Cybersecurity prediction method, apparatus, computing device, and storage medium

Abstract

The present application relates to the technical field of network security, and particularly relates to a network security prediction method and device, a computing device and a storage medium. The method comprises: acquiring external known data and network data of each host in real time; modeling the data structure of the ontology based on the external known data, the network data and a pre-acquired professional knowledge base, to obtain a knowledge model; performing knowledge extraction on the knowledge entities, attributes and association relationships of the external known data network data based on the external known data, the professional knowledge base and the knowledge model of the external known data, to generate a plurality of target knowledge; storing the target knowledge and the external known data in the knowledge base; and determining an analysis rule based on the external known data, to perform knowledge reasoning on the target knowledge based on the analysis rule, to obtain a prediction result. The present application can effectively expand the context of threat event analysis, and further achieve effective detection, comprehensive tracing and accurate prediction of threat events.

Description

TECHNICAL FIELD

[0001] The embodiment of the application relates to the technical field of network security, in particular to a network security prediction method and device, a computing device and a storage medium. BACKGROUND

[0002] With the gradual upgrading and complication of attack tools and methods, the network security prediction method gradually becomes a research hotspot.

[0003] However, the existing network security prediction method can only detect network data and predict whether a threat event will occur, and cannot comprehensively realize data tracing of the threat event, so that the practicability and effect of the existing network security prediction method are poor.

[0004] Therefore, a new network security prediction method is urgently needed. SUMMARY

[0005] In order to solve the problem that the traditional network security prediction method cannot comprehensively realize data tracing of a threat event, the embodiment of the application provides a network security prediction method, device, computing device and storage medium.

[0006] In a first aspect, the embodiment of the application provides a network security prediction method, comprising:

[0007] Real-time acquisition of external known data and network data of each host; wherein the network data comprises log data and traffic data;

[0008] Based on the network data and a pre-acquired professional knowledge base, the data structure of the ontology is modeled to obtain a knowledge model; wherein the data structure comprises the name, attribute and association relationship of the ontology;

[0009] Based on the professional knowledge base and the knowledge model, knowledge extraction is performed on the knowledge entity, attribute and association relationship of the network data to generate a plurality of target knowledge;

[0010] Based on the target knowledge, a knowledge graph is generated, and the knowledge graph and the external known data are stored in a knowledge base;

[0011] Based on the external known data, an analysis rule is determined, and knowledge reasoning is performed on the target knowledge based on the analysis rule to obtain a prediction result.

[0012] In a second aspect, the embodiment of the application further provides a network security prediction device, comprising:

[0013] An acquisition unit is configured to acquire external known data and network data of each host in real time; wherein the network data comprises log data and traffic data;

[0014] a modeling unit configured to model a data structure of the ontology based on the network data and a pre-acquired professional knowledge base, to obtain a knowledge model, wherein the data structure comprises a name, attributes and a correlation relationship of the ontology;

[0015] an extracting unit configured to perform knowledge extraction on knowledge entities, attributes and the correlation relationship of the network data based on the professional knowledge base and the knowledge model, to generate a plurality of target knowledge;

[0016] a storing unit configured to generate a knowledge graph based on the target knowledge, and store the knowledge graph and the external known data into a knowledge base;

[0017] a reasoning unit configured to determine an analysis rule based on the external known data, to perform knowledge reasoning on the target knowledge based on the analysis rule, to obtain a prediction result.

[0018] In a third aspect, an embodiment of the present application further provides a computing device, comprising a memory and a processor, the memory stores a computer program, and the processor executes the computer program to implement the method in any of the embodiments of the present application.

[0019] In a fourth aspect, an embodiment of the present application further provides a computer readable storage medium, which stores a computer program, and the computer program, when executed in a computer, causes the computer to execute the method in any of the embodiments of the present application.

