An adaptive network security defense strategy configuration system

Abstract

The present invention relates to an adaptive network security defense strategy configuration system, comprising multiple network nodes and a network security management platform. The network security management platform comprises a behavior simulation module, a feature extraction module, an attack evolution module, and a strategy configuration module. The network security management platform generates a corresponding attack behavior relationship network based on the historical vulnerability information of the network nodes, maps an alarm sequence composed of multiple coarse-grained alarm information of the network nodes to the attack behavior relationship network to obtain an attack evolution sequence of the current network intrusion behavior, determines a first attack feature and a second attack feature of the network intrusion behavior based on the alarm sequence and the attack evolution sequence, determines the threat level of the network intrusion behavior based on the first threat feature and the second threat feature of the network intrusion behavior, and executes an adaptive configuration strategy for the system's scheduling tasks according to the threat level of the network intrusion behavior.

Description

Technical Field

[0001] The present invention relates to the fields of cloud computing and network security, and in particular to an adaptive network security defense strategy configuration system. Background Art

[0002] With the rapid development of my country's economy, the efficient information exchange method provided by computer network technology has become an indispensable part of economic development. However, as a means of information exchange, computer network technology is extremely susceptible to penetration by some computer viruses and Trojans due to its openness and interconnectedness, resulting in the leakage of computer users' privacy, threatening the safe use of computer technology, and causing computer users to worry about network security.

[0003] Existing network security defense strategies mostly rely on a single defense strategy. For example, spatiotemporal diversity defense strategies can present different security attributes at different time periods, making the system dynamic. Spatial diversity defense strategies simultaneously maintain redundant and heterogeneous executors or processes, preventing attacks on a single executor or process from causing service failure. The threat landscape facing systems in cloud environments is constantly evolving, and existing system defense strategies are not highly adaptable. Deploying excessive defense resources when the threat level decreases will result in reduced system service quality. Summary of the Invention

[0004] In response to the shortcomings of the existing technology, the present invention provides an adaptive network security defense strategy configuration system, which includes multiple network nodes and a network security management platform. The network security management platform includes a behavior simulation module, a feature extraction module, an attack evolution module, and a strategy configuration module.

[0005] The behavior simulation module extracts an action node set and a state node set of historical network intrusion behaviors based on historical vulnerability information of network nodes, and constructs each single-step attack action node of the simulated network intrusion behavior based on each matching action node and state node in the action node set and the state node set, wherein each action node in the action node set corresponds to an attack action taken by the simulated network intrusion behavior, and the attack action is used to represent a scan or a vulnerability exploit;

[0006] The feature extraction module adds corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updates the attack behavior relationship network, extracting the first attack feature of the current network intrusion behavior based on multiple coarse-grained alarm information generated in real time by the network nodes, wherein the coarse-grained alarm information is used to characterize the attack information of the current network intrusion behavior of the network node, and the network parameters include edge weights and node attributes, and the node attributes are used to characterize the local conditional probability distribution characteristics of the corresponding single-step attack action node;

[0007] The attack evolution module maps each coarse-grained alarm information arranged in chronological order in the alarm sequence of the network node to the corresponding single-step attack action node in the updated attack behavior relationship network, uses the mapped single-step attack action nodes as the attack observation nodes of the alarm sequence, analyzes all the attack observation nodes corresponding to the alarm sequence to obtain the attack evolution sequence of the current network intrusion behavior, and obtains the second attack feature of the current network intrusion behavior based on the analysis of the attack evolution sequence;

[0008] The policy configuration module determines the threat level of the network intrusion behavior based on the first attack feature and the second attack feature of the network intrusion behavior. When it is determined that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to shift the execution process of the current network node to an execution direction with improved security; when it is determined that the threat level of the network intrusion behavior is less than or equal to the preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes temporal diversity to shift the execution process of the current network node to an execution direction with reduced security.

[0009] According to a preferred embodiment, the execution configuration strategy that maximizes spatial heterogeneous diversity refers to simultaneously adopting multiple equivalent execution processes for a scheduling task, and voting on the execution results of different execution processes to obtain the final output; the execution configuration strategy that maximizes temporal diversity refers to rotating different execution processes or system properties for a scheduling task in different time segments, that is, using different execution processes for processing in different time segments or presenting different system properties to the outside world.

