules and a multi-layered knowledge graph, the attack path is deduced through a graph reasoning engine, candidate defense strategies are generated, and the concealment cost, detection hit probability, and business impact factor of the attack path are calculated for multi-objective optimization, including:

[0104] Step S302: Input the set of reasoning rules and the multi-layer knowledge graph into the graph reasoning engine, and use the graph search algorithm to identify the reachable path from the initial intrusion point to the attack target, as the result of the attack path deduction.

[0105] Step S304: Based on the defense measure nodes and cost model nodes bound in the multi-layer knowledge graph, generate at least one candidate defense strategy corresponding to the attack path.

[0106] Step S306: Call the predefined cost function to calculate the concealment cost value, the expected detection hit probability value, and the business impact assessment value for each candidate defense strategy, and perform weighted summation to obtain a multi-objective optimization score.

[0107] Specifically, the inference rule set and multi-layered knowledge graph are integrated into the graph inference engine, and graph search algorithms are used to deduce attack paths. The key to the inference process lies in calculating the reachable path from the initial intrusion point to the attack target using nodes and edges in the graph, and simultaneously considering multiple optimization factors such as concealment, step size cost, detection hit probability, and business impact when selecting paths. The inference process is implemented through the following function:

[0108] ;

[0109] in: This refers to the inference scoring function in the graph reasoning engine, which is used to calculate the suitability score between attack techniques Ti and defense measures Mj, providing a basis for selecting the optimal strategy path; The similarity between the attack technique and the Kill Chain phase; The degree of dependence between attack and defense measures; The cost function of the strategy (including operating costs, time costs, etc.); The weighting coefficients of each factor determine the priority of the objective optimization.

[0110] The inference function generates a path score for each possible strategy and selects at least one candidate defense strategy corresponding to the attack path through a heuristic graph search algorithm, ensuring that while maintaining stealth and effectiveness, business interruption and execution costs are minimized.

[0111] To ensure the auditability and interpretability of the reasoning results, the system introduces a traceability design for the reasoning chain. Each strategy derivation must output a complete rule-hitting chain, ensuring transparency in the decision-making process and facilitating subsequent auditing and verification. Each step in the reasoning process needs to return the relevant rules, constraints, and corresponding matching evidence. The system implements this through the following chain recording function:

[0112] ;

[0113] in, The inference chain recording function is used to record the complete process of strategy deduction, ensuring auditability and interpretability; This refers to instances of body attack techniques (such as certain types of vulnerability exploitation, lateral movement methods); This refers to instances of corresponding defense measures (such as isolation operations or activation of detection rules). This refers to the dependency rules between attack and defense (belonging to a set of rules). ); This refers to the system's pre-defined set of rules (including reachability, dependency, and timing constraints). This refers to parameters in the reasoning process (such as weight coefficients, constraint thresholds, etc.).

[0114] This function records specific information about each rule hit and provides a detailed chain of evidence and decision-making basis for each strategy path, thereby improving the interpretability of strategy generation. All deduction steps are recorded one by one, ensuring that users can understand how the system makes specific decisions, and also providing a basis for strategy auditing and compliance verification.

[0115] Next, for each candidate defense strategy to be evaluated, three predefined mathematical models are invoked for calculation: the first cost function quantifies its concealment cost based on characteristics such as the exposure risk and residual traces of the attack path after the strategy is implemented; the second function combines the current detection rule coverage and historical data to predict the detection hit probability of the strategy in the actual environment; and the third function analyzes the system downtime, data flow interruption, or resource consumption that may result from the strategy execution, assessing its business impact. Subsequently, the system performs a weighted summation of the quantification results of these three dimensions according to preset weight coefficients, ultimately generating a unified multi-objective optimization score. This score comprehensively reflects the balance between the strategy's security effectiveness, implementation concealment, and business friendliness, providing accurate data basis for subsequent strategy ranking and optimal selection.

[0116] In this embodiment, a predefined cost function provides a multi-dimensional quantitative evaluation for each candidate strategy, transforming the previously difficult-to-balance stealth, detection rate, and business impact into a calculable unified indicator. This enables precise quantitative comparison and scientific ranking of defense strategies. Furthermore, by generating a multi-objective optimization score through weighted synthesis, an automated trade-off and optimal balance can be achieved among multiple objectives such as security effectiveness, countermeasure stealth, and business continuity. Ultimately, this ensures that the selected defense strategy not only possesses technical effectiveness but also meets the comprehensive cost-effectiveness and risk management requirements of actual operations.

