Digital twin system

Abstract

A digital twin system includes: an attack trajectory prediction and analysis module for receiving intelligence data from an intelligence database and local area network topology information and cybersecurity monitoring alarm information from an enterprise network, and providing simulated attack trajectories of target intelligence and the probability of attack for each node in the enterprise network based on the intelligence data, local area network topology information, and cybersecurity monitoring alarm information; a countermeasure suggestion module for providing corresponding handling countermeasures for target intelligence based on the intelligence data, local area network topology information, and cybersecurity monitoring alarm information; and an attack potential display module for integrating and displaying local area network topology information, simulated attack trajectories, the probability of attack for each node, and corresponding handling countermeasures for the enterprise network.

Description

Technical Field

[0001] This invention relates to an information management technology, and more particularly to a digital twin system applied to information security. Prior Technology

[0002] With the continuous advancement of digital technology, incidents such as cyberattacks, data breaches, and hacking are emerging one after another. Information security has become an issue that cannot be ignored, especially for enterprises with high security needs such as trade secrets. How to provide real-time intelligence data, simulate attack trajectories, and estimate the probability of being attacked to ensure the security of enterprises is an important issue that this technology field needs to address. Summary of the Invention

[0003] This invention provides a digital twin system that can provide real-time intelligence data, simulated attack trajectories, and attack probabilities to ensure enterprise security, while also providing suggested countermeasures.

[0004] To achieve one, some, or all of the above objectives, or other objectives, an embodiment of the present invention provides a digital twin system, comprising: an attack trajectory prediction and analysis module, used to receive intelligence data from an intelligence database and local area network topology information and cybersecurity monitoring alarm information from an enterprise network, and to provide simulated attack trajectories of target intelligence and the probability of attack for each node in the enterprise network based on the intelligence data, local area network topology information, and cybersecurity monitoring alarm information; a countermeasure suggestion module, coupled to the attack trajectory prediction and analysis module, used to provide corresponding handling countermeasures for target intelligence based on the intelligence data, local area network topology information, and cybersecurity monitoring alarm information; and an attack potential display module, coupled to the attack trajectory prediction and analysis module and the countermeasure suggestion module, used to integrate and display the local area network topology information, simulated attack trajectories, the probability of attack for each node, and corresponding handling countermeasures of the enterprise network.

[0005] In one embodiment of the present invention, the attack trajectory prediction and analysis module includes: an intrusion threat indicator identification unit, used to determine multiple types of intrusion threat indicators of the target intelligence; a network node anomaly analysis unit, coupled to the intrusion threat indicator identification unit, used to generate correlations between multiple types of intrusion threat indicators and detect abnormal nodes in the enterprise network; and an attack trajectory prediction unit, coupled to the network node anomaly analysis unit, used to generate simulated attack trajectories and the probability of each node being attacked based on intelligence data, correlations between multiple types, and regional network topology information.

[0006] In one embodiment of the present invention, the above-mentioned multiple types include attacker (A), vulnerability (V), device (D), platform (P), malicious file (F), and attack type (T).

[0007] In one embodiment of the present invention, the associations among the above-mentioned multiple types include attacker attacking a vulnerability, attacker intruding into a device, two attackers cooperating, a vulnerability affecting a device, the attack type of the vulnerability, the vulnerability containing malicious files, malicious files targeting a device, the vulnerability including other vulnerabilities, and the platform type to which the device belongs.

[0008] In one embodiment of the present invention, the aforementioned intrusion threat indicators include domain name, IP address, and file hash value.

[0009] In one embodiment of the present invention, the aforementioned intrusion threat indicator identification unit marks the type of intrusion threat indicator for each piece of data in the target intelligence using natural language annotation.

[0010] In one embodiment of the present invention, the above-mentioned natural language annotation method is the BIO sequence annotation method.

[0011] In one embodiment of the present invention, the network node anomaly analysis unit described above extracts the associations between multiple types and generates a heterogeneous association graph through a dependency parsing method.

[0012] The digital twin system of the present invention employs an intrusion threat indicator identification unit, a network node anomaly analysis unit, and an attack trajectory prediction unit, thereby providing real-time intelligence data, simulated attack trajectories, and attack probability to ensure enterprise security, while also providing suggested countermeasures.