[0020] The embodiments of the present application provide a network security prediction method and device, a computing device and a storage medium. Firstly, external known data and network data of each host are acquired in real time. Then, a data structure of an ontology is modeled based on the network data and a pre-acquired professional knowledge base, to obtain a knowledge model. Knowledge entities, attributes and a correlation relationship of the network data of each host are extracted based on the professional knowledge base and the knowledge model, to generate a plurality of target knowledge. Next, a knowledge graph is generated based on the target knowledge, and the knowledge graph and the external known data are stored into a knowledge base. Finally, an analysis rule is determined based on the external known data, to perform knowledge reasoning on the target knowledge based on the analysis rule, to obtain a prediction result. According to the present application, the network data of each host is generated into a knowledge graph, and the correlation relationship between each entity in the knowledge graph is utilized, so that the context of threat event analysis can be effectively expanded, and effective detection, comprehensive tracing and accurate prediction of threat events can be further achieved. BRIEF DESCRIPTION OF DRAWINGS

[0021] In order to more clearly illustrate the technical solutions in the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiments or prior art description. Obviously, the drawings described below are only some embodiments of the present application, and the other drawings can be obtained by those skilled in the art without any creative effort based on these drawings.

[0022] Figure 1 is a network security prediction method flowchart provided by an embodiment of the present application;

[0023] Figure 2 is a network security prediction method overall architecture diagram provided by an embodiment of the present application;

[0024] Figure 3 is a hardware architecture diagram of an electronic device provided by an embodiment of the present application;

[0025] Figure 4 is a network security prediction device structure diagram provided by an embodiment of the present application. DETAILED DESCRIPTION

[0026] In order to make the objects, technical solutions and advantages of the embodiments of the present application clearer, the following will combine the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without any creative effort are within the protection scope of the present application.

[0027] As described above, the existing network security prediction method can only detect network data and predict whether a threat event will occur, but cannot comprehensively realize data tracing of the threat event, resulting in poor practicability and effect of the existing network security prediction method.

[0028] In order to solve the above technical problems, the inventors can consider introducing a knowledge graph into the network security field to depict a security situation, support security decision and early warning prediction, and fully exert the graph attribute of network data in the form of graph organization to improve the efficiency of security data analysis in multiple links such as storage, analysis and visualization, and realize deep mining of threat events based on the association relationship of various types of network data. Therefore, the present scheme can generate a knowledge graph by network data of each host, utilize the association relationship between entities in the knowledge graph, effectively expand the context of threat event analysis, and further realize effective detection, comprehensive tracing and accurate prediction of threat events.

[0029] The following describes specific implementation modes of the above concept.

[0030] Referring to Figure 1 The embodiment of the present application provides a network security prediction method, which comprises the following steps:

[0031] Step 100: Real-time acquisition of external known data and network data of each host; wherein the network data comprises log data and traffic data;

[0032] Step 102: Modeling of the data structure of the ontology based on the network data and the pre-acquired professional knowledge base, to obtain a knowledge model; wherein the data structure comprises the name, attribute and association relationship of the ontology;

[0033] Step 104: Knowledge extraction of the knowledge entity, attribute and association relationship of the network data based on the professional knowledge base and the knowledge model, to generate a plurality of target knowledge;

[0034] Step 106: Generation of a knowledge graph based on the target knowledge, and storage of the knowledge graph and the external known data into the knowledge base;

[0035] Step 108: Determination of an analysis rule based on the external known data, to perform knowledge reasoning on the target knowledge based on the analysis rule, to obtain a prediction result.

[0036] In the embodiment of the present application, first, the external known data and the network data of each host are acquired in real time; then, the data structure of the ontology is modeled based on the network data and the pre-acquired professional knowledge base, to obtain a knowledge model; further, the knowledge entity, attribute and association relationship of the network data of each host are extracted based on the professional knowledge base and the knowledge model, to generate a plurality of target knowledge; then, a knowledge graph is generated based on the target knowledge, and the knowledge graph and the external known data are stored into the knowledge base; finally, an analysis rule is determined based on the external known data, to perform knowledge reasoning on the target knowledge based on the analysis rule, to obtain a prediction result. Through the generation of the knowledge graph of the network data of each host, the association relationship between the internal entities of the knowledge graph can effectively expand the context of threat event analysis, and further realize effective detection, comprehensive tracing and accurate prediction of threat events.