[0117] In an exemplary embodiment, a two-layer game model between the attacker and the defender is constructed, and a multi-objective optimization algorithm is applied to search for and optimize candidate defense strategies, including:

[0118] A two-layer game model is constructed, with the upper layer representing the attacker's decision-making process aimed at minimizing attack costs and maximizing attack benefits, and the lower layer representing the defender's decision-making process aimed at minimizing defense costs and maximizing defense effectiveness.

[0119] A multi-objective evolutionary algorithm is used to search the solution space of candidate defense strategies and identify the optimal set of strategies that approximate the Pareto front in multiple objectives such as attack success rate, defense cost, and business availability.

[0120] Select the final strategy from the optimal strategy set and convert it into a standardized operation plan that includes detection rule configuration, isolation point instructions, response thresholds and linkage processes.

[0121] Specifically, a two-layer game model is first constructed to model the decision-making processes of the attacker and defender as an interactive game. In this model, the attacker aims to maximize attack gains by minimizing attack costs, while the defender attempts to minimize defense costs and maximize defense effectiveness. Each layer of the game can be represented as:

[0122] ;

[0123] ;

[0124] in, : That is, the attacker's objective function, which refers to the attacker's decision variables. Under constraints, maximize attack gains (based on attack success rate) and attack costs. The difference between them is the value of achieving the attack objective at the lowest cost; This represents the attacker's decision variables.

[0125] : That is, the defensive objective function, which refers to the defensive side's decision variables Under constraints, the goal is to minimize the difference between defense cost (Costdefense) and defense benefit (Gaindefense, based on the effectiveness of the defense strategy), that is, to prevent the attack from succeeding at the lowest cost. This represents the decision variables for the defending side.

[0126] and These represent the payoff functions for the attacker and defender, respectively, and measure the cost of the defense strategy based on the attack success rate and the impact of the defense strategy.

[0127] The candidate defense strategies of the attacker and defender are calculated through the game process, and the feedback path of the candidate defense strategies is generated based on the game results.

[0128] Next, multi-objective optimization needs to be performed within the game theory framework to balance multiple objectives such as attack success rate, stealth, step cost, detection hit probability, and defense cost. To this end, a heuristic search algorithm and a multi-objective evolutionary algorithm are employed, and the optimization objective of the strategy is calculated using the following formula:

[0129] ;

[0130] in: This refers to a multi-objective optimization function used to comprehensively compute attack techniques. With defensive measures The optimized score of the combination is used to balance the cost of concealment, detection hit rate and business impact, providing a quantitative basis for the final strategy selection; This indicates the cost of concealment in an attack path; The detection hit rate of defensive measures; Indicates the potential impact of the strategy on business (such as system downtime, data loss, etc.); parameters This is used to adjust the weights of different objectives during the optimization process. During optimization, multiple Paret optimal solutions are generated using a multi-objective evolutionary algorithm (such as NSGA-II) to ensure that, given the constraints of cost and reward, the optimal policy set can be output.

[0131] After completing the game model and optimization algorithm, the final attack and defense strategies (i.e., the Playbook) are automatically generated. These strategies include detection rule configurations, isolation point instructions, response thresholds, and linkage processes, and the following evaluation is provided for each strategy:

[0132] ;

[0133] in, This refers to the strategy effectiveness evaluation results, which combine attack techniques. Defense measures Multi-objective optimization function The results of a comprehensive assessment of the effectiveness of offensive and defensive strategies and the recovery time range, as well as the impact on business operations.

[0134] in, The function combines attack and defense strategies with a business impact assessment model to predict the effectiveness and recovery time range of each strategy. This process not only outputs a detailed playbook but also incorporates predictions of attack and defense effectiveness, ensuring that the actual impact of each strategy on the system can be accurately measured when it is implemented.

[0135] In this embodiment, a two-layer game model is constructed to minimize the attacker's cost and the defender's cost, formalizing the attack-defense confrontation as a dynamic optimization problem. This ensures that the generated defense strategy possesses both adversarial targeting and global balance. Furthermore, a multi-objective evolutionary algorithm is applied to intelligently search the strategy solution space, simultaneously optimizing mutually constraining objectives such as attack success rate, defense cost, and business availability. The final output is a comprehensive optimal strategy set approaching the Pareto front. The resulting standardized operational plan not only includes specific detection rules and response instructions but also reflects the optimal balance between cost, effectiveness, and business continuity in a real adversarial environment. This upgrades the defense system from a single-point response to a dynamic protection system with game theory intelligence.

