A network attack path reconstruction and evaluation method and system

Abstract

The present invention provides a network attack path reconstruction and assessment method and system, which includes: preprocessing monitoring data to obtain at least one security threat indicator, the preprocessing including feature extraction and labeling; performing similarity analysis on all attack events to reconstruct the attack paths one by one according to the similarity analysis results; assessing the threat level of the reconstructed attack path according to the at least one security threat indicator, and retrieving the threat level corresponding to the reconstructed attack path from a preset threat level table according to the assessment results; and obtaining the behavior pattern corresponding to the reconstructed attack path according to preset rules, the behavior pattern including real attacks and feints. The present application can automatically and accurately assess the threat level of each reconstructed attack path and effectively distinguish between real attacks and feints, thereby providing a reliable technical basis for the defense system to respond in advance and deploy defense resources.

Description

Technical Field

[0001] The present invention relates to the technical field of network attack path reconstruction, and in particular to a network attack path reconstruction and evaluation method and system. Background Art

[0002] Reconstructing a network attack path involves analyzing the data left by the attacker during the attack, such as honeypot logs. This data is then logically combined based on the relationships between the data to restore the attacker's activity path throughout the entire process. This path can then be used to trace the attacker. Reconstructing a network attack path requires considering two issues. First, the same attack behavior in multiple logging devices may result in a large number of duplicate attack alerts. Second, network attacks are becoming increasingly complex. A single attack may consist of multiple steps, each of which may generate alerts on different devices.

[0003] There are three main methods for network attack path reconstruction and evaluation. The first is network attack path reconstruction based on attack alarm similarity. This type of method aggregates and correlates alarms from intrusion detection systems, uses the similarity between alarms to infer the coherence and progress of the attack, and constructs an attack chain based on the chronological order of these coherence and progress; the second is network attack path reconstruction based on the causal correlation of attack alarms. This type of method assumes that each attack step contains a series of preconditions and postconditions. If the consequences of other alarms meet the prerequisites of other alarms, it is considered that there is a causal relationship between these alarms, thus constructing an attack chain; the third is attack path reconstruction using graph theory and multi-information fusion technology. This type of method does not rely solely on the similarity of alarms, but represents the attack as nodes and edges in the graph. By fusing multiple information sources such as attack time information, risk assessment information, and attack node information, a weighted directed graph of the attack scenario is constructed to reflect the entire attacker's activity trajectory in the system.

[0004] However, current attack path reconstruction technologies are unable to determine which attack path in the reconstructed path is a feint attack by the attacker and which attack path is the attack path the attacker actually wants to carry out during the attack path reconstruction. Instead, they use other technologies to infer it afterwards, which requires more resources and results in lower data processing efficiency. Summary of the Invention

[0005] The purpose of the present invention is to provide a network attack path reconstruction and evaluation method and system, aiming to solve the problem that traditional attack path reconstruction technology cannot accurately infer the threat level of the current path attack and distinguish between real attacks and false attacks.

[0006] In a first aspect, the present invention provides a network attack path reconstruction and evaluation method, comprising:

[0007] Acquire at least one piece of monitoring data and preprocess the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling;

[0008] Performing similarity analysis on all attack events to reconstruct attack paths of all attack events contained in the monitoring data one by one according to the similarity analysis results;

[0009] Performing a threat level assessment on the reconstructed attack path according to the at least one security threat indicator, and retrieving a threat level corresponding to the reconstructed attack path from a preset threat level table according to the assessment result;

[0010] A behavior pattern corresponding to the reconstructed attack path is obtained according to preset rules, where the behavior pattern includes a real attack and a feint attack.

[0011] Furthermore, the step of obtaining at least one piece of monitoring data and preprocessing the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling processing, comprises:

[0012] The monitoring data includes intrusion detection system alerts, honeypot logs, network traffic reports, and system call logs;

[0013] Feature extraction is performed on the monitoring data to obtain at least one data feature, wherein the data feature includes text feature, classification feature, numerical feature, sequence feature, and interactive text feature.

[0014] Furthermore, after the step of extracting features from the monitoring data, the following steps are further included:

[0015] Analyzing the at least one data feature to obtain, based on the analysis result, an attack type corresponding to each piece of the monitoring data, and labeling the monitoring data according to the attack type to obtain at least one security threat indicator;

[0016] The security threat indicators include the complexity of attack techniques, the importance of affected assets, and the number of deployed defense resources.