[0037] The execution mode of each step shown in the following description. Figure 1

[0038] For step 100:

[0039] In combination with Figure 2 ​In the embodiment of the present application, in order to construct an automated threat event analysis capability, it is necessary to systematically sort and organize large-scale, multi-source and multi-dimensional network security data to realize correlation mining based on each type of data, so the present scheme integrates ATT&CK, ChatGPT, NLP and other technologies to predict network security data. Among them, the ATT&CK framework is a threat analysis framework for analyzing attacker behavior (i.e. TTPs); ChatGPT is a natural language processing tool driven by artificial intelligence technology, which can understand and learn human language to carry on a conversation, and can also interact according to the context of the chat; NLP inference (Natural Language Processing) can realize network security knowledge inference through context analysis and semantic comparison.

[0040] Therefore, in the embodiment of the present application, the external known data includes consultation data of ChatGPT, knowledge data of the ATT&CK site and expert annotated feature data.

[0041] The present scheme can be used to predict the network security of each host in the enterprise, so it is necessary to obtain the log data and traffic data of each host in the enterprise. In order to subsequently use the ATT&CK engine, NLP inference engine and other machine learning engines to perform knowledge inference on the network data of each host in the enterprise, it is necessary to obtain the consultation data of ChatGPT, the knowledge data of the ATT&CK site and the expert annotated feature data as external known data, so as to serve as the basic data for the ATT&CK engine, NLP inference engine and other machine learning engines to determine the analysis rules and perform knowledge inference.

[0042] For step 102:

[0043] In the embodiment of the present application, the network data of each host obtained in step 100 has multiple data types, including structured data, unstructured data and semi-structured data. Structured data is data represented in a certain format such as tables and databases, which can usually be directly used to construct a knowledge graph; unstructured data is text, audio, video, pictures, etc., which need to be knowledge extracted before further establishing a knowledge graph; semi-structured data is a data between structured and unstructured, which also needs to be information extracted to establish a knowledge graph.

[0044] In the present embodiment, in order to establish a knowledge graph of the mutual correlation of each type of network data and improve the detection, tracing and prediction capabilities of network security, it is necessary to perform knowledge modeling and knowledge extraction on the unstructured data and semi-structured data in the network data.

[0045] Knowledge modeling mainly refers to modeling the name, attribute and association relationship of the ontology of each data type, specifically as follows: Figure 2As shown, the ontology includes modeling of the field and scope of the ontology, ontology classes and class structure, ontology properties, ontology property relationships, and relationships between ontologies. The ontology is a knowledge representation method and a conceptual formalization. Conceptualization refers to an abstract model of a phenomenon established by relevant concepts in the world; and formalization refers to a model that can be understood and processed by a machine. The core of ontology modeling is to clarify the concepts of entities in the field of network security, the attributes of the concepts, and the hierarchical relationships between the concepts and the constraints.

[0046] For step 104:

[0047] In the embodiment of the present application, knowledge extraction is performed on the knowledge entities, attributes, and association relationships of network data, and can be implemented in at least three ways as follows:

[0048] The first way is to perform knowledge extraction based on a knowledge extraction template and a professional knowledge base.

[0049] The second way is to perform knowledge extraction based on a deep learning model for network security.

[0050] The third way is to perform knowledge extraction based on a knowledge extraction template and a professional knowledge base, and also based on a deep learning model for network security, and then compare the extraction results of the two ways to summarize the final knowledge extraction result.

[0051] The three ways are described below.

[0052] First, the first way is described.

[0053] In the first way, step 104 can include:

[0054] acquiring a knowledge extraction template containing knowledge entities, attributes, and association relationships;

[0055] For each network data, the following is performed:

[0056] based on the knowledge extraction template, knowledge extraction is performed on the knowledge entities, attributes, and association relationships of the current network data;

[0057] when the knowledge entities cannot be identified, based on the professional knowledge base, knowledge extraction is performed on the knowledge entities, attributes, and association relationships of the current network data;

[0058] based on the data structure of the ontology in the knowledge model, the extracted knowledge is converted into target knowledge.

