Methods, systems, and devices for network attack early warning and attribution based on event knowledge graphs

Abstract

The present invention discloses a network attack early warning and tracing method, system and device based on a knowledge graph of facts, obtains network attack records to build a knowledge graph layer; extracts event causal relationships from network attack records, forms attack links, and aggregates and generalizes events and causal relationships to build a graph layer of facts; maps generalized nodes in the attack link with knowledge graph layer entities to establish a network attack knowledge graph of facts; infers the attack means taken by the attacker, or predicts the attack means to be taken in the next step, thereby realizing the tracing and early warning of the attack behavior. The present invention combines the facts graph and knowledge graph technology, and through the construction of the facts graph layer and the knowledge graph layer, transforms the network attack link and the organizational information asset architecture into a reasoning graph that combines dynamic facts logic with static objective knowledge, and realizes the reasoning and prediction of the overall attack behavior based on a small amount of exposed attack traces, so as to support the rapid and effective response of network attacks.

Description

Technical Field

[0001] The present invention relates to the field of network attack early warning, and in particular to a network attack early warning and tracing method, system and device based on a knowledge graph. Background Art

[0002] Network attacks use a variety of complex attack techniques, and through continuous attack and defense confrontation, they gradually achieve their attack objectives. Traditional network intrusion detection technologies such as traffic detection, code detection, and log detection can only detect "single-point" network attack behaviors, and cannot perceive the context of the attack process, making it difficult to effectively detect network attacks. Therefore, in order to prevent network attacks that cannot be traced, organizations need to invest a huge amount of senior expert resources and implement continuous threat identification and judgment to ensure a rapid response to attack behaviors.

[0003] In order to solve the problems of network attack prevention and tracing difficulties caused by insufficient network security expert resources and limited expert experience in an organization, the present invention uses the knowledge graph technology to provide a network attack early warning and tracing solution. Summary of the invention

[0004] The purpose of the present invention is to address the deficiencies in the prior art and propose a network attack early warning and tracing method, system and device based on a knowledge graph of facts and principles. By combining the facts and principles graph and the knowledge graph technology, the network attack link and the organizational information asset architecture are transformed into a reasoning graph that combines dynamic facts and principles logic with static objective knowledge through the construction of the facts and principles graph layer and the knowledge graph layer, so as to realize the reasoning and prediction of the overall attack behavior based on a small amount of exposed attack traces, so as to support the rapid and effective response to network attacks.

[0005] The object of the present invention is achieved through the following technical solutions: In the first aspect, the present invention provides a network attack early warning and tracing method based on a knowledge graph, the method comprising the following steps:

[0006] (1) Obtain the entities and relationships of the objective IT assets and related information of an organization or enterprise, and build a knowledge graph layer;

[0007] (2) Design event and causal relationship rule templates, extract causal attack sub-chains from the attack behavior chain, aggregate similar nodes in the attack sub-chain to form new generalized nodes, and construct the event graph layer;

[0008] (3) Map the generalized nodes in the attack subchain in the event graph layer to the entities in the knowledge graph layer to complete the establishment of the network attack event knowledge graph;

[0009] (4) Infer the attack methods adopted by the attacker based on the knowledge graph of network attack facts, or predict the attack methods that the attacker will take next, so as to achieve the tracing and early warning of the attack behavior.

[0010] Furthermore, in step (1), entities include Internet assets, intranet assets, application systems, network domains, vulnerabilities, configuration risks, and high-risk ports.

[0011] Furthermore, in step (2), the attack subchain is in the form of a triple of {event source, event target, event operation}, and the rule template includes a cause event, a result event, and an event causal relationship identifier; wherein the cause event is mapped to the "event operation" in the attack subchain, and the result event is mapped to the "event target" in the subchain, and the attack entry that first appears in the attack behavior link is used as the "event source" of the link-starting attack subchain, and the "event target" of the attack subchain is used as the "event source" of its next-hop attack subchain.

[0012] Furthermore, in step (2), for the event source nodes and event target nodes in the attack subchain, the application system entity names in the knowledge graph layer are traversed, and the nodes are aggregated into one category based on similarity to form generalized nodes. The generalized node name is the application system entity name that meets the similarity threshold. For the event operation nodes in the attack subchain, they are matched with the ATT&CK attack tactics based on similarity in combination with the threat intelligence correlation analysis, and mapped to the attack stage of the kill chain model. The event operation nodes are clustered, and the mean similarity between the attack means and all other similar attack means is calculated. The name of the attack means corresponding to the maximum value is taken to name the generalized node of the event operation after clustering.