[0013] To make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments are described below in conjunction with the accompanying drawings for detailed explanation. Simple Explanation of the Diagram

[0014] Figure 1 is a schematic diagram of a digital twin system provided in an embodiment of the present invention; Figure 2 is a schematic diagram of a heterogeneous correlation diagram provided in an embodiment of the present invention. Implementation

[0015] This invention is described in particular by way of the following examples, which are merely illustrative. Various modifications and refinements can be made by those skilled in the art without departing from the spirit and scope of this disclosure. Therefore, the scope of protection of this disclosure shall be determined by the appended claims. Throughout this specification and claims, unless explicitly stated otherwise, the words “a” and “the” include statements containing “a or at least one” element or component. Furthermore, as used herein, the singular article also includes statements of a plurality of elements or components unless clearly excluded from the specific context. Moreover, when applied in this description and throughout the claims below, unless explicitly stated otherwise, “in which” may include both “in which” and “on which”. The terms used throughout this specification and claims, unless otherwise specified, generally have their ordinary meaning in the context of this art, the disclosure, and the specific content. Certain terms used to describe the invention will be discussed below or elsewhere in this specification to provide additional guidance to practitioners in describing the invention. Examples throughout this specification, including examples of any terms discussed herein, are merely illustrative and do not limit the scope or meaning of the invention or any of the illustrative terms. Similarly, the invention is not limited to the various embodiments set forth in this specification.

[0016] Furthermore, the use of the terms "coupled" or "connected" here includes any direct and indirect electrical connection. For example, if the text describes a first device being electrically coupled to a second device, it means that the first device can be directly connected to the second device, or indirectly connected to the second device through other devices or connection means. Additionally, in descriptions concerning the transmission or provision of electrical signals, those skilled in the art will understand that attenuation or other non-ideal variations may occur during the transmission of electrical signals. However, unless otherwise specified, the source and receiver of the transmitted or provided electrical signal should be considered as the same signal. For example, if an electrical signal S is transmitted (or provided) from terminal A of an electronic circuit to terminal B of the same electronic circuit, a voltage drop may occur across the source and drain terminals of a transistor switch and / or possible stray capacitances. However, unless the purpose of this design is to intentionally utilize attenuation or other non-ideal variations during transmission (or provision) to achieve certain specific technical effects, the electrical signal S at terminals A and B of the electronic circuit should be considered as the same signal.

[0017] It is understood that terms such as "comprising," "including," "having," "containing," and "involving," as used herein, are open-ended, meaning they include but are not limited to. Furthermore, no embodiment or claim of this invention is required to achieve all the objectives, advantages, or features disclosed herein. In addition, the abstract and headings are merely for assisting in patent document searches and are not intended to limit the scope of this invention.

[0018] Please refer to Figure 1, which is a schematic diagram of a digital twin system provided in an embodiment of the present invention. The digital twin system 1 provided in this embodiment includes an attack trajectory prediction and analysis module 2, a countermeasure suggestion module 3, and an attack potential display module 4. The countermeasure suggestion module 3 is coupled to the attack trajectory prediction and analysis module 2, and the attack potential display module 4 is coupled to both the attack trajectory prediction and analysis module 2 and the countermeasure suggestion module 3. The digital twin system 1 provided in this embodiment can simultaneously display information on the attack potential display module 4 based on hacker or network attack behavior, predict the possible attack routes of hackers, present them visually, and provide suggestions based on the attack method. Through artificial intelligence calculations, including the intrusion threat indicator identification unit 21, the network node anomaly analysis unit 22, and the attack trajectory prediction unit 23 included in the attack trajectory prediction and analysis module 2, based on information such as packets, logs, and alarms collected in the network, the attack potential display module 4 predicts the potential path of a hacker attack and provides suggested countermeasures when a cybersecurity alarm occurs. Furthermore, it can be noted that the digital twin system 1 can be multiple hardware, software, or a combination of hardware and software cloud servers, computers, etc., that execute, compute, and store information and data; the modules included in the digital twin system 1 can be hardware, software, or a combination of hardware and software computers, computers, control circuits, processing circuits, etc., that execute, compute, and store information and data; and the units included in the attack trajectory prediction and analysis module 2 can be hardware, software, or a combination of hardware and software computers, computers, control circuits, processing circuits, etc., that execute, compute, and store information and data.

[0019] The attack trajectory prediction and analysis module 2 provided in this embodiment is used to receive intelligence data from the intelligence database 5 and local area network topology information and cybersecurity monitoring alarm information from the enterprise network 6, and to provide simulated attack trajectories of target intelligence and the probability of attack for each node in the enterprise network 6 based on the intelligence data, local area network topology information and cybersecurity monitoring alarm information. The intelligence data can be collected and stored from different sources through the intelligence database 5.