[0059] In the embodiment, first, the knowledge extraction template set by the expert is acquired, and for each network data, the knowledge extraction template is used to perform knowledge extraction on the network data. When the knowledge extraction template does not contain the knowledge entity or feature in the current network data, the professional knowledge base is used to perform knowledge extraction on the knowledge entity, attribute and association relationship of the current network data. If the professional knowledge base also does not contain the knowledge entity or feature in the current network data, the expert needs to perform knowledge extraction on the current network data, and the knowledge extraction result is supplemented to the knowledge extraction template and the professional knowledge base to update the knowledge extraction template and the professional knowledge base. Then, according to the data structure of the ontology in the knowledge model, the extracted knowledge is converted to the corresponding position in the ontology data structure to generate the target knowledge.

[0060] The above completes the description of mode one, and next, mode two is described.

[0061] In the mode two, the step 104 can include:

[0062] Each network data is input into the deep learning model trained based on the network security data in advance to classify and identify the knowledge entity, attribute and association relationship in the network data.

[0063] Based on the data structure of the ontology in the knowledge model and the classification and identification result of each network data, the target knowledge is generated.

[0064] In the embodiment, the deep learning model needs to be trained in advance using the network security data, and then each network data is input into the deep learning model to classify and identify the knowledge entity, attribute and association relationship in the network data. Then, according to the classification and identification result of each network data, the corresponding knowledge is converted to the corresponding position in the ontology data structure in the knowledge model to generate the target knowledge.

[0065] It can be understood that the deep learning model needs to be continuously iterated and optimized to make the result of knowledge extraction more accurate.

[0066] Next, mode three is described.

[0067] In the mode three, the step 104 can include:

[0068] The knowledge extraction template containing each knowledge entity, attribute and association relationship is acquired;

[0069] For each network data, the following is performed:

[0070] Based on the knowledge extraction template, the knowledge entity, attribute and association relationship of the current network data are extracted;

[0071] When the knowledge entity cannot be recognized, knowledge extraction is performed on the knowledge entity, attribute and association relationship of the current network data based on the professional knowledge base;

[0072] The extracted knowledge is converted into first target knowledge based on the data structure of the ontology in the knowledge model;

[0073] Each network data is input into a deep learning model pre-trained based on network security data to classify and identify the knowledge entity, attribute and association relationship in the network data;

[0074] Based on the data structure of the ontology in the knowledge model and the classification and identification result of each network data, second target knowledge is generated;

[0075] Based on the first target knowledge and the second target knowledge, target knowledge is generated.

[0076] In the embodiment, the extraction results (i.e., the first target knowledge and the second target knowledge) of the first mode and the second mode can be compared to generate the final target knowledge. Through the two modes of knowledge extraction template, professional knowledge base and deep learning model, knowledge extraction is performed on each network data, and then the knowledge extraction of the two modes is compared and analyzed to generate more accurate target knowledge, which can improve the accuracy of knowledge extraction.

[0077] For step 106:

[0078] The structured network data, the target knowledge extracted in step 104 and the external known data are stored in the knowledge base. Specifically, the metadata can be saved to the Mysql database, the structured data can be saved to the Clickhouse database, the semi-structured data can be saved to the MongoDB database and the graph database.

[0079] For step 108:

[0080] In the embodiment of the application, multiple inference engines such as the ATT&CK engine and the NLP inference engine are integrated, so before the step of “determining an analysis rule based on external known data”, it further includes: determining a target engine from an engine list to determine an analysis rule and perform knowledge inference by using the target engine; wherein the engine list includes the ATT&CK engine and the NLP inference engine.

[0081] In the embodiment of the application, when the target engine is determined as the NLP inference engine, step 108 can include:

[0082] Obtaining a data range and a rule instruction;

[0083] Obtaining target knowledge in the data range from the knowledge base to create a session based on the target knowledge;

[0084] The NLP inference engine obtains rule features from the consultation data of ChatGPT and the expert-labeled feature data according to the rule instruction;

[0085] Based on the rule features, target knowledge in the conversation is detected to obtain first inference knowledge;

[0086] Based on the association relationship of the first inference knowledge, second inference knowledge is obtained;

[0087] Based on the first inference knowledge and the second inference knowledge, a prediction result is generated.

[0088] In this embodiment, the data range for this analysis needs to be determined first, including the computer range and the time range. For example, the computer range can be determined as the finance department, and the time range is determined by determining the running strategy of the conversation, including manual and scheduling. The manual method is to perform an analysis, and the scheduling method is to perform a periodic analysis according to a time point (such as every 10 minutes or every 1 hour).