[0010] According to a preferred embodiment, each state node in the state node set is used to represent the state of the simulated network intrusion behavior, and the state is used to represent whether the corresponding simulated network intrusion behavior obtains the corresponding authority or occupies the corresponding resource.

[0011] According to a preferred embodiment, the attack evolution sequence of the current network intrusion behavior obtained by analyzing all attack observation nodes corresponding to the alarm sequence includes:

[0012] Based on the edge weights and node attributes of each attack observation node, the prior attack probability of each attack observation node is determined, the historical verification rate and historical false alarm rate of the attack action corresponding to each coarse-grained alarm information are obtained, and the alarm confidence of each coarse-grained alarm information is determined according to the prior attack probability, historical verification rate and historical false alarm rate of each attack observation node;

[0013] Each terminated single-step attack action node in the updated attack behavior relationship network that does not have a subsequent single-step attack action node and has one or more attack observation nodes in the path sequence is used as the target single-step attack action node for evolutionary analysis. The intrusion probability of each target single-step attack action node is determined based on the alarm confidence of each coarse-grained alarm information.

[0014] The target single-step attack action node with the largest intrusion probability is used as the attack evolution node, and the path sequence corresponding to the attack evolution node is used as the attack evolution sequence of the current network intrusion behavior.

[0015] According to a preferred embodiment, when determining that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the method further includes:

[0016] Determine whether the spatial heterogeneous diversity of the execution process in the current scheduling cycle of the network node has reached a maximum. If so, shorten the scheduling cycle of each execution process until the service performance of the network node returns to normal; if not, adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to increase the spatial heterogeneous diversity of the execution process in the current scheduling cycle, and shift the execution process in the current scheduling cycle to an execution direction with improved security until the service performance of the network node returns to normal.

[0017] According to a preferred embodiment, when determining that the threat level of the network intrusion behavior is less than or equal to a preset threat level threshold, the method further includes:

[0018] Determine whether the spatial heterogeneous diversity of the execution process in the previous scheduling cycle of the network node is maximum or whether the previous neighboring execution configuration strategy of the network node is an execution configuration strategy that maximizes spatial heterogeneous diversity. If so, adopt the execution configuration strategy that maximizes time diversity to increase the time diversity of the execution process in the current scheduling cycle, and turn the execution process in the current scheduling cycle to an execution direction with reduced security until the service performance of the network node returns to normal; if not, shorten the scheduling cycle of the execution process until the service performance of the network node returns to normal.

[0019] According to a preferred embodiment, adding corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updating the attack behavior relationship network includes:

[0020] Determine the access complexity and authentication complexity of the corresponding system vulnerability on the network node based on the historical vulnerability information of the network node, determine the attack success probability of the corresponding single-step attack action node based on the access complexity and authentication complexity of the system vulnerability, obtain the historical access frequency of the system vulnerability in a nearby time period from the log data of the network node, and determine the action occurrence probability of the corresponding single-step attack action node based on the access complexity, authentication complexity and historical access frequency of the system vulnerability;

[0021] The action occurrence probability and attack success probability of the corresponding single-step attack action node are weightedly integrated to obtain the corresponding node transition probability, and the node transition probability is used as the edge weight of the directed connection edge between the corresponding single-step attack action node and its subsequent single-step attack action node;

[0022] Obtaining all preceding single-step attack action nodes corresponding to the corresponding single-step attack action node, multiplying the action occurrence probability corresponding to each preceding single-step attack action node to obtain a first local conditional probability of the single-step attack action node, multiplying the attack success probability corresponding to each preceding single-step attack action node to obtain a second local conditional probability of the single-step attack action node, and performing feature extraction on the first local conditional probability and the second local conditional probability to obtain a local conditional probability distribution feature of the corresponding single-step attack action node;

[0023] Identify and parse new vulnerability information of network nodes, add a single-step attack action node corresponding to the new vulnerability information to the attack behavior relationship network, search from the attack behavior relationship network for all predecessor single-step attack action nodes corresponding to the single-step attack action node based on a predecessor state condition when the single-step attack action node is triggered, increase the node attributes of the single-step attack action node and the edge weight of the directed connection edge between the single-step attack action node and each predecessor single-step attack action node to update the attack behavior relationship network.