[0020] In detail, the attack trajectory prediction and analysis module 2 includes an intrusion threat indicator identification unit 21, which is used to determine multiple types of intrusion threat indicators (IOCs) in target intelligence. Specifically, it extracts multiple data points, such as security data, from intelligence data, such as threat intelligence using XML path languages ​​like XPath; it annotates the intrusion threat indicators into multiple data points using natural language annotation methods such as BIO (Begin-Inside-Outside) sequence annotation; it fine-tunes the collected data using Roberta's pre-trained model; and it uses a multi-gram attention mechanism. The mechanism extracts threat features at different granularities from multiple data points in the intelligence data, and modifies and assigns each labeled data point to the corresponding intrusion threat indicator type through an n-gram method, and labels the intrusion threat indicators themselves (such as e1, e2, etc.), thus completing an intrusion threat indicator identification model to determine multiple types of intrusion threat indicators of the target intelligence. The intrusion threat indicators include domain name, IP address, file hash value, and multiple types including attacker (A), vulnerability (V), device (D), platform (P), malicious file (F), and attack type (T).

[0021] The attack trajectory prediction and analysis module 2 includes a network node anomaly analysis unit 22 coupled to an intrusion threat indicator identification unit 21. This unit generates multiple correlations between various types of intrusion threat indicators and detects abnormal nodes in the enterprise network 6. Specifically, it uses a Transformer's pre-trained model to fine-tune 11 types of relations (such as N / A, isA, targets, uses, hasAuthor, has, variantOf, has Alias, indicates, discoveredIn, exploits). It also extracts the correlations between multiple types using dependency parsing to represent them as triples (IOC1-relation-IOC2). Different types of threats are pre-labeled, and their corresponding relationships are predicted, thereby generating multiple heterogeneous relation graphs from different sources. As shown in Figure 2, the nodes in the enterprise network 6 are pre-trained using a graph convolutional network (GCN) model or a transformer model to generate a vector representation for each node. This allows anomalies in a node to be displayed in the vector representation, thus completing a network node anomaly analysis model. The correlations between multiple types include attacker attacking vulnerabilities, attacker intruding into devices, cooperation between two attackers, vulnerabilities affecting devices, attack types of vulnerabilities, vulnerabilities containing malicious files, malicious files targeting devices, vulnerabilities including other vulnerabilities, and the platform type to which the device belongs.

[0022] The attack trajectory prediction and analysis module 2 includes an attack trajectory prediction unit 23 coupled to a network node anomaly analysis unit 22. This unit generates simulated attack trajectories and the probability of each node being attacked based on intelligence data, the relationships between multiple types, and regional network topology information. Specifically, it collects intelligence data from various sources, such as threat intelligence, from the intelligence database 5. It then uses a graph neural network to obtain the relationships between various objects in the intelligence data and establishes a topological network. This network topology can represent potential attack paths. Finally, it extracts multiple features of the topological network using graph embedding or deep walk methods. (Extraction) A classifier is trained using multiple features of the topology network to predict the probability of each node in the topology network being attacked and its corresponding score. Here, the probability of a node being attacked can be evaluated by comparing similarity with threat intelligence, host software version comparison, etc. At the same time, a Beta network is established by using the probability of each node being attacked in the topology network, thus completing an attack trajectory prediction model to calculate the simulated attack trajectory of the target intelligence.

[0023] The countermeasure suggestion module 3 provided in this embodiment is used to provide response and handling countermeasures for target intelligence based on intelligence data, local area network topology information, and cybersecurity monitoring alarm information.

[0024] The attack potential display module 4 provided in this embodiment is used to integrate and display the local area network topology information of the enterprise network 6, simulated attack trajectories, the probability of each node being attacked, and corresponding countermeasures. Specifically, the attack potential display module 4 integrates local area network topology information, simulated attack trajectories, the probability of each node being attacked, and corresponding countermeasures onto a webpage to identify nodes that may be affected by the attack and present the potential impact of the target information on the enterprise network 6. It also references the historical behavior information of reference devices associated with this attack to present corresponding countermeasures.