[0089] Then, the rule instruction is confirmed manually, and then the NLP inference engine obtains rule features from the consultation data of ChatGPT and the expert-labeled feature data in the knowledge base according to the rule instruction. For example, the rule instruction is "detect whether there is a DDOS attack", then the NLP inference engine will first identify the rule instruction, and then obtain the DDOS feature from the consultation data of ChatGPT and the expert-labeled feature data.

[0090] Next, based on the rule features, target knowledge in the conversation is detected to obtain first inference knowledge, and based on the association relationship of the first inference knowledge, second inference knowledge can be obtained, and then the first inference knowledge and the second inference knowledge are taken as a prediction result for display.

[0091] In the embodiment of the application, when the target engine is determined as the ATT&CK engine, step 108 can include:

[0092] Obtain the data range and the rule instruction;

[0093] Obtain target knowledge in the data range from the knowledge base to create a conversation based on the target knowledge;

[0094] The ATT&CK engine obtains rule features from the knowledge data of the ATT&CK site according to the rule instruction;

[0095] Based on the rule features, target knowledge in the conversation is detected to obtain first inference knowledge;

[0096] Based on the association relationship of the first inference knowledge, second inference knowledge is obtained;

[0097] generate a prediction result based on the first reasoning knowledge and the second reasoning knowledge.

[0098] In this embodiment, similar to the reasoning process of the NLP reasoning engine, the data range of this analysis is first determined, including the computer range and the time range. Then, the rule instruction is confirmed manually, and then the NLP reasoning engine obtains the rule features from the knowledge data of the ATT&CK site in the knowledge base according to the rule instruction. Then, based on the rule features, the target knowledge in the session is detected to obtain the first reasoning knowledge, and the second reasoning knowledge can be obtained according to the association relationship of the first reasoning knowledge. Then, the first reasoning knowledge and the second reasoning knowledge are taken as the prediction result for display.

[0099] In some embodiments, when the target engine is determined as the ATT&CK engine, after the step of "obtaining the second reasoning knowledge", before the step of "generating the prediction result", it further includes:

[0100] Based on the first reasoning knowledge, the second reasoning knowledge and the ATT&CK knowledge matrix in the knowledge data, the next attack mode is predicted, so as to generate the prediction result based on the first reasoning knowledge, the second reasoning knowledge and the next attack mode.

[0101] In this embodiment, the positions of the first reasoning knowledge and the second reasoning knowledge in the ATT&CK knowledge matrix are determined, and the next row of the positions of the first reasoning knowledge and the second reasoning knowledge in the ATT&CK knowledge matrix is the possible next attack mode. The first reasoning knowledge, the second reasoning knowledge and the next attack mode are taken as the prediction result for display.

[0102] The display mode of the result includes session result overview, alarm list, graph analysis, ATT&CK matrix, alarm timeline and host and host user. The session result overview displays the time range of this session, the list of hit rule instructions, the number of knowledge entities hit by each rule, etc. The alarm list displays all alarms hit by the rules in this session and classifies them. Each alarm includes each first reasoning knowledge and the second reasoning knowledge associated with the first reasoning knowledge. The graph analysis can select a row in the alarm list to display the association relationship between the reasoning knowledge in this alarm in the form of a graph. The ATT&CK matrix displays the attack mode found in this analysis result and the tactics and techniques covered in the ATT&CK matrix. The alarm timeline displays the timeline of each host that has an alarm in the dimension of host name. The host and host user display all hosts hit in this analysis and the list of users involved in each host.

[0103] Therefore, the scheme can realize expansion of behavior analysis from post-compromise behavior analysis of an enterprise intranet, a Windows platform, and a terminal side to multi-scenarios (enterprise intranet, mobile environment, etc.), multi-platforms (Windows, Linux, macOS, etc.), multi-source data (terminal, network, file, etc.), and attack chain full life cycle, can effectively expand the context of threat event analysis, and can further realize effective detection, comprehensive tracing, and accurate prediction of a threat event.