[0024] According to a preferred embodiment, determining the intrusion probability of each target single-step attack action node based on the alarm confidence of each coarse-grained alarm information includes:

[0025] The action occurrence probability of each attack observation node whose alarm confidence is greater than a preset confidence threshold is set to 1, and with the corresponding target single-step attack action node as the starting point and the corresponding attack observation node as the end point, reversely search for all the predecessor single-step attack action nodes corresponding to the target single-step attack action node and the predecessor single-step attack action nodes corresponding to each predecessor single-step attack action node in the updated attack behavior relationship network to obtain all the parent single-step attack action nodes of the target single-step attack action node;

[0026] The intrusion probability of the corresponding target single-step attack action node is obtained by multiplying the action occurrence probabilities of all parent single-step attack action nodes of the corresponding target single-step attack action node, where there are one or more attack observation nodes in all parent single-step attack action nodes corresponding to each target single-step attack action node.

[0027] According to a preferred embodiment, the step of generating the path sequence is: starting from the corresponding attack observation node, forward searching all subsequent single-step attack action nodes corresponding to the attack observation node in the updated attack behavior relationship network and all subsequent single-step attack action nodes corresponding to each subsequent single-step attack action node, until a terminating single-step attack action node without a subsequent single-step attack action node is found, and the search sequence of the terminating single-step attack action node is used as the path sequence of the terminating single-step attack action node. At the same time, the terminating single-step attack action node will be used as the target single-step attack action node for evolutionary analysis.

[0028] The present invention has the following beneficial effects:

[0029] The adaptive network security defense strategy configuration system provided by the present invention performs correlation analysis and evolution analysis on the single-step attack actions corresponding to each coarse-grained alarm information in the relationship network template, so as to accurately perceive the attack path and evolutionary attack target of the network intrusion behavior, thereby improving the system's threat identification level for network intrusion behavior, and adopting an adaptive execution configuration strategy for the system's scheduling tasks according to the threat level of the network intrusion behavior, thereby avoiding the system from reducing its own service quality due to excessive defense and improving the utilization rate of system resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 A structural block diagram of an adaptive network security defense strategy configuration system provided by an exemplary embodiment. DETAILED DESCRIPTION

[0031] Exemplary embodiments will be described in detail herein, with examples illustrated in the accompanying drawings. In the following description, when referring to the drawings, identical numerals in different figures represent identical or similar elements, unless otherwise indicated. The embodiments described in the following exemplary embodiments are not intended to represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

[0032] The terms used in this invention are for the purpose of describing specific embodiments only and are not intended to limit the invention. The singular forms "a," "the," and "the" used in this invention and the appended claims are also intended to include plural forms unless the context clearly indicates otherwise. It should also be understood that the term "and / or" as used herein refers to and includes any or all possible combinations of one or more of the associated listed items.

[0033] It should be understood that although the terms "first," "second," "third," etc. may be used in the present invention to describe various information, such information should not be limited to these terms. These terms are merely used to distinguish information of the same type from one another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present invention. Depending on the context, the term "if" as used herein may be interpreted as "when," "when," or "in response to determining."

[0034] See also Figure 1 In one embodiment, an adaptive network security defense policy configuration system includes multiple network nodes and a network security management platform. The network security management platform has a communication connection with each network node, and the network security management platform includes a behavior simulation module, a feature extraction module, an attack evolution module and a policy configuration module.

[0035] The behavior simulation module is used to extract the action node set and state node set of historical network intrusion behavior based on the historical vulnerability information of the network node, and form each single-step attack action node of the simulated network intrusion behavior based on each matching action node and state node in the action node set and the state node set, wherein each action node in the action node set corresponds to an attack action taken by the simulated network intrusion behavior, and the attack action is used to represent a scan or a vulnerability exploit;

[0036] The feature extraction module is used to add corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and update the attack behavior relationship network, and extract the first attack feature of the current network intrusion behavior based on multiple coarse-grained alarm information generated in real time by the network nodes, wherein the coarse-grained alarm information is used to characterize the attack information of the current network intrusion behavior of the network node, and the network parameters include edge weights and node attributes, and the node attributes are used to characterize the local conditional probability distribution characteristics of the corresponding single-step attack action node;

[0037] The attack evolution module is used to sequentially map each coarse-grained alarm information arranged in chronological order in the alarm sequence of the network node to the corresponding single-step attack action node in the updated attack behavior relationship network, use the mapped single-step attack action nodes as the attack observation nodes of the alarm sequence, analyze all the attack observation nodes corresponding to the alarm sequence to obtain the attack evolution sequence of the current network intrusion behavior, and analyze the attack evolution sequence to obtain the second attack feature of the current network intrusion behavior;

[0038] The policy configuration module is used to determine the threat level of the network intrusion behavior based on the first attack feature and the second attack feature of the network intrusion behavior. When it is determined that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to turn the execution process of the current network node to an execution direction with improved security; when it is determined that the threat level of the network intrusion behavior is less than or equal to the preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes temporal diversity to turn the execution process of the current network node to an execution direction with reduced security.

