Network security threat processing method and apparatus, and electronic device

Abstract

The present application relates to the technical field of communications, and in particular to a network security threat processing method and apparatus, and an electronic device. The method comprises: on the basis of acquired local area network data, determining a network security attack type of a network attack event and an association relationship between entities in the network attack event; constructing a knowledge graph on the basis of the network security attack type, the association relationship between the entities in the network attack event and a configuration rule of an initial weight; using any node in the knowledge graph as an initial node, accessing each neighbor node of the initial node along adjacent edges of the initial node, and using a preset algorithm to calculate an initial weight of each neighbor node to obtain a degree-of-maliciousness weight of the initial node; and comparing the degree-of-maliciousness weight with a preset first threshold value, and deleting a node with a degree-of-maliciousness weight thereof being lower than the first threshold value in the knowledge graph, and also deleting the adjacent edges to obtain an updated knowledge graph. The solution can improve the network security threat processing efficiency.

Description

Network security threat processing method, device and electronic equipment

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims priority to the Chinese patent application filed with the China Patent Office on October 19, 2023, with application number 202311360741.6 and application name “A method, device and electronic device for handling network security threats”, the entire contents of which are incorporated by reference into this application. Technical Field

[0003] The present application relates to the field of communication technology, and in particular to a network security threat processing method, device and electronic device. Background Art

[0004] In recent years, with the continuous development of the digital economy, cyber threats have surpassed traditional security threats, bringing a significant impact. Due to the rapid evolution and diversification of cyber threats, risks and threats are characterized by diversity and rapid dynamics. Cybersecurity threat handling must be as swift as possible to maintain monitoring and response to the latest threats.

[0005] Existing technologies for handling network security threats require significant time and manpower to collect, organize, and analyze large amounts of local area network data. Therefore, improving the efficiency of handling network security threats is a question worth discussing.

[0006] Summary of the Invention

[0007] The embodiments of the present application provide a network security threat processing method, apparatus, and electronic device for improving the efficiency of network security threat processing.

[0008] In a first aspect, an embodiment of the present application provides a method for handling network security threats, including:

[0009] Based on the acquired LAN network data, the network security attack type of the network attack event and the association relationship between each entity in the network attack event are determined. Based on the network security attack type of the network attack event, the association relationship between each entity in the network attack event and the configuration rules of the initial weight, a knowledge graph is constructed, and the initial weight represents the known network threat level of the entity. Any node in the knowledge graph is used as the initial node, and the neighboring nodes of the initial node are accessed along the adjacent edges of the initial node. The initial weight of each neighboring node is calculated using a preset algorithm to obtain the maliciousness weight of the initial node. The maliciousness weight represents the network threat level of the entity after the spread of malicious behavior is simulated using a preset algorithm. The node is used to represent the entity. The maliciousness weight is compared with a preset first threshold, and the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold are deleted to obtain an updated knowledge graph.

[0010] In the above method, the way of constructing a knowledge graph based on LAN network data can introduce the perspective features of the network side and provide richer and more accurate clue information. At the same time, it can support intelligence line extension and attack tracing, and has higher versatility. At the same time, by using a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node, the network threat level of the entity after the spread of simulated malicious behavior can be determined. By comparing the maliciousness weight with a preset first threshold, deleting the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph, the scale and complexity of the knowledge graph can be reduced, thereby improving the efficiency of subsequent data analysis. Real-time updating of the knowledge graph based on LAN network data is achieved, improving the effectiveness and practicality of the knowledge graph, and the efficiency of network security threat processing.

[0011] Optionally, the configuration rule is that there is a correspondence between the network security attack type of the network attack event and the initial weight. A knowledge graph is constructed based on the network security attack type of the network attack event, the association relationship between the entities in the network attack event, and the configuration rule of the initial weight, specifically including:

[0012] Determine the relationship between nodes in the knowledge graph based on the association between entities in the cyber attack incident;

[0013] Based on the correspondence between the network security attack type and the initial weight of the network attack event, the initial weight of the entity in the network attack event is determined to obtain a knowledge graph.

[0014] In the above method, the relationships between the various nodes in the knowledge graph are determined based on the associations between the entities in the cyberattack incident. The initial weights of the entities in the cyberattack incident are determined based on the correspondence between the cybersecurity attack type and the initial weights. This method, which generates a knowledge graph, can be used to construct a knowledge graph based on existing local area network data. This provides richer and more accurate clues during subsequent data analysis, supporting both intelligence outsourcing and attack tracing, and achieving greater versatility.

[0015] Optionally, the above-mentioned method of calculating the initial weight of each neighbor node using a preset algorithm to obtain the maliciousness weight of the initial node includes:

[0016] The random walk algorithm on the graph is used to calculate the initial weight of each neighbor node to obtain the malicious weight of the initial node.

[0017] In this method, by using a random walk algorithm on a graph to calculate the initial weights of each neighboring node and obtain the maliciousness weight of the initial node, we can capture rich relationships between nodes. This facilitates simulating the spread of malicious behavior and more accurately determining the network threat level of an entity.