[0013] Furthermore, in step (3), the network attack maps the generalized nodes of the event source and event target of the event graph layer with the corresponding application system entities of the knowledge graph layer; for the generalized nodes of the event operation of the event graph layer, the generalized nodes of the attack means of the event graph layer are used as the benchmark to screen the weakness entities in the knowledge graph layer whose names meet the similarity threshold for mapping.

[0014] Furthermore, in step (4), the specific reasoning process is as follows:

[0015] (4.1) Extract the alarm log sequence obtained from the security equipment monitoring, and extract the attack sub-chain of the event graph layer in the network attack event knowledge graph; obtain the characteristic sub-sequences of the alarm log sequence and the attack sub-chain based on the sliding window, and select the characteristic sub-sequences that meet the requirements based on the information gain value; calculate the matching degree of the alarm log sequence and the attack sub-chain as follows:

[0016]

[0017] in, For the matching degree, is the probability that the characteristic subsequence of the alarm log sequence appears in the alarm log sequence, is the probability that the characteristic subsequence of the attack subchain that is the same as the characteristic subsequence of the alarm log sequence appears in the attack subchain. If there is no identical characteristic subsequence, assign ;

[0018] (4.2) Extract all attack subchains that meet the matching threshold, and map them to the attack stage of the kill chain model according to the "event operation" node; obtain all attack subchains of the previous kill chain model attack stage and all attack subchains of the next kill chain model attack stage, and repeat the operation to obtain the forward tracing link set and the backward warning link set respectively; each link in the set uses its corresponding matching degree as the initial matching degree of the link;

[0019] (4.3) Link mapping is performed for the forward tracing link set and the backward warning link set respectively. The backward warning link set starts from the last attack subchain, and the forward tracing link set starts from the first attack subchain. The entity group associated with the attack subchain triple is obtained from the knowledge graph layer, and the matching degree of the attack subchain is corrected:

[0020]

[0021] Where n is the number of entity groups that meet the conditions, For the corrected matching degree, continue to start with the previous attack subchain and repeat the mapping operation until no associated entity group is obtained; after all links are mapped, sort them according to the link matching degree. The higher the matching degree, the higher the credibility of the warning link / tracing link.

[0022] In a second aspect, the present invention also provides a network attack warning and tracing system based on a knowledge graph, the system comprising a knowledge graph layer construction module, a knowledge graph layer construction module, a knowledge graph establishment module and a graph reasoning module;

[0023] The knowledge graph layer construction module is used to obtain the entities and relationships of the objective IT assets and related information of an organization or enterprise, and to construct a knowledge graph layer;

[0024] The event graph layer construction module is used to design event and causal relationship rule templates, extract causal attack subchains from attack behavior links, aggregate similar nodes in attack subchains to form new generalized nodes to construct the event graph layer;

[0025] The knowledge graph establishment module is used to map the generalized nodes in the attack subchain in the knowledge graph layer to the entities in the knowledge graph layer to complete the establishment of the network attack knowledge graph;

[0026] The graph reasoning module is used to infer the attack methods taken by the attacker based on the network attack knowledge graph, or predict the attack methods to be taken next, so as to trace the source and warn the attack behavior.

[0027] In the third aspect, the present invention also provides a network attack warning and tracing device based on a knowledge graph of things, including a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it implements the network attack warning and tracing method based on the knowledge graph of things.

[0028] In a fourth aspect, the present invention also provides a computer-readable storage medium having a program stored thereon, which, when executed by a processor, implements the network attack warning and tracing method based on a knowledge graph.

[0029] In a fifth aspect, the present invention also provides a computer program product, including a computer program, which, when executed by a processor, implements the network attack warning and tracing method based on a knowledge graph.