[0039] In one embodiment, a processing method of an adaptive network security defense policy configuration system may include:

[0040] S1. The behavior simulation module extracts the action node set and state node set of the historical network intrusion behavior based on the historical vulnerability information of the network node, and constructs each single-step attack action node of the simulated network intrusion behavior based on each matching action node and state node in the action node set, wherein each action node in the action node set corresponds to an attack action taken by the simulated network intrusion behavior, and the attack action is used to represent a scan or a vulnerability exploit.

[0041] Optionally, each state node in the state node set is used to represent the state of the simulated network intrusion behavior, and the state is used to represent whether the corresponding simulated network intrusion behavior obtains corresponding permissions or occupies corresponding resources.

[0042] Optionally, the historical vulnerability information is composed of vulnerability information of all system vulnerabilities that have been historically attacked on the network node, and the historical vulnerability information includes access complexity, authentication complexity, number of attacks, and attack frequency of each system vulnerability;

[0043] The simulated network intrusion behavior is used to simulate and reconstruct the attack action and state of each historical network intrusion behavior, so as to construct a more accurate network graph template for a newly generated network intrusion behavior.

[0044] S2. The feature extraction module adds corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updates the attack behavior relationship network, and extracts the first attack feature of the current network intrusion behavior based on multiple coarse-grained alarm information generated in real time by the network nodes, wherein the coarse-grained alarm information is used to characterize the attack information of the current network intrusion behavior of the network node, and the network parameters include edge weights and node attributes, and the node attributes are used to characterize the local conditional probability distribution characteristics of the corresponding single-step attack action nodes.

[0045] Optionally, the coarse-grained alarm information is generated by the network node based on the vulnerability information of the attacked system vulnerability, attacker information and attack time analysis, and the attacker information includes the attacker's IP address, port number and network protocol used; the first attack feature is used to characterize the threat type, severity, attack frequency and propagation method of the corresponding network intrusion behavior, and the threat type is used to identify predefined threat event types, including distributed denial of service attacks, illegal access and traffic anomalies.

[0046] Specifically, adding corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updating the attack behavior relationship network includes:

[0047] Determine the access complexity and authentication complexity of the corresponding system vulnerability on the network node based on the historical vulnerability information of the network node, determine the attack success probability of the corresponding single-step attack action node based on the access complexity and authentication complexity of the system vulnerability, obtain the historical access frequency of the system vulnerability in a nearby time period from the log data of the network node, and determine the action occurrence probability of the corresponding single-step attack action node based on the access complexity, authentication complexity and historical access frequency of the system vulnerability;

[0048] The action occurrence probability and attack success probability of the corresponding single-step attack action node are weightedly integrated to obtain the corresponding node transition probability, and the node transition probability is used as the edge weight of the directed connection edge between the corresponding single-step attack action node and its subsequent single-step attack action node;

[0049] Obtaining all preceding single-step attack action nodes corresponding to the corresponding single-step attack action node, multiplying the action occurrence probability corresponding to each preceding single-step attack action node to obtain a first local conditional probability of the single-step attack action node, multiplying the attack success probability corresponding to each preceding single-step attack action node to obtain a second local conditional probability of the single-step attack action node, and performing feature extraction on the first local conditional probability and the second local conditional probability to obtain a local conditional probability distribution feature of the corresponding single-step attack action node;

[0050] Identify and parse new vulnerability information of network nodes, add a single-step attack action node corresponding to the new vulnerability information to the attack behavior relationship network, search from the attack behavior relationship network for all predecessor single-step attack action nodes corresponding to the single-step attack action node based on a predecessor state condition when the single-step attack action node is triggered, increase the node attributes of the single-step attack action node and the edge weight of the directed connection edge between the single-step attack action node and each predecessor single-step attack action node to update the attack behavior relationship network.

[0051] Optionally, the pre-condition is used to indicate the system permissions or system resources that need to be obtained in advance when the attack action corresponding to the single-step attack action node is triggered.