[0136] In an exemplary embodiment, execution feedback data of defense strategy plans in the production environment is collected, and the multi-layer knowledge graph and inference rule set are dynamically adjusted based on the execution feedback data, including:

[0137] Continuously monitor network traffic, security event logs, and system response status after the deployment of defense strategies and contingency plans; collect attack detection results, policy blocking effectiveness, and business impact indicators; and use these as execution feedback data.

[0138] By using reinforcement learning algorithms, the association weights between nodes in the multi-layer knowledge graph, the rule triggering conditions in the inference rule set, and the policy cost function parameters are iteratively optimized and updated based on the execution feedback data.

[0139] Specifically, once the strategy is deployed to the production environment, it enters a continuous operation phase, utilizing a feedback loop mechanism to continuously optimize and adjust the defense strategy. This process includes: collecting real-time data from the production environment by continuously monitoring key nodes such as network traffic, endpoint security status, and intrusion detection systems. The monitoring system will detect potential attack patterns, abnormal behaviors, or vulnerabilities in the defense strategy in real time; based on monitoring data and attack logs, the system will periodically evaluate the effectiveness of the defense strategy and automatically adjust the strategy when necessary; the adjustment process includes updating detection rules, modifying isolation policies, and adjusting defense measures.

[0140] The collected feedback data is used to retrain and optimize the knowledge graph, rule weights, parameter thresholds, etc.; through methods such as reinforcement learning, it can automatically learn new attack patterns and adjust defense strategies. Through this continuous feedback and learning process, the system can continuously improve the efficiency and adaptability of its defense strategies as the environment changes and new attacks emerge, forming a self-updating and optimizing closed loop.

[0141] In this embodiment, the above process achieves a complete lifecycle from policy verification to automatic deployment, and then to continuous operation and adaptive optimization. This closed-loop mechanism not only ensures that the generated policies are effective in the real environment, but also guarantees that the system can flexibly adjust defense measures according to changes in the attack environment and different business needs. Ultimately, through continuous policy optimization and feedback adjustments, the system forms an adaptive, intelligent, and efficient network security defense system capable of coping with ever-changing network attack threats.

[0142] It should be understood that although the steps in the flowcharts of the embodiments described above are shown sequentially according to the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the embodiments described above may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but can be executed at different times. The execution order of these steps or stages is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the steps or stages of other steps.

[0143] Based on the same inventive concept, this application also provides a knowledge graph-based automated attack and defense strategy generation device for implementing the aforementioned knowledge graph-based automated attack and defense strategy generation method. The solution provided by this device is similar to the implementation described in the above method. Therefore, the specific limitations in one or more knowledge graph-based automated attack and defense strategy generation device embodiments provided below can be found in the limitations of the knowledge graph-based automated attack and defense strategy generation method described above, and will not be repeated here.

[0144] In one exemplary embodiment, such as Figure 4 As shown, an automated attack and defense strategy generation device based on knowledge graphs is provided, including:

[0145] Knowledge graph construction module 402 is used to construct a multi-layered knowledge graph that integrates cybersecurity knowledge;

[0146] The graph reasoning module 404 is used to infer attack paths based on a preset set of reasoning rules and a multi-layer knowledge graph, generate candidate defense strategies, and calculate the concealment cost, detection hit probability, and business impact factor of the attack path for multi-objective optimization.

[0147] The game optimization module 406 is used to construct a two-layer game model between the attacker and the defender, and to apply a multi-objective optimization algorithm to search and optimize candidate defense strategies, generating a defense strategy plan containing operation instructions.

[0148] The verification and deployment module 408 is used to verify the effectiveness of the defense strategy plan through a simulation verification environment, and to deploy the verified defense strategy plan to the production environment.

[0149] The closed-loop optimization module 410 is used to collect execution feedback data of defense strategy plans in the production environment and dynamically adjust the multi-layer knowledge graph and inference rule set based on the execution feedback data.

[0150] In an exemplary embodiment, the knowledge graph construction module 402 is specifically used to construct a heterogeneous graph model, which includes multiple node types such as attack technology nodes, attack stage nodes, device feature nodes, defense measure nodes, and cost model nodes, as well as a set of edges representing the dependencies, connections, and mapping relationships between nodes; cross-mapping a preset attack technology framework with the attack stage model, and calculating the semantic association strength between attack technology nodes and attack stage nodes; receiving security events and monitoring evidence input from external systems, binding the security events and monitoring evidence with corresponding nodes in the heterogeneous graph model to form an evidence chain; and generating a multi-layer knowledge graph based on the heterogeneous graph model, semantic association strength, and evidence chain.