[0030] Beneficial effects of the invention: The invention aims to solve the problem that there is no trace of cyber attacks on organizations and enterprises, and it is difficult to quickly and effectively warn and track them. The invention introduces two technologies, namely, the event graph and the knowledge graph. By establishing a two-layer reasoning graph structure of event and knowledge, the dynamic event logic is combined with static objective knowledge, and a network attack early warning and tracing method, system and device are designed. It is helpful to transform a large number of complex network attack cases into a reasonable information network, so as to reason and warn the overall attack behavior based on a small number of exposed network attack traces, so as to support the rapid and effective response to network attack behavior. BRIEF DESCRIPTION OF THE DRAWINGS

[0031] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0032] Figure 1 It is a schematic diagram of the knowledge graph of things and principles.

[0033] Figure 2 It is a generalized diagram of attack means nodes.

[0034] Figure 3 This is a schematic diagram of automatic warning link generation.

[0035] Figure 4It is a structural diagram of a network attack early warning and tracing device based on a knowledge graph of facts and principles of the present invention. DETAILED DESCRIPTION

[0036] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described below in conjunction with the accompanying drawings and implementation examples. It should be understood that the specific implementation examples described herein are only used to explain the present invention and are not used to limit the present invention.

[0037] The present invention provides a network attack early warning and tracing method based on a knowledge graph, the method comprising the following steps:

[0038] 1. Construction of the knowledge graph

[0039] The knowledge graph is a two-layer graph structure, consisting of a graph layer and a knowledge graph layer. Its nodes mainly include knowledge nodes with IT assets, their weaknesses, and fingerprint information as the core, and event nodes with specific network attack cases as the core; the relationships include the classification associations between knowledge graph entities, between entities and attributes, the evolutionary relationships between events in the graph, and the cascade mapping relationships between entities and events. Figure 1 shown.

[0040] The knowledge graph of facts and principles combines objective knowledge and logic of facts, and can provide a logical reasoning framework based on multi-modal knowledge association. In the present invention, the process of constructing the knowledge graph of cyber attack facts and principles is divided into three steps.

[0041] 1. Knowledge graph layer construction

[0042] In the present invention, the fingerprint information, architecture, vulnerabilities, etc. of the objective IT assets of an organization or enterprise are expressed through the knowledge graph layer, and its construction is divided into model layer construction and data layer construction.

[0043] (1) Model layer construction

[0044] The model layer is the data paradigm of the knowledge graph, which is used to accurately describe entities, attributes and their relationships. The present invention focuses on the organization's Internet assets, intranet assets and their fingerprint information and vulnerability information. It includes application systems and network areas associated with assets that need to be focused on during network security operations and threat assessment and response processes, as well as inherent vulnerabilities of hosts due to service and version issues, exploitable vulnerabilities exposed by various systems to the public network, high-risk ports, configuration errors, etc. Therefore, the knowledge graph entities and relationships are defined as shown in Table 1, and each entity is uniquely identified by its name:

[0045] Table 1 Entities and relationships between entities

[0046]

[0047] (2) Data layer construction

[0048] The data layer extracts entities and relationships according to the model layer paradigm in the following way:

[0049] 1) Internet asset scanning

[0050] Through Internet asset scanning and opening up IP and port of Internet exit firewall, all Internet asset IPs are obtained, and then linked to the organization or enterprise CMDB system to establish Internet asset entities.

[0051] 2) HIDS / EDR Detection

[0052] Through the HIDS / EDR deployed on the host / terminal, IT asset information is scanned to extract entities including intranet assets, application systems, network domains, vulnerabilities, configuration risks, high-risk ports, and asset attribute information such as asset identification, operating system, person in charge, and physical location. This method will also extract the associations between the above entities and attributes.

[0053] 3) Network rule association

[0054] The relationship <Internet assets, mapping, intranet assets> is extracted based on NAT, load balancing, ACL and other policy configurations. Taking the link "Internet egress->NAT->load balancing->intranet server" as an example, starting from the Internet egress IP, the next-hop IP is matched step by step according to the NAT and load balancing configuration until it is associated with the intranet server IP, thereby obtaining the <Internet assets, mapping, intranet assets> relationship consisting of the asset entities corresponding to the first and last IPs.

[0055] 4) Traffic side combing

[0056] The full volume of internal IP access relations is extracted through the full flow detection equipment, and a tuple of the form (source IP, destination IP, effective time) is extracted to represent the access relationship between IPs. The source IP and destination IP correspond to the intranet asset entity in the relationship <intranet asset, reachable, intranet asset>, and the effective time is used to control the effective time of the relationship. If the same access relationship vector between IPs is not captured within the effective time, the access relationship is recycled.