[0018] Optionally, the random walk algorithm on the above graph satisfies the following formula:

[0019] Among them, S K(V) Indicates the malicious weight of node v in the knowledge graph in the kth round of random walk algorithm, S K-1(V) represents the malicious weight of node v in the knowledge graph in the k-1th round of random walk algorithm, α represents the hyperparameter, β represents the hyperparameter, and w p represents the diffusion weight of relation p, |N(v)| represents the number of neighbor nodes of node v, u represents the neighbor node u of node v, S K-1(u) Represents the malicious weight of node u in the knowledge graph in the k-1th round of random walk algorithm.

[0020] Optionally, the above method further includes:

[0021] Receive triples, which include multiple entities and the relationships between entities;

[0022] Add new entities to the updated knowledge graph based on the association relationship between entities in the triples;

[0023] The neighboring nodes of the new node are visited along the adjacent edges of the new node, and the maliciousness weight of each neighboring node is calculated using a preset algorithm to obtain the maliciousness weight of the new node. The new node is used to represent the new entity.

[0024] In this method, by updating the knowledge graph based on received triples, the accuracy of the relationships between entities in the knowledge graph can be continuously corrected, and the maliciousness weights can be continuously updated, achieving comprehensive monitoring of local area network data. This facilitates the subsequent construction of threat intelligence based on the knowledge graph, improving the accuracy and recall rate of the threat intelligence library.

[0025] Optionally, the above method further includes:

[0026] Import the relationships between entities and entities in the updated knowledge graph and the corresponding entity display fields into the preset graph database.

[0027] In the above method, by importing the updated knowledge graph's entities and the relationships between the knowledge graph and the corresponding entity display fields into a specified graph database, users can use graph query languages ​​(such as Cypher, Gremlin, etc.) to conduct multi-level, cross-entity queries and analyses to discover hidden attack paths and threat sources. For example, you can query which hosts are communicating with malicious IP addresses, which hosts have vulnerabilities and weaknesses, which users have accessed malicious domain names, etc. At the same time, since the graph database also provides graph analysis functions, the entities and relationships in the graph can be analyzed and visualized through a variety of algorithms (such as clustering, connectivity analysis, path analysis, etc.). Analyzing the knowledge graph based on the graph database can better achieve in-depth tracing and analysis of threat events, more intuitively understand the overall picture and impact of threat events, and better guide the formulation and implementation of security defense strategies.

[0028] Optionally, the above method further includes:

[0029] The updated knowledge graph is stored in the threat intelligence database.

[0030] In the above method, the updated knowledge graph is stored in the threat intelligence database to facilitate subsequent data analysis.

[0031] Optionally, the above method further includes:

[0032] Multiple nodes whose maliciousness weights are higher than a set second threshold are fused with preset rules in a preset manner to generate threat intelligence.

[0033] In the above method, the method of generating threat intelligence by fusing multiple nodes whose maliciousness weight is higher than the set second threshold in a preset manner with preset rules can facilitate subsequent users to determine whether to update the threat intelligence database based on the threat intelligence.

[0034] In a second aspect, an embodiment of the present application provides a network security threat processing device, comprising:

[0035] A determination module, configured to determine the network security attack type of the network attack event and the association relationship between entities in the network attack event based on the acquired local area network data;

[0036] A processing module is used to construct a knowledge graph based on the network security attack type of the network attack event, the association relationship between the entities in the network attack event, and the configuration rules of the initial weight, where the initial weight represents the known network threat level of the entity;

[0037] The calculation module is used to take any node in the knowledge graph as the initial node, access each neighbor node of the initial node along the adjacent edges of the initial node, and use a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node. The maliciousness weight represents the network threat level of the entity after the spread of simulated malicious behavior. The node is used to represent the entity;

[0038] The processing module is also used to compare the maliciousness weight with a preset first threshold, and delete the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph.

[0039] In a third aspect, an embodiment of the present application further provides an electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, the processor implements any one of the network security threat handling methods described in the first aspect above.

[0040] In a fourth aspect, an embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. When the computer program is executed by a processor, the network security threat processing method of the first aspect is implemented.

[0041] In a fifth aspect, an embodiment of the present application further provides a computer program product, including a computer program, which is executed by a processor to implement a network security threat processing method as described in any one of the first aspects above.

[0042] The technical effects brought about by any implementation method in the second to fifth aspects can refer to the technical effects brought about by the corresponding implementation method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] FIG1 is a schematic diagram of an application scenario of a network security threat processing method provided by an embodiment of the present application;

[0044] FIG2 is a flow chart of a method for handling network security threats provided by an embodiment of the present application;

[0045] FIG3 is a schematic diagram of a knowledge graph provided in an embodiment of the present application;

[0046] FIG4 is a schematic diagram of another knowledge graph provided in an embodiment of the present application;

[0047] FIG5 is a schematic diagram of another knowledge graph provided in an embodiment of the present application;

[0048] FIG6 is a schematic diagram of another knowledge graph provided in an embodiment of the present application;

[0049] FIG7 is a flowchart of an exemplary network security threat processing method provided in an embodiment of the present application;

[0050] FIG8 is a schematic diagram of a device for handling network security threats provided by an embodiment of the present application;

[0051] FIG9 is a schematic diagram of another apparatus for handling network security threats provided by an embodiment of the present application;

[0052] FIG10 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0053] To make the objectives, technical solutions, and advantages of this application more clear, this application will be further described in detail below with reference to the accompanying drawings. Obviously, the embodiments described are only some of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making any creative efforts are within the scope of protection of this application.