[0025] In one example, when a user logs into the Digital Twin System 1 via an electronic device and enters the main screen of the operating platform (on a webpage), such as the attack potential display module 4, they can then see a graphical network topology diagram of the enterprise network 6, displaying the status of all nodes such as servers, routers, and personal computers. This graphical network topology diagram will automatically and dynamically update to show the health status, risk level, and current alarms of each node. Here, the attack trajectory prediction and analysis module 2 of the Digital Twin System 1 monitors the packets and logs of each node in the enterprise network 6 in real time, analyzing each behavior in the network topology to determine the health, potential risks, and alarms of each node. In addition, the main screen of the operating platform also displays "Abnormal Alarms," ​​which users can click to display the current abnormal traffic source, suspicious IP addresses, and related intelligence information. Here, the attack trajectory prediction and analysis module 2 of the Digital Twin System 1 can determine that certain alarms may be potential attacks based on packet, log, behavioral patterns, and intrusion threat indicators. Simultaneously, the main screen of the operating platform displays "Predicted Attack Path," which users can click to see the predicted possible attack paths and high-risk nodes such as servers and routers. Here, the attack trajectory prediction and analysis module 2 of the Digital Twin System 1 uses image neural networks to analyze the correlation between nodes in the enterprise network 6's network topology and the probability of being attacked, based on the historical behavioral patterns of the attack source, the current network topology, and high-risk nodes marked in the intelligence data, to calculate nodes that may be continuously attacked. Next, the user can click on a high-risk node, and the Digital Twin System 1 will automatically display corresponding countermeasures through the countermeasure suggestion module 3, such as blocking specific IPs or ports, strengthening security monitoring of nodes, isolating high-risk nodes or network segments, or directly integrating countermeasures to update firewall rules or intrusion prevention system (IPS) settings. Here, the Digital Twin System 1 can generate countermeasures by associating the predicted attack paths with high-risk nodes and intelligence data from the intelligence database.

[0026] In summary, the digital twin system of the present invention, by employing an intrusion threat indicator identification unit, a network node anomaly analysis unit, and an attack trajectory prediction unit, can provide real-time intelligence data, simulated attack trajectories, and attack probability to ensure enterprise security, while also providing suggested countermeasures.

[0027] Although the present invention has been disclosed above by way of embodiments, it is not intended to limit the present invention. Those skilled in the art to which this invention pertains may make some modifications and refinements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the appended claims.

[0028] 1: Digital Twin System 2: Attack Trajectory Prediction and Analysis Module 3: Countermeasures and Solution Suggestions Module 4: Attack Potential Display Module 5: Intelligence Database 6: Enterprise Network 21: Intrusion Threat Indicator Identification Unit 22: Network Node Anomaly Analysis Unit 23: Attack Trajectory Prediction Unit

Claims

1. A digital twin system, comprising: An attack trajectory prediction and analysis module receives intelligence data from an intelligence database and local area network topology information and cybersecurity monitoring alarm information from an enterprise network. Based on the intelligence data, local area network topology information, and cybersecurity monitoring alarm information, it provides a simulated attack trajectory of a target intelligence and the probability of attack for each node in the enterprise network. A countermeasure suggestion module, coupled to the attack trajectory prediction and analysis module, provides corresponding handling countermeasures for the target intelligence based on the intelligence data, local area network topology information, and cybersecurity monitoring alarm information. An attack potential display module, coupled to the attack trajectory prediction and analysis module and the countermeasure suggestion module, integrates and displays the local area network topology information of the enterprise network, the simulated attack trajectory, the probability of attack for each node, and the corresponding handling countermeasures. The attack trajectory prediction and analysis module includes: an intrusion threat indicator identification unit, used to determine multiple types of intrusion threat indicators of the target intelligence. A network node anomaly analysis unit, coupled to the intrusion threat indicator identification unit, is used to generate correlations between the multiple types of the intrusion threat indicator and detect abnormal nodes in the enterprise network; and an attack trajectory prediction unit, coupled to the network node anomaly analysis unit, is used to generate the simulated attack trajectory and the probability of attack for each node based on the intelligence data, the correlations between the multiple types, and the regional network topology information; wherein the attack trajectory prediction unit obtains the correlations between various objects in the intelligence data and establishes a topology network, extracts multiple features of the topology network, and trains a classifier through the multiple features to establish a Bayesian network to complete the attack trajectory prediction model.

2. The digital twin system as described in claim 1, wherein the plurality of types includes attacker (A), vulnerability (V), device (D), platform (P), malicious file (F), and attack type (T).

3. The digital twin system as described in claim 2, wherein the associations between the multiple types include attacker exploiting a vulnerability, attacker intruding into a device, two attackers collaborating, a vulnerability affecting a device, the type of attack on the vulnerability, the vulnerability containing malicious files, malicious files targeting a device, the vulnerability including other vulnerabilities, and the platform type to which the device belongs.

4. The digital twin system as described in claim 1, wherein the intrusion threat indicator includes domain name, IP address, and file hash value.

5. The digital twin system as described in claim 1, wherein the intrusion threat indicator identification unit labels the type of the intrusion threat indicator for each piece of data in the target intelligence using a natural language annotation method.

6. The digital twin system as described in claim 5, wherein the natural language annotation method is BIO sequence annotation.

7. The digital twin system as described in claim 1, wherein the network node anomaly analysis unit extracts the associations between the multiple types and generates a heterogeneous association graph through a dependency parsing method.

Images