[0052] Optionally, the attack success probability of the corresponding single-step attack action node is determined by the product of the access complexity and authentication complexity of the corresponding system vulnerability. The log data of the network node is used to record important events occurring on the network node, including transaction logs and system software and hardware failure information, wherein the system software and hardware failure information includes vulnerability information of the system vulnerability and information on historical network intrusion behaviors;

[0053] The present invention sets the near-term time period to be within one month with the current time point as the reference time. The historical access frequency is determined by the total number of times the corresponding system vulnerability was accessed within one month, which includes both the number of normal access behaviors and the number of abnormal access behaviors (network intrusions).

[0054] S3. The attack evolution module maps each coarse-grained alarm information arranged in chronological order in the alarm sequence of the network node to the corresponding single-step attack action node in the updated attack behavior relationship network in sequence, and uses the mapped single-step attack action nodes as the attack observation nodes of the alarm sequence. Based on the analysis of all the attack observation nodes corresponding to the alarm sequence, the attack evolution sequence of the current network intrusion behavior is obtained, and based on the analysis of the attack evolution sequence, the second attack feature of the current network intrusion behavior is obtained.

[0055] Optionally, the second attack feature is used to characterize the historical attack frequency, threat type, and propagation mode of the evolving intrusion behavior indicated by the attack evolution sequence of the corresponding network intrusion behavior.

[0056] Specifically, the attack evolution sequence of the current network intrusion behavior obtained by analyzing all attack observation nodes corresponding to the alarm sequence includes:

[0057] Based on the edge weights and node attributes of each attack observation node, the prior attack probability of each attack observation node is determined, the historical verification rate and historical false alarm rate of the attack action corresponding to each coarse-grained alarm information are obtained, and the alarm confidence of each coarse-grained alarm information is determined according to the prior attack probability, historical verification rate and historical false alarm rate of each attack observation node;

[0058] Each terminated single-step attack action node in the updated attack behavior relationship network that does not have a subsequent single-step attack action node and has one or more attack observation nodes in the path sequence is used as the target single-step attack action node for evolutionary analysis. The intrusion probability of each target single-step attack action node is determined based on the alarm confidence of each coarse-grained alarm information.

[0059] The target single-step attack action node with the largest intrusion probability is used as the attack evolution node, and the path sequence corresponding to the attack evolution node is used as the attack evolution sequence of the current network intrusion behavior.

[0060] Optionally, the step of generating the path sequence is: taking the corresponding attack observation node as the starting point, forward searching all the subsequent single-step attack action nodes corresponding to the attack observation node in the updated attack behavior relationship network and all the subsequent single-step attack action nodes corresponding to each subsequent single-step attack action node, until a terminating single-step attack action node without a subsequent single-step attack action node is found, and the search sequence of the terminating single-step attack action node is used as the path sequence of the terminating single-step attack action node. At the same time, the terminating single-step attack action node will be used as the target single-step attack action node for evolutionary analysis.

[0061] Specifically, determining the intrusion probability of each target single-step attack action node based on the alarm confidence of each coarse-grained alarm information includes:

[0062] The action occurrence probability of each attack observation node whose alarm confidence is greater than a preset confidence threshold is set to 1, and with the corresponding target single-step attack action node as the starting point and the corresponding attack observation node as the end point, reversely search for all the predecessor single-step attack action nodes corresponding to the target single-step attack action node and the predecessor single-step attack action nodes corresponding to each predecessor single-step attack action node in the updated attack behavior relationship network to obtain all the parent single-step attack action nodes of the target single-step attack action node;

[0063] The intrusion probability of the corresponding target single-step attack action node is obtained by multiplying the action occurrence probabilities of all parent single-step attack action nodes of the corresponding target single-step attack action node, where there are one or more attack observation nodes in all parent single-step attack action nodes corresponding to each target single-step attack action node.

[0064] Optionally, the preset confidence threshold is a value pre-set by the system for determining whether the corresponding coarse-grained alarm information is true alarm information. Coarse-grained alarm information with an alarm confidence greater than the preset confidence threshold is true alarm information, and coarse-grained alarm information with an alarm confidence less than or equal to the preset confidence threshold is false alarm information, that is, a false alarm.

[0065] Optionally, the prior attack probability of the corresponding attack observation node is determined by the product between the node transfer probability indicated by the edge weight of the attack observation node and the first local conditional probability indicated by the node attribute, and the product between the node transfer probability and the second local conditional probability, that is, the product between the node transfer probability and the first local conditional probability and the product between the node transfer probability and the second local conditional probability are added to obtain the prior attack probability of the corresponding attack observation node.