[0054] The application scenarios described in the embodiments of this application are intended to more clearly illustrate the technical solutions of the embodiments of this application and do not constitute a limitation on the technical solutions provided by the embodiments of this application. Persons skilled in the art will appreciate that, as new application scenarios emerge, the technical solutions provided by the embodiments of this application are equally applicable to similar technical problems. In the description of this application, unless otherwise specified, "multiple" means two or more.

[0055] In recent years, with the continuous development of the digital economy, cyber threats have surpassed traditional security threats, bringing a significant impact. Due to the rapid evolution and diversification of cyber threats, risks and threats are characterized by diversity and rapid dynamics. Cybersecurity threat handling must be as swift as possible to maintain monitoring and response to the latest threats.

[0056] Based on the knowledge graph, it can effectively support the expansion of threat intelligence and the accurate discovery of high-threat network attacks. It can also help users conduct in-depth attack source tracing analysis of network security threats, intuitively analyze their attack intentions and organizational affiliation, and establish an intelligence closed-loop evolutionary analysis system with sustainable production, expansion, and verification.

[0057] A knowledge graph is a semantic network-based knowledge representation method that can integrate, organize, and display various data sources. In a knowledge graph, different entities can be represented as nodes, and the relationships between entities as edges.

[0058] For example, a knowledge graph can be constructed based on known malicious domain names, combined with domain name resolution data, traffic interaction data, and other threat intelligence-related metadata. This knowledge graph effectively supports threat intelligence outsourcing and the precise discovery of high-threat network attacks. It also helps security analysts conduct in-depth attack source tracing, intuitively analyzing attack intent and organizational affiliation, and establishing a closed-loop intelligence evolutionary analysis system with sustainable production, expansion, and verification.

[0059] In existing technologies, knowledge graphs are primarily constructed by manually or automatically collecting relevant local area network data. However, collecting, organizing, and analyzing large amounts of local area network data consumes significant time and labor costs.

[0060] In order to solve the above problems, the embodiments of the present application provide a network security threat processing method, device and electronic device. For example, the network security attack type of the network attack event and the association relationship between the entities in the network attack event are determined based on the acquired local area network data. A knowledge graph is constructed based on the network security attack type of the network attack event, the association relationship between the entities in the network attack event and the configuration rules of the initial weight, and the initial weight represents the known network threat level of the entity. Any node in the knowledge graph is used as the initial node, and the neighboring nodes of the initial node are accessed along the adjacent edges of the initial node, and the initial weight of each neighboring node is calculated using a preset algorithm to obtain the maliciousness weight of the initial node. The maliciousness weight represents the network threat level of the entity after the simulated malicious behavior spreads. The node is used to represent the entity. The maliciousness weight is compared with a preset first threshold, and the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold are deleted to obtain an updated knowledge graph.

[0061] In this way, the method of constructing a knowledge graph based on LAN network data can introduce the perspective features of the network side and provide richer and more accurate clue information. At the same time, it can support intelligence line extension and attack tracing, and has higher versatility. At the same time, by using a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node, the network threat level of the entity after the spread of simulated malicious behavior can be determined. By comparing the maliciousness weight with a preset first threshold, deleting the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph, the scale and complexity of the knowledge graph can be reduced, thereby improving the efficiency of subsequent data analysis. It is possible to achieve real-time updating of the knowledge graph based on LAN network data, improve the effectiveness and practicality of the knowledge graph, and improve the efficiency of network security threat processing.

[0062] As shown in Figure 1, an application scenario diagram of an optional network security threat handling method of an embodiment of the present application includes a server 100 and a terminal 101. The server 100 and the terminal 101 can be connected to each other through a network to achieve a communicative connection to implement the network security threat handling method of the present application.

[0063] The user can use the server 100 to interact with the terminal 101 via the network, such as receiving or sending messages, etc. Various client applications can be installed on the terminal 101, such as programming applications, web browser applications, search applications, etc.

[0064] It is understood that the network security threat handling method provided in the embodiments of the present application can be executed by the server 100 or by the terminal 101. In the embodiments of the present application, the server 100 can be implemented as an independent server or a server cluster consisting of multiple servers. The terminal 101 can be any electronic device with a display screen and supporting web browsing, including but not limited to a smartphone, tablet computer, desktop computer, etc.

[0065] As shown in Figure 2, a flowchart of a network security threat processing method provided in an embodiment of the present application may specifically include the following steps. In the embodiment shown in Figure 2, the network security threat processing method is executed by the server as an example for description.

[0066] Step S201: Determine the network security attack type of the network attack event and the association relationship between entities in the network attack event based on the acquired local area network data.

[0067] In an optional implementation, the server can collect LAN network data in real time.

[0068] The following is an explanation of the LAN network data collected by the server:

[0069] 1. The server can collect domain name resolution log data.

[0070] Domain name resolution logs can include DNS response data, such as passive Domain Name System (DNS) logs. Passive DNS logs are network logs that record DNS queries and contain the relationship between DNS queries and responses. Specifically, they include information about which IP (Internet Protocol) addresses queried which domain names, and which domain names were resolved to which IP addresses.

[0071] In the above method, obtaining Passive DNS logs can help security analysts identify potential threat sources, as well as the domain names and IP addresses associated with these threat sources.

