A bayesian network-based remote behavior knowledge base construction and prediction method

Abstract

The application provides a method for constructing and predicting remote behavior knowledge base based on a Bayesian network. The method comprises the following steps: constructing a remote behavior knowledge base, including a remote behavior perception graph, a remote behavior feature graph and a remote behavior traceability graph, by performing feature extraction and analysis on remote behavior historical data; based on the established knowledge graph, a large number of data sets with time sequence relationship are formed from the historical data, the Prefixspan algorithm is used to calculate the data sets, and the causal association rules in the remote behavior are obtained; and the historical data are subjected to parameter learning, the remote behavior Bayesian network structure is constructed in combination with the association rules, and the next step of attack behavior prediction is realized.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of network security, and in particular to a remote control behavior knowledge base construction and prediction method based on a Bayesian network. BACKGROUND

[0002] With the rapid development of Internet technology and the popularity of information-based office work, remote control technology has gradually improved. Especially in the past two years, the demand for remote control has risen with the tide, and has been widely used in our work. More and more enterprises are no longer satisfied with using information systems within the enterprise. Due to the reasons of employees working from home, business trips, customer requirements, etc., the demand for remote control access tools is high. However, remote access to enterprise internal network resources undoubtedly increases the risk of enterprise network attacks and improves the possibility of network security remote control incidents.

[0003] Computer remote control is a means of operating a computer using remote technology, and the implementation method is to achieve control of all data resources of the controlled end by remote control software. Its essence is a client / server program, which serves as the control end and the controlled end, respectively. When the two establish a connection, the remote computer can control the local program. Common remote control technologies and frameworks include Grpc, Dubbo, XML-RPC, and Thrift.

[0004] While remote control technology makes people's work and life more convenient, it also causes some network security problems. Worms, Trojans, APT attacks and other malicious programs have been hidden on the Internet for a long time, infringing on the legitimate rights and interests of users. Among them, remote control Trojans belong to a category of malicious programs, which are generally composed of a control end and a controlled end. Attackers often use a control end to control multiple controlled ends. This type of Trojan can control the controlled end to perform malicious operations and illegally access various data resources of the controlled end, thereby stealing private information.

[0005] In recent years, the application of machine learning to remote control event research has made a lot of progress. In contrast, the use of network security knowledge graph technology to build related knowledge bases to detect remote control events is still in its early stages. Network security knowledge graph is the practical application of knowledge graph in the field of network security, including the construction of security knowledge ontology structure based on ontology, and the processing, processing and integration of multi-source heterogeneous network security field information through threat modeling, etc. into a structured wisdom security field knowledge base. For internal network data, the alarm traffic and traffic data lack relevant semantics, while the security knowledge graph incorporates existing security knowledge, which can greatly improve the accuracy of threat identification and assessment.

[0006] In the aspect of network security knowledge graph construction, many scholars have conducted a lot of research. Based on the ontology research shows that the network security ontology is hierarchical, has many modular sub ontology, and the abstract hierarchical concept can be divided into upper layer, middle layer and domain ontology. In the aspect of knowledge reasoning and knowledge graph construction, there are three kinds of reasoning methods: rule-based reasoning, distributed representation-based reasoning and neural network-based reasoning.

[0007] Due to the above-mentioned ontology-based research and the wide application field of knowledge graph construction, the related concepts are relatively abstract, and the applicability in a specific field is lacking, so it is not well adapted to remote control events and malicious program attacks, and under the current situation, remote control has a great security risk, and it is urgently needed to defend, track and capture. Therefore, how to adaptively construct the knowledge graph of remote control event direction and perform knowledge reasoning and association rule mining on it has become the focus of the present application. SUMMARY

[0008] In the aspect of constructing the remote control event knowledge graph and the reasoning model, it is difficult to perceive the complete network structure and the actual remote control path of the remote control event only according to the traffic log alarm method, in order to solve this problem, the present application provides a remote behavior knowledge base construction and prediction method based on Bayesian network. The present patent comprises two parts of remote behavior knowledge base construction method and remote behavior prediction. All historical traffic data and log data are used as data sources, element extraction is performed on the data sources, a remote behavior perception graph, a remote behavior feature graph and a remote behavior tracing graph are constructed, and the three graphs constitute a remote behavior knowledge base. Then, combined with the prefixspan algorithm, a remote behavior Bayesian network structure is constructed to realize behavior prediction. In order to achieve the above purpose, the technical scheme of the present application comprises:

[0009] A remote behavior knowledge base construction and prediction method based on Bayesian network, comprising the following steps:

[0010] 1) constructing a remote behavior knowledge base by using historical data of a target network; the remote behavior knowledge base comprises a remote behavior perception graph, a remote behavior feature graph and a remote behavior tracing graph;

[0011] 2) constructing a remote behavior tracing atlas according to the remote behavior tracing graph, historical traffic data and log data obtained in step 1); taking the data in the remote behavior tracing atlas as source data, performing data mining and data association operations on the source data, and mining the association rules in the remote behavior process;

[0012] 3) constructing a Bayesian network according to the association rules; inputting the current attack traffic five-tuple information in the target network into the Bayesian network, performing attack prediction and tracing to the attack host.