[0066] Optionally, the historical verification rate is the probability that the network node generates an alarm when an attack occurs, and the historical false alarm rate is the probability that the network node generates an alarm when an attack does not occur, both of which are obtained from the statistics of historical coarse-grained alarm information of the network node.

[0067] The alarm confidence is used to characterize the authenticity of the corresponding coarse-grained alarm information. The calculation formula of the alarm confidence is:

[0068]

[0069] Among them, P i is the alarm confidence of coarse-grained alarm information i, d i is the historical verification rate of the attack action corresponding to the coarse-grained alarm information i, f i is the historical false alarm rate of the attack action corresponding to the coarse-grained alarm information i, p(v i ) is the attack observation node v i The prior attack probability of is the attack observation node v i The probability that no attack occurs.

[0070] S4. The policy configuration module determines the threat level of the network intrusion behavior based on the first attack feature and the second attack feature of the network intrusion behavior. When it is determined that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to shift the execution process of the current network node to an execution direction with improved security; when it is determined that the threat level of the network intrusion behavior is less than or equal to the preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes temporal diversity to shift the execution process of the current network node to an execution direction with reduced security.

[0071] Optionally, the preset threat level threshold is a system preset limit for characterizing the tolerance of network nodes to abnormal behavior. The scheduling task may be a request that the system is responding to.

[0072] Optionally, the execution configuration strategy that maximizes spatial heterogeneous diversity refers to simultaneously adopting multiple equivalent execution processes for a scheduling task, and voting on the execution results of different execution processes to obtain the final output; the execution configuration strategy that maximizes temporal diversity refers to rotating different execution processes or system properties for a scheduling task in different time segments, that is, using different execution processes for processing in different time segments or presenting different system properties to the outside world.

[0073] Specifically, when determining that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the method further includes:

[0074] Determine whether the spatial heterogeneous diversity of the execution process in the current scheduling cycle of the network node has reached a maximum. If so, shorten the scheduling cycle of each execution process until the service performance of the network node returns to normal; if not, adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to increase the spatial heterogeneous diversity of the execution process in the current scheduling cycle, and shift the execution process in the current scheduling cycle to an execution direction with improved security until the service performance of the network node returns to normal.

[0075] Specifically, when determining that the threat level of the network intrusion behavior is less than or equal to a preset threat level threshold, the method further includes:

[0076] Determine whether the spatial heterogeneous diversity of the execution process in the previous scheduling cycle of the network node is maximum or whether the previous neighboring execution configuration strategy of the network node is an execution configuration strategy that maximizes spatial heterogeneous diversity. If so, adopt the execution configuration strategy that maximizes time diversity to increase the time diversity of the execution process in the current scheduling cycle, and turn the execution process in the current scheduling cycle to an execution direction with reduced security until the service performance of the network node returns to normal; if not, shorten the scheduling cycle of the execution process until the service performance of the network node returns to normal.

[0077] In the present invention, the execution configuration strategy that maximizes spatial heterogeneity diversity performs multiple redundant execution processes in parallel within the same time segment, which will greatly improve system security and at the same time increase the response delay of service tasks;

[0078] The execution configuration strategy that maximizes temporal diversity executes different execution processes in different time segments. Compared with the configuration strategy that maximizes spatial heterogeneous diversity, it will reduce system security and shorten the response delay of service tasks.

[0079] Optionally, the execution process of the network node has an initialization scheduling period determined according to the attack frequency and attack period of historical network intrusion behavior. When the service performance of the network node returns to normal, the network node automatically restores the current scheduling period to the initialization scheduling period.

[0080] The adaptive network security defense strategy configuration system provided by the present invention performs correlation analysis and evolution analysis on the single-step attack actions corresponding to each coarse-grained alarm information in the relationship network template, so as to accurately perceive the attack path and evolutionary attack target of the network intrusion behavior, thereby improving the system's threat identification level for the network intrusion behavior, and adopts an adaptive execution configuration strategy for the system's scheduling tasks according to the threat level of the network intrusion behavior, so that when the threat level is high, the system increases the defense capability and guarantees the service quality at the same time, and when the threat level is reduced, the system reduces the defense capability and improves the service quality at the same time.