[0072] 2. The server can actively detect and collect data on the domain names and IP assets involved in the Passive DNS log, and obtain information such as the secure socket layer (SSL) certificate corresponding to the domain name and the open ports of the IP assets.

[0073] 3. The server can collect network monitoring (NetFlow) data.

[0074] NetFlow data is a data record generated by network devices (such as routers and switches) when they use NetFlow technology to collect and analyze traffic. Each NetFlow data record contains information about the traffic that passed through the device over a period of time (usually several minutes), including statistics such as traffic volume, duration, source IP address, destination IP address, source port, destination port, and protocol type.

[0075] 4. The server can collect data from the domain name query protocol (Whois) database.

[0076] The WHOIS database is a protocol and database used to query registration information for internet resources, such as domain names, IP addresses, and Autonomous System (AS) numbers. The WHOIS database is a publicly accessible, distributed database maintained and managed by various registries, such as the Internet Corporation for Assigned Names and Numbers (ICANN) and the China Internet Network Information Center (CNNIC). Through the WHOIS database, users can query and obtain detailed information about domain name and IP address registrations, including the registrant, registration date, expiration date, and contact information.

[0077] It is understandable that the LAN network data in the embodiments of the present application include but are not limited to the above-mentioned situations, and the present application does not make any specific limitation thereto.

[0078] After obtaining the LAN network data, the server can determine the network security attack type of the network attack event and the association relationship between the entities in the network attack event based on the obtained LAN network data.

[0079] In an optional embodiment, the server can determine multiple network attack events and various types of entities involved in the network attack events from the local area network data. For example, the entities may include domain names, IP addresses, organizations, locations, SSL certificates, etc.

[0080] The following examples illustrate the relationships between entities involved in cyberattacks. For example, we can build a resolution relationship between a domain name and an IP / CName based on Passive DNS log information. Another example is building a traffic interaction relationship between IP addresses based on NetFlow data. Another example is building a domain name organization relationship based on the WHOIS database. Another example is actively collecting data on domain names and IP assets mentioned in Passive DNS logs to obtain information such as SSL certificates and IP address locations.

[0081] The following provides examples of network attack types, such as structured query language (SQL) injection attacks and distributed denial of service (DDoS) attacks.

[0082] Step S202: Construct a knowledge graph based on the network security attack type of the network attack event, the association relationship between the entities in the network attack event, and the configuration rules of the initial weight.

[0083] The initial weight represents the known cyber threat level of the entity.

[0084] In an optional embodiment, the threat intelligence database may store a correspondence between the network security attack type and the initial weight of a network attack event. After determining the network security attack type of the network attack event and the association between the entities in the network attack event based on the acquired local area network data, the server may determine the relationship between the nodes in the knowledge graph based on the association between the entities in the network attack event. Based on the correspondence between the network security attack type of the network attack event and the initial weight, the initial weight of the entity in the network attack event is determined to obtain a knowledge graph.

[0085] For example, assuming that the threat intelligence database can store the corresponding relationship between network attack types and initial weights of network attack events, the initial weight of the entity in the network attack event being a SQL injection attack is 1. The initial weight of the entity in the network attack event being a DDoS attack is 2.

[0086] Based on the acquired LAN data, the network attack event's network security attack type is determined to be a SQL injection attack. The association between the entities in the SQL injection attack event is that Domain Name 1 belongs to Organization 1. Based on the correspondence between the network attack event's network security attack type and the initial weights, the initial weights of the entities in the network attack event are determined as follows: Domain Name 1's initial weight is 1. Organization 1's initial weight is also 1.

[0087] Based on the acquired LAN data, the network attack type of the network attack event is determined to be a DDoS attack. The association between the entities in the DDoS attack event is that IP2 is located in location 2. Based on the correspondence between the network attack type and the initial weights, the initial weights of the entities in the network attack event are determined: Domain 2's initial weight is 2.

[0088] Optionally, when the network security attack type of the network attack event does not exist in the stored correspondence between the network security attack type of the network attack event and the initial weight, the server may determine that the initial weight of the entity in the above network attack event is 0.

[0089] Optionally, when constructing the knowledge graph, the server can also determine preset attribute information based on the associations between entities in the cyberattack incident. For example, the preset attribute information can include the time of the entity's first appearance. Another example can include the time of the entity's last appearance. Another example can include the average number of times an entity is resolved per day.

[0090] It is understood that the preset attribute information of the entity in the embodiment of the present application can be pre-set by those skilled in the art. Moreover, the preset attribute information of the above-mentioned entity can also be set and changed according to the application scenario. This application does not make specific limitations on this.

[0091] In the above method, the way of constructing a knowledge graph based on the network security attack type of network attack events, the association relationship between entities in network attack events, and the configuration rules of initial weights can facilitate modeling network interaction behavior and is more conducive to subsequent malicious detection and threat verification based on preset information.

[0092] As shown in Figure 3, an embodiment of the present application provides a schematic diagram of a knowledge graph.

[0093] In Figure 3, domain name 1 first appeared on February 1, 2023. It last appeared on February 2, 2023. The average number of daily resolutions for domain name 1 is 10. Its malicious weight is 0.85. Domain name 1 belongs to organization 1. Domain name 1 corresponds to SSL certificate 1. Resolving domain name 1 yields IP address 1. IP address 1 is located in location 1. Traffic from IP address 1 flows to IP address 2. Traffic from IP address 1 flows to IP address 3. IP address 3 is located in location 2. Domain name 1 last appeared on February 2, 2023. The average number of daily resolutions for domain name 1 is 10.