[0013] Further, the remote behavior perception graph includes three types of perception graph triples; the entity of the first type of perception graph triple is a user, the attribute is a user name and a user permission user role, and the relationship is an associated device relationship; the entity of the second type of perception graph triple is a device, the attribute is an IP address, a port number and a device name, and the relationship is a corresponding user relationship or a used resource relationship; the entity of the third type of perception graph triple is a resource, the attribute is an IP address, a port number and a resource name, and the relationship is a used protocol relationship; the associated device relationship refers to the relationship between a user and a device, the corresponding user relationship refers to the relationship between a user and a device, the used resource relationship refers to the relationship between a device and a resource, and the used protocol relationship refers to the relationship between a device and a resource.

[0014] Further, the remote behavior feature graph includes four types of feature graph triples: the entity of the first type of feature graph triple is a remote behavior, the attribute is a remote behavior name and a description, and the relationship is an associated attack mode; the entity of the second type of feature graph triple is an attack mode, the attribute is a specific attack mode name and a description, and the relationship is an attack mode and attack type relationship; the entity of the third type of feature graph triple is an attack type, the attribute is a specific attack type name and a description, and the relationship is an associated flow feature; the entity of the fourth type of feature graph triple is a flow feature, the attribute is a specific flow feature name and a feature value, and the relationship is a flow feature and attack type relationship.

[0015] Further, the remote behavior traceability graph includes four types of traceability graph triples: the entity of the first type of traceability graph triple is a remote control end, the attribute is an IP address, a port number and a protocol, and the relationship is a remote control end and controlled end relationship; the entity of the second type of traceability graph triple is a controlled end, the attribute is an IP address, a port number and a protocol, and the relationship is a controlled end and control time relationship; the entity of the third type of traceability graph triple is a control time, the attribute is a start time and an end time, and the relationship is a remote control end and control time relationship; the entity of the fourth type of traceability graph triple is a control mode, the attribute is a control mode description, and the relationship is a remote control end and control mode relationship.

[0016] Further, the method for obtaining the association rule is:

[0017] 21) generating a remote behavior perception graph according to each of the perception graph triples, generating a remote behavior feature graph according to each of the feature graph triples, and generating a remote behavior traceability graph according to each of the traceability graph triples; then taking the triples corresponding to the remote behavior traceability graph as source data S;

[0018] 22) for the same remote behavior, arranging and merging all records with the same behavior ID in the source data S in chronological order to obtain multiple sequences; saving each sequence to a time series data set Q;

[0019] 23) obtain all different items in the time series dataset Q, generate an item sequence; for each item in the item sequence, count the number of sequences in Q containing the item as the occurrence of the item, and take the item with an occurrence not less than a set support as a frequent single item;

[0020] 24) take each frequent single item as a prefix of each sequence in the time series dataset Q, and obtain a projection database corresponding to each frequent single item;

[0021] 25) for each projection database, sequentially perform the following operations: 251) obtain a new frequent single item from the projection database corresponding to the current frequent single item, and combine the new frequent single item with the current frequent single item to obtain a combined frequent single item and calculate its projection database; 252) take the combined frequent single item as the current frequent single item; 253) repeat steps 251) to 252) recursively until there is no new frequent single item, and generate a frequent sequence from the original frequent single item and each new frequent single item obtained;

[0022] 26) take each frequent sequence obtained in step 25) as a said association rule; the frequent sequence provides the association relationship between nodes in the remote access behavior, i.e. the causal relationship association rule of the remote access behavior.

[0023] Further, the constructed Bayesian network is trained using the source data S, and then the current attack traffic five-tuple information in the target network is input into the trained Bayesian network to perform attack prediction and trace to the attack host.

[0024] Further, the set support is 2.

[0025] A server, characterized in that it comprises a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program comprising instructions for executing each step of the above method.

[0026] A computer readable storage medium having a computer program stored thereon, characterized in that the computer program is executed by a processor to implement the steps of the above method.