[0104] As shown in Figure 3 , Figure 4 , the embodiment of the application provides a network security prediction device. The device embodiment can be realized by software, or realized by hardware or a combination of software and hardware. From the hardware layer, as shown in Figure 3 , a hardware architecture diagram of a computing device where the network security prediction device provided by the embodiment of the application is located, in addition to the processor, the memory, the network interface, and the non-volatile memory shown in Figure 3 , the computing device where the device in the embodiment is usually also composed of other hardware, such as a forwarding chip responsible for processing a message, etc. Taking the software implementation as an example, as shown in Figure 4 , as a logically meaningful device, it is formed by the CPU of the computing device where the device is located to read the corresponding computer program in the non-volatile memory into the memory for running.

[0105] As shown in Figure 4 , the embodiment provides a network security prediction device, which comprises:

[0106] The acquisition unit 401 is configured to acquire external known data and network data of each host in real time, wherein the network data comprises log data and traffic data;

[0107] The modeling unit 402 is configured to model a data structure of the ontology based on the network data and a pre-acquired professional knowledge base, to obtain a knowledge model, wherein the data structure comprises a name, an attribute, and a correlation of the ontology;

[0108] The extraction unit 403 is configured to perform knowledge extraction on knowledge entities, attributes, and correlation of the network data based on the professional knowledge base and the knowledge model, to generate a plurality of target knowledge;

[0109] The storage unit 404 is configured to generate a knowledge graph based on the target knowledge, and store the knowledge graph and the external known data into the knowledge base;

[0110] The reasoning unit 405 is configured to determine an analysis rule based on the external known data, to perform knowledge reasoning on the target knowledge based on the analysis rule, to obtain a prediction result.

[0111] In an embodiment of the present application, the extraction unit 403 is configured to perform:

[0112] Obtain a knowledge extraction template containing each knowledge entity, attribute and association relationship;

[0113] For each network data, the following is performed:

[0114] Based on the knowledge extraction template, the knowledge entity, attribute and association relationship of the current network data are extracted;

[0115] When the knowledge entity cannot be recognized, the knowledge entity, attribute and association relationship of the current network data are extracted based on the professional knowledge base;

[0116] Based on the data structure of the ontology in the knowledge model, the extracted knowledge is converted into the first target knowledge.

[0117] In an embodiment of the present application, after the extraction unit 403 performs the conversion of the extracted knowledge into the first target knowledge based on the data structure of the ontology in the knowledge model, it is further configured to perform:

[0118] Each network data is input into a deep learning model pre-trained based on network security data to classify and identify the knowledge entity, attribute and association relationship in the network data;

[0119] Based on the data structure of the ontology in the knowledge model and the classification and identification result of each network data, the second target knowledge is generated;

[0120] Based on the first target knowledge and the second target knowledge, the target knowledge is generated.

[0121] In an embodiment of the present application, the external known data in the acquisition unit 401 includes: ChatGPT consultation data, ATT&CK site knowledge data and expert annotated feature data;

[0122] Before the reasoning unit 405 performs the determination of the analysis rule based on the external known data, it is further configured to:

[0123] Determine a target engine from an engine list to determine the analysis rule and perform knowledge reasoning using the target engine; wherein the engine list includes an ATT&CK engine and an NLP reasoning engine.

[0124] In an embodiment of the present application, when the target engine is determined as the NLP reasoning engine, the reasoning unit 405 is configured to perform:

[0125] Obtain a data range and a rule instruction;

[0126] Obtain target knowledge within the data range from the knowledge base to create a session based on the target knowledge.

[0127] The NLP inference engine obtains rule features from the consultation data of ChatGPT and the expert-labeled feature data according to the rule instruction;

[0128] Based on the rule features, target knowledge in the conversation is detected to obtain first inference knowledge;

[0129] Based on the association relationship of the first inference knowledge, second inference knowledge is obtained;

[0130] Based on the first inference knowledge and the second inference knowledge, a prediction result is generated.