[0094] Domain 2 first appeared on February 1, 2023. It last appeared on February 2, 2023. The average number of daily resolutions for domain 2 is 20. Domain 2 belongs to organization 1. Domain 2 corresponds to SSL certificate 2. Domain 1 has a malicious weight of 0.65. Resolving domain 2 yields IP address 2, which is located in location 2.

[0095] Step S203: Take any node in the knowledge graph as the initial node, visit the neighbor nodes of the initial node along the adjacent edges of the initial node, and use a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node.

[0096] The maliciousness weight represents the network threat level of an entity after the spread of malicious behavior is simulated using a preset algorithm. Nodes are used to represent entities.

[0097] In an optional embodiment, the server can simulate the spread of malicious behavior using a random walk algorithm on a graph, calculating the initial weights of each neighboring node to obtain the maliciousness weight of the initial node. During the random walk, the initial weight of the initial node is diffused to its neighboring nodes. The server can then update the initial node's weight by combining the initial node's own weight and the diffused weights received by the neighboring nodes.

[0098] For example, in the embodiment of the present application, the node weight can be updated according to the following formula.

[0099] Among them, S K(V) S represents the malicious weight of node v in the knowledge graph in the kth round of random walk algorithm. K-1(V) represents the maliciousness weight of node v in the knowledge graph in the k-1th round of random walk algorithm. α represents a hyperparameter. β represents a hyperparameter. w p Represents the diffusion weight of relation p. |N(v)| represents the number of neighbor nodes of node v. U represents the neighbor node u of node v. S K-1(u) It represents the maliciousness weight of node u in the knowledge graph in the k-1th round of random walk algorithm.

[0100] As shown in Figure 4, an embodiment of the present application provides a schematic diagram of node weight update. In Figure 4, it is assumed that the second-round malicious weight of domain name 1 is 0.56. The second-round malicious weight of organization 1 is 0.89. The second-round malicious weight of IP1 is 0.10. The second-round malicious weight of IP2 is 0.05. The second-round malicious weight of domain name 2 is 0.65. For the initial node domain name 1, it is assumed that when the third-round malicious weight is updated, the diffusion weight of the relationship "belongs" is 1. The diffusion weight of the relationship "resolution" is 2. α is 0.86. β is 1.45. Based on the random walk algorithm on the graph to simulate the diffusion of malicious behavior, it can be obtained that the malicious weight of the initial node domain name 1 in the third round is:

[0101] It is understandable that the preset algorithm in the embodiment of the present application may also be a random walk algorithm such as the DeepWalk algorithm or the Random Walk Metropolis algorithm, but the present application does not make any specific limitation on this.

[0102] Step S204: compare the maliciousness weight with a preset first threshold, and delete the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph.

[0103] In an optional embodiment, after the knowledge graph undergoes a preset number of free random walks, the weights of all nodes are updated. Since malicious nodes only account for a small portion of the entire network topology, and the majority of nodes are normal, non-malicious nodes can be removed from the knowledge graph, retaining only suspected malicious nodes and their neighbors. The server can also remove nodes and their adjacent edges whose weights fall below a preset first threshold, thereby reducing the complexity of the knowledge graph.

[0104] It is understood that the preset number of rounds in the embodiments of the present application is pre-set by those skilled in the art. The preset number of rounds can also be set according to specific application scenarios. For example, the preset number of rounds can be 2. For another example, the preset number of rounds can be 5.

[0105] For example, as shown in Figure 5, an embodiment of the present application provides a schematic diagram of a knowledge graph. Assume that the first threshold is 0.5. After two rounds of free random walk algorithms, the second-round maliciousness weight of domain name 1 in the knowledge graph is 0.56. The second-round maliciousness weight of organization 1 is 0.89. The second-round maliciousness weight of IP1 is 0.10. The second-round maliciousness weight of IP2 is 0.55. The second-round maliciousness weight of domain name 2 is 0.65. The server can determine that the node whose second-round maliciousness weight is lower than the first threshold of 0.5 is IP1. The server can delete the node IP1 and the adjacent edges of IP "resolve domain name 1 to obtain IP1" and "IP1's traffic flows to IP2" to obtain an updated knowledge graph.

[0106] In the above method, by comparing the maliciousness weight with a preset first threshold and deleting the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph, the scale and complexity of the knowledge graph can be reduced, thereby improving the computational efficiency of subsequent updates to the weights of each node in the knowledge graph.

[0107] Optionally, to facilitate subsequent data analysis, the server can store the updated knowledge graph in the threat intelligence database.

[0108] Optionally, the server can determine, from the updated knowledge graph, multiple nodes whose maliciousness weight is greater than or equal to a preset second threshold. The server can then fuse the multiple nodes whose maliciousness weight is greater than the preset second threshold with preset rules in a preset manner to generate threat intelligence. After generating the threat intelligence, the server can send the threat intelligence to the user terminal. After the user determines whether the threat intelligence can be stored in the threat intelligence database, the server can store the threat intelligence in the threat intelligence database.