[0057] 2. Construction of the event graph layer

[0058] In the present invention, the actual attack links in the organizational network environment are expressed through the event graph layer, and its construction is divided into two steps: event and causal relationship extraction and event generalization.

[0059] (1) Event and causal relationship extraction

[0060] A rule template method is designed to extract events and causal relationships, and attack sub-chains in the form of {event source, event target, event operation} triplets are extracted from continuous attack behavior links in network attack reports and penetration test reports.

[0061] The rule template is like {Reason}, <cause>{Effect}, where {Reason} represents the cause event, mapped to the "event operation" in the attack subchain, and {Effect} represents the result event, mapped to the "event target" in the subchain. <cause>It identifies the causal relationship of the event, and uses the attack entry that first appears in the attack behavior link as the "event source" of the link-starting attack subchain, and the "event target" of the attack subchain as the "event source" of its next-hop attack subchain, extracting all the end-to-end connected attack subchains in the attack behavior link.

[0062] According to different types of causal representation methods in Chinese, the rule template types are summarized as shown in Table 2:

[0063] Table 2 Event and causal relationship extraction rule template

[0064]

[0065] (2) Event generalization

[0066] Event generalization is to generalize events with similar semantics into the same type of abstract events, elevate the causal relationship between specific events to the causal relationship between abstract events, and then discover the general causal logic evolution law. In the present invention, the word2vec algorithm is used to aggregate the same or highly similar nodes in the attack subchain to form a new generalized node.

[0067] The word2vec algorithm model parameters are set as follows: skip-gram algorithm, the dimension of the output word vector is 60, the maximum distance between the current word and the central word is 5, the word frequency filtering threshold is 5, the configuration threshold of random downsampling of high-frequency words is 0.001, the number of sampled noise words is 3, and hierarchical softmax is used.

[0068] For the event source and event target nodes in the attack subchain, traverse the application system entity name in the knowledge graph layer, calculate the similarity between the event source and event target nodes in all attack subchains, aggregate the nodes with similarity higher than 0.9 into one category, and generalize the node name to the application system entity name, such as Figure 2 shown.

[0069] As shown in Table 3, for the event operation nodes in the attack subchain, combined with threat intelligence correlation analysis, they are matched with ATT&CK attack tactics and further mapped to the attack stage of the kill chain model. The event operation nodes mapped to different attack stages are aggregated separately, and nodes with similarity higher than 0.9 are aggregated into one category, and the attack methods in this category are calculated. The average similarity with all other similar attack methods , take the name of the attack method corresponding to its maximum value to name the generalized node after aggregation.

[0070] Table 3

[0071]

[0072] 3. Graph association

[0073] Map the attack subchain nodes of the event graph to the entities of the knowledge graph layer to complete the establishment of the event knowledge graph. The method is as follows:

[0074] Map the generalized nodes of event sources and event targets in the event graph layer to entities with the same names in the knowledge graph layer;

[0075] For the generalized nodes of event operations in the event graph layer, the aforementioned word2vec model is applied. Taking the generalized nodes of attack methods in the event graph layer as the benchmark, the vulnerable entities in the knowledge graph layer whose name similarity is greater than 0.95 are selected for mapping.

[0076] 2. Automatic tracing and early warning reasoning

[0077] like Figure 3 As shown in the figure, the knowledge graph reasoning of network attack facts is applied to network attack tracing and early warning scenarios, that is, based on a small amount of attack warning information, reverse reasoning is performed on the attack methods taken by the attacker, or the attack methods that the attacker will take next are predicted, thereby achieving tracing and early warning of the attack behavior.

[0078] (1) Matching algorithm design

[0079] Apply n-gram algorithm to design matching algorithm. For the original sequence , when the sliding window n=2, any feature subsequence Relative to The information gain value is:

[0080]

[0081] in, is the information entropy of all samples of the original sequence and, The original sequence sample contains the characteristic subsequence The conditional entropy at .

[0082]

[0083]

[0084] in The original sequence of the sample is probability; , is the characteristic subsequence Probability of appearing or not appearing; , is the characteristic subsequence When the original sequence appears, the result is probability.

[0085] Extract the attack source, attack purpose, and attack means fields from the alarms monitored by security devices to form an alarm log sequence in the form of {source IP, destination IP, alarm name} ; Extract the attack subchain of the event graph layer in the event knowledge graph .