[0151] In an exemplary embodiment, the attack technique framework is the MITRE ATT&CK matrix, and the attack phase model is the Kill Chain model. The knowledge graph construction module 402 is further used to semantically associate the attack technique nodes in the MITRE ATT&CK matrix with the attack phase nodes in the Kill Chain model, and to construct an association strength function based on semantic similarity index and logical dependency index. The output value of the association strength function is used to quantify the connection strength between the attack technique nodes and the attack phase nodes.

[0152] In an exemplary embodiment, the graph reasoning module 404 is specifically used to input the set of reasoning rules and the multi-layer knowledge graph into the graph reasoning engine, use a graph search algorithm to identify the reachable path from the initial intrusion point to the attack target, and use this path as the reasoning result of the attack path; generate at least one candidate defense strategy corresponding to the attack path based on the defense measure nodes and cost model nodes bound in the multi-layer knowledge graph; call a predefined cost function to calculate the concealment cost value, the expected detection hit probability value, and the business impact assessment value for each candidate defense strategy, and perform weighted summation to obtain a multi-objective optimization score.

[0153] In an exemplary embodiment, the game optimization module 406 is specifically used to construct a two-layer game model between the attacker and the defender. The upper-layer model of the two-layer game model represents the attacker's decision-making process with the goal of minimizing attack costs and maximizing attack benefits, while the lower-layer model represents the defender's decision-making process with the goal of minimizing defense costs and maximizing defense effectiveness. A multi-objective evolutionary algorithm is used to search in the solution space of candidate defense strategies to identify the optimal set of strategies that approximate the Pareto front in multiple objectives such as attack success rate, defense cost, and business availability. The final strategy is selected from the optimal set of strategies and converted into a standardized operation plan that includes detection rule configuration, isolation point instructions, response thresholds, and linkage processes.

[0154] In an exemplary embodiment, the closed-loop optimization module 410 is specifically used to continuously monitor network traffic, security event logs, and system response status after the deployment of the defense strategy plan, collect attack detection results, policy blocking effects, and business impact indicators, and use them as execution feedback data; and use reinforcement learning algorithms to iteratively optimize and update the association weights between nodes in the multi-layer knowledge graph, the rule triggering conditions in the inference rule set, and the policy cost function parameters based on the execution feedback data.

[0155] The modules in the aforementioned knowledge graph-based automated attack and defense strategy generation device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the computer device's memory as software, so that the processor can call and execute the corresponding operations of each module.

[0156] In one exemplary embodiment, a computer device is provided, which may be a server, and its internal structure diagram may be as follows: Figure 5As shown, this computer device includes a processor, memory, input / output (I / O) interfaces, and a communication interface. The processor, memory, and I / O interfaces are connected via a system bus, and the communication interface is also connected to the system bus via the I / O interfaces. The processor provides computational and control capabilities. The memory includes non-volatile storage media and internal memory. The non-volatile storage media stores the operating system, computer programs, and a database. The internal memory provides the environment for the operating system and computer programs in the non-volatile storage media to run. The database stores execution feedback data for defense strategy plans. The I / O interfaces are used for information exchange between the processor and external devices. The communication interface is used for communication with external terminals via a network connection. When the computer program is executed by the processor, it implements an automated attack and defense strategy generation method based on a knowledge graph.

[0157] Those skilled in the art will understand that Figure 5 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0158] In one exemplary embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the steps of the method described above.

[0159] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the steps of the above-described method.

[0160] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps of the method described above.

[0161] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data must comply with relevant regulations.

[0162] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the above methods. Any references to memory, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. By way of illustration and not limitation, RAM can take many forms, such as Static Random Access Memory (SRAM) or Dynamic Random Access Memory (DRAM). The databases involved in the embodiments provided in this application may include at least one type of relational database and non-relational database. Non-relational databases may include, but are not limited to, blockchain-based distributed databases. The processors involved in the embodiments provided in this application may be general-purpose processors, central processing units, graphics processing units, digital signal processors, programmable logic devices, quantum computing-based data processing logic devices, artificial intelligence (AI) processors, etc., and are not limited to these.

[0163] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0164] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A method for generating automated attack and defense strategies based on knowledge graphs, characterized in that, The method includes: Construct a multi-layered knowledge graph that integrates cybersecurity knowledge; Based on the preset set of reasoning rules and the multi-layer knowledge graph, the attack path is deduced through the graph reasoning engine, candidate defense strategies are generated, and the concealment cost, detection hit probability and business impact factor of the attack path are calculated for multi-objective optimization. A two-layer game model of attacker and defender is constructed, and a multi-objective optimization algorithm is applied to search and optimize the candidate defense strategies to generate a defense strategy plan containing operation instructions. The effectiveness of the defense strategy plan is verified through a simulation verification environment, and the verified defense strategy plan is deployed to the production environment. Collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and the inference rule set based on the execution feedback data.