[0027] The main advantage of the embodiments of the present application compared with the prior art is that:

[0028] The application constructs a remote behavior knowledge base in a remote behavior scene, comprehensively including various entities and relationships of remote behavior. On the other hand, the causal relationship association rules in the scene are calculated by using the remote behavior historical data, and then the Bayesian network structure for prediction is constructed based on the rules. Therefore, in order to solve the problem of lack of research on knowledge graph in remote control scene and the problem of low adaptability of general network security knowledge graph, the Bayesian network structure is introduced, and the application of network security knowledge graph in remote behavior scene is further expanded, and the next step of attack prediction of remote behavior is realized. BRIEF DESCRIPTION OF DRAWINGS

[0029] Figure 1 The remote behavior knowledge base construction flowchart of the application is shown.

[0030] Figure 2 The prediction method flowchart of the application is shown. DETAILED DESCRIPTION

[0031] In order to make the purpose, technical scheme and advantages of the application more clear, the embodiments of the application will be further described in detail.

[0032] The application relates to a remote behavior knowledge base construction method based on a Bayesian network.

[0033] Step 1: Constructing a remote behavior knowledge base

[0034] The historical traffic data and log data are taken as data sources, entity extraction, relationship extraction and attribute extraction are carried out, a remote behavior perception graph, a remote behavior feature graph and a remote behavior traceability graph are constructed, and a remote behavior knowledge base is further formed.

[0035] (1) Remote behavior perception graph

[0036] The remote behavior perception graph is used for perceiving the network topology environment of the whole target network, and the graph stores five-tuple information of all hosts entering the network topology environment, including source IP (source IP), source port (source port), target IP (destination IP), target port (destination port) and layer 4 communication protocol (the layer 4 protocol). The three-tuple structure of the graph is shown in Table 1:

[0037] Table 1 Remote behavior perception knowledge graph three-tuple

[0038]

[0039]

[0040] Wherein the association device relationship refers to the relationship between the user and the device, the corresponding user relationship refers to the relationship between the user and the device, the use resource refers to the relationship between the device and the resource, and the use protocol refers to the relationship between the device and the resource.

[0041] (2) Remote access behavior feature graph

[0042] Based on the remote access behavior scenario, the remote access behavior feature graph is constructed by entity extraction, attribute extraction and relationship extraction on the data source. Then, the characteristic properties of various remote access behaviors are summarized by statistical methods, which provides an important basis for identifying the types and paths of various remote access behaviors.

[0043] The remote access behavior feature graph is composed of triples, and the definitions of entities, relationships and attributes therein are shown in Table 2:

[0044] Table 2 Remote access behavior feature graph

[0045] entity attribute relationship remote behavior name, description correlation attack mode attack mode name, description (correlation attack mode) correlation attack type attack type name, description correlation traffic feature traffic feature feature name, feature value (correlation traffic feature) correlation attack type

[0046] Wherein the association attack mode relationship refers to the relationship between the remote access behavior and the attack mode, the (attack mode) associated attack type refers to the relationship between the attack mode and the attack type, the associated flow characteristic refers to the relationship between the attack type and the flow characteristic, and the (flow characteristic) associated attack type refers to the relationship between the flow characteristic and the attack type.

[0047] (3) Remote access behavior tracing graph

[0048] The triple composition of the remote access behavior tracing graph is shown in Table 3. The remote access behavior tracing graph provides five-tuple information based on the remote access behavior perception graph and attack mode information provided by the remote access behavior feature graph, constructs an attack timing graph as knowledge information, and inserts it into the knowledge graph. When new attack flow five-tuple information is transmitted, the remote access behavior tracing graph identifies the attack and traces it to the host that initiated the attack. The remote access behavior tracing graph depicts the complete path of the attack from initiation to completion. The graph contains remote control terminals, controlled terminals, control times, control modes and other entities. The triple composition of the graph is as follows:

[0049] Table 3 Remote access behavior tracing knowledge graph triples

[0050]

[0051]

[0052] Wherein the associated controlled terminal refers to the relationship between the remote control terminal and the controlled terminal, the associated control time refers to the relationship between the controlled terminal and the control time, the (control time) corresponding to the remote control terminal refers to the relationship between the remote control terminal and the control time, and the (control mode) corresponding to the remote control terminal refers to the relationship between the remote control terminal and the control mode.

[0053] Step 2: Remote behavior prediction

[0054] 1. Mining remote behavior causal association rules

[0055] 1) Basic concepts

[0056] Sequence: Each sequence is ordered by different elements in time sequence, each element is composed of different items, and the length of the sequence is the number of all items in the sequence, and the length of the item is 1.