[0017] Furthermore, the step of performing similarity analysis on all attack events to reconstruct attack paths of all attack events contained in the monitoring data one by one according to the similarity analysis results includes:

[0018] Obtaining a causal relationship between the attack events based on causal correlation analysis, and constructing an event relationship graph according to the causal relationship;

[0019] Applying graph neural networks to analyze the event relationship graph and inferring potential causal chains through iterative aggregation to obtain the starting point, logical flow, and key factors of the attack event;

[0020] The attack path of the attack event is reconstructed based on the similarity analysis results and the starting point, logical process and key factors of the attack event.

[0021] Furthermore, the step of evaluating the threat level of the reconstructed attack path according to the at least one security threat indicator and retrieving the threat level corresponding to the reconstructed attack path from a preset threat level table according to the evaluation result includes:

[0022] Retrieving a corresponding score from a preset scoring table according to the security threat indicator;

[0023] The evaluation results are calculated according to the following formula:

[0024] S total =W1S tech +W2S asset +W3S defense

[0025] Among them, S total represents the evaluation result, W1, W2, and W3 represent the weights corresponding to the complexity of attack technology, the importance of affected assets, and the number of defense resources deployed, respectively. tech Indicates the score corresponding to the complexity of the attack technology, S asset represents the score corresponding to the importance of the affected assets, S defense Indicates the score corresponding to the number of deployed defense resources.

[0026] Furthermore, the step of obtaining a behavior pattern corresponding to the reconstructed attack path according to a preset rule, wherein the behavior pattern includes a real attack and a feint attack, comprises:

[0027] Predefine multiple features to be analyzed, including attack frequency, attack complexity, target asset value, and attack stealth;

[0028] Analyze the reconstructed attack path according to the characteristics to be analyzed to obtain the attack probability corresponding to the reconstructed attack path;

[0029] Determining whether the attack probability is greater than a first preset attack probability threshold;

[0030] If the attack probability is greater than a first preset attack threshold, determining that the behavior pattern of the reconstructed attack path is a real attack;

[0031] If the attack probability is less than or equal to the first preset attack threshold, it is determined that the behavior pattern of the reconstructed attack path is a feint.

[0032] Furthermore, after the step of obtaining a behavior pattern corresponding to the reconstructed attack path according to a preset rule, wherein the behavior pattern includes a real attack and a feint attack, the following steps are further included:

[0033] The reconstructed attack path is labeled according to the threat level and the behavior pattern to convert the reconstructed attack path into a graph.

[0034] In a second aspect, the present invention provides a network attack reconstruction system based on a large model, the system comprising:

[0035] a preprocessing module, configured to obtain at least one piece of monitoring data and preprocess the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling;

[0036] A path reconstruction module is used to perform similarity analysis on all attack events, so as to reconstruct the attack paths of all attack events contained in the monitoring data one by one according to the similarity analysis results;

[0037] an evaluation module, configured to evaluate the threat level of the reconstructed attack path according to the at least one security threat indicator, and retrieve the threat level corresponding to the reconstructed attack path from a preset threat level table according to the evaluation result;

[0038] The behavior pattern analysis module is used to obtain the behavior pattern corresponding to the reconstructed attack path according to preset rules, and the behavior pattern includes real attack and feint attack.

[0039] In a third aspect, the present invention provides a readable storage medium, which stores one or more programs, and when the program is executed by a processor, implements the above-mentioned network attack path reconstruction and evaluation method.

[0040] In a fourth aspect, the present invention provides a computer device, comprising a memory and a processor, wherein:

[0041] The memory is used to store computer programs;

[0042] When the processor is used to execute the computer program stored in the memory, the above-mentioned network attack path reconstruction and evaluation method is implemented.

[0043] Compared with the prior art, the present invention has the following advantages:

[0044] 1. The present invention can automatically extract various features contained in the acquired monitoring data, namely text semantics, and automatically label the information after the semantics are extracted, so as to mark the risk level of the attack path reconstructed using the monitoring data.

[0045] 2. The present invention realizes automatic attack path reconstruction through large model technology. It only needs to input at least one piece of monitoring data generated by each defense device to realize the reconstruction of the attack path, that is, automatically restore the entire attack path without the need for additional personnel intervention, thus reducing resource consumption.