[0109] In the above method, the method of generating threat intelligence by fusing multiple nodes whose maliciousness weight is higher than the set second threshold in a preset manner with preset rules can facilitate subsequent users to determine whether to update the threat intelligence database based on the threat intelligence.

[0110] Optionally, the server can also import the association relationships between entities and each entity in the updated knowledge graph and the corresponding entity display fields into a preset graph database.

[0111] In the above method, by importing the updated knowledge graph's entities and the relationships between the knowledge graph and the corresponding entity display fields into a specified graph database, users can use graph query languages ​​(such as Cypher, Gremlin, etc.) to conduct multi-level, cross-entity queries and analyses to discover hidden attack paths and threat sources. For example, you can query which hosts are communicating with malicious IP addresses, which hosts have vulnerabilities and weaknesses, which users have accessed malicious domain names, etc. At the same time, since the graph database also provides graph analysis functions, the entities and relationships in the graph can be analyzed and visualized through a variety of algorithms (such as clustering, connectivity analysis, path analysis, etc.). Analyzing the knowledge graph based on the graph database can better achieve in-depth tracing and analysis of threat events, more intuitively understand the overall picture and impact of threat events, and better guide the formulation and implementation of security defense strategies.

[0112] Optionally, since LAN network data (such as domain name resolution network data and traffic interaction network data) is generated and changed in real time. Therefore, the knowledge graph is a spatiotemporal knowledge graph with temporal changes, and there are changes in entities and relationships between entities. For example, adding entities, deleting entities, deleting relationships between entities, and adding relationships between entities. At the same time, since the server can also continuously receive new LAN network data, the knowledge graph in the embodiment of the present application can be continuously updated, the accuracy of the relationships between entities in the knowledge graph can be continuously corrected, and the maliciousness weights can be continuously updated to achieve all-round monitoring of LAN network data. This is convenient for improving the accuracy and recall rate of the threat intelligence library when subsequently building threat intelligence based on the knowledge graph.

[0113] In one possible scenario, the server may receive a triple that includes multiple entities and relationships between the entities, and add the new entity to the updated knowledge graph based on the relationships between the entities in the triple.

[0114] For example, as shown in Figure 6, an embodiment of the present application provides a schematic diagram of a knowledge graph. Assume that the received triple is (domain name 3, belongs to, organization 1). The updated knowledge graph includes organization 1. Domain name 3 is a new entity. The interaction relationship between domain name 3 and organization 1 in the bracket is that domain name 3 belongs to organization 1. Therefore, on the basis of the original knowledge graph, a node for representing domain name 3 and an edge for representing the relationship between domain name 3 and organization 1 can be added.

[0115] Optionally, since the network threat level of the new entity in the triplet is unknown, in one possible scenario, the new entity can be sent to the terminal, allowing the user to analyze the network threat level of the new entity and obtain an initial weight for the new entity.

[0116] In another possible scenario, since the new triple update only accounts for a small portion of the entire knowledge graph, the time complexity of weight diffusion on the entire knowledge graph is also relatively high. Therefore, the server can also access the new node's neighboring nodes along the adjacent edges of the new node and use a preset algorithm to calculate the maliciousness weight of each neighboring node to obtain the maliciousness weight of the new node. The new node is used to represent the new entity.

[0117] For example, the server can visit each neighbor node of the new node along the adjacent edges of the new node, and use the random walk algorithm on the graph to calculate the maliciousness weight of each neighbor node to obtain the maliciousness weight of the new node.

[0118] Optionally, after obtaining the initial weight of the new node, the server may also delete the new node and its adjacent edges whose initial weight is lower than the first threshold.

[0119] As shown in FIG7 , an embodiment of the present application provides a flowchart of an exemplary network security threat processing method.

[0120] S701, obtaining local area network data;

[0121] S702: Determine the network attack type of the network attack event and the association relationship between entities in the network attack event based on the acquired local area network data;

[0122] S703. Determine the relationship between nodes in the knowledge graph based on the association relationship between entities in the network attack event;

[0123] S704. Determine the initial weights of entities in the network attack event based on the correspondence between the network attack type and the initial weights, and obtain a knowledge graph.

[0124] S705: Take any node in the knowledge graph as the initial node, visit the neighboring nodes of the initial node along the adjacent edges of the initial node, and use the random walk algorithm on the graph to calculate the initial weight of each neighboring node to obtain the maliciousness weight of the initial node;

[0125] S706: Compare the maliciousness weight with a preset first threshold, and delete the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph;

[0126] S707: A plurality of nodes whose maliciousness weights are higher than a set second threshold are integrated with preset rules in a preset manner to generate threat intelligence.

[0127] FIG8 is a schematic structural diagram of a network security threat processing device provided in an embodiment of the present application. As shown in FIG8 , the device includes: a determination module 801 , a processing module 802 , and a calculation module 803 .

[0128] Determination module 801, for determining the network security attack type of the network attack event and the association relationship between entities in the network attack event based on the acquired local area network data;

[0129] Processing module 802 is used to build a knowledge graph based on the network security attack type of the network attack event, the association relationship between entities in the network attack event, and the configuration rules of the initial weight, where the initial weight represents the known network threat level of the entity;

[0130] The calculation module 803 is used to take any node in the knowledge graph as the initial node, access each neighbor node of the initial node along the adjacent edges of the initial node, and use a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node. The maliciousness weight represents the network threat level of the entity after the preset algorithm is used to simulate the spread of malicious behavior. The node is used to represent the entity;

[0131] The processing module 802 is further used to compare the maliciousness weight with a preset first threshold, and delete the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph.