[0057] Subsequence: For sequences t and s, if each ordered element in t is a subset of an ordered element in s, then t is a subsequence of s.

[0058] Prefix: For sequence A = {a1, a2,..., an} and sequence B = {b1, b2,..., bn}, n ≤ m, satisfy a1 = b1, a2 = b2,..., an = bn, and n} and sequence B = {b1, b2,..., bn}, n ≤ m, satisfy a1 = b1, a2 = b2,..., an = bn, and m} and sequence B = {b1, b2,..., bn}, n ≤ m, satisfy a1 = b1, a2 = b2,..., an = bn, and n-1} and sequence B = {b1, b2,..., bn}, n ≤ m, satisfy a1 = b1, a2 = b2,..., an = bn, and n-1} and sequence B = {b1, b2,..., bn}, n ≤ m, satisfy a1 = b1, a2 = b2,..., an = bn, and then A is called the prefix of B.

[0059] Suffix: For a prefix, the subsequence left after the prefix in the sequence is called the suffix.

[0060] Projection database: the set of all suffixes corresponding to the same prefix is called the projection database corresponding to the prefix.

[0061] Based on step 1 and historical traffic data and log data, a knowledge graph of remote behavior awareness graph, remote behavior feature graph and remote behavior traceability graph is established using Neo4j graph database, which is composed of nodes and directed lines, and each node is linked by directed lines, where the directed lines represent the association between two nodes.

[0062] Since the remote behavior traceability knowledge graph describes the complete path of remote behavior attack from initiation to end through nodes and directed lines, it is assumed that there are N different remote control terminals in the remote behavior traceability knowledge graph database, denoted as C = {C1, C2,..., CN}, and the same node data of the remote control terminal is merged, denoted as S = {S1, S2,..., SN}. N N

[0063] 2) Data processing

[0064] Each node is denoted as an item, and for all node information S1 of remote control terminal C1, nodes with the same occurrence time are merged to form an element, and the elements are merged in time sequence to form a sequence ​​

[0065] Then the above operation is performed on other remote controls to obtain a sequence set Q:

[0066]

[0067]

[0068] 3) Mining frequent sequences

[0069] The present application adopts the prefixspan algorithm to mine the association rules in remote behaviors, sets the minimum support degree as 2, and the specific algorithm steps are as follows:

[0070] a. Scanning the sequence set Q to find all different elements, assuming as (a), (b), (c), (d), (e), (f). The number of times of each element appearing in the sequence set Q is calculated, if an element appears many times in the same sequence, it is also counted as once. Assuming that the number of times of (f) is less than the support degree, the element is deleted from all sequences in the sequence set Q, and the frequent single item set is generated , , <c> , <d> , <e>;

[0071] b. In step a, each frequent single item in the frequent single item set is taken as a prefix of each sequence in the sequence set Q, and the projection database of each frequent single item is obtained, denoted as T a , T b , T c , T d , T e ;

[0072] c. The following operations are sequentially performed on T a , T b , T c , T d , T e : first, step a is performed on T a , all different elements are found, and finally new frequent single items are obtained, and the old frequent single items< / e> < / d> < / c> merge with new frequent single item, get frequent single item <a1>, execute the bth step to calculate its projection database. Repeat the recursive execution of the ath to cth steps until there is no frequent item, at which time the frequent sequence with the prefix a can be obtained as< / a1> ， <a1>,..., <a j (j >= 0).

[0073] Through the above algorithm, the frequent sequence in the historical data can be mined, which provides the association relationship between part of the nodes in the long-range behavior, that is, the causal relationship association rule of the long-range behavior, and further improves the prediction effect of the Bayesian network structure in the following.

[0074] 2. Constructing a Bayesian network structure for prediction

[0075] Since the above long-range behavior traceability knowledge graph database is constructed based on historical traffic data and log data, the frequent sequence obtained in the above step shows the association relationship of the nodes in the long-range behavior traceability knowledge graph database, and the nodes in the frequent sequence are connected in time sequence through the directed line segment, and a causal Bayesian attack graph is further constructed. Then all the data in the long-range behavior traceability knowledge graph database are taken as a training set, and the parameter probability of the causal Bayesian attack graph is learned to obtain the probability of the occurrence of the next step node when the node of the above step occurs, and the calculation method is as follows:

[0076]

[0077] Where P j|i The maximum attack behavior is the next step attack behavior after the occurrence of the i-th step attack behavior.

[0078] Therefore, when new attack data comes, the next step attack behavior can be predicted through the Bayesian network structure constructed above.