[0131] In an embodiment of the present application, when the target engine is determined to be an ATT&CK engine, the inference unit 405 is configured to perform:

[0132] Obtain data range and rule instruction;

[0133] Obtain target knowledge within the data range from the knowledge base to create a conversation based on the target knowledge;

[0134] The ATT&CK engine obtains rule features from the knowledge data of the ATT&CK site according to the rule instruction;

[0135] Based on the rule features, target knowledge in the conversation is detected to obtain first inference knowledge;

[0136] Based on the association relationship of the first inference knowledge, second inference knowledge is obtained;

[0137] Based on the first inference knowledge and the second inference knowledge, a prediction result is generated.

[0138] In an embodiment of the present application, after obtaining the second inference knowledge, the inference unit 405 is further configured to, before generating the prediction result:

[0139] Based on the first inference knowledge, the second inference knowledge and the ATT&CK knowledge matrix in the knowledge data, predict the next attack mode, to generate the prediction result based on the first inference knowledge, the second inference knowledge and the next attack mode.

[0140] The information interaction, execution process and other contents between the modules in the above device are based on the same concept as the method embodiments of the present application, and the specific contents can be referred to the description in the method embodiments of the present application, which will not be described here.

[0141] The present application also provides a computing device comprising a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement the prediction method of network security in any one of the embodiments of the present application.

[0142] The embodiment of the present application also provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program enables a processor to execute the network security prediction method in any of the embodiments of the present application when the computer program is executed by the processor.

[0143] Specifically, a system or device provided with a storage medium storing software program codes for realizing the functions of any of the above embodiments, and enabling a computer (or CPU or MPU) of the system or device to read and execute the program codes stored in the storage medium.

[0144] In this case, the program codes read from the storage medium can realize the functions of any of the above embodiments by themselves, and therefore the program codes and the storage medium storing the program codes constitute a part of the present application.

[0145] The embodiments of the storage medium for providing the program codes include floppy disks, hard disks, magneto-optical disks, optical disks (such as CD-ROM, CD-R, CD-RW, DVD-ROM, DVD-RAM, DVD-RW, DVD+RW), magnetic tapes, nonvolatile memory cards and ROMs. Alternatively, the program codes can be downloaded from a server computer through a communication network.

[0146] In addition, it should be clear that not only the program codes read by the computer, but also the operating system and the like operating on the computer can complete part or all of the actual operations based on the instructions of the program codes, so as to realize the functions of any of the above embodiments.

[0147] In addition, it should be understood that the program codes read from the storage medium can be written into the memory provided in the expansion board inserted into the computer or the memory provided in the expansion module connected to the computer, and then part or all of the actual operations can be executed by the CPU and the like installed on the expansion board or the expansion module based on the instructions of the program codes, so as to realize the functions of any of the above embodiments.

[0148] It should be noted that, in this document, the relationship terms such as first and second are merely used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply that there is any such actual relationship or order between these entities or operations. Moreover, the terms "include", "contain" or any other variants thereof are intended to cover non-exclusive inclusion, so that the processes, methods, articles or devices including a series of elements not only include those elements, but also include other elements not explicitly listed or inherent to such processes, methods, articles or devices.

[0149] Those skilled in the art can understand that all or part of the steps of the above-mentioned method embodiments can be completed by related hardware of program instructions, and the foregoing program can be stored in a computer-readable storage medium, and the program executes the steps of the above-mentioned method embodiments when executed; and the foregoing storage medium includes various storage media that can store program codes, such as ROM, RAM, magnetic disks or optical disks.