[0086] for Each characteristic subsequence of , calculate its ,filter All feature subsequences greater than 0.4 form a set ;for Each characteristic subsequence of , calculate its ,filter All feature subsequences greater than 0.4 form a set .

[0087] for Each feature subsequence in , extract its sequence The probability of appearing in ;exist Find and The same feature subsequence , extract its information in Probability of occurrence , if there is no identical feature subsequence , then assign . Then the alarm log sequence Attacking subchains The matching degree for:

[0088]

[0089] (2) Attack link generation

[0090] For the alarm logs obtained through monitoring, their source IP and destination IP are mapped to asset names based on the knowledge graph layer to form an alarm log sequence. Traverse the attack subchains in the event graph layer and use the aforementioned alarm matching algorithm to calculate the matching degree between each attack subchain and its , extract all attack subchains with matching degree greater than 0.8 .

[0091] For attacking subchains , according to the "Event Action" field, map the attack stage of the kill chain model to which it belongs .

[0092] Forward traceability link:

[0093] for The previous stage , in the event graph layer, search for "event target" as , "Event Source", and "Event Action" belongs to All attack subchains in the stage, as Continue with this subchain as the starting point and repeat the above steps until you reach the attack subchain at the "initial invasion stage" or there is no connected attack subchain. Connect all attack subchains in series to form a forward warning link set. .

[0094] Backward warning link:

[0095] for The latter stage , in the event graph layer, search for "event source" as , "Event Target", and "Event Action" are All attack subchains in the stage, as The next hop; continue to use this subchain as the starting point and repeat the above steps until reaching the attack subchain of the "attack execution phase" or there is no connected attack subchain. Connect all attack subchains in series to form a backward tracing link set .

[0096] for , Each link in the As the initial matching degree of the link.

[0097] (3) Attack link mapping

[0098] for Any link And the attack sub-chains at all levels , starting from the last attack subchain, retrieve entities that meet the following conditions from the knowledge graph layer:

[0099]

[0100] in, For subchain The event source, For its event target, For event operations.

[0101] If it exists, associate the entity group with the attack subchain and correct the initial matching degree of the link:

[0102]

[0103] Where n is the number of entity groups that meet the conditions, is the corrected matching degree. Continue to start with the previous attack subchain and repeat the above steps. If it does not exist, stop mapping the link.

[0104] for In the link, the mapping method is Same as above, but the starting attack subchain is changed to the first attack subchain of the link.

[0105] After all links are mapped, they are sorted according to the link matching degree. The higher the matching degree, the higher the credibility of the warning link / tracing link.

[0106] Corresponding to the aforementioned embodiment of a network attack early warning and tracing method based on a knowledge graph of facts, the present invention also provides an embodiment of a network attack early warning and tracing system based on a knowledge graph of facts. The system includes a knowledge graph layer construction module, a fact graph layer construction module, a fact knowledge graph establishment module, and a graph reasoning module; for the specific process of each module implementation, please refer to the specific steps of the aforementioned embodiment of a network attack early warning and tracing method based on a knowledge graph of facts.

[0107] The knowledge graph layer construction module is used to obtain the entities and relationships of the objective IT assets and related information of an organization or enterprise, and to construct a knowledge graph layer;

[0108] The event graph layer construction module is used to design event and causal relationship rule templates, extract causal attack subchains from attack behavior links, aggregate similar nodes in attack subchains to form new generalized nodes to construct the event graph layer;

[0109] The knowledge graph establishment module is used to map the generalized nodes in the attack subchain in the knowledge graph layer to the entities in the knowledge graph layer to complete the establishment of the network attack knowledge graph;

[0110] The graph reasoning module is used to infer the attack methods taken by the attacker based on the network attack knowledge graph, or predict the attack methods to be taken next, so as to trace the source and warn the attack behavior.

[0111] Corresponding to the aforementioned embodiment of a network attack early warning and tracing method based on a knowledge graph of facts, the present invention also provides an embodiment of a network attack early warning and tracing device based on a knowledge graph of facts.

[0112] See also Figure 4 A network attack warning and tracing device based on a knowledge graph of facts and principles provided in an embodiment of the present invention includes a memory and one or more processors, wherein the memory stores executable code, and when the processor executes the executable code, it is used to implement a network attack warning and tracing method based on a knowledge graph of facts and principles in the above embodiment.