[0079] The above examples are only for illustrating the technical concept and characteristics of the present application, and the purpose is to enable those skilled in the art to understand the content of the present application and to implement it, and it cannot limit the protection scope of the present application. Any equivalent transformation or modification made according to the spirit and essence of the present application should be covered within the protection scope of the present application.

Claims

1. A method for constructing and predicting a remote control behavior knowledge base based on Bayesian networks, comprising the following steps: 1) Construct a remote control behavior knowledge base using historical data from the target network; The remote control behavior knowledge base includes a remote control behavior perception map, a remote control behavior feature map, and a remote control behavior source map; The remote control behavior perception graph includes three types of perception graph triples; the first type of perception graph triple is an entity of users, with attributes of user name, user permissions, and user roles, and a relationship of associated device relationship; the second type of perception graph triple is an entity of devices, with attributes of IP address, port number, and device name, and a relationship of corresponding user relationship or resource usage relationship; the third type of perception graph triple is an entity of resources, with attributes of IP address, port number, and resource name, and a relationship of usage protocol relationship; the associated device relationship refers to the relationship between users and devices, the corresponding user relationship refers to the relationship between users and devices, the resource usage relationship refers to the relationship between devices and resources, and the usage protocol relationship refers to the relationship between devices and resources; The remote control behavior feature graph includes four types of feature graph triples: the first type of feature graph triple is the entity of the remote control behavior, the attributes are the name and description of the remote control behavior, and the relationship is associated attack method; the second type of feature graph triple is the entity of the attack method, the attributes are the name and description of the specific attack method, and the relationship is the relationship between the attack method and the attack type; the third type of feature graph triple is the entity of the attack type, the attributes are the name and description of the specific attack type, and the relationship is associated traffic feature; the fourth type of feature graph triple is the entity of the traffic feature, the attributes are the name and feature value of the specific traffic feature, and the relationship is the relationship between the traffic feature and the attack type. The remote control behavior tracing graph includes four types of tracing graph triples: The first type of tracing graph triple represents the remote control terminal, with attributes of IP address, port number, and protocol, and the relationship between the remote control terminal and the controlled terminal; the second type of tracing graph triple represents the controlled terminal, with attributes of IP address, port number, and protocol, and the relationship between the controlled terminal and the control time; the third type of tracing graph triple represents the control time, with attributes of start time and end time, and the relationship between the remote control terminal and the control time; the fourth type of tracing graph triple represents the control method. The attribute describes the control method, and the relationship is the relationship between the remote control terminal and the control method. 2) Based on the remote control behavior tracing graph, historical traffic data, and log data obtained in step 1), construct a remote control behavior tracing graph; using the data in the remote control behavior tracing graph as source data, perform data mining and data association operations on the source data to mine the association rules in the remote control behavior process; the method for obtaining the association rules is as follows: 21) Generate a remote control behavior perception map based on each of the perception map triples, generate a remote control behavior feature map based on each of the feature map triples, and generate a remote control behavior tracing map based on each of the tracing map triples; then use the triples corresponding to the remote control behavior tracing map as source data S. 22) For the same remote control action, all records with the same action ID in the source data S are arranged and merged in chronological order to obtain multiple sequences; Save each sequence to the time series dataset Q; 23) Obtain all distinct items in the time series dataset Q and generate an item sequence; for each item in the item sequence, count the number of sequences in Q that contain the item as the occurrence frequency of the item, and select items whose occurrence frequency is not less than the set support as frequent single items; 24) Using each frequent item as a prefix for each sequence in the time series dataset Q, a projection database of each corresponding frequent item is obtained; 25) Perform the following operations sequentially on each of the projection databases: 251) Obtain a new frequent item from the projection database corresponding to the current frequent item, merge the new frequent item with the current frequent item to obtain the merged frequent item, and calculate its projection database. 252) Take the merged frequent item as the current frequent item; 253) Repeat steps 251) to 252) recursively until there are no new frequent items, and generate a frequent sequence based on the original frequent items and the new frequent items obtained. 26) Take each of the frequent sequences obtained in step 25) as an association rule; the frequent sequences provide the association relationship between nodes in the remote control behavior, that is, the causal relationship association rule of the remote control behavior; 3) Construct a Bayesian network based on the association rules; The attack traffic quintuple information in the target network is input into the Bayesian network to predict the attack and trace it back to the attacking host.

2. The method according to claim 1, characterized in that, The constructed Bayesian network is trained using the source data S. Then, the current attack traffic quintuple information in the target network is input into the trained Bayesian network to predict the attack and trace it back to the attacking host.

3. The method according to claim 1, characterized in that, The set support level is 2.

4. A server, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing each step of the method of any one of claims 1 to 3.

5. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 3.

Images