[0046] 3. The present invention can automatically and accurately evaluate the threat level of each reconstructed attack path while reconstructing the attack path, and effectively distinguish between real attacks and feints, thereby providing a reliable technical basis for the defense system to respond in advance and deploy defense resources.

[0047] 4. The large model of the present invention has the ability to learn and adapt to new attack patterns. As new data is continuously input, the model can update its attack identification and analysis mechanisms to adapt to the ever-evolving cyber threat landscape. This dynamic adaptability enables the present invention to maintain efficient and effective defense capabilities in the face of new and rapidly changing attacks. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] Figure 1 A framework diagram of a large model proposed for the first embodiment of the present invention;

[0049] Figure 2 This is a flowchart of the network attack path reconstruction proposed in the first embodiment of the present invention;

[0050] Figure 3 This is a flow chart of a network attack path reconstruction and evaluation method proposed in the first embodiment of the present invention;

[0051] Figure 4 This is a flow chart of the network attack path reconstruction and evaluation method proposed in the second embodiment of the present invention;

[0052] Figure 5 This is a visualization diagram of the attack path proposed in the second embodiment of the present invention;

[0053] Figure 6 Schematic diagram of the structure of a network attack path reconstruction and evaluation system proposed in the third embodiment of the present invention.

[0054] The following specific embodiments will further illustrate the present invention in conjunction with the above-mentioned drawings. DETAILED DESCRIPTION

[0055] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention. Unless otherwise defined, the technical terms or scientific terms used herein should be the common meanings understood by people with ordinary skills in the field to which the invention belongs. The words "including" and similar words used in this article mean that the elements or objects appearing before the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects.

[0056] See also Figure 1 and Figure 2 The large model used in the embodiment of the present invention is designed for the automatic reconstruction of network attack paths and consists of three core parts. First, it is necessary to process and understand the multi-format monitoring data (monitoring data) generated by each device in the network defense system, such as intrusion detection system alarms and honeypot logs. At the same time, the indicators for assessing the danger level of the attack path will be input. The key information is extracted based on the input labels and nodes within the large model, and the monitoring data generated by the defense system is labeled. Secondly, the large language model receives the text and label information processed by the feature integration module and performs complex reasoning tasks, including analyzing the causal relationship and similarity between data items, and reconstructing potential attack paths. Finally, the visualization module converts the path reconstruction results of the large language model into attack path graphs. These graphs can intuitively show the attacker's action trajectory and can optimize the recognition and understanding of attack behavior through graph analysis technology.

[0057] See also Figure 3 , which is a flow chart of a network attack path reconstruction and evaluation method provided by the first embodiment of the present invention, the method includes steps S101 to S104, wherein:

[0058] Step S101: Acquire at least one piece of monitoring data, and pre-process the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the pre-processing includes feature extraction and labeling.

[0059] It should be noted that, in some embodiments, the monitoring data is generated by a network defense system. The monitoring data includes intrusion detection system (IDS) alerts, honeypot logs, network traffic reports, and system call logs, etc., which serve as the data source for constructing attack paths in large models. This process does not require preprocessing of multi-source data formats to unify them. Compared with previous methods, it greatly improves the efficiency of network attack path reconstruction.

[0060] In addition, in this step, hidden features in the data stream are extracted through automatic features, so that the subsequent large language model can automatically classify attacks based on the features extracted by this module and reduce the false alarm rate.

[0061] Furthermore, during labeling, the data is first analyzed based on input features to determine the specific attack type each piece of data represents. Subsequently, this data is labeled based on the security threat indicators initially input. This labeling allows for subsequent reconstruction of attack paths, using the data labels for each path to comprehensively determine the severity of each attack path and whether it is a genuine attack or a feint.

[0062] Step S102: performing similarity analysis on all attack events, and reconstructing the attack paths of all attack events contained in the monitoring data one by one according to the similarity analysis results.

[0063] Step S103: performing a threat level assessment on the reconstructed attack path according to the at least one security threat indicator, and retrieving a threat level corresponding to the reconstructed attack path from a preset threat level table according to the assessment result.

[0064] It should be pointed out that by assessing the threat level, it is possible to reflect the extent of damage the attack has caused to the attacked system, or to describe the severity of the consequences.

[0065] Step S104: obtaining a behavior pattern corresponding to the reconstructed attack path according to preset rules, wherein the behavior pattern includes a real attack and a feint attack.