[0132] Optionally, the configuration rule is that there is a correspondence between the network security attack type of the network attack event and the initial weight. A knowledge graph is constructed based on the network security attack type of the network attack event, the association relationship between entities in the network attack event, and the configuration rule of the initial weight. The processing module 802 is specifically used to:

[0133] Determine the relationship between nodes in the knowledge graph based on the association between entities in the cyber attack incident;

[0134] Based on the correspondence between the network security attack type and the initial weight of the network attack event, the initial weight of the entity in the network attack event is determined to obtain a knowledge graph.

[0135] Optionally, a preset algorithm is used to calculate the initial weight of each neighboring node to obtain the maliciousness weight of the initial node. The calculation module 803 is specifically used to:

[0136] The random walk algorithm on the graph is used to calculate the initial weight of each neighbor node to obtain the malicious weight of the initial node.

[0137] Optionally, the random walk algorithm on the graph satisfies the following formula:

[0138] Among them, S K(V) Indicates the malicious weight of node v in the knowledge graph in the kth round of random walk algorithm, S K-1(V)represents the malicious weight of node v in the knowledge graph in the k-1th round of random walk algorithm, α represents the hyperparameter, β represents the hyperparameter, and w p represents the diffusion weight of relation p, |N(v)| represents the number of neighbor nodes of node v, u represents the neighbor node u of node v, S K-1(u) Represents the malicious weight of node u in the knowledge graph in the k-1th round of random walk algorithm.

[0139] Optionally, as shown in FIG9 , the network security threat processing device may further include a transceiver module 904 .

[0140] The transceiver module 904 is configured to receive a triplet, wherein the triplet includes multiple entities and relationships between the entities;

[0141] The calculation module 803 is further used to: add new entities to the updated knowledge graph based on the association relationship between entities in the triples;

[0142] The neighboring nodes of the new node are visited along the adjacent edges of the new node, and the maliciousness weight of each neighboring node is calculated using a preset algorithm to obtain the maliciousness weight of the new node. The new node is used to represent the new entity.

[0143] Optionally, the processing module 802 is further configured to:

[0144] Import the relationships between entities and entities in the updated knowledge graph and the corresponding entity display fields into the preset graph database.

[0145] Optionally, the processing module 802 is further configured to:

[0146] The updated knowledge graph is stored in the threat intelligence database.

[0147] Optionally, the processing module 802 is further configured to:

[0148] Multiple nodes whose maliciousness weights are higher than a set second threshold are fused with preset rules in a preset manner to generate threat intelligence.

[0149] Based on the same technical concept, an electronic device is also provided in an embodiment of the present application, which can realize the functions of the aforementioned target object detection device.

[0150] FIG10 is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application.

[0151] At least one processor 1001, and a memory 1002 connected to at least one processor 1001. In the embodiments of the present application, the specific connection medium between the processor 1001 and the memory 1002 is not limited. FIG10 takes the connection between the processor 1001 and the memory 1002 via the bus 1000 as an example. The bus 1000 is represented by a bold line in FIG10, and the connection between other components is only for schematic illustration and is not intended to be limiting. The bus 1000 can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, FIG10 only uses a bold line to represent it, but this does not mean that there is only one bus or one type of bus. Alternatively, the processor 1001 can also be called a controller, and there is no limitation on the name.

[0152] In the embodiment of the present application, memory 1002 stores instructions executable by at least one processor 1001. At least one processor 1001 can perform the target object detection method discussed above by executing the instructions stored in memory 1002. Processor 1001 can implement the functions of each module in the apparatus shown in Figure 8 or Figure 9.

[0153] Among them, the processor 1001 is the control center of the device, which can use various interfaces and lines to connect the various parts of the entire control device, and monitor the device as a whole by running or executing instructions stored in the memory 1002 and calling data stored in the memory 1002, the various functions of the device and processing data.

[0154] In one possible design, processor 1001 may include one or more processing units. Processor 1001 may integrate an application processor and a modem processor. The application processor primarily processes the operating system, driver interface, and application programs, while the modem processor primarily handles wireless communications. It is understood that the modem processor may not be integrated into processor 1001. In some embodiments, processor 1001 and memory 1002 may be implemented on the same chip. In some embodiments, they may also be implemented on separate chips.

[0155] The processor 1001 can be a general-purpose processor, such as a central processing unit (CPU), a digital signal processor, an application-specific integrated circuit, a field programmable gate array or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component, and can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of the present application. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the target object detection method disclosed in the embodiments of the present application can be directly embodied as being executed by a hardware processor, or can be executed by a combination of hardware and software modules in the processor.

[0156] Memory 1002 is a non-volatile computer-readable storage medium that can be used to store non-volatile software programs, non-volatile computer executable programs and modules. Memory 1002 may include at least one type of storage medium, such as a flash memory, a hard disk, a multimedia card, a card-type memory, a random access memory (Random Access Memory, RAM), a static random access memory (Static Random Access Memory, SRAM), a programmable read-only memory (Programmable Read Only Memory, PROM), a read-only memory (Read Only Memory, ROM), an electrically erasable programmable read-only memory (Electrically Erasable Programmable Read-Only Memory, EEPROM), a magnetic memory, a disk, an optical disk, etc. Memory 1002 is any other medium that can be used to carry or store a desired program code in the form of an instruction or data structure and can be accessed by a computer, but is not limited thereto. The memory 1002 in the embodiment of the present application can also be a circuit or any other device that can realize a storage function, for storing program instructions and / or data.