[0081] The various technical features in the above embodiments can be combined arbitrarily as long as there is no conflict or contradiction between the combinations of features. However, due to space limitations, they are not described one by one. Therefore, the arbitrary combination of the various technical features in the above embodiments also falls within the scope of disclosure of this specification.

[0082] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the inventions claimed herein. This application is intended to cover any variations, uses, or adaptations of the present application that follow the general principles of this application and include common knowledge or customary techniques in the art not claimed herein. The description and examples are to be considered as exemplary only, and the true scope and spirit of the present application are indicated by the following claims.

[0083] It should be understood that the present application is not limited to the exact structures described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. An adaptive network security defense strategy configuration system, characterized in that: The system includes multiple network nodes and a network security management platform, which includes a behavior simulation module, a feature extraction module, an attack evolution module and a policy configuration module; The behavior simulation module extracts an action node set and a state node set of historical network intrusion behaviors based on historical vulnerability information of network nodes, and constructs each single-step attack action node of the simulated network intrusion behavior based on each matching action node and state node in the action node set and the state node set, wherein each action node in the action node set corresponds to an attack action taken by the simulated network intrusion behavior, and the attack action is used to represent a scan or a vulnerability exploit; The feature extraction module adds corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updates the attack behavior relationship network, extracting the first attack feature of the current network intrusion behavior based on multiple coarse-grained alarm information generated in real time by the network nodes, wherein the coarse-grained alarm information is used to characterize the attack information of the current network intrusion behavior of the network node, and the network parameters include edge weights and node attributes, and the node attributes are used to characterize the local conditional probability distribution characteristics of the corresponding single-step attack action node; The attack evolution module maps each coarse-grained alarm information arranged in chronological order in the alarm sequence of the network node to the corresponding single-step attack action node in the updated attack behavior relationship network, uses the mapped single-step attack action nodes as the attack observation nodes of the alarm sequence, analyzes all the attack observation nodes corresponding to the alarm sequence to obtain the attack evolution sequence of the current network intrusion behavior, and obtains the second attack feature of the current network intrusion behavior based on the analysis of the attack evolution sequence; The policy configuration module determines the threat level of the network intrusion behavior based on the first attack feature and the second attack feature of the network intrusion behavior. When it is determined that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to shift the execution process of the current network node to an execution direction with improved security; when it is determined that the threat level of the network intrusion behavior is less than or equal to the preset threat level threshold, the system's scheduling tasks adopt an execution configuration strategy that maximizes temporal diversity to shift the execution process of the current network node to an execution direction with reduced security.

2. The system according to claim 1, wherein: The execution configuration strategy that maximizes spatial heterogeneous diversity refers to simultaneously adopting multiple equivalent execution processes for a scheduling task, and voting on the execution results of different execution processes to obtain the final output; the execution configuration strategy that maximizes temporal diversity refers to rotating different execution processes or system properties for a scheduling task in different time segments, that is, using different execution processes for processing in different time segments or presenting different system properties to the outside world.

3. The system according to claim 2, characterized in that Each state node in the state node set is used to represent the state of the simulated network intrusion behavior, and the state is used to represent whether the corresponding simulated network intrusion behavior obtains the corresponding authority or occupies the corresponding resource.

4. The system according to claim 3, characterized in that The attack evolution sequence of the current network intrusion behavior obtained by analyzing all attack observation nodes corresponding to the alarm sequence includes: Based on the edge weights and node attributes of each attack observation node, the prior attack probability of each attack observation node is determined, the historical verification rate and historical false alarm rate of the attack action corresponding to each coarse-grained alarm information are obtained, and the alarm confidence of each coarse-grained alarm information is determined according to the prior attack probability, historical verification rate and historical false alarm rate of each attack observation node; Each terminated single-step attack action node in the updated attack behavior relationship network that does not have a subsequent single-step attack action node and has one or more attack observation nodes in the path sequence is used as the target single-step attack action node for evolutionary analysis. The intrusion probability of each target single-step attack action node is determined based on the alarm confidence of each coarse-grained alarm information. The target single-step attack action node with the largest intrusion probability is used as the attack evolution node, and the path sequence corresponding to the attack evolution node is used as the attack evolution sequence of the current network intrusion behavior.