[0066] In this step, the large model is primarily used to deeply analyze the attacker's behavioral patterns. By comparing known real attack patterns with feints, the model can identify whether the characteristics of the current attack path are more similar to a real attack or a feint. For example, feints are often intended to distract defenders and may not involve direct attacks on high-value assets or use advanced attack techniques. Specifically, a set of feature vectors is first defined to describe attack behavior patterns, such as [attack frequency, attack complexity, target asset value, attack stealth]. Each attack event is assigned a numerical value based on its behavioral characteristics, such as attack frequency (times / day), attack complexity (rated from 1 to 5), target asset value (rated from 1 to 5), and attack stealth (rated from 1 to 5). The large model analyzes these features on the data used to construct the current path and generates a prediction for each attack event's feature vector, indicating whether the event is more similar to a real attack or a feint. Based on the model's prediction, a decision threshold is applied to ultimately determine the nature of the attack path. For example, the model may output an attack probability that is a real attack. If this attack probability exceeds a preset threshold (such as 75%), it is determined to be a real attack; otherwise, it is considered a feint. The threshold probability can be adjusted based on historical data analysis, expert opinions or actual defense needs, and is not specified in detail in this embodiment.

[0067] In summary, the above-mentioned network attack path reconstruction and assessment method can automatically and accurately reconstruct network attack paths. At the same time, when reconstructing the attack path, it can infer the threat level of each current attack path and whether the current path is a real attack or a feint. This helps the defense system respond to attacks in advance and deploy defense resources properly. It solves the problems of the traditional method, such as the cumbersome reconstruction process and the need for professional security analysts to perform multiple analyses of the data during the path reconstruction process.

[0068] See also Figure 4 , which is a flow chart of a network attack path reconstruction and evaluation method provided by the second embodiment of the present invention, the method includes steps S201 to S207, wherein:

[0069] Step S201: extracting features from the monitoring data to obtain at least one data feature, wherein the data feature includes text features, classification features, numerical features, sequence features, and interactive text features.

[0070] In this step, text features are extracted from input intrusion detection system (IDS) alerts, honeypot logs, network traffic reports, and system call logs. These features can be processed by a large language model to achieve automated attack classification. For IDS alerts, these features include text features (such as keywords or phrases in the alert), classification features (such as the alert type and alert level in the alert), and numerical features (such as the attack time in the alert); for honeypot logs, these include behavior sequence features (interaction command sequence) and interaction text features (such as the text content of the interaction command); for network traffic reports, these include text features (such as traffic volume, session duration, and total packet count statistics); and for system call logs, these include sequence features (such as the system call sequence).

[0071] Step S202: Analyze the at least one data feature to obtain an attack type corresponding to each piece of monitoring data according to the analysis result, and label the monitoring data according to the attack type to obtain at least one security threat indicator.

[0072] In some embodiments, security threat indicators include the complexity of attack techniques, the importance of affected assets, and the number of deployed defense resources:

[0073] 1. Attack Technique Complexity: By analyzing intrusion detection system (IDS) alerts, we identify the attack techniques used, such as SQL injection, cross-site scripting (XSS), and remote code execution (RCE). More advanced attack techniques, such as those using zero-day vulnerabilities, typically indicate a more complex attack. Generally speaking, more complex attacks represent a higher threat level. Therefore, to reflect the correlation between attack technique complexity and threat level, we score these attack methods based on their complexity. See Table 1 below for details:

[0074] Table 1 Attack technology complexity score table

[0075]

[0076]

[0077] 2. Importance of Affected Assets: The importance of an asset can be determined by its role in the organization, the amount of data, and its impact on business continuity. The more important the assets affected by an attack path, the higher the risk. According to the national standard "Information Security Risk Assessment Specification," asset importance is categorized into five levels: L1, L2, L3, L4, and L5. Each level corresponds to an asset importance score. See Table 2 below for details.

[0078] Table 2 Importance rating table of affected assets

[0079]

[0080] 3. Number of defensive resources deployed on the attack path: For an attack path, the more defensive resources deployed, the lower the attack success rate. Conversely, the higher the success rate, the higher the risk. Since common network defense measures are relatively fixed, such as firewalls, IPS, IDS, WAF, and honeypots, we assume that if no defensive measures are deployed on an attack path, the path's threat level is rated 5. Each additional defensive measure on the path reduces the attack threat score by one point. For details, please refer to Table 3 below:

[0081] Table 3 Defense resource deployment quantity scoring table

[0082]

[0083]

[0084] Step S203: Obtaining the causal relationship between the attack events based on causal correlation analysis, and constructing an event relationship graph according to the causal relationship.