[0113] The embodiment of a network attack warning and tracing device based on a knowledge graph of facts provided by the present invention can be applied to any device with data processing capabilities, and the device with data processing capabilities can be a device or apparatus such as a computer. The device embodiment can be implemented through software, or through hardware or a combination of software and hardware. Taking software implementation as an example, as a device in a logical sense, it is formed by the processor of any device with data processing capabilities in which it is located reading the corresponding computer program instructions in the non-volatile memory into the internal memory for execution. From a hardware perspective, if Figure 4 As shown, it is a hardware structure diagram of a network attack early warning and tracing device based on the knowledge graph provided by the present invention, in which any device with data processing capability is located, except Figure 4 In addition to the processor, memory, network interface, and non-volatile memory shown, any device with data processing capabilities in which the apparatus in the embodiments is located may also include other hardware, generally based on the actual functions of the device with data processing capabilities, which will not be described in detail.

[0114] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0115] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of the present invention. Ordinary technicians in this field can understand and implement it without paying creative work.

[0116] An embodiment of the present invention also provides a computer-readable storage medium on which a program is stored. When the program is executed by a processor, a network attack warning and tracing method based on a knowledge graph of facts in the above embodiment is implemented.

[0117] The computer-readable storage medium may be an internal storage unit of any device with data processing capability described in any of the aforementioned embodiments, such as a hard disk or a memory. The computer-readable storage medium may also be an external storage device of any device with data processing capability, such as a plug-in hard disk, a smart media card (SMC), an SD card, a flash card, etc. equipped on the device. Furthermore, the computer-readable storage medium may also include both an internal storage unit and an external storage device of any device with data processing capability. The computer-readable storage medium is used to store the computer program and other programs and data required by any device with data processing capability, and may also be used to temporarily store data that has been output or is to be output.

[0118] The present invention also provides a computer program product, including a computer program. When the computer program is executed by a processor, it implements the network attack early warning and tracing method based on the knowledge graph.

[0119] The above embodiments are used to illustrate the present invention rather than to limit the present invention. Any modification and change made to the present invention within the spirit of the present invention and the protection scope of the claims shall fall within the protection scope of the present invention.< / cause> < / cause>

Claims

1. A network attack early warning and tracing method based on a knowledge graph, characterized in that: The method comprises the following steps: (1) Obtain the entities and relationships of the objective IT assets and related information of an organization or enterprise, and build a knowledge graph layer; (2) Design event and causal relationship rule templates, extract causal attack sub-chains from the attack behavior chain, aggregate similar nodes in the attack sub-chain to form new generalized nodes, and construct the event graph layer; (3) Map the generalized nodes in the attack subchain in the event graph layer to the entities in the knowledge graph layer to complete the establishment of the network attack event knowledge graph; (4) Based on the network attack knowledge graph, the attack methods adopted by the attacker can be inferred, or the attack methods that the attacker will adopt next can be predicted, so as to trace the source and provide early warning for the attack behavior. The specific process of inference is as follows: (4.1) Extract the alarm log sequence obtained by security equipment monitoring, and extract the attack sub-chain of the event graph layer in the network attack event knowledge graph; obtain the characteristic sub-sequence of the alarm log sequence and the attack sub-chain based on the sliding window, and extract the characteristic sub-sequence based on the information entropy of all original sequence samples and the number of samples containing the characteristic sub-sequence relative to the original sequence samples. The information gain value of the conditional entropy at that time selects the feature subsequence that meets the requirements; the matching degree between the alarm log sequence and the attack subchain is calculated as follows: ； in, For the matching degree, is the probability that the characteristic subsequence of the alarm log sequence appears in the alarm log sequence, is the probability that the characteristic subsequence of the attack subchain that is the same as the characteristic subsequence of the alarm log sequence appears in the attack subchain. If there is no identical characteristic subsequence, assign ; (4.2) Extract all attack subchains that meet the matching threshold, and map them to the attack stage of the kill chain model according to the "event operation" node; obtain all attack subchains of the previous kill chain model attack stage and all attack subchains of the next kill chain model attack stage, and repeat the operation to obtain the forward tracing link set and the backward warning link set respectively; each link in the set uses its corresponding matching degree as the initial matching degree of the link; (4.3) Link mapping is performed for the forward tracing link set and the backward warning link set respectively. The backward warning link set starts from the last attack subchain, and the forward tracing link set starts from the first attack subchain. The entity group associated with the attack subchain triple is obtained from the knowledge graph layer, and the matching degree of the attack subchain is corrected: ； Where n is the number of entity groups that meet the conditions, is the matching degree between each attack sub-chain and the attack sub-chain of the event graph layer, For the corrected matching degree, continue to start with the previous attack subchain and repeat the mapping operation until no associated entity group is obtained; after all links are mapped, sort them according to the link matching degree. The higher the matching degree, the higher the credibility of the warning link / tracing link.