5. The system according to claim 4, characterized in that When determining that the threat level of the network intrusion behavior is greater than a preset threat level threshold, the method further includes: Determine whether the spatial heterogeneous diversity of the execution process in the current scheduling cycle of the network node has reached a maximum. If so, shorten the scheduling cycle of each execution process until the service performance of the network node returns to normal; if not, adopt an execution configuration strategy that maximizes spatial heterogeneous diversity to increase the spatial heterogeneous diversity of the execution process in the current scheduling cycle, and shift the execution process in the current scheduling cycle to an execution direction with improved security until the service performance of the network node returns to normal.

6. The system according to claim 5, characterized in that When determining that the threat level of the network intrusion behavior is less than or equal to a preset threat level threshold, the method further includes: Determine whether the spatial heterogeneous diversity of the execution process in the previous scheduling cycle of the network node is maximum or whether the previous neighboring execution configuration strategy of the network node is an execution configuration strategy that maximizes spatial heterogeneous diversity. If so, adopt the execution configuration strategy that maximizes time diversity to increase the time diversity of the execution process in the current scheduling cycle, and turn the execution process in the current scheduling cycle to an execution direction with reduced security until the service performance of the network node returns to normal; if not, shorten the scheduling cycle of the execution process until the service performance of the network node returns to normal.

7. The system according to claim 6, characterized in that Adding corresponding network parameters to the attack behavior relationship network composed of all single-step attack action nodes and updating the attack behavior relationship network includes: Determine the access complexity and authentication complexity of the corresponding system vulnerability on the network node based on the historical vulnerability information of the network node, determine the attack success probability of the corresponding single-step attack action node based on the access complexity and authentication complexity of the system vulnerability, obtain the historical access frequency of the system vulnerability in a nearby time period from the log data of the network node, and determine the action occurrence probability of the corresponding single-step attack action node based on the access complexity, authentication complexity and historical access frequency of the system vulnerability; The action occurrence probability and attack success probability of the corresponding single-step attack action node are weightedly integrated to obtain the corresponding node transition probability, and the node transition probability is used as the edge weight of the directed connection edge between the corresponding single-step attack action node and its subsequent single-step attack action node; Obtaining all preceding single-step attack action nodes corresponding to the corresponding single-step attack action node, multiplying the action occurrence probability corresponding to each preceding single-step attack action node to obtain a first local conditional probability of the single-step attack action node, multiplying the attack success probability corresponding to each preceding single-step attack action node to obtain a second local conditional probability of the single-step attack action node, and performing feature extraction on the first local conditional probability and the second local conditional probability to obtain a local conditional probability distribution feature of the corresponding single-step attack action node; Identify and parse new vulnerability information of network nodes, add a single-step attack action node corresponding to the new vulnerability information to the attack behavior relationship network, search from the attack behavior relationship network for all predecessor single-step attack action nodes corresponding to the single-step attack action node based on a predecessor state condition when the single-step attack action node is triggered, increase the node attributes of the single-step attack action node and the edge weight of the directed connection edge between the single-step attack action node and each predecessor single-step attack action node to update the attack behavior relationship network.

8. The system according to claim 7, characterized in that The step of determining the intrusion probability of each target single-step attack action node based on the alarm confidence of each coarse-grained alarm information includes: The action occurrence probability of each attack observation node whose alarm confidence is greater than a preset confidence threshold is set to 1, and with the corresponding target single-step attack action node as the starting point and the corresponding attack observation node as the end point, reversely search for all the predecessor single-step attack action nodes corresponding to the target single-step attack action node and the predecessor single-step attack action nodes corresponding to each predecessor single-step attack action node in the updated attack behavior relationship network to obtain all the parent single-step attack action nodes of the target single-step attack action node; The intrusion probability of the corresponding target single-step attack action node is obtained by multiplying the action occurrence probabilities of all parent single-step attack action nodes of the corresponding target single-step attack action node, where there are one or more attack observation nodes in all parent single-step attack action nodes corresponding to each target single-step attack action node.

9. The system according to claim 8, characterized in that The path sequence generation step is as follows: starting from the corresponding attack observation node, forward searching all subsequent single-step attack action nodes corresponding to the attack observation node in the updated attack behavior relationship network and all subsequent single-step attack action nodes corresponding to each subsequent single-step attack action node until a terminating single-step attack action node without a subsequent single-step attack action node is found, and the search sequence of the terminating single-step attack action node is used as the path sequence of the terminating single-step attack action node. At the same time, the terminating single-step attack action node will be used as the target single-step attack action node for evolutionary analysis.

Images