[0085] Step S204: Analyze the event relationship graph using a graph neural network, and infer potential causal chains through iterative aggregation to obtain the starting point, logical flow, and key factors of the attack event.

[0086] Step S205: reconstructing the attack path of the attack event based on the similarity analysis result and the starting point, logical flow and key factors of the attack event.

[0087] It is important to note that during the attack path reconstruction process, similarity analysis is first performed using a trained deep learning model to calculate the similarity between different attack events, thereby identifying events with the same or similar attack patterns. The key to this step is the use of word embedding technology to convert event descriptions into vector form, enabling the model to understand and evaluate the characteristics of the attack events and their contextual information. Next, causal correlation analysis is used to reveal the causal relationships between the attack events. This process constructs a dynamic event relationship graph and applies a graph neural network (GNN) to conduct in-depth analysis of this graph, capturing the complex relationships within the graph-structured data. Through iterative aggregation, the underlying causal chains are inferred, thereby understanding the logical sequence and inherent connections of the attack behaviors.

[0088] The results of causal correlation analysis provide key clues for constructing a precise attack path, revealing the attack's starting point, logical flow, and key factors. Finally, after conducting similarity and causal correlation analysis, we use multi-information fusion technology to integrate these analysis results with raw data from various monitoring devices. Advanced data processing and analysis algorithms identify and integrate key attack signatures and behavioral patterns. This process model not only considers single events, but also comprehensively considers the interactions and temporal relationships between events to construct a more complete and accurate attack path. The reconstructed attack path is visualized and provides detailed explanations and analysis, enabling security analysts to intuitively understand the attacker's behavioral patterns and attack strategies, thereby formulating effective defensive measures.

[0089] Step S206: performing a threat level assessment on the reconstructed attack path according to the at least one security threat indicator, and retrieving a threat level corresponding to the reconstructed attack path from a preset threat level table according to the assessment result;

[0090] In some embodiments, please refer to Table 1 below, which is a table of preset threat levels:

[0091] Table 4 Preset Threat Level Table

[0092]

[0093] It should be noted that the corresponding scores are retrieved from a preset scoring table according to the security threat indicators, and then the evaluation results are obtained based on the scores of each indicator.

[0094] In some embodiments, the evaluation result is calculated according to the following formula:

[0095] S total =W1S tech +W2S asset +W3S defense

[0096] Among them, S total represents the evaluation result, W1, W2, and W3 represent the weights corresponding to the complexity of attack technology, the importance of affected assets, and the number of defense resources deployed, respectively. tech Indicates the score corresponding to the complexity of the attack technology, S asset represents the score corresponding to the importance of the affected assets, S defense The weights represent scores corresponding to the number of defense resource deployments. These weights are related to historical monitoring data, expert opinions, or actual defense needs. They can be adjusted according to specific circumstances during actual user application and are not specifically limited in this embodiment.

[0097] Step S207: obtaining a behavior pattern corresponding to the reconstructed attack path according to a preset rule, wherein the behavior pattern includes a real attack and a feint attack.

[0098] Specifically, to accurately obtain the behavior pattern, it is first necessary to predefine multiple features to be analyzed, including attack frequency, attack complexity, target asset value, and attack concealment. The reconstructed attack path is then analyzed based on the features to obtain the attack probability corresponding to the reconstructed attack path. It is then determined whether the attack probability is greater than a first preset attack probability threshold.

[0099] If the attack probability is greater than a first preset attack threshold, the behavior pattern of the reconstructed attack path is determined to be a real attack; if the attack probability is less than or equal to the first preset attack threshold, the behavior pattern of the reconstructed attack path is determined to be a feint. This allows for accurate and rapid output of the behavior pattern corresponding to the reconstructed attack path.

[0100] In some embodiments, see Figure 5 In order to achieve path visualization and model updates, the attack path reconstructed by the large language model needs to be converted into a graphical representation, including the starting point of the attack, the nodes passed through, and the end point. For attack paths with different threat levels, different colors will be used to mark the attack paths with different threat levels, and warning symbols will be used to identify real attacks. This graphical display method makes the complex attack process intuitive and easy to understand, helping security analysts quickly grasp the attacker's action pattern. At the same time, in order to respond to network attacks, attack methods and defense strategies are constantly evolving. The large model implemented by this patent can continuously absorb new data and intelligence through online learning and incremental learning mechanisms, and then adjust and optimize its algorithm. This not only improves the model's ability to respond to emerging threats, but also maintains effective response to known attack methods. In addition, the introduced transfer learning capability allows the large model to apply its learning results across network environments, greatly improving the practicality and flexibility of the model.