[0157] By designing and programming the processor 1001, the code corresponding to the target object detection method described in the aforementioned embodiment can be embedded in the chip, thereby enabling the chip to execute the target object detection method of the embodiment shown in FIG3 during operation. Designing and programming the processor 1001 is well known to those skilled in the art and will not be further described here.

[0158] It should be noted here that the above-mentioned electronic device provided in the embodiment of the present application can implement all the method steps implemented in the above-mentioned method embodiment and can achieve the same technical effect. The parts and beneficial effects of this embodiment that are the same as those in the method embodiment will not be described in detail here.

[0159] An embodiment of the present application further provides a computer-readable storage medium, which stores computer-executable instructions. The computer-executable instructions are used to enable a computer to execute the target object detection method in the above embodiment.

[0160] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Furthermore, the present application may adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to magnetic disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0161] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate a device for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0162] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0163] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0164] Obviously, those skilled in the art may make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalents, this application is intended to include these modifications and variations.

Claims

1. A network security threat processing method, characterized in that: The method comprises: Determine the network security attack type of the network attack event and the association relationship between entities in the network attack event based on the acquired local area network data; Constructing a knowledge graph based on the network security attack type of the network attack event, the association relationship between entities in the network attack event, and the configuration rules of the initial weight, wherein the initial weight represents the known network threat degree of the entity; Taking any node in the knowledge graph as the initial node, visiting each neighbor node of the initial node along the adjacent edge of the initial node, and using a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node, the maliciousness weight represents the network threat level of the entity after the preset algorithm is used to simulate the spread of malicious behavior, and the node is used to represent the entity; The maliciousness weight is compared with a preset first threshold, and the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold are deleted to obtain an updated knowledge graph.

2. The method according to claim 1, characterized in that The configuration rule is that there is a corresponding relationship between the network security attack type of the network attack event and the initial weight, and the configuration rule based on the network security attack type of the network attack event, the association relationship between the entities in the network attack event and the initial weight constructs a knowledge graph, specifically including: Determine the relationship between nodes in the knowledge graph based on the association relationship between entities in the network attack event; Based on the correspondence between the network security attack type and the initial weight, the initial weight of the entity in the network attack event is determined to obtain the knowledge graph.

3. The method according to claim 1, characterized in that The using of a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node specifically includes: The random walk algorithm on the graph is used to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node.

4. The method according to claim 3, characterized in that The random walk algorithm on the graph satisfies the following formula: Among them, S K(V) represents the maliciousness weight of node v in the knowledge graph in the kth round of random walk algorithm, S K-1(V) represents the maliciousness weight of node v in the knowledge graph in the k-1th round of random walk algorithm, α represents a hyperparameter, β represents a hyperparameter, and w p represents the diffusion weight of relation p, |N(v)| represents the number of neighbor nodes of node v, u represents the neighbor node u of node v, S K-1(u) It represents the maliciousness weight of node u in the knowledge graph in the k-1th round of random walk algorithm.

5. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Receiving a triplet, wherein the triplet includes a plurality of entities and associations between the entities; Adding new entities to the updated knowledge graph based on the association relationship between the entities in the triples; Each neighboring node of the new node is visited along the adjacent edge of the new node, and the maliciousness weight of each neighboring node is calculated using a preset algorithm to obtain the maliciousness weight of the new node, and the new node is used to represent the new entity.

6. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: Import the association relationships between the entities in the updated knowledge graph and the entities and the corresponding entity display fields into a preset graph database.

7. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: The updated knowledge graph is stored in a threat intelligence database.

8. The method according to any one of claims 1 to 4, characterized in that: The method further comprises: The multiple nodes whose maliciousness weights are higher than the set second threshold are integrated with preset rules in a preset manner to generate threat intelligence.

9. A network security threat processing device, characterized in that: include: A determination module, used to determine the network security attack type of the network attack event and the association relationship between the entities in the network attack event based on the acquired local area network data; A processing module is used for determining the network security attack type based on the network attack event, the network The association relationship between entities in the attack event and the configuration rules of the initial weights are used to construct a knowledge graph, where the initial weights represent the known network threat levels of the entities; A calculation module, used to take any node in the knowledge graph as an initial node, visit each neighbor node of the initial node along the adjacent edge of the initial node, and use a preset algorithm to calculate the initial weight of each neighbor node to obtain the maliciousness weight of the initial node, wherein the maliciousness weight represents the network threat level of the entity after the spread of simulated malicious behavior, and the node is used to represent the entity; The processing module is also used to compare the maliciousness weight with a preset first threshold, and delete the nodes and adjacent edges in the knowledge graph whose maliciousness weight is lower than the first threshold to obtain an updated knowledge graph.

10. An electronic device comprising a memory, a processor and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 8 are implemented.

11. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.

12. A computer program product, characterized in that When the computer program product is called by a computer, the computer executes the steps of any one of the methods of claims 1 to 8.

Images