2. According to claim 1, a network attack early warning and tracing method based on a knowledge graph is characterized in that: In step (1), entities include Internet assets, intranet assets, application systems, network domains, vulnerabilities, configuration risks, and high-risk ports.

3. According to claim 1, a network attack early warning and tracing method based on a knowledge graph is characterized in that: In step (2), the attack subchain is in the form of a triple of {event source, event target, event operation}, and the rule template includes the cause event, the result event, and the event causal relationship identifier; The cause event is mapped to the "event operation" in the attack subchain, and the result event is mapped to the "event target" in the subchain. The attack entry that first appears in the attack behavior link is used as the "event source" of the link-starting attack subchain, and the "event target" of the attack subchain is used as the "event source" of its next-hop attack subchain.

4. According to claim 3, a network attack early warning and tracing method based on a knowledge graph is characterized in that: In step (2), for the event source nodes and event target nodes in the attack subchain, the application system entity names in the knowledge graph layer are traversed, and the nodes are aggregated into one category based on similarity to form generalized nodes. The generalized node name is the application system entity name that meets the similarity threshold. For the event operation nodes in the attack subchain, they are matched with the ATT&CK attack tactics based on similarity in combination with the threat intelligence correlation analysis, and mapped to the attack stage of the kill chain model. The event operation nodes are clustered, and the mean similarity between the attack means and all other similar attack means is calculated. The name of the attack means corresponding to the maximum value is taken to name the generalized node of the event operation after clustering.

5. According to claim 4, a network attack early warning and tracing method based on a knowledge graph is characterized in that: In step (3), the network attack maps the generalized nodes of the event source and event target of the event graph layer with the corresponding application system entities of the knowledge graph layer; for the generalized nodes of the event operation of the event graph layer, the generalized nodes of the attack means of the event graph layer are used as the benchmark, and the weakness entities of the knowledge graph layer whose names meet the similarity threshold are selected for mapping.

6. A network attack early warning and tracing system based on a knowledge graph that implements the method described in any one of claims 1 to 5, characterized in that: The system includes a knowledge graph layer construction module, a fact graph layer construction module, a fact knowledge graph establishment module and a graph reasoning module; The knowledge graph layer construction module is used to obtain the entities and relationships of the objective IT assets and related information of an organization or enterprise, and to construct a knowledge graph layer; The event graph layer construction module is used to design event and causal relationship rule templates, extract causal attack subchains from attack behavior links, aggregate similar nodes in attack subchains to form new generalized nodes to construct the event graph layer; The knowledge graph establishment module is used to map the generalized nodes in the attack subchain in the knowledge graph layer to the entities in the knowledge graph layer to complete the establishment of the network attack knowledge graph; The graph reasoning module is used to infer the attack methods taken by the attacker based on the network attack knowledge graph, or predict the attack methods to be taken next, so as to trace the source and warn the attack behavior.

7. A network attack early warning and tracing device based on a knowledge graph, comprising a memory and one or more processors, wherein the memory stores executable code, characterized in that: When the processor executes the executable code, a network attack early warning and tracing method based on a knowledge graph of facts as described in any one of claims 1 to 5 is implemented.

8. A computer-readable storage medium having a program stored thereon, characterized in that: When the program is executed by the processor, a network attack early warning and tracing method based on a knowledge graph of facts as described in any one of claims 1 to 5 is implemented.

9. A computer program product, comprising a computer program, characterized in that When the computer program is executed by the processor, a network attack early warning and tracing method based on a knowledge graph of facts as described in any one of claims 1 to 5 is implemented.

Images