[0101] In summary, according to the above-mentioned network attack path reconstruction and evaluation method, this method uses a large model to process monitoring data in various formats such as honey spot logs, intrusion detection system (IDS) alerts, network traffic, and system calls generated by the defense system, and extracts the features of these monitoring data. Then, the large model first automatically analyzes the attack type based on the extracted features and performs data labeling processing. Then, based on the causal relationship, similarity and other information between multi-source data, the attack path is reconstructed using multi-information fusion technology. Finally, after the reconstruction process, the danger level of each reconstructed attack path is scored based on the previous data labeling results, and it is predicted whether the current attack path is a real attack or a feint launched by the attacker. After all paths are reconstructed, these paths are merged into an overall path diagram and visualized to show the attacker's activity path in the entire protected system. At the same time, the large model will continuously update and optimize its own algorithm based on the input data to adapt to the ever-changing network situation.

[0102] See also Figure 6 , which shows a network attack reconstruction system based on a large model in a third embodiment of the present invention, the system includes:

[0103] A preprocessing module 10 is configured to obtain at least one piece of monitoring data and preprocess the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling.

[0104] A path reconstruction module 20 is configured to perform similarity analysis on all attack events, and to reconstruct the attack paths of all attack events contained in the monitoring data one by one according to the similarity analysis results;

[0105] an evaluation module 30 for evaluating the threat level of the reconstructed attack path according to the at least one security threat indicator, and retrieving the threat level corresponding to the reconstructed attack path from a preset threat level table according to the evaluation result;

[0106] The behavior pattern analysis module 40 is used to obtain the behavior pattern corresponding to the reconstructed attack path according to preset rules, and the behavior pattern includes real attacks and feints.

[0107] Furthermore, in some optional embodiments, the system further includes:

[0108] The visualization module is used to mark the reconstructed attack path according to the threat level and the behavior pattern, so as to convert the reconstructed attack path into a graph.

[0109] On the other hand, the present invention further provides a readable storage medium having one or more programs stored thereon, which, when executed by a processor, implement the above-mentioned network attack reconstruction and assessment method.

[0110] On the other hand, the present invention also proposes a computer device, including a memory and a processor, wherein the memory is used to store computer programs, and the processor is used to execute the computer programs stored in the memory to implement the above-mentioned network attack reconstruction and assessment method.

[0111] Those skilled in the art will appreciate that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (e.g., a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device.

[0112] More specific examples (a non-exhaustive list) of computer-readable media include the following: an electrical connection with one or more wires (electronic devices), a portable computer disk cartridge (magnetic devices), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), a fiber optic device, and a portable compact disc read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0113] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used to implement the hardware: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0114] While the embodiments of the present invention have been described in detail above, it will be apparent to those skilled in the art that various modifications and variations of these embodiments are possible. However, it should be understood that such modifications and variations are within the scope and spirit of the present invention as set forth in the claims. Furthermore, the invention described herein is susceptible to other embodiments and may be practiced or implemented in a variety of ways.

Claims

1. A network attack path reconstruction and evaluation method, characterized in that: The method comprises: Acquire at least one piece of monitoring data and preprocess the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling; Performing similarity analysis on all attack events to reconstruct the attack paths of all attack events contained in the monitoring data one by one based on the similarity analysis results, including: obtaining the causal relationship between the attack events based on causal correlation analysis, and constructing an event relationship graph based on the causal relationship; applying a graph neural network to analyze the event relationship graph, and inferring potential causal chains through iterative aggregation to obtain the starting point, logical flow, and key factors of the attack event; and reconstructing the attack path of the attack event based on the similarity analysis results and the starting point, logical flow, and key factors of the attack event; Performing a threat level assessment on the reconstructed attack path according to the at least one security threat indicator, and retrieving a threat level corresponding to the reconstructed attack path from a preset threat level table according to the assessment result; A behavior pattern corresponding to the reconstructed attack path is obtained according to preset rules, where the behavior pattern includes a real attack and a feint attack.