[0150] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, and not to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or make equivalent replacements for part of the technical features; and these modifications or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A method of predicting network security, characterized by, The method comprises the following steps: Real-time acquisition of external known data and network data of each host; wherein, the network data comprises log data and traffic data; Based on the network data and the pre-acquired professional knowledge base, the data structure of the ontology is modeled to obtain a knowledge model; wherein, the data structure comprises the name, attributes and association relationships of the ontology; Based on the professional knowledge base and the knowledge model, knowledge entities, attributes and association relationships of the network data are extracted to generate a plurality of target knowledge; Based on the target knowledge, a knowledge graph is generated, and the knowledge graph and the external known data are stored in a knowledge base; Based on the external known data, an analysis rule is determined to perform knowledge reasoning on the target knowledge based on the analysis rule to obtain a prediction result; The external known data comprises ChatGPT consultation data, ATT&CK site knowledge data and expert annotated feature data; Before determining the analysis rule based on the external known data, a target engine is determined from an engine list to determine the analysis rule and perform knowledge reasoning using the target engine; wherein, the engine list comprises an ATT&CK engine and an NLP reasoning engine; When the target engine is determined to be the ATT&CK engine, the analysis rule is determined based on the external known data, and the target knowledge is subjected to knowledge reasoning based on the analysis rule to obtain a prediction result, which comprises: Acquiring data range and rule instructions; Acquiring the target knowledge within the data range from the knowledge base to create a session based on the target knowledge; The ATT&CK engine acquires rule features from the knowledge data of the ATT&CK site according to the rule instructions; Based on the rule features, the target knowledge in the session is detected to obtain first reasoning knowledge; Based on the association relationship of the first reasoning knowledge, second reasoning knowledge is obtained; Based on the first reasoning knowledge and the second reasoning knowledge, a prediction result is generated.

2. The method of claim 1, wherein, Based on the professional knowledge base and the knowledge model, knowledge entities, attributes and association relationships of the network data are extracted to generate a plurality of target knowledge, which comprises: Acquiring a knowledge extraction template containing knowledge entities, attributes and association relationships; For each network data, the following steps are performed: Based on the knowledge extraction template, knowledge entities, attributes and association relationships of the current network data are extracted; When the knowledge entity cannot be identified, the knowledge entities, attributes and association relationships of the current network data are extracted based on the professional knowledge base; Based on the data structure of the ontology in the knowledge model, the extracted knowledge is converted into first target knowledge.

3. The method of claim 1, wherein, After converting the extracted knowledge into first target knowledge based on the data structure of the ontology in the knowledge model, the following steps are further included: Each network data is input into a deep learning model pre-trained based on network security data to classify and identify knowledge entities, attributes and association relationships in the network data; generate second target knowledge based on the data structure of the ontology in the knowledge model and the classification recognition result of each network data; generate target knowledge based on the first target knowledge and the second target knowledge.

4. The method of claim 1, wherein, When the target engine is determined to be an NLP inference engine, the analysis rule is determined based on the external known data, and knowledge inference is performed on the target knowledge based on the analysis rule to obtain a prediction result, including: acquiring data range and rule instructions; acquiring the target knowledge in the data range from the knowledge base to create a session based on the target knowledge; the NLP inference engine acquires rule features from the consultation data of the ChatGPT and the expert-labeled feature data according to the rule instructions; detect the target knowledge in the session based on the rule features to obtain first inference knowledge; obtain second inference knowledge based on the association relationship of the first inference knowledge; generate a prediction result based on the first inference knowledge and the second inference knowledge.

5. The method of claim 1, wherein, After the second inference knowledge is acquired, before the prediction result is generated, it further includes: predict the attack mode of the next step based on the first inference knowledge, the second inference knowledge, and the ATT&CK knowledge matrix in the knowledge data, and generate a prediction result based on the first inference knowledge, the second inference knowledge, and the attack mode of the next step.

6. A cyber-security prediction apparatus for implementing the method of any one of claims 1-5, characterized by, including: an acquisition unit configured to acquire external known data and network data of each host in real time; wherein the network data includes log data and traffic data; a modeling unit configured to model a data structure of an ontology based on the network data and a pre-acquired professional knowledge base, to obtain a knowledge model; wherein the data structure includes the name, attributes, and association relationship of the ontology; an extraction unit configured to perform knowledge extraction on knowledge entities, attributes, and association relationships of the network data based on the professional knowledge base and the knowledge model, to generate a plurality of target knowledge; a storage unit configured to generate a knowledge graph based on the target knowledge, and store the knowledge graph and the external known data into a knowledge base; an inference unit configured to determine an analysis rule based on the external known data, and perform knowledge inference on the target knowledge based on the analysis rule to obtain a prediction result.

7. A computing device comprising a memory and a processor, the memory storing a computer program, and the processor executing the computer program to implement the method of any one of claims 1-5.

8. A computer-readable storage medium storing a computer program, which, when executed in a computer, causes the computer to perform the method of any one of claims 1-5.

Images