2. The method according to claim 1, characterized in that, The construction of a multi-layered knowledge graph integrating cybersecurity knowledge includes: Construct a heterogeneous graph model, which includes multiple node types such as attack technology nodes, attack stage nodes, device feature nodes, defense measure nodes and cost model nodes, as well as a set of edges representing the dependencies, connections and mapping relationships between nodes. Cross-mapping is performed between the pre-defined attack technology framework and the attack phase model to calculate the semantic association strength between attack technology nodes and attack phase nodes. Receive security events and monitoring evidence input from external systems, and bind the security events and monitoring evidence to the corresponding nodes in the heterogeneous graph model to form an evidence chain; The multi-layer knowledge graph is generated based on the heterogeneous graph model, the semantic association strength, and the evidence chain.

3. The method according to claim 2, characterized in that, The attack technique framework is the MITRE ATT&CK matrix, and the attack phase model is the Kill Chain model; the cross-mapping of the preset attack technique framework and the attack phase model includes: Semantically associate the attack technique nodes in the MITRE ATT&CK matrix with the attack stage nodes in the Kill Chain model, and construct an association strength function based on semantic similarity index and logical dependency index. The output value of the correlation strength function is used to quantify the connection strength between the attack technique node and the attack phase node.

4. The method according to claim 1, characterized in that, The system, based on a preset set of reasoning rules and the multi-layered knowledge graph, uses a graph reasoning engine to deduce attack paths, generate candidate defense strategies, and calculates the concealment cost, detection hit probability, and business impact factors of the attack paths for multi-objective optimization, including: The set of reasoning rules and the multi-layer knowledge graph are input into the graph reasoning engine, and the graph search algorithm is used to identify the reachable path from the initial intrusion point to the attack target, which is used as the deduction result of the attack path. Based on the defense measure nodes and cost model nodes bound in the multi-layer knowledge graph, at least one candidate defense strategy corresponding to the attack path is generated. The predefined cost function is invoked to calculate the concealment cost, expected detection hit probability, and business impact assessment value for each candidate defense strategy, and then a weighted sum is performed to obtain a multi-objective optimization score.

5. The method according to claim 1, characterized in that, The construction of a two-layer game model between the attacker and the defender, and the application of a multi-objective optimization algorithm to search for and optimize the candidate defense strategies, includes: A two-layer game model is constructed, in which the upper layer model represents the attacking party's decision-making process with the goal of minimizing attack costs and maximizing attack benefits, and the lower layer model represents the defending party's decision-making process with the goal of minimizing defense costs and maximizing defense effectiveness. A multi-objective evolutionary algorithm is used to search the solution space of the candidate defense strategies to identify the optimal set of strategies that approximate the Pareto front in multiple objectives such as attack success rate, defense cost, and business availability. Select the final strategy from the set of optimal strategies and convert it into a standardized operation plan that includes detection rule configuration, isolation point instructions, response thresholds and linkage processes.

6. The method according to claim 1, characterized in that, The process of collecting execution feedback data of the defense strategy plan in the production environment and dynamically adjusting the multi-layer knowledge graph and the inference rule set based on the execution feedback data includes: Continuously monitor network traffic, security event logs, and system response status after the deployment of the defense strategy plan; collect attack detection results, strategy blocking effects, and business impact indicators, and use them as execution feedback data. Using reinforcement learning algorithms, the association weights between nodes in the multi-layer knowledge graph, the rule triggering conditions in the inference rule set, and the policy cost function parameters are iteratively optimized and updated based on the execution feedback data.

7. An automated attack and defense strategy generation device based on knowledge graphs, characterized in that, The device includes: The knowledge graph construction module is used to build a multi-layered knowledge graph that integrates cybersecurity knowledge. The graph reasoning and deduction module is used to deduce attack paths based on a preset set of reasoning rules and the multi-layer knowledge graph, generate candidate defense strategies, and calculate the concealment cost, detection hit probability, and business impact factor of the attack path for multi-objective optimization. The game optimization module is used to construct a two-layer game model between the attacker and the defender, and to apply a multi-objective optimization algorithm to search and optimize the candidate defense strategies, generating a defense strategy plan containing operation instructions. The verification and deployment module is used to verify the effectiveness of the defense strategy plan through a simulation verification environment, and to deploy the verified defense strategy plan to the production environment. The closed-loop optimization module is used to collect execution feedback data of the defense strategy plan in the production environment, and dynamically adjust the multi-layer knowledge graph and the inference rule set based on the execution feedback data.

8. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 6.

Images