2. The network attack path reconstruction and evaluation method according to claim 1, characterized in that: The step of obtaining at least one piece of monitoring data and preprocessing the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling processing, comprises: The monitoring data includes intrusion detection system alerts, honeypot logs, network traffic reports, and system call logs; Feature extraction is performed on the monitoring data to obtain at least one data feature, wherein the data feature includes text feature, classification feature, numerical feature, sequence feature, and interactive text feature.

3. The network attack path reconstruction and evaluation method according to claim 2, characterized in that: After the step of extracting features from the monitoring data, the following steps are further included: Analyzing the at least one data feature to obtain, based on the analysis result, an attack type corresponding to each piece of the monitoring data, and labeling the monitoring data according to the attack type to obtain at least one security threat indicator; The security threat indicators include the complexity of attack techniques, the importance of affected assets, and the number of deployed defense resources.

4. The network attack path reconstruction and evaluation method according to claim 3 is characterized in that: The step of evaluating the threat level of the reconstructed attack path according to the at least one security threat indicator and retrieving the threat level corresponding to the reconstructed attack path from a preset threat level table according to the evaluation result includes: Retrieving a corresponding score from a preset scoring table according to the security threat indicator; The evaluation results are calculated according to the following formula: ， in, Indicates the evaluation results, 、 They represent the weights corresponding to the complexity of attack technology, the importance of affected assets, and the number of defense resources deployed, respectively. Indicates the score corresponding to the complexity of the attack technology, represents the score corresponding to the importance of the affected asset, Indicates the score corresponding to the number of deployed defense resources.

5. The network attack path reconstruction and evaluation method according to claim 1, characterized in that: The step of obtaining a behavior pattern corresponding to the reconstructed attack path according to a preset rule, wherein the behavior pattern includes a real attack and a feint attack, comprises: Predefine multiple features to be analyzed, including attack frequency, attack complexity, target asset value, and attack stealth; Analyze the reconstructed attack path according to the characteristics to be analyzed to obtain the attack probability corresponding to the reconstructed attack path; Determining whether the attack probability is greater than a first preset attack probability threshold; If the attack probability is greater than a first preset attack threshold, determining that the behavior pattern of the reconstructed attack path is a real attack; If the attack probability is less than or equal to the first preset attack threshold, it is determined that the behavior pattern of the reconstructed attack path is a feint.

6. The network attack path reconstruction and evaluation method according to claim 1, characterized in that: After the step of obtaining a behavior pattern corresponding to the reconstructed attack path according to a preset rule, wherein the behavior pattern includes a real attack and a feint attack, the following steps are further included: The reconstructed attack path is labeled according to the threat level and the behavior pattern to convert the reconstructed attack path into a graph.

7. A network attack reconstruction system based on a large model, characterized by: The system comprises: a preprocessing module, configured to obtain at least one piece of monitoring data and preprocess the monitoring data to obtain at least one security threat indicator corresponding to each piece of monitoring data, wherein the preprocessing includes feature extraction and labeling; A path reconstruction module is used to perform similarity analysis on all attack events, and reconstruct the attack paths of all attack events contained in the monitoring data one by one based on the similarity analysis results, including: obtaining the causal relationship between the attack events based on causal correlation analysis, and constructing an event relationship graph based on the causal relationship; applying a graph neural network to analyze the event relationship graph, and inferring potential causal chains through iterative aggregation to obtain the starting point, logical flow, and key factors of the attack event; and reconstructing the attack path of the attack event based on the similarity analysis results and the starting point, logical flow, and key factors of the attack event; an evaluation module, configured to evaluate the threat level of the reconstructed attack path according to the at least one security threat indicator, and retrieve the threat level corresponding to the reconstructed attack path from a preset threat level table according to the evaluation result; The behavior pattern analysis module is used to obtain the behavior pattern corresponding to the reconstructed attack path according to preset rules, and the behavior pattern includes real attack and feint attack.

8. A readable storage medium, characterized in that: The readable storage medium stores one or more programs, which, when executed by a processor, implement a network attack path reconstruction and evaluation method as described in any one of claims 1 to 6.

9. A computer device, characterized in that: The computer device comprises a memory and a processor, wherein: The memory is used to store computer programs; When the processor is used to execute the computer program stored in the memory, it implements the network attack path reconstruction and evaluation method described in any one of claims 